diff --git a/parser/parser_lex.l b/parser/parser_lex.l index 31a3399c9..c29ddc8b5 100644 --- a/parser/parser_lex.l +++ b/parser/parser_lex.l @@ -190,7 +190,7 @@ ADD_ASSIGN \+= return TOK_FLAG_CLOSEPAREN; } - {WS}+ { /* Eat whitespace */ } + {WS}+ { /* Eat whitespace */ } {FLAGSEP} { PDEBUG("Flag , \n"); @@ -201,26 +201,12 @@ ADD_ASSIGN \+= PDEBUG("Flag = \n"); return TOK_EQUALS; } - {KEYWORD} { - int token = get_keyword_token(yytext); - - /* special cases */ - switch (token) { - case TOK_FLAG_AUDIT: - case TOK_FLAG_COMPLAIN: - case TOK_FLAG_DEBUG: - /* legit */ - break; - default: - /* bad keyword or no token found */ - yyerror(_("Found unknown flag: '%s'"), yytext); - break; + yylval = (YYSTYPE) strdup(yytext); + return TOK_FLAG_ID; } - return token; - } - [^\n] { + [^\n] { /* Something we didn't expect */ yyerror(_("Found unexpected character: '%s'"), yytext); } @@ -352,6 +338,12 @@ ADD_ASSIGN \+= return TOK_COLON; } +{FLAGOPEN_PAREN} { + PDEBUG("FLag (\n"); + BEGIN(FLAGS_MODE); + return TOK_FLAG_OPENPAREN; + } + {VARIABLE_NAME} { int token = get_keyword_token(yytext); diff --git a/parser/parser_misc.c b/parser/parser_misc.c index 0f7cead2c..5cc2304ab 100644 --- a/parser/parser_misc.c +++ b/parser/parser_misc.c @@ -82,9 +82,6 @@ static struct keyword_table keyword_table[] = { {"audit_control", TOK_CAP_AUDIT_CONTROL}, /* flags */ {"flags", TOK_FLAGS}, - {"debug", TOK_FLAG_DEBUG}, - {"complain", TOK_FLAG_COMPLAIN}, - {"audit", TOK_FLAG_AUDIT}, /* network */ {"via", TOK_VIA}, {"tcp_connect", TOK_TCP_CONN}, diff --git a/parser/parser_yacc.y b/parser/parser_yacc.y index 81e0e54a9..9e0821574 100644 --- a/parser/parser_yacc.y +++ b/parser/parser_yacc.y @@ -150,12 +150,11 @@ struct cod_entry *do_file_rule(char *namespace, char *id, int mode); %token TOK_FLAG_OPENPAREN %token TOK_FLAG_CLOSEPAREN %token TOK_FLAG_SEP -%token TOK_FLAG_DEBUG -%token TOK_FLAG_COMPLAIN -%token TOK_FLAG_AUDIT +%token TOK_FLAG_ID %union { char *id; + char *flag_id; char *ip; char *iface; char *mode; @@ -208,6 +207,7 @@ struct cod_entry *do_file_rule(char *namespace, char *id, int mode); %type flags %type flagvals %type flagval +%type TOK_FLAG_ID %type cap %type capability %type change_profile @@ -390,6 +390,11 @@ flags: TOK_FLAGS TOK_EQUALS TOK_FLAG_OPENPAREN flagvals TOK_FLAG_CLOSEPAREN $$ = $4; }; +flags: TOK_FLAG_OPENPAREN flagvals TOK_FLAG_CLOSEPAREN + { + $$ = $2; + } + flagvals: flagvals TOK_FLAG_SEP flagval { $1.complain = $1.complain || $3.complain; @@ -403,27 +408,19 @@ flagvals: flagval $$ = $1; }; -flagval: TOK_FLAG_DEBUG +flagval: TOK_FLAG_ID { - PDEBUG("Matched: flag debug\n"); - yyerror(_("flags=(debug) is no longer supported, sorry.")); - }; - -flagval: TOK_FLAG_COMPLAIN - { - struct flagval fv = { 0, 1, 0 }; - - PDEBUG("Matched: flag complain\n"); - - $$ = fv; - }; - -flagval: TOK_FLAG_AUDIT - { - struct flagval fv = { 0, 0, 1 }; - - PDEBUG("Matched: flag audit\n"); - + struct flagval fv = {0, 0, 0}; + if (strcmp($1, "debug") == 0) { + yyerror(_("Profile flag 'debug' is no longer valid.")); + } else if (strcmp($1, "complain") == 0) { + fv.complain = 1; + } else if (strcmp($1, "audit") == 0) { + fv.audit = 1; + } else { + yyerror(_("Invalid profile flag: %s."), $1); + } + free($1); $$ = fv; }; diff --git a/parser/tst/simple_tests/flags_bad5.sd b/parser/tst/simple_tests/flags_bad5.sd new file mode 100644 index 000000000..4d470565d --- /dev/null +++ b/parser/tst/simple_tests/flags_bad5.sd @@ -0,0 +1,39 @@ +# +# $Id: flags_bad.sd 66 2006-06-01 18:02:28Z steve-beattie $ +#=DESCRIPTION Ensure debug flag is no longer accepted +#=EXRESULT FAIL +# vim:syntax=subdomain +# Last Modified: Sun Apr 17 19:44:44 2005 +# +/does/not/exist (debug) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist r, +} + +/does/not/exist2 (audit,debug) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist2 r, +} + +/does/not/exist3 (debug,complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist5 r, +} + +/does/not/exist4 (audit,complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist7 r, + + ^debug (debug) { + /var/log/debug rwl, + } +} + diff --git a/parser/tst/simple_tests/flags_bad6.sd b/parser/tst/simple_tests/flags_bad6.sd new file mode 100644 index 000000000..8aa97e78b --- /dev/null +++ b/parser/tst/simple_tests/flags_bad6.sd @@ -0,0 +1,13 @@ +# +# $Id: flags_bad2.sd 66 2006-06-01 18:02:28Z steve-beattie $ +#=DESCRIPTION Don't accept other keyword as a flag +#=EXRESULT FAIL +# vim:syntax=subdomain +# Last Modified: Sun Apr 17 19:44:44 2005 +# +/does/not/exist (capability) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist r, +} diff --git a/parser/tst/simple_tests/flags_bad7.sd b/parser/tst/simple_tests/flags_bad7.sd new file mode 100644 index 000000000..4d781f690 --- /dev/null +++ b/parser/tst/simple_tests/flags_bad7.sd @@ -0,0 +1,19 @@ +# +# $Id: flags_bad3.sd 66 2006-06-01 18:02:28Z steve-beattie $ +#=DESCRIPTION Ensure really bad parsing fails +#=EXRESULT FAIL +# vim:syntax=subdomain +# Last Modified: Sun Apr 17 19:44:44 2005 +# +/does/not/exist (blahblab { + + /usr/X11R6/lib/lib*so* r + /does/not/exist r +} + +audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist2 r, +} diff --git a/parser/tst/simple_tests/flags_bad8.sd b/parser/tst/simple_tests/flags_bad8.sd new file mode 100644 index 000000000..afb56b219 --- /dev/null +++ b/parser/tst/simple_tests/flags_bad8.sd @@ -0,0 +1,14 @@ +# +# $Id: flags_bad4.sd 66 2006-06-01 18:02:28Z steve-beattie $ +#=DESCRIPTION Bad flags parsing should fail +#=EXRESULT FAIL +# vim:syntax=subdomain +# Last Modified: Sun Apr 17 19:44:44 2005 +# +/does/not/exist ({{{ }} { } { } audit +{{}}}{{{} {}{}{} / ^ ) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist r, +} diff --git a/parser/tst/simple_tests/flags_hats_ok.sd b/parser/tst/simple_tests/flags_hats_ok.sd index 91ccfcf55..c20482e6d 100644 --- a/parser/tst/simple_tests/flags_hats_ok.sd +++ b/parser/tst/simple_tests/flags_hats_ok.sd @@ -25,6 +25,10 @@ ^FOO flags=(complain) { #include } + + ^FOO2 (complain) { + #include + } } /does/not/exist3 flags=(complain) { @@ -36,6 +40,9 @@ ^FOO flags=(audit) { #include } + ^FOO2 (audit) { + #include + } } /does/not/exist4 { @@ -47,6 +54,9 @@ ^FOO flags=(complain) { #include } + ^FOO2 (complain) { + #include + } } /does/not/exist5 flags=(audit) { @@ -69,6 +79,9 @@ ^FOO flags=(audit) { #include } + ^FOO2 (audit) { + #include + } } /does/not/exist7 flags=(audit) { @@ -80,6 +93,9 @@ ^FOO flags=(complain) { #include } + ^FOO2 (complain) { + #include + } } /does/not/exist8 { @@ -91,6 +107,9 @@ ^FOO flags=(audit) { #include } + ^FOO2 (audit) { + #include + } } /does/not/exist9 { @@ -103,6 +122,10 @@ #include } + ^FOO2 (audit) { + #include + } + ^BAR { #include } @@ -111,11 +134,173 @@ #include } + ^BAZ2 (audit) { + #include + } + ^BIF flags=(complain) { #include } + ^BIF2 (complain) { + #include + } + ^BUZ flags=(complain,audit) { /var/log/messages r, } + + ^BUZ2 (complain,audit) { + /var/log/messages r, + } +} + +/does/not/exist11 flags=(complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist r, + + ^FOO { + #include + } +} + +/does/not/exist12 flags=(complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist2 r, + + ^FOO flags=(complain) { + #include + } + + ^FOO2 (complain) { + #include + } +} + +/does/not/exist13 flags=(complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist3 r, + + ^FOO flags=(audit) { + #include + } + ^FOO2 (audit) { + #include + } +} + +/does/not/exist14 { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist4 r, + + ^FOO flags=(complain) { + #include + } + ^FOO2 (complain) { + #include + } +} + +/does/not/exist15 flags=(audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist5 r, + + ^FOO { + #include + } +} + +/does/not/exist16 flags=(audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist6 r, + + ^FOO flags=(audit) { + #include + } + ^FOO2 (audit) { + #include + } +} + +/does/not/exist17 flags=(audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist7 r, + + ^FOO flags=(complain) { + #include + } + ^FOO2 (complain) { + #include + } +} + +/does/not/exist18 { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist8 r, + + ^FOO flags=(audit) { + #include + } + ^FOO2 (audit) { + #include + } +} + +/does/not/exist19 { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist9 r, + + ^FOO flags=(audit) { + #include + } + + ^FOO2 (audit) { + #include + } + + ^BAR { + #include + } + + ^BAZ flags=(audit) { + #include + } + + ^BAZ2 (audit) { + #include + } + + ^BIF flags=(complain) { + #include + } + + ^BIF2 (complain) { + #include + } + + ^BUZ flags=(complain,audit) { + /var/log/messages r, + } + + ^BUZ2 (complain,audit) { + /var/log/messages r, + } } diff --git a/parser/tst/simple_tests/flags_ok.sd b/parser/tst/simple_tests/flags_ok.sd index 2e8d0d38a..0d2b57eb7 100644 --- a/parser/tst/simple_tests/flags_ok.sd +++ b/parser/tst/simple_tests/flags_ok.sd @@ -39,3 +39,38 @@ /usr/X11R6/lib/lib*so* r, /does/not/exist8 r, } + +/does/not/exist6 (complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist r, +} + +/does/not/exist7 (audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist2 r, +} + +/does/not/exist8 (complain,audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist5 r, +} + +/does/not/exist9 (audit,complain) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist7 r, +} + +/does/not/exist10 (audit,complain,audit) { + #include + + /usr/X11R6/lib/lib*so* r, + /does/not/exist8 r, +}