From f9cae8b1b7ddcc6f33c7b9f04fea654b0d1c47a1 Mon Sep 17 00:00:00 2001 From: Christian Boltz Date: Mon, 6 Jul 2015 14:45:59 +0200 Subject: [PATCH] Improve validate_profile_mode() and drop PROFILE_MODE_NT_RE The only difference between PROFILE_MODE_RE and PROFILE_MODE_NT_RE was that the latter one additionally allowed 'x', which looks wrong. (Standalone 'x' is ok for deny rules, but those are handled by PROFILE_MODE_DENY_RE.) This patch completely drops PROFILE_MODE_NT_RE and the related code in validate_profile_mode(). Also wrap the two remaining regexes in '^(...)+$' instead of doing it inside validate_profile_mode(). This makes the code more readable and also results in a 2% performance improvement when parsing profiles. Acked-by: Steve Beattie for trunk and 2.9. --- utils/apparmor/aa.py | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/utils/apparmor/aa.py b/utils/apparmor/aa.py index 74194078d..ea66a864d 100644 --- a/utils/apparmor/aa.py +++ b/utils/apparmor/aa.py @@ -2422,28 +2422,18 @@ def collapse_log(): if not is_known_rule(aa[profile][hat], 'network', NetworkRule(family, sock_type)): log_dict[aamode][profile][hat]['netdomain'][family][sock_type] = True -PROFILE_MODE_RE = re.compile('r|w|l|m|k|a|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix') -PROFILE_MODE_NT_RE = re.compile('r|w|l|m|k|a|x|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix') -PROFILE_MODE_DENY_RE = re.compile('r|w|l|m|k|a|x') +PROFILE_MODE_RE = re.compile('^(r|w|l|m|k|a|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix)+$') +PROFILE_MODE_DENY_RE = re.compile('^(r|w|l|m|k|a|x)+$') def validate_profile_mode(mode, allow, nt_name=None): if allow == 'deny': - pattern = '^(%s)+$' % PROFILE_MODE_DENY_RE.pattern - if re.search(pattern, mode): - return True - else: - return False - - elif nt_name: - pattern = '^(%s)+$' % PROFILE_MODE_NT_RE.pattern - if re.search(pattern, mode): + if PROFILE_MODE_DENY_RE.search(mode): return True else: return False else: - pattern = '^(%s)+$' % PROFILE_MODE_RE.pattern - if re.search(pattern, mode): + if PROFILE_MODE_RE.search(mode): return True else: return False