mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 10:07:12 +00:00
Code Issues Releases Wiki Activity

parser: add non-functional prompt parsing

Browse Source 
Add the ability to parse the prompt qualifier but do not provide
functionality because the backend does not currently support prompt
permissions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2020-06-18 04:06:42 -07:00
parent db66b36064
commit c86f8f06dd
3 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
parser/parser_misc.c
View File

@ -97,6 +97,7 @@ static struct keyword_table keyword_table[] = {
{"audit", TOK_AUDIT}, {"audit", TOK_AUDIT},
{"deny", TOK_DENY}, {"deny", TOK_DENY},
{"allow", TOK_ALLOW}, {"allow", TOK_ALLOW},
{"prompt", TOK_PROMPT},
{"set", TOK_SET}, {"set", TOK_SET},
{"rlimit", TOK_RLIMIT}, {"rlimit", TOK_RLIMIT},
{"alias", TOK_ALIAS}, {"alias", TOK_ALIAS},

9
parser/parser_yacc.y
View File

@ -115,6 +115,7 @@ static void abi_features(char *filename, bool search);
%token TOK_AUDIT %token TOK_AUDIT
%token TOK_DENY %token TOK_DENY
%token TOK_ALLOW %token TOK_ALLOW
%token TOK_PROMPT
%token TOK_PROFILE %token TOK_PROFILE
%token TOK_SET %token TOK_SET
%token TOK_ALIAS %token TOK_ALIAS
@ -632,6 +633,7 @@ opt_owner_flag: { /* nothing */ $$ = 0; }
opt_rule_mode: { /* nothing */ $$ = RULE_UNSPECIFIED; } opt_rule_mode: { /* nothing */ $$ = RULE_UNSPECIFIED; }
| TOK_ALLOW { $$ = RULE_ALLOW; } | TOK_ALLOW { $$ = RULE_ALLOW; }
| TOK_DENY { $$ = RULE_DENY; } | TOK_DENY { $$ = RULE_DENY; }
| TOK_PROMPT { $$ = RULE_PROMPT; }
opt_prefix: opt_audit_flag opt_rule_mode opt_owner_flag opt_prefix: opt_audit_flag opt_rule_mode opt_owner_flag
{ {
@ -674,8 +676,11 @@ rules: rules opt_prefix block
{ {
struct cod_entry *entry, *tmp; struct cod_entry *entry, *tmp;
PDEBUG("matched: %s%s%sblock\n", $2.audit == AUDIT_FORCE ? "audit " : "", PDEBUG("matched: %s%s%sblock\n",
$2.rule_mode == RULE_DENY ? "deny " : "", $2.owner ? "owner " : ""); $2.audit == AUDIT_FORCE ? "audit " : "",
$2.rule_mode == RULE_DENY ? "deny " : "",
$2.rule_mode == RULE_PROMPT ? "prompt " : "",
$2.owner ? "owner " : "");
list_for_each_safe($3->entries, entry, tmp) { list_for_each_safe($3->entries, entry, tmp) {
const char *error; const char *error;
entry->next = NULL; entry->next = NULL;

16
parser/rule.h
View File

@ -153,7 +153,7 @@ typedef std::list<rule_t *> RuleList;
/* Not classes so they can be used in the bison front end */ /* Not classes so they can be used in the bison front end */
typedef uint32_t perms_t; typedef uint32_t perms_t;
typedef enum { AUDIT_UNSPECIFIED, AUDIT_FORCE, AUDIT_QUIET } audit_t; typedef enum { AUDIT_UNSPECIFIED, AUDIT_FORCE, AUDIT_QUIET } audit_t;
typedef enum { RULE_UNSPECIFIED, RULE_ALLOW, RULE_DENY } rule_mode_t; typedef enum { RULE_UNSPECIFIED, RULE_ALLOW, RULE_DENY, RULE_PROMPT } rule_mode_t;
/* NOTE: we can not have a constructor for class prefixes. This is /* NOTE: we can not have a constructor for class prefixes. This is
* because it will break bison, and we would need to transition to * because it will break bison, and we would need to transition to
@ -183,6 +183,13 @@ public:
} }
switch (rule_mode) { switch (rule_mode) {
case RULE_ALLOW:
if (output)
os << " ";
os << "allow";
output = true;
break;
case RULE_DENY: case RULE_DENY:
if (output) if (output)
os << " "; os << " ";
@ -190,6 +197,13 @@ public:
os << "deny"; os << "deny";
output = true; output = true;
break; break;
case RULE_PROMPT:
if (output)
os << " ";
os << "prompt";
output = true;
break;
default: default:
break; break;
} }