mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
4be07c3265
tree. It is limited in that it doesn't currently handle the permissions of a rule.
conversion output presents an aare -> prce conversion followed by 1 or more expression
tree rules, governed by what the rule does.
eg.
aare: /** -> /[^/\x00][^\x00]*
rule: /[^/\x00][^\x00]* -> /[^\0000/]([^\0000])*
eg.
echo "/foo { /** rwlkmix, } " | ./apparmor_parser -QT -D rule-exprs -D expr-tree
aare: /foo -> /foo
aare: /** -> /[^/\x00][^\x00]*
rule: /[^/\x00][^\x00]* -> /[^\0000/]([^\0000])*
rule: /[^/\x00][^\x00]*\x00/[^/].* -> /[^\0000/]([^\0000])*\0000/[^/](.)*
DFA: Expression Tree
(/[^\0000/]([^\0000])*(((((((((((((<513>|<2>)|<4>)|<8>)|<16>)|<32>)|<64>)|<8404992>)|<32768>)|<65536>)|<131072>)|<262144>)|<524288>)|<1048576>)|/[^\0000/]([^\0000])*\0000/[^/](.)*((<16>|<32>)|<262144>))
This simple example shows many things
1. The profile name under goes pcre conversion. But since no regular expressions where found
it doesn't generate any expr rules
2. /** is converted into the pcre expression /[^\0000/]([^\0000])*
3. The pcre expression /[^\0000/]([^\0000])* is converted into two rules that are then
converted into expression trees.
The reason for this can not be seen by the output as this is actually triggered by
permissions separation for the rule. In this case the link permission is separated
into what is shown as the second rule: statement.
4. DFA: Expression Tree dump shows how these rules are combined together
You will notice that the rule conversion statement is fairly redundant currently as it just
show pcre to expression tree pcre. This will change when direct aare parsing occurs,
but currently serves to verify the pcre conversion step.
It is not the prettiest patch, as its touching some ugly code that is schedule to be cleaned
up/replaced. eg. convert_aaregex_to_pcre is going to replaced with native parse conversion
from an aare straight to the expression tree, and dfaflag passing will become part of the
rule set.
63 lines
1.7 KiB
C
63 lines
1.7 KiB
C
/* $Id$
|
|
*
|
|
* Copyright (c) 2003, 2004, 2005, 2006, 2007 Novell, Inc.
|
|
* (All rights reserved)
|
|
*
|
|
* The libapparmor library is licensed under the terms of the GNU
|
|
* Lesser General Public License, version 2.1. Please see the file
|
|
* COPYING.LGPL.
|
|
*/
|
|
|
|
#ifndef APPARMOR_RE_H
|
|
#define APPARMOR_RE_H
|
|
|
|
typedef enum dfaflags {
|
|
DFA_CONTROL_EQUIV = 1 << 0,
|
|
DFA_CONTROL_NO_TREE_NORMAL = 1 << 1,
|
|
DFA_CONTROL_NO_TREE_SIMPLE = 1 << 2,
|
|
DFA_CONTROL_TREE_LEFT = 1 << 3,
|
|
DFA_CONTROL_NO_MINIMIZE = 1 << 4,
|
|
DFA_CONTROL_NO_HASH_PART = 1 << 5,
|
|
DFA_CONTROL_NO_UNREACHABLE = 1 << 6,
|
|
DFA_CONTROL_TRANS_HIGH = 1 << 7,
|
|
|
|
DFA_DUMP_TREE_STATS = 1 << 8,
|
|
DFA_DUMP_TREE = 1 << 9,
|
|
DFA_DUMP_SIMPLE_TREE = 1 << 10,
|
|
DFA_DUMP_PROGRESS = 1 << 11,
|
|
DFA_DUMP_STATS = 1 << 12,
|
|
DFA_DUMP_STATES = 1 << 13,
|
|
DFA_DUMP_GRAPH = 1 << 14,
|
|
DFA_DUMP_TRANS_PROGRESS = 1 << 15,
|
|
DFA_DUMP_TRANS_STATS = 1 << 16,
|
|
DFA_DUMP_TRANS_TABLE = 1 << 17,
|
|
DFA_DUMP_EQUIV = 1 << 18,
|
|
DFA_DUMP_EQUIV_STATS = 1 << 19,
|
|
DFA_DUMP_MINIMIZE = 1 << 20,
|
|
DFA_DUMP_UNREACHABLE = 1 << 22,
|
|
DFA_DUMP_RULE_EXPR = 1 << 23,
|
|
} dfaflags_t;
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
struct aare_ruleset;
|
|
|
|
typedef struct aare_ruleset aare_ruleset_t;
|
|
|
|
aare_ruleset_t *aare_new_ruleset(int reverse);
|
|
void aare_delete_ruleset(aare_ruleset_t *rules);
|
|
int aare_add_rule(aare_ruleset_t *rules, char *rule, int deny,
|
|
uint32_t perms, uint32_t audit, dfaflags_t flags);
|
|
int aare_add_rule_vec(aare_ruleset_t *rules, int deny, uint32_t perms,
|
|
uint32_t audit, int count, char **rulev, dfaflags_t flags);
|
|
void *aare_create_dfa(aare_ruleset_t *rules, size_t *size, dfaflags_t flags);
|
|
void aare_reset_matchflags(void);
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif /* APPARMOR_RE_H */
|