mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 14:55:10 +00:00
Code Issues Releases Wiki Activity

update parser to use HAS_X macros

Browse Source
This commit is contained in:
John Johansen
2006-08-04 17:20:16 +00:00
parent 7f1df42d3e
commit b96bd2cd3b
4 changed files with 37 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
parser/immunix.h
View File

@@ -88,4 +88,14 @@ enum pattern_t {
ePatternInvalid, ePatternInvalid,
}; };
#define HAS_MAY_READ(mode) ((mode) & KERN_COD_MAY_READ)
#define HAS_MAY_WRITE(mode) ((mode) & KERN_COD_MAY_WRITE)
#define HAS_MAY_LINK(mode) ((mode) & KERN_COD_MAY_LINK)
#define HAS_MAY_EXEC(mode) ((mode) & KERN_COD_MAY_EXEC)
#define HAS_EXEC_INHERIT(mode) ((mode) & KERN_COD_EXEC_INHERIT)
#define HAS_EXEC_PROFILE(mode) ((mode) & KERN_COD_EXEC_PROFILE)
#define HAS_EXEC_UNCONSTRAINED(mode) ((mode) & KERN_COD_EXEC_UNCONSTRAINED)
#define HAS_EXEC_MMAP(mode) ((mode) & KERN_COD_EXEC_MMAP)
#define HAS_EXEC_UNSAFE(mode) ((mode) & KERN_COD_EXEC_UNSAFE)
#endif /* ! _IMMUNIX_H */ #endif /* ! _IMMUNIX_H */

2
parser/parser_main.c
View File

@@ -128,7 +128,7 @@ void pwarn(char *fmt, ...)
if (conf_quiet || names_only || option == OPTION_REMOVE) if (conf_quiet || names_only || option == OPTION_REMOVE)
return; return;
rc = asprintf(&newfmt, "Warning (%s line %d): %s", rc = asprintf(&newfmt, _("Warning (%s line %d): %s"),
profilename ? profilename : "stdin", profilename ? profilename : "stdin",
current_lineno, current_lineno,
fmt); fmt);

10
parser/parser_merge.c
View File

@@ -75,19 +75,17 @@ static int process_file_entries(struct codomain *cod)
table[count] = NULL; table[count] = NULL;
#define CHECK_CONFLICT_UNSAFE(a, b) \ #define CHECK_CONFLICT_UNSAFE(a, b) \
(((a & KERN_COD_EXEC_UNSAFE) ^ (b & KERN_COD_EXEC_UNSAFE)) && \ ((HAS_EXEC_UNSAFE(a) ^ HAS_EXEC_UNSAFE(b)) && \
(KERN_EXEC_MODIFIERS(a) & ~KERN_COD_EXEC_INHERIT) && \ ((HAS_EXEC_PROFILE(a) && HAS_EXEC_PROFILE(b)) || \
(KERN_EXEC_MODIFIERS(b) & ~KERN_COD_EXEC_INHERIT)) (HAS_EXEC_UNCONSTRAINED(a) && HAS_EXEC_UNCONSTRAINED(b))))
/* walk the sorted table merging similar entries */ /* walk the sorted table merging similar entries */
for (cur = table[0], next = table[1], n = 1; next != NULL; n++, next = table[n]) { for (cur = table[0], next = table[1], n = 1; next != NULL; n++, next = table[n]) {
if (file_comp(&cur, &next) == 0) { if (file_comp(&cur, &next) == 0) {
int conflict = CHECK_CONFLICT_UNSAFE(cur->mode, next->mode); int conflict = CHECK_CONFLICT_UNSAFE(cur->mode, next->mode);
PDEBUG("%s: cur_mode: %x next_mode: %x conflict %d\n",
__FUNCTION__, cur->mode, next->mode, conflict);
cur->mode |= next->mode; cur->mode |= next->mode;
/* check for merged x consistency */ /* check for merged x consistency */
if (KERN_COD_MAY_EXEC & cur->mode && if (HAS_MAY_EXEC(cur->mode) &&
((KERN_EXEC_MODIFIERS(cur->mode) & ((KERN_EXEC_MODIFIERS(cur->mode) &
(KERN_EXEC_MODIFIERS(cur->mode) - 1)) || (KERN_EXEC_MODIFIERS(cur->mode) - 1)) ||
conflict)) { conflict)) {

40
parser/parser_misc.c
View File

@@ -266,8 +266,8 @@ static int warned_uppercase = 0;
static void warn_uppercase(void) static void warn_uppercase(void)
{ {
if (!warned_uppercase) { if (!warned_uppercase) {
pwarn("Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n" pwarn(_("Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"); "See the apparmor.d(5) manpage for details.\n"));
warned_uppercase = 1; warned_uppercase = 1;
} }
} }
@@ -324,16 +324,18 @@ reeval:
case COD_UNSAFE_UNCONSTRAINED_CHAR: case COD_UNSAFE_UNCONSTRAINED_CHAR:
mode |= KERN_COD_EXEC_UNSAFE; mode |= KERN_COD_EXEC_UNSAFE;
pwarn("Unconstrained exec qualifier (%c%c) allows some dangerous environment variables\n" pwarn(_("Unconstrained exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; see the apparmor.d(5) manpage for details.\n", "to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"),
COD_UNSAFE_UNCONSTRAINED_CHAR, COD_EXEC_CHAR); COD_UNSAFE_UNCONSTRAINED_CHAR, COD_EXEC_CHAR);
/* fall through */ /* fall through */
case COD_UNCONSTRAINED_CHAR: case COD_UNCONSTRAINED_CHAR:
PDEBUG("Parsing mode: found UNCONSTRAINED\n"); PDEBUG("Parsing mode: found UNCONSTRAINED\n");
if (next != COD_EXEC_CHAR && tolower(next) != COD_EXEC_CHAR) { if (next != COD_EXEC_CHAR && tolower(next) != COD_EXEC_CHAR) {
yyerror(_("Exec qualifier 'u' must be followed by 'x'")); yyerror(_("Exec qualifier '%c' must be followed by 'x'"),
this);
} else if (IS_DIFF_QUAL(this)) { } else if (IS_DIFF_QUAL(this)) {
yyerror(_("Exec qualifier 'u' invalid, conflicting qualifier already specified")); yyerror(_("Exec qualifier '%c' invalid, conflicting qualifier already specified"),
this);
} else { } else {
if (next != tolower(next)) if (next != tolower(next))
warn_uppercase(); warn_uppercase();
@@ -350,9 +352,11 @@ reeval:
case COD_PROFILE_CHAR: case COD_PROFILE_CHAR:
PDEBUG("Parsing mode: found PROFILE\n"); PDEBUG("Parsing mode: found PROFILE\n");
if (next != COD_EXEC_CHAR && tolower(next) != COD_EXEC_CHAR) { if (next != COD_EXEC_CHAR && tolower(next) != COD_EXEC_CHAR) {
yyerror(_("Exec qualifier 'p' must be followed by 'x'")); yyerror(_("Exec qualifier '%c' must be followed by 'x'"),
this);
} else if (IS_DIFF_QUAL(this)) { } else if (IS_DIFF_QUAL(this)) {
yyerror(_("Exec qualifier 'p' invalid, conflicting qualifier already specified")); yyerror(_("Exec qualifier '%c' invalid, conflicting qualifier already specified"),
this);
} else { } else {
if (next != tolower(next)) if (next != tolower(next))
warn_uppercase(); warn_uppercase();
@@ -556,29 +560,29 @@ void debug_cod_entries(struct cod_entry *list)
printf("Item is NULL!\n"); printf("Item is NULL!\n");
printf("Mode:\t"); printf("Mode:\t");
if (item->mode & KERN_COD_MAY_READ) if (HAS_MAY_READ(item->mode))
printf("%c", COD_READ_CHAR); printf("%c", COD_READ_CHAR);
if (item->mode & KERN_COD_MAY_WRITE) if (HAS_MAY_WRITE(item->mode))
printf("%c", COD_WRITE_CHAR); printf("%c", COD_WRITE_CHAR);
if (item->mode & KERN_COD_MAY_LINK) if (HAS_MAY_LINK(item->mode))
printf("%c", COD_LINK_CHAR); printf("%c", COD_LINK_CHAR);
if (item->mode & KERN_COD_EXEC_INHERIT) if (HAS_EXEC_INHERIT(item->mode))
printf("%c", COD_INHERIT_CHAR); printf("%c", COD_INHERIT_CHAR);
if (item->mode & KERN_COD_EXEC_UNCONSTRAINED) { if (HAS_EXEC_UNCONSTRAINED(item->mode)) {
if (item->mode & KERN_COD_EXEC_UNSAFE) if (HAS_EXEC_UNSAFE(item->mode))
printf("%c", COD_UNSAFE_UNCONSTRAINED_CHAR); printf("%c", COD_UNSAFE_UNCONSTRAINED_CHAR);
else else
printf("%c", COD_UNCONSTRAINED_CHAR); printf("%c", COD_UNCONSTRAINED_CHAR);
} }
if (item->mode & KERN_COD_EXEC_PROFILE) { if (HAS_EXEC_PROFILE(item->mode)) {
if (item->mode & KERN_COD_EXEC_UNSAFE) if (HAS_EXEC_UNSAFE(item->mode))
printf("%c", COD_UNSAFE_PROFILE_CHAR); printf("%c", COD_UNSAFE_PROFILE_CHAR);
else else
printf("%c", COD_PROFILE_CHAR); printf("%c", COD_PROFILE_CHAR);
} }
if (item->mode & KERN_COD_EXEC_MMAP) if (HAS_EXEC_MMAP(item->mode))
printf("%c", COD_MMAP_CHAR); printf("%c", COD_MMAP_CHAR);
if (item->mode & KERN_COD_MAY_EXEC) if (HAS_MAY_EXEC(item->mode))
printf("%c", COD_EXEC_CHAR); printf("%c", COD_EXEC_CHAR);
if (item->name) if (item->name)