Add mount rules

Add the ability to control mounting and unmounting

The basic form of the rules are.

  [audit] [deny] mount [conds]* [device] [ -> [conds] path],
  [audit] [deny] remount [conds]* [path],
  [audit] [deny] umount [conds]* [path],
  [audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>

  remount is just a short cut for mount options=remount

  where [conds] can be
    fstype=<expr>
    options=<expr>


  conds follow the extended conditional syntax of allowing either:

  * a single value after the equals, which has the same character range as
    regular IDS (ie most anything but it can't be terminated with a , (comma)
    and if spaces or other characters are needed it can be quoted

    eg.
       options=foo
       options = foo
       options="foo bar"

  * a list of values after the equals, the list of values is enclosed within
    parenthesis () and its has a slightly reduced character set but again
    elements can be quoted.

    the separation between elements is whitespace and commas.

    eg.
      options=(foo bar)
      options=(foo, bar)
      options=(foo , bar)
      options=(foo,bar)


The rules are flexible and follow a similar pattern as network, capability,
etc.

  mount,	# allow all mounts, but not umount or pivotroot

  mount fstype=procfs,  # allow mounting procfs anywhere

  mount options=(bind, ro) /foo -> /bar,  # readonly bind mount

  mount /dev/sda -> /mnt,

  mount /dev/sd** -> /mnt/**,

  mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/

  umount,

  umount /m*,


Currently variables and regexs are are supported on the device and mount
point. ie.
  mount <devince> -> <mount point>,

Regexes are supported in fstype and options.  The options have a further
caveat that regexs only work if the option is fs specific option.

  eg. options=(upperdir=/tmp/*,lowerdir=/)

regex's will not currently work against the standard options like ro, rw
nosuid


Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).

Options can be specified multiple times
  mount option=rw option=(nosuid,upperdir=/foo),

and will be combined together into a single set of values

The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.

Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
  option=(rw,ro) options=(suid,nosuid)

For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.

Improvements to the syntax and order restrictions are planned for the
future.

Signed-off-by: John Johansen <john.johansen@canonical.com>

parser/parser_misc.c

@@ -37,6 +37,7 @@
 
 #include "parser.h"
 #include "parser_yacc.h"
+#include "mount.h"
 
 /* #define DEBUG */
 #ifdef DEBUG
@@ -78,6 +79,11 @@ static struct keyword_table keyword_table[] = {
 	{"rewrite",		TOK_ALIAS},
 	{"ptrace",		TOK_PTRACE},
 	{"file",		TOK_FILE},
+	{"mount",		TOK_MOUNT},
+	{"remount",		TOK_REMOUNT},
+	{"umount",		TOK_UMOUNT},
+	{"unmount",		TOK_UMOUNT},
+	{"pivotroot",		TOK_PIVOTROOT},
 	/* terminate */
 	{NULL, 0}
 };
@@ -776,6 +782,20 @@ void free_cod_entries(struct cod_entry *list)
 	free(list);
 }
 
+void free_mnt_entries(struct mnt_entry *list)
+{
+	if (!list)
+		return;
+	if (list->next)
+		free_mnt_entries(list->next);
+	free(list->mnt_point);
+	free(list->device);
+	free_value_list(list->dev_type);
+	free_value_list(list->opts);
+
+	free(list);
+}
+
 static void debug_base_perm_mask(int mask)
 {
 	if (HAS_MAY_READ(mask))
@@ -960,6 +980,37 @@ void free_value_list(struct value_list *list)
 	}
 }
 
+struct value_list *dup_value_list(struct value_list *list)
+{
+	struct value_list *entry, *dup, *head = NULL;
+	char *value;
+
+	list_for_each(list, entry) {
+		value = NULL;
+		if (list->value) {
+			value = strdup(list->value);
+			if (!value)
+				goto fail2;
+		}
+		dup = new_value_list(value);
+		if (!dup)
+			goto fail;
+		if (head)
+			list_append(head, dup);
+		else
+			head = dup;
+	}
+
+	return head;
+
+fail:
+	free(value);
+fail2:
+	free_value_list(head);
+
+	return NULL;
+}
+
 void print_value_list(struct value_list *list)
 {
 	struct value_list *entry;
@@ -974,6 +1025,35 @@ void print_value_list(struct value_list *list)
 	}
 }
 
+struct cond_entry *new_cond_entry(char *name, struct value_list *list)
+{
+	struct cond_entry *ent = calloc(1, sizeof(struct cond_entry));
+	if (ent) {
+		ent->name = name;
+		ent->vals = list;
+	}
+
+	return ent;
+}
+
+void free_cond_entry(struct cond_entry *ent)
+{
+	if (ent) {
+		free(ent->name);
+		free_value_list(ent->vals);
+		free(ent);
+	}
+}
+
+void print_cond_entry(struct cond_entry *ent)
+{
+	if (ent) {
+		fprintf(stderr, "%s=(", ent->name);
+		print_value_list(ent->vals);
+		fprintf(stderr, ")\n");
+	}
+}
+
 #ifdef UNIT_TEST
 int test_str_to_boolean(void)
 {