diff --git a/parser/apparmor.d.pod b/parser/apparmor.d.pod index 124b0a4cd..dfcb37077 100644 --- a/parser/apparmor.d.pod +++ b/parser/apparmor.d.pod @@ -80,7 +80,7 @@ B = 'alias' I '-E' I ',' B = ( '#include' | 'include' ) [ 'if exists' ] ( I | I ) -B = ( 'abi' ) ( I | I ) ',' +B = ( 'abi' ) ( I | I | '' | '' ) ',' B = '"' path '"' (the path is passed to open(2)) @@ -2127,6 +2127,8 @@ If the policy abi is specified as B then the running kernel's abi will be used. This should never be used in shipped policy as it can cause system breakage when a new kernel is installed. +The special abi B is equivalent to not specifying an ABI. + =head3 ABI compatibility with AppArmor 2.x AppArmor 3 remains compatible with AppArmor 2.x by detecting when a diff --git a/parser/parser_yacc.y b/parser/parser_yacc.y index d1fe72d2e..4d9c62762 100644 --- a/parser/parser_yacc.y +++ b/parser/parser_yacc.y @@ -1780,8 +1780,17 @@ static int abi_features_base(struct aa_features **features, char *filename, bool bool cached; if (search) { - if (strcmp(filename, "kernel") == 0) + if (strcmp(filename, "kernel") == 0) { + if (kernel_features) { + *features = aa_features_ref(kernel_features); + return 0; + } return aa_features_new_from_kernel(features); + } else if (strcmp(filename, "default") == 0) { + return aa_features_new_from_string(features, + default_features_abi, + strlen(default_features_abi)); + } f = search_path(filename, &fullpath, &cached); PDEBUG("abi lookup '%s' -> '%s' f %p cached %d\n", filename, fullpath, f, cached); if (!f && cached) { diff --git a/parser/tst/simple_tests/abi/ok_23.sd b/parser/tst/simple_tests/abi/ok_23.sd new file mode 100644 index 000000000..3f4ea4ba1 --- /dev/null +++ b/parser/tst/simple_tests/abi/ok_23.sd @@ -0,0 +1,10 @@ +# +#=DESCRIPTION abi testing - abi kernel special case +#=EXRESULT PASS +# + +abi , + +/does/not/exist { + +} \ No newline at end of file diff --git a/parser/tst/simple_tests/abi/ok_24.sd b/parser/tst/simple_tests/abi/ok_24.sd new file mode 100644 index 000000000..60d67d4da --- /dev/null +++ b/parser/tst/simple_tests/abi/ok_24.sd @@ -0,0 +1,10 @@ +# +#=DESCRIPTION abi testing - abi default special case +#=EXRESULT PASS +# + +abi , + +/does/not/exist { + +} \ No newline at end of file