mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 07:54:17 +01:00
111 lines
2.3 KiB
Go
111 lines
2.3 KiB
Go
// apparmor.d - Full set of apparmor profiles
|
|
// Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
package aa
|
|
|
|
import (
|
|
"fmt"
|
|
"slices"
|
|
"strings"
|
|
)
|
|
|
|
const MQUEUE Kind = "mqueue"
|
|
|
|
func init() {
|
|
requirements[MQUEUE] = requirement{
|
|
"access": []string{
|
|
"r", "w", "rw", "read", "write", "create", "open",
|
|
"delete", "getattr", "setattr",
|
|
},
|
|
"type": []string{"posix", "sysv"},
|
|
}
|
|
}
|
|
|
|
type Mqueue struct {
|
|
RuleBase
|
|
Qualifier
|
|
Access []string
|
|
Type string
|
|
Label string
|
|
Name string
|
|
}
|
|
|
|
func newMqueue(q Qualifier, rule rule) (Rule, error) {
|
|
access, name := "", ""
|
|
r := rule.GetSlice()
|
|
size := len(r)
|
|
if size > 0 {
|
|
access = strings.Join(r[:size-1], " ")
|
|
name = r[size-1]
|
|
if slices.Contains(requirements[MQUEUE]["access"], name) {
|
|
access += " " + name
|
|
}
|
|
}
|
|
accesses, err := toAccess(MQUEUE, access)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &Mqueue{
|
|
RuleBase: newBase(rule),
|
|
Qualifier: q,
|
|
Access: accesses,
|
|
Type: rule.GetValuesAsString("type"),
|
|
Label: rule.GetValuesAsString("label"),
|
|
Name: name,
|
|
}, nil
|
|
}
|
|
|
|
func newMqueueFromLog(log map[string]string) Rule {
|
|
mqueueType := "posix"
|
|
if strings.Contains(log["class"], "posix") {
|
|
mqueueType = "posix"
|
|
} else if strings.Contains(log["class"], "sysv") {
|
|
mqueueType = "sysv"
|
|
}
|
|
return &Mqueue{
|
|
RuleBase: newBaseFromLog(log),
|
|
Qualifier: newQualifierFromLog(log),
|
|
Access: Must(toAccess(MQUEUE, log["requested"])),
|
|
Type: mqueueType,
|
|
Label: log["label"],
|
|
Name: log["name"],
|
|
}
|
|
}
|
|
|
|
func (r *Mqueue) Validate() error {
|
|
if err := validateValues(r.Kind(), "access", r.Access); err != nil {
|
|
return fmt.Errorf("%s: %w", r, err)
|
|
}
|
|
if err := validateValues(r.Kind(), "type", []string{r.Type}); err != nil {
|
|
return fmt.Errorf("%s: %w", r, err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (r *Mqueue) Compare(other Rule) int {
|
|
o, _ := other.(*Mqueue)
|
|
if res := compare(r.Access, o.Access); res != 0 {
|
|
return res
|
|
}
|
|
if res := compare(r.Type, o.Type); res != 0 {
|
|
return res
|
|
}
|
|
if res := compare(r.Label, o.Label); res != 0 {
|
|
return res
|
|
}
|
|
return r.Qualifier.Compare(o.Qualifier)
|
|
}
|
|
|
|
func (r *Mqueue) String() string {
|
|
return renderTemplate(r.Kind(), r)
|
|
}
|
|
|
|
func (r *Mqueue) Constraint() constraint {
|
|
return blockKind
|
|
}
|
|
|
|
func (r *Mqueue) Kind() Kind {
|
|
return MQUEUE
|
|
}
|