mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-28 21:07:56 +00:00
Code Issues Releases Wiki Activity

Convert aare_rules into a class

Browse Source 
This cleans things up a bit and fixes a bug where not all rules are
getting properly counted so that the addition of policy_mediation
rules fails to generate the policy dfa in some cases.

Because the policy dfa is being generated correctly now we need to
fix some tests to use the new -M flag to specify the expected features
set of the test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This commit is contained in:
John Johansen 2014-04-23 10:57:16 -07:00
parent 873ae31d29
commit f7e12a9bc5
7 changed files with 114 additions and 160 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
parser/dbus.c
View File

@ -301,28 +301,26 @@ int dbus_rule::gen_policy_re(Profile &prof)
} }
if (mode & AA_DBUS_BIND) { if (mode & AA_DBUS_BIND) {
if (!aare_add_rule_vec(prof.policy.rules, deny, if (!prof.policy.rules->add_rule_vec(deny, mode & AA_DBUS_BIND,
mode & AA_DBUS_BIND,
audit & AA_DBUS_BIND, audit & AA_DBUS_BIND,
2, vec, dfaflags)) 2, vec, dfaflags))
goto fail; goto fail;
} }
if (mode & (AA_DBUS_SEND | AA_DBUS_RECEIVE)) { if (mode & (AA_DBUS_SEND | AA_DBUS_RECEIVE)) {
if (!aare_add_rule_vec(prof.policy.rules, deny, if (!prof.policy.rules->add_rule_vec(deny,
mode & (AA_DBUS_SEND | AA_DBUS_RECEIVE), mode & (AA_DBUS_SEND | AA_DBUS_RECEIVE),
audit & (AA_DBUS_SEND | AA_DBUS_RECEIVE), audit & (AA_DBUS_SEND | AA_DBUS_RECEIVE),
6, vec, dfaflags)) 6, vec, dfaflags))
goto fail; goto fail;
} }
if (mode & AA_DBUS_EAVESDROP) { if (mode & AA_DBUS_EAVESDROP) {
if (!aare_add_rule_vec(prof.policy.rules, deny, if (!prof.policy.rules->add_rule_vec(deny,
mode & AA_DBUS_EAVESDROP, mode & AA_DBUS_EAVESDROP,
audit & AA_DBUS_EAVESDROP, audit & AA_DBUS_EAVESDROP,
1, vec, dfaflags)) 1, vec, dfaflags))
goto fail; goto fail;
} }
prof.policy.count++;
return RULE_OK; return RULE_OK;
fail: fail:

78
parser/libapparmor_re/aare_rules.cc
View File

@ -34,38 +34,20 @@
#include "chfa.h" #include "chfa.h"
#include "../immunix.h" #include "../immunix.h"
struct aare_ruleset {
int reverse;
Node *root;
};
aare_ruleset_t *aare_new_ruleset(int reverse)
aare_rules::~aare_rules(void)
{ {
aare_ruleset_t *container = (aare_ruleset_t *) malloc(sizeof(aare_ruleset_t)); if (root)
if (!container) root->release();
return NULL;
container->root = NULL;
container->reverse = reverse;
return container;
}
void aare_delete_ruleset(aare_ruleset_t *rules)
{
if (rules) {
if (rules->root)
rules->root->release();
free(rules);
}
aare_reset_matchflags(); aare_reset_matchflags();
} }
int aare_add_rule(aare_ruleset_t *rules, const char *rule, int deny, bool aare_rules::add_rule(const char *rule, int deny, uint32_t perms,
uint32_t perms, uint32_t audit, dfaflags_t flags) uint32_t audit, dfaflags_t flags)
{ {
return aare_add_rule_vec(rules, deny, perms, audit, 1, &rule, flags); return add_rule_vec(deny, perms, audit, 1, &rule, flags);
} }
#define FLAGS_WIDTH 2 #define FLAGS_WIDTH 2
@ -94,8 +76,7 @@ void aare_reset_matchflags(void)
#undef RESET_FLAGS #undef RESET_FLAGS
} }
int aare_add_rule_vec(aare_ruleset_t *rules, int deny, bool aare_rules::add_rule_vec(int deny, uint32_t perms, uint32_t audit,
uint32_t perms, uint32_t audit,
int count, const char **rulev, dfaflags_t flags) int count, const char **rulev, dfaflags_t flags)
{ {
Node *tree = NULL, *accept; Node *tree = NULL, *accept;
@ -105,15 +86,15 @@ int aare_add_rule_vec(aare_ruleset_t *rules, int deny,
assert(perms != 0); assert(perms != 0);
if (regex_parse(&tree, rulev[0])) if (regex_parse(&tree, rulev[0]))
return 0; return false;
for (int i = 1; i < count; i++) { for (int i = 1; i < count; i++) {
Node *subtree = NULL; Node *subtree = NULL;
Node *node = new CharNode(0); Node *node = new CharNode(0);
if (!node) if (!node)
return 0; return false;
tree = new CatNode(tree, node); tree = new CatNode(tree, node);
if (regex_parse(&subtree, rulev[i])) if (regex_parse(&subtree, rulev[i]))
return 0; return false;
tree = new CatNode(tree, subtree); tree = new CatNode(tree, subtree);
} }
@ -132,25 +113,14 @@ int aare_add_rule_vec(aare_ruleset_t *rules, int deny,
exact_match = 0; exact_match = 0;
} }
if (rules->reverse) if (reverse)
flip_tree(tree); flip_tree(tree);
/* 0x7f == 4 bits x mods + 1 bit unsafe mask + 1 bit ix, + 1 pux after shift */ /* 0x7f == 4 bits x mods + 1 bit unsafe mask + 1 bit ix, + 1 pux after shift */
#define EXTRACT_X_INDEX(perm, shift) (((perm) >> (shift + 7)) & 0x7f) #define EXTRACT_X_INDEX(perm, shift) (((perm) >> (shift + 7)) & 0x7f)
//if (perms & ALL_AA_EXEC_TYPE && (!perms & AA_EXEC_BITS))
// fprintf(stderr, "adding X rule without MAY_EXEC: 0x%x %s\n", perms, rulev[0]);
//if (perms & ALL_EXEC_TYPE) /* the permissions set is assumed to be non-empty if any audit
// fprintf(stderr, "adding X rule %s 0x%x\n", rulev[0], perms);
//if (audit)
//fprintf(stderr, "adding rule with audit bits set: 0x%x %s\n", audit, rulev[0]);
//if (perms & AA_CHANGE_HAT)
// fprintf(stderr, "adding change_hat rule %s\n", rulev[0]);
/* the permissions set is assumed to be non-empty if any audit
* bits are specified */ * bits are specified */
accept = NULL; accept = NULL;
for (unsigned int n = 0; perms && n < (sizeof(perms) * 8); n++) { for (unsigned int n = 0; perms && n < (sizeof(perms) * 8); n++) {
@ -230,44 +200,44 @@ int aare_add_rule_vec(aare_ruleset_t *rules, int deny,
cerr << "\n\n"; cerr << "\n\n";
} }
if (rules->root) if (root)
rules->root = new AltNode(rules->root, new CatNode(tree, accept)); root = new AltNode(root, new CatNode(tree, accept));
else else
rules->root = new CatNode(tree, accept); root = new CatNode(tree, accept);
return 1; rule_count++;
return true;
} }
/* create a dfa from the ruleset /* create a dfa from the ruleset
* returns: buffer contain dfa tables, @size set to the size of the tables * returns: buffer contain dfa tables, @size set to the size of the tables
* else NULL on failure * else NULL on failure
*/ */
void *aare_create_dfa(aare_ruleset_t *rules, size_t *size, void *aare_rules::create_dfa(size_t *size, dfaflags_t flags)
dfaflags_t flags)
{ {
char *buffer = NULL; char *buffer = NULL;
label_nodes(rules->root); label_nodes(root);
if (flags & DFA_DUMP_TREE) { if (flags & DFA_DUMP_TREE) {
cerr << "\nDFA: Expression Tree\n"; cerr << "\nDFA: Expression Tree\n";
rules->root->dump(cerr); root->dump(cerr);
cerr << "\n\n"; cerr << "\n\n";
} }
if (flags & DFA_CONTROL_TREE_SIMPLE) { if (flags & DFA_CONTROL_TREE_SIMPLE) {
rules->root = simplify_tree(rules->root, flags); root = simplify_tree(root, flags);
if (flags & DFA_DUMP_SIMPLE_TREE) { if (flags & DFA_DUMP_SIMPLE_TREE) {
cerr << "\nDFA: Simplified Expression Tree\n"; cerr << "\nDFA: Simplified Expression Tree\n";
rules->root->dump(cerr); root->dump(cerr);
cerr << "\n\n"; cerr << "\n\n";
} }
} }
stringstream stream; stringstream stream;
try { try {
DFA dfa(rules->root, flags); DFA dfa(root, flags);
if (flags & DFA_DUMP_UNIQ_PERMS) if (flags & DFA_DUMP_UNIQ_PERMS)
dfa.dump_uniq_perms("dfa"); dfa.dump_uniq_perms("dfa");

32
parser/libapparmor_re/aare_rules.h
View File

@ -24,26 +24,24 @@
#include <stdint.h> #include <stdint.h>
#include "apparmor_re.h" #include "apparmor_re.h"
#include "expr-tree.h"
#ifdef __cplusplus class aare_rules {
extern "C" { Node *root;
#endif public:
int reverse;
int rule_count;
aare_rules(): root(NULL), reverse(0), rule_count(0) { };
aare_rules(int reverse): root(NULL), reverse(reverse), rule_count(0) { };
~aare_rules();
struct aare_ruleset; bool add_rule(const char *rule, int deny, uint32_t perms,
typedef struct aare_ruleset aare_ruleset_t;
aare_ruleset_t *aare_new_ruleset(int reverse);
void aare_delete_ruleset(aare_ruleset_t *rules);
int aare_add_rule(aare_ruleset_t *rules, const char *rule, int deny, uint32_t perms,
uint32_t audit, dfaflags_t flags); uint32_t audit, dfaflags_t flags);
int aare_add_rule_vec(aare_ruleset_t *rules, int deny, uint32_t perms, bool add_rule_vec(int deny, uint32_t perms, uint32_t audit, int count,
uint32_t audit, int count, const char **rulev, const char **rulev, dfaflags_t flags);
dfaflags_t flags); void *create_dfa(size_t *size, dfaflags_t flags);
void *aare_create_dfa(aare_ruleset_t *rules, size_t *size, dfaflags_t flags); };
void aare_reset_matchflags(void); void aare_reset_matchflags(void);
#ifdef __cplusplus
}
#endif
#endif /* __LIBAA_RE_RULES_H */ #endif /* __LIBAA_RE_RULES_H */

31
parser/mount.c
View File

@ -629,7 +629,7 @@ int mnt_rule::gen_policy_re(Profile &prof)
tmpallow = allow; tmpallow = allow;
/* rule for match without required data || data MATCH_CONT */ /* rule for match without required data || data MATCH_CONT */
if (!aare_add_rule_vec(prof.policy.rules, deny, tmpallow, if (!prof.policy.rules->add_rule_vec(deny, tmpallow,
audit | AA_AUDIT_MNT_DATA, 4, audit | AA_AUDIT_MNT_DATA, 4,
vec, dfaflags)) vec, dfaflags))
goto fail; goto fail;
@ -641,8 +641,7 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!build_mnt_opts(optsbuf, opts)) if (!build_mnt_opts(optsbuf, opts))
goto fail; goto fail;
vec[4] = optsbuf.c_str(); vec[4] = optsbuf.c_str();
if (!aare_add_rule_vec(prof.policy.rules, deny, if (!prof.policy.rules->add_rule_vec(deny, allow,
allow,
audit | AA_AUDIT_MNT_DATA, audit | AA_AUDIT_MNT_DATA,
5, vec, dfaflags)) 5, vec, dfaflags))
goto fail; goto fail;
@ -672,8 +671,8 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags)) if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags))
goto fail; goto fail;
vec[3] = flagsbuf; vec[3] = flagsbuf;
if (!aare_add_rule_vec(prof.policy.rules, deny, allow, if (!prof.policy.rules->add_rule_vec(deny, allow, audit, 4, vec,
audit, 4, vec, dfaflags)) dfaflags))
goto fail; goto fail;
count++; count++;
} }
@ -701,8 +700,8 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags)) if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags))
goto fail; goto fail;
vec[3] = flagsbuf; vec[3] = flagsbuf;
if (!aare_add_rule_vec(prof.policy.rules, deny, allow, if (!prof.policy.rules->add_rule_vec(deny, allow, audit, 4, vec,
audit, 4, vec, dfaflags)) dfaflags))
goto fail; goto fail;
count++; count++;
} }
@ -731,8 +730,8 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags)) if (!build_mnt_flags(flagsbuf, PATH_MAX, tmpflags, tmpinv_flags))
goto fail; goto fail;
vec[3] = flagsbuf; vec[3] = flagsbuf;
if (!aare_add_rule_vec(prof.policy.rules, deny, allow, if (!prof.policy.rules->add_rule_vec(deny, allow, audit, 4, vec,
audit, 4, vec, dfaflags)) dfaflags))
goto fail; goto fail;
count++; count++;
} }
@ -771,7 +770,7 @@ int mnt_rule::gen_policy_re(Profile &prof)
tmpallow = allow; tmpallow = allow;
/* rule for match without required data || data MATCH_CONT */ /* rule for match without required data || data MATCH_CONT */
if (!aare_add_rule_vec(prof.policy.rules, deny, tmpallow, if (!prof.policy.rules->add_rule_vec(deny, tmpallow,
audit | AA_AUDIT_MNT_DATA, 4, audit | AA_AUDIT_MNT_DATA, 4,
vec, dfaflags)) vec, dfaflags))
goto fail; goto fail;
@ -783,8 +782,7 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!build_mnt_opts(optsbuf, opts)) if (!build_mnt_opts(optsbuf, opts))
goto fail; goto fail;
vec[4] = optsbuf.c_str(); vec[4] = optsbuf.c_str();
if (!aare_add_rule_vec(prof.policy.rules, deny, if (!prof.policy.rules->add_rule_vec(deny, allow,
allow,
audit | AA_AUDIT_MNT_DATA, audit | AA_AUDIT_MNT_DATA,
5, vec, dfaflags)) 5, vec, dfaflags))
goto fail; goto fail;
@ -797,8 +795,8 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!convert_entry(mntbuf, mnt_point)) if (!convert_entry(mntbuf, mnt_point))
goto fail; goto fail;
vec[0] = mntbuf.c_str(); vec[0] = mntbuf.c_str();
if (!aare_add_rule_vec(prof.policy.rules, deny, allow, if (!prof.policy.rules->add_rule_vec(deny, allow, audit, 1, vec,
audit, 1, vec, dfaflags)) dfaflags))
goto fail; goto fail;
count++; count++;
} }
@ -811,8 +809,8 @@ int mnt_rule::gen_policy_re(Profile &prof)
if (!clear_and_convert_entry(devbuf, device)) if (!clear_and_convert_entry(devbuf, device))
goto fail; goto fail;
vec[1] = devbuf.c_str(); vec[1] = devbuf.c_str();
if (!aare_add_rule_vec(prof.policy.rules, deny, allow, if (!prof.policy.rules->add_rule_vec(deny, allow, audit, 2, vec,
audit, 2, vec, dfaflags)) dfaflags))
goto fail; goto fail;
count++; count++;
} }
@ -821,7 +819,6 @@ int mnt_rule::gen_policy_re(Profile &prof)
/* didn't actually encode anything */ /* didn't actually encode anything */
goto fail; goto fail;
prof.policy.count++;
return RULE_OK; return RULE_OK;
fail: fail:

69
parser/parser_regex.c
View File

@ -431,11 +431,11 @@ static int process_profile_name_xmatch(Profile *prof)
prof->xmatch_size = 0; prof->xmatch_size = 0;
} else { } else {
/* build a dfa */ /* build a dfa */
aare_ruleset_t *rule = aare_new_ruleset(0); aare_rules *rules = new aare_rules();
if (!rule) if (!rules)
return FALSE; return FALSE;
if (!aare_add_rule(rule, tbuf.c_str(), 0, AA_MAY_EXEC, 0, dfaflags)) { if (!rules->add_rule(tbuf.c_str(), 0, AA_MAY_EXEC, 0, dfaflags)) {
aare_delete_ruleset(rule); delete rules;
return FALSE; return FALSE;
} }
if (prof->altnames) { if (prof->altnames) {
@ -450,15 +450,14 @@ static int process_profile_name_xmatch(Profile *prof)
len = strlen(alt->name); len = strlen(alt->name);
if (len < prof->xmatch_len) if (len < prof->xmatch_len)
prof->xmatch_len = len; prof->xmatch_len = len;
if (!aare_add_rule(rule, tbuf.c_str(), 0, AA_MAY_EXEC, 0, dfaflags)) { if (!rules->add_rule(tbuf.c_str(), 0, AA_MAY_EXEC, 0, dfaflags)) {
aare_delete_ruleset(rule); delete rules;
return FALSE; return FALSE;
} }
} }
} }
prof->xmatch = aare_create_dfa(rule, &prof->xmatch_size, prof->xmatch = rules->create_dfa(&prof->xmatch_size, dfaflags);
dfaflags); delete rules;
aare_delete_ruleset(rule);
if (!prof->xmatch) if (!prof->xmatch)
return FALSE; return FALSE;
} }
@ -466,7 +465,7 @@ static int process_profile_name_xmatch(Profile *prof)
return TRUE; return TRUE;
} }
static int process_dfa_entry(aare_ruleset_t *dfarules, struct cod_entry *entry) static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
{ {
std::string tbuf; std::string tbuf;
pattern_t ptype; pattern_t ptype;
@ -498,12 +497,12 @@ static int process_dfa_entry(aare_ruleset_t *dfarules, struct cod_entry *entry)
* entry of the pair * entry of the pair
*/ */
if (entry->deny && (entry->mode & AA_LINK_BITS)) { if (entry->deny && (entry->mode & AA_LINK_BITS)) {
if (!aare_add_rule(dfarules, tbuf.c_str(), entry->deny, if (!dfarules->add_rule(tbuf.c_str(), entry->deny,
entry->mode & ~AA_LINK_BITS, entry->mode & ~AA_LINK_BITS,
entry->audit & ~AA_LINK_BITS, dfaflags)) entry->audit & ~AA_LINK_BITS, dfaflags))
return FALSE; return FALSE;
} else if (entry->mode & ~AA_CHANGE_PROFILE) { } else if (entry->mode & ~AA_CHANGE_PROFILE) {
if (!aare_add_rule(dfarules, tbuf.c_str(), entry->deny, entry->mode, if (!dfarules->add_rule(tbuf.c_str(), entry->deny, entry->mode,
entry->audit, dfaflags)) entry->audit, dfaflags))
return FALSE; return FALSE;
} }
@ -526,7 +525,7 @@ static int process_dfa_entry(aare_ruleset_t *dfarules, struct cod_entry *entry)
perms |= LINK_TO_LINK_SUBSET(perms); perms |= LINK_TO_LINK_SUBSET(perms);
vec[1] = "/[^/].*"; vec[1] = "/[^/].*";
} }
if (!aare_add_rule_vec(dfarules, entry->deny, perms, entry->audit & AA_LINK_BITS, 2, vec, dfaflags)) if (!dfarules->add_rule_vec(entry->deny, perms, entry->audit & AA_LINK_BITS, 2, vec, dfaflags))
return FALSE; return FALSE;
} }
if (entry->mode & AA_CHANGE_PROFILE) { if (entry->mode & AA_CHANGE_PROFILE) {
@ -545,12 +544,12 @@ static int process_dfa_entry(aare_ruleset_t *dfarules, struct cod_entry *entry)
vec[index++] = tbuf.c_str(); vec[index++] = tbuf.c_str();
/* regular change_profile rule */ /* regular change_profile rule */
if (!aare_add_rule_vec(dfarules, 0, AA_CHANGE_PROFILE | AA_ONEXEC, 0, index - 1, &vec[1], dfaflags)) if (!dfarules->add_rule_vec(0, AA_CHANGE_PROFILE | AA_ONEXEC, 0, index - 1, &vec[1], dfaflags))
return FALSE; return FALSE;
/* onexec rules - both rules are needed for onexec */ /* onexec rules - both rules are needed for onexec */
if (!aare_add_rule_vec(dfarules, 0, AA_ONEXEC, 0, 1, vec, dfaflags)) if (!dfarules->add_rule_vec(0, AA_ONEXEC, 0, 1, vec, dfaflags))
return FALSE; return FALSE;
if (!aare_add_rule_vec(dfarules, 0, AA_ONEXEC, 0, index, vec, dfaflags)) if (!dfarules->add_rule_vec(0, AA_ONEXEC, 0, index, vec, dfaflags))
return FALSE; return FALSE;
} }
return TRUE; return TRUE;
@ -560,15 +559,12 @@ int post_process_entries(Profile *prof)
{ {
int ret = TRUE; int ret = TRUE;
struct cod_entry *entry; struct cod_entry *entry;
int count = 0;
list_for_each(prof->entries, entry) { list_for_each(prof->entries, entry) {
if (!process_dfa_entry(prof->dfa.rules, entry)) if (!process_dfa_entry(prof->dfa.rules, entry))
ret = FALSE; ret = FALSE;
count++;
} }
prof->dfa.count = count;
return ret; return ret;
} }
@ -579,17 +575,17 @@ int process_profile_regex(Profile *prof)
if (!process_profile_name_xmatch(prof)) if (!process_profile_name_xmatch(prof))
goto out; goto out;
prof->dfa.rules = aare_new_ruleset(0); prof->dfa.rules = new aare_rules();
if (!prof->dfa.rules) if (!prof->dfa.rules)
goto out; goto out;
if (!post_process_entries(prof)) if (!post_process_entries(prof))
goto out; goto out;
if (prof->dfa.count > 0) { if (prof->dfa.rules->rule_count > 0) {
prof->dfa.dfa = aare_create_dfa(prof->dfa.rules, &prof->dfa.size, prof->dfa.dfa = prof->dfa.rules->create_dfa(&prof->dfa.size,
dfaflags); dfaflags);
aare_delete_ruleset(prof->dfa.rules); delete prof->dfa.rules;
prof->dfa.rules = NULL; prof->dfa.rules = NULL;
if (!prof->dfa.dfa) if (!prof->dfa.dfa)
goto out; goto out;
@ -683,7 +679,7 @@ int process_profile_policydb(Profile *prof)
{ {
int error = -1; int error = -1;
prof->policy.rules = aare_new_ruleset(0); prof->policy.rules = new aare_rules();
if (!prof->policy.rules) if (!prof->policy.rules)
goto out; goto out;
@ -694,26 +690,21 @@ int process_profile_policydb(Profile *prof)
* to be supported * to be supported
*/ */
if (kernel_supports_mount) { if (kernel_supports_mount &&
if (!aare_add_rule(prof->policy.rules, mediates_mount, 0, AA_MAY_READ, 0, dfaflags)) !prof->policy.rules->add_rule(mediates_mount, 0, AA_MAY_READ, 0, dfaflags))
goto out; goto out;
prof->policy.count++; if (kernel_supports_dbus &&
} !prof->policy.rules->add_rule(mediates_dbus, 0, AA_MAY_READ, 0, dfaflags))
if (kernel_supports_dbus) {
if (!aare_add_rule(prof->policy.rules, mediates_dbus, 0, AA_MAY_READ, 0, dfaflags))
goto out; goto out;
prof->policy.count++; if (prof->policy.rules->rule_count > 0) {
} prof->policy.dfa = prof->policy.rules->create_dfa(&prof->policy.size, dfaflags);
if (prof->policy.count > 0) { delete prof->policy.rules;
prof->policy.dfa = aare_create_dfa(prof->policy.rules,
&prof->policy.size,
dfaflags);
aare_delete_ruleset(prof->policy.rules);
prof->policy.rules = NULL; prof->policy.rules = NULL;
if (!prof->policy.dfa) if (!prof->policy.dfa)
goto out; goto out;
} else { } else {
aare_delete_ruleset(prof->policy.rules); delete prof->policy.rules;
prof->policy.rules = NULL; prof->policy.rules = NULL;
} }
@ -722,7 +713,7 @@ int process_profile_policydb(Profile *prof)
error = 0; error = 0;
out: out:
aare_delete_ruleset(prof->policy.rules); delete prof->policy.rules;
prof->policy.rules = NULL; prof->policy.rules = NULL;
return error; return error;

4
parser/profile.cc
View File

@ -67,11 +67,11 @@ Profile::~Profile()
for (RuleList::iterator i = rule_ents.begin(); i != rule_ents.end(); i++) for (RuleList::iterator i = rule_ents.begin(); i != rule_ents.end(); i++)
delete *i; delete *i;
if (dfa.rules) if (dfa.rules)
aare_delete_ruleset(dfa.rules); delete dfa.rules;
if (dfa.dfa) if (dfa.dfa)
free(dfa.dfa); free(dfa.dfa);
if (policy.rules) if (policy.rules)
aare_delete_ruleset(policy.rules); delete policy.rules;
if (policy.dfa) if (policy.dfa)
free(policy.dfa); free(policy.dfa);
if (xmatch) if (xmatch)

6
parser/profile.h
View File

@ -18,6 +18,7 @@
#include "parser.h" #include "parser.h"
#include "rule.h" #include "rule.h"
#include "libapparmor_re/aare_rules.h"
class Profile; class Profile;
@ -120,12 +121,11 @@ struct network {
}; };
struct dfa_stuff { struct dfa_stuff {
aare_ruleset_t *rules; aare_rules *rules;
int count;
void *dfa; void *dfa;
size_t size; size_t size;
dfa_stuff(void): rules(NULL), count(0), dfa(NULL), size(0) { } dfa_stuff(void): rules(NULL), dfa(NULL), size(0) { }
}; };
class Profile { class Profile {