mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 18:17:09 +00:00
Code Issues Releases Wiki Activity

parser: add permission merging

Browse Source 
By changing the compare function from each rule to use class_rule_t,
instead of perms_rule_t, we temporarily ignore if permissions are
different. If every rule attribute is the same, then the permissions
can be merged. This is done at the perms_rule_t's level.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
This commit is contained in:
Georgia Garcia 2023-07-10 17:58:08 -03:00
parent 1279f85e4a
commit cdb5e501d6
9 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
parser/af_rule.h
View File

@ -80,7 +80,8 @@ public:
virtual bool is_mergeable(void) { return true; } virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const virtual int cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
af_rule const &trhs = (rule_cast<af_rule const &>(rhs)); af_rule const &trhs = (rule_cast<af_rule const &>(rhs));

3
parser/dbus.h
View File

@ -65,7 +65,8 @@ public:
virtual bool is_mergeable(void) { return true; } virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const virtual int cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
dbus_rule const &trhs = (rule_cast<dbus_rule const &>(rhs)); dbus_rule const &trhs = (rule_cast<dbus_rule const &>(rhs));

3
parser/io_uring.h
View File

@ -52,7 +52,8 @@ public:
virtual bool is_mergeable(void) { return true; } virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const virtual int cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
return null_strcmp(label, return null_strcmp(label,

4
parser/mount.cc
View File

@ -649,8 +649,8 @@ static int cmp_vec_int(std::vector<unsigned int> const &lhs,
} }
int mnt_rule::cmp(rule_t const &rhs) const { int mnt_rule::cmp(rule_t const &rhs) const {
// for now don't do merging of perms, only exact match /* use class_rule_t instead of perms_rule_t to merge perms */
int res = perms_rule_t::cmp(rhs); int res = class_rule_t::cmp(rhs);
if (res != 0) if (res != 0)
return res; return res;
mnt_rule const &rhs_mnt = rule_cast<mnt_rule const &>(rhs); mnt_rule const &rhs_mnt = rule_cast<mnt_rule const &>(rhs);

3
parser/mqueue.h
View File

@ -110,7 +110,8 @@ public:
virtual bool is_mergeable(void) { return true; } virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const virtual int cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
mqueue_rule const &trhs = rule_cast<mqueue_rule const &>(rhs); mqueue_rule const &trhs = rule_cast<mqueue_rule const &>(rhs);

3
parser/ptrace.h
View File

@ -55,7 +55,8 @@ public:
virtual bool is_mergeable(void) { return true; } virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const virtual int cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
return null_strcmp(peer_label, return null_strcmp(peer_label,

9
parser/rule.h
View File

@ -364,6 +364,15 @@ public:
return perms - (rule_cast<perms_rule_t const &>(rhs)).perms; return perms - (rule_cast<perms_rule_t const &>(rhs)).perms;
} }
virtual bool merge(rule_t &rhs)
{
int res = class_rule_t::merge(rhs);
if (!res)
return res;
perms |= (rule_cast<perms_rule_t const &>(rhs)).perms;
return true;
};
/* defaut perms, override/mask off if none default used */ /* defaut perms, override/mask off if none default used */
virtual ostream &dump(ostream &os) { virtual ostream &dump(ostream &os) {

3
parser/signal.cc
View File

@ -249,7 +249,8 @@ static int cmp_set_int(Signals const &lhs, Signals const &rhs)
int signal_rule::cmp(rule_t const &rhs) const int signal_rule::cmp(rule_t const &rhs) const
{ {
int res = perms_rule_t::cmp(rhs); /* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res) if (res)
return res; return res;
signal_rule const &trhs = rule_cast<signal_rule const &>(rhs); signal_rule const &trhs = rule_cast<signal_rule const &>(rhs);

1
parser/userns.h
View File

@ -47,6 +47,7 @@ public:
{ {
return perms_rule_t::cmp(rhs); return perms_rule_t::cmp(rhs);
}; };
/* merge perms not required atm since there's only one permission */
protected: protected:
virtual void warn_once(const char *name) override; virtual void warn_once(const char *name) override;