2006-04-11 21:52:54 +00:00
|
|
|
# ----------------------------------------------------------------------
|
2007-04-11 08:12:51 +00:00
|
|
|
# Copyright (c) 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007
|
|
|
|
|
# NOVELL (All rights reserved)
|
2006-04-11 21:52:54 +00:00
|
|
|
#
|
2018-03-18 17:50:57 +01:00
|
|
|
# Copyright (c) Christian Boltz 2018
|
|
|
|
|
#
|
2006-04-11 21:52:54 +00:00
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
|
# License published by the Free Software Foundation.
|
|
|
|
|
#
|
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
|
#
|
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
|
# along with this program; if not, contact Novell, Inc.
|
|
|
|
|
# ----------------------------------------------------------------------
|
|
|
|
|
NAME=apparmor-parser
|
|
|
|
|
all:
|
2006-04-12 03:09:10 +00:00
|
|
|
COMMONDIR=../common/
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2015-01-23 15:52:09 -08:00
|
|
|
include $(COMMONDIR)/Make.rules
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
DESTDIR=/
|
|
|
|
|
APPARMOR_BIN_PREFIX=${DESTDIR}/lib/apparmor
|
2018-05-01 00:22:45 +02:00
|
|
|
SBINDIR=${DESTDIR}/sbin
|
|
|
|
|
USR_SBINDIR=${DESTDIR}/usr/sbin
|
2018-03-18 17:50:57 +01:00
|
|
|
SYSTEMD_UNIT_DIR=${DESTDIR}/usr/lib/systemd/system
|
2006-04-11 21:52:54 +00:00
|
|
|
CONFDIR=/etc/apparmor
|
|
|
|
|
INSTALL_CONFDIR=${DESTDIR}${CONFDIR}
|
|
|
|
|
LOCALEDIR=/usr/share/locale
|
2018-12-17 14:49:53 -08:00
|
|
|
MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 aa-teardown.8 apparmor_xattrs.7
|
2006-04-11 21:52:54 +00:00
|
|
|
|
parser: fix bison error message output when built against bison 3.6+
bison change the default text past to yerror in bison 3.6, this
breaks make check as some tests are comparing against the error
output
======================================================================
FAIL: test_modefail (__main__.AAErrorTests)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/jj/apparmor.git/parser/tst/testlib.py", line 50, in new_unittest_func
return unittest_func(self)
File "./errors.py", line 58, in test_modefail
self._run_test(
File "./errors.py", line 40, in _run_test
self.assertIn(message, outerr, report)
AssertionError: 'AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error, unexpected TOK_ID, expecting TOK_MODE' not found in 'AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error\n' :
Command: ../apparmor_parser --config-file=./parser.conf -S -I errors errors/modefail.sd
Exit value:1
STDERR
AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error
To fix this we need to add
define parse.error=verbose
to bison. Unfortunately define parse.error was only added in bison 3.0
and and older versions of bison will break if that is defined in
parser_yacc.y
Instead test for the version of bison available and set define parse.error
as a build flag if supported by the version of bison being called.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/640
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
2020-09-30 14:55:29 -07:00
|
|
|
# Test for bison version
|
|
|
|
|
# parse.error added in version 3.0
|
|
|
|
|
# default behavior changed in version 3.6
|
|
|
|
|
# parse.error=verbose supported from 3.0 so just test on that
|
|
|
|
|
# TODO move to autoconf
|
|
|
|
|
BISON_MAJOR:=$(shell bison --version | awk '/^bison/ { print ($$NF) }' | awk -F. '{print $$1 }')
|
|
|
|
|
USE_PARSE_ERROR:=$(shell test ${BISON_MAJOR} -ge 3 && echo true)
|
|
|
|
|
|
2018-10-04 23:15:28 -07:00
|
|
|
YACC := bison
|
2006-04-11 21:52:54 +00:00
|
|
|
YFLAGS := -d
|
parser: fix bison error message output when built against bison 3.6+
bison change the default text past to yerror in bison 3.6, this
breaks make check as some tests are comparing against the error
output
======================================================================
FAIL: test_modefail (__main__.AAErrorTests)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/home/jj/apparmor.git/parser/tst/testlib.py", line 50, in new_unittest_func
return unittest_func(self)
File "./errors.py", line 58, in test_modefail
self._run_test(
File "./errors.py", line 40, in _run_test
self.assertIn(message, outerr, report)
AssertionError: 'AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error, unexpected TOK_ID, expecting TOK_MODE' not found in 'AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error\n' :
Command: ../apparmor_parser --config-file=./parser.conf -S -I errors errors/modefail.sd
Exit value:1
STDERR
AppArmor parser error for errors/modefail.sd in profile errors/modefail.sd at line 6: syntax error
To fix this we need to add
define parse.error=verbose
to bison. Unfortunately define parse.error was only added in bison 3.0
and and older versions of bison will break if that is defined in
parser_yacc.y
Instead test for the version of bison available and set define parse.error
as a build flag if supported by the version of bison being called.
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/640
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
2020-09-30 14:55:29 -07:00
|
|
|
ifeq ($(USE_PARSE_ERROR),true)
|
|
|
|
|
YFLAGS+=--define=parse.error=verbose
|
|
|
|
|
endif
|
2018-10-04 23:15:28 -07:00
|
|
|
LEX := flex
|
2006-04-11 21:52:54 +00:00
|
|
|
LEXFLAGS = -B -v
|
2020-04-21 16:54:56 -07:00
|
|
|
ifndef DEBUG
|
|
|
|
|
LEXFLAGS += --noyy_top_state
|
|
|
|
|
endif
|
|
|
|
|
|
2020-09-29 11:42:32 -07:00
|
|
|
CPPFLAGS += -D_GNU_SOURCE
|
|
|
|
|
|
|
|
|
|
STDLIB_INCLUDE:="\#include <stdlib.h>"
|
2021-02-16 03:46:57 -08:00
|
|
|
HAVE_REALLOCARRAY:=$(shell echo $(STDLIB_INCLUDE) | ${CPP} ${CPPFLAGS} - - | grep -q reallocarray && echo true)
|
2020-09-29 11:42:32 -07:00
|
|
|
|
2010-11-09 13:39:18 -08:00
|
|
|
WARNINGS = -Wall
|
2020-05-28 09:55:31 -07:00
|
|
|
CXX_WARNINGS = ${WARNINGS} ${EXTRA_WARNINGS}
|
2013-09-27 16:13:22 -07:00
|
|
|
CPP_WARNINGS =
|
2010-10-09 14:15:59 -07:00
|
|
|
ifndef CFLAGS
|
2022-07-25 17:10:49 -03:00
|
|
|
CFLAGS = -g -O2 -pipe
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
ifdef DEBUG
|
2011-09-01 11:57:54 -07:00
|
|
|
CFLAGS += -pg -D DEBUG
|
2006-04-11 21:52:54 +00:00
|
|
|
endif
|
2013-12-06 05:31:11 -08:00
|
|
|
ifdef COVERAGE
|
|
|
|
|
CFLAGS = -g -pg -fprofile-arcs -ftest-coverage
|
|
|
|
|
endif
|
2010-10-09 14:15:59 -07:00
|
|
|
endif #CFLAGS
|
|
|
|
|
|
2024-02-24 15:08:36 +00:00
|
|
|
HAVE_FLTO_PARTITION_NONE:=$(shell ${CC} -E -flto-partition=none /dev/null 1>/dev/null 2>&1 && echo true)
|
|
|
|
|
ifeq ($(HAVE_FLTO_PARTITION_NONE),true)
|
|
|
|
|
CFLAGS += -flto-partition=none
|
|
|
|
|
endif
|
2022-07-25 17:10:49 -03:00
|
|
|
|
2020-09-29 11:42:32 -07:00
|
|
|
EXTRA_CXXFLAGS = ${CFLAGS} ${CPPFLAGS} ${CXX_WARNINGS} -std=gnu++0x
|
2010-11-09 13:39:18 -08:00
|
|
|
EXTRA_CFLAGS = ${EXTRA_CXXFLAGS} ${CPP_WARNINGS}
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2020-09-29 11:42:32 -07:00
|
|
|
ifeq ($(HAVE_REALLOCARRAY),true)
|
|
|
|
|
EXTRA_CXXCFLAGS+=-DHAVE_REALLOCARRAY=1
|
|
|
|
|
EXTRA_CFLAGS+=-DHAVE_REALLOCARRAY=1
|
|
|
|
|
endif
|
|
|
|
|
|
2020-04-21 16:54:56 -07:00
|
|
|
ifdef DEBUG
|
|
|
|
|
LEXLIB := -lfl
|
|
|
|
|
endif
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
# override this on the make command to point to where the immunix.h file is
|
|
|
|
|
# (yeah this is lame, but since we are tied to the kernel so tightly...)
|
|
|
|
|
#INCLUDEDIR = /usr/src/linux/include
|
|
|
|
|
INCLUDEDIR =
|
|
|
|
|
|
|
|
|
|
ifdef INCLUDEDIR
|
|
|
|
|
CFLAGS += -I$(INCLUDEDIR)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
# Internationalization support. Define a package and a LOCALEDIR
|
|
|
|
|
EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
|
|
|
|
|
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
SRCS = parser_common.c parser_include.c parser_interface.c parser_lex.c \
|
|
|
|
|
parser_main.c parser_misc.c parser_merge.c parser_symtab.c \
|
|
|
|
|
parser_yacc.c parser_regex.c parser_variable.c parser_policy.c \
|
2023-06-26 14:39:39 -03:00
|
|
|
parser_alias.c common_optarg.c lib.c network.cc \
|
parser: first step implementing fine grained mediation for unix domain sockets
This patch implements parsing of fine grained mediation for unix domain
sockets, that have abstract and anonymous paths. Sockets with file
system paths are handled by regular file access rules.
The unix network rules follow the general fine grained network
rule pattern of
[<qualifiers>] af_name [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
specifically for af_unix this is
[<qualifiers>] 'unix' [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
<qualifiers> = [ 'audit' ] [ 'allow' | 'deny' ]
<access expr> = ( <access> | <access list> )
<access> = ( 'server' | 'create' | 'bind' | 'listen' | 'accept' |
'connect' | 'shutdown' | 'getattr' | 'setattr' |
'getopt' | 'setopt' |
'send' | 'receive' | 'r' | 'w' | 'rw' )
(some access modes are incompatible with some rules or require additional
parameters)
<access list> = '(' <access> ( [','] <WS> <access> )* ')'
<WS> = white space
<rule conds> = ( <type cond> | <protocol cond> )*
each cond can appear at most once
<type cond> = 'type' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<protocol cond> = 'protocol' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<local expr> = ( <path cond> | <attr cond> | <opt cond> )*
each cond can appear at most once
<peer expr> = 'peer' '=' ( <path cond> | <label cond> )+
each cond can appear at most once
<path cond> = 'path' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<label cond> = 'label' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')')
<attr cond> = 'attr' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<opt cond> = 'opt' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<AARE> = ?*[]{}^ ( see man page )
unix domain socket rules are accumulated so that the granted unix
socket permissions are the union of all the listed unix rule permissions.
unix domain socket rules are broad and general and become more restrictive
as further information is specified. Policy may be specified down to
the path and label level. The content of the communication is not
examined.
Some permissions are not compatible with all unix rules.
unix socket rule permissions are implied when a rule does not explicitly
state an access list. By default if a rule does not have an access list
all permissions that are compatible with the specified set of local
and peer conditionals are implied.
The 'server', 'r', 'w' and 'rw' permissions are aliases for other permissions.
server = (create, bind, listen, accept)
r = (receive, getattr, getopt)
w = (create, connect, send, setattr, setopt)
In addition it supports the v7 kernel abi semantics around generic
network rules. The v7 abi removes the masking unix and netlink
address families from the generic masking and uses fine grained
mediation for an address type if supplied.
This means that the rules
network unix,
network netlink,
are now enforced instead of ignored. The parser previously could accept
these but the kernel would ignore anything written to them. If a network
rule is supplied it takes precedence over the finer grained mediation
rule. If permission is not granted via a broad network access rule
fine grained mediation is applied.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 13:22:26 -07:00
|
|
|
mount.cc dbus.cc profile.cc rule.cc signal.cc ptrace.cc \
|
2022-02-07 19:15:11 -03:00
|
|
|
af_rule.cc af_unix.cc policy_cache.c default_features.c userns.cc \
|
2023-09-21 20:39:27 -07:00
|
|
|
mqueue.cc io_uring.cc all_rule.cc
|
2021-09-14 17:18:36 -07:00
|
|
|
STATIC_HDRS = af_rule.h af_unix.h capability.h common_optarg.h dbus.h \
|
|
|
|
|
file_cache.h immunix.h lib.h mount.h network.h parser.h \
|
|
|
|
|
parser_include.h parser_version.h policy_cache.h policydb.h \
|
2023-07-06 16:41:56 -07:00
|
|
|
profile.h ptrace.h rule.h signal.h userns.h mqueue.h io_uring.h \
|
2023-09-21 20:39:27 -07:00
|
|
|
common_flags.h bignum.h all_rule.h
|
2021-09-14 17:18:36 -07:00
|
|
|
|
|
|
|
|
SPECIAL_HDRS = parser_yacc.h unit_test.h base_cap_names.h
|
|
|
|
|
GENERATED_HDRS = af_names.h generated_af_names.h \
|
|
|
|
|
cap_names.h generated_cap_names.h parser_version.h
|
|
|
|
|
LIBAA_HDRS = libapparmor_re/apparmor_re.h libapparmor_re/aare_rules.h
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
TOOLS = apparmor_parser
|
|
|
|
|
|
2014-09-23 07:54:04 -07:00
|
|
|
OBJECTS = $(patsubst %.cc, %.o, $(SRCS:.c=.o))
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-02-27 02:29:16 +00:00
|
|
|
AAREDIR= libapparmor_re
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
AAREOBJECT = ${AAREDIR}/libapparmor_re.a
|
2013-10-15 16:50:42 -07:00
|
|
|
AAREOBJECTS = $(AAREOBJECT)
|
2017-01-19 23:04:34 +00:00
|
|
|
AARE_LDFLAGS = -static-libgcc -static-libstdc++ -L. $(LDFLAGS)
|
2013-10-15 17:02:59 -07:00
|
|
|
AALIB = -Wl,-Bstatic -lapparmor -Wl,-Bdynamic -lpthread
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2020-04-24 17:34:24 +02:00
|
|
|
ifdef WITH_LIBINTL
|
|
|
|
|
AALIB += -lintl
|
|
|
|
|
endif
|
|
|
|
|
|
2014-01-06 14:46:10 -08:00
|
|
|
ifdef USE_SYSTEM
|
|
|
|
|
# Using the system libapparmor so Makefile dependencies can't be used
|
|
|
|
|
LIBAPPARMOR_A =
|
|
|
|
|
INCLUDE_APPARMOR =
|
|
|
|
|
APPARMOR_H =
|
|
|
|
|
else
|
2016-03-25 10:28:52 -05:00
|
|
|
LIBAPPARMOR_SRC = ../libraries/libapparmor
|
2014-01-06 14:46:10 -08:00
|
|
|
LOCAL_LIBAPPARMOR_INCLUDE = $(LIBAPPARMOR_SRC)/include
|
|
|
|
|
LOCAL_LIBAPPARMOR_LDPATH = $(LIBAPPARMOR_SRC)/src/.libs
|
|
|
|
|
|
|
|
|
|
LIBAPPARMOR_A = $(LOCAL_LIBAPPARMOR_LDPATH)/libapparmor.a
|
|
|
|
|
INCLUDE_APPARMOR = -I$(LOCAL_LIBAPPARMOR_INCLUDE)
|
|
|
|
|
AARE_LDFLAGS += -L$(LOCAL_LIBAPPARMOR_LDPATH)
|
|
|
|
|
APPARMOR_H = $(LOCAL_LIBAPPARMOR_INCLUDE)/sys/apparmor.h
|
|
|
|
|
endif
|
|
|
|
|
EXTRA_CFLAGS += $(INCLUDE_APPARMOR)
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
LEX_C_FILES = parser_lex.c
|
|
|
|
|
YACC_C_FILES = parser_yacc.c parser_yacc.h
|
|
|
|
|
|
2015-03-25 17:09:27 -05:00
|
|
|
TESTS = tst_regex tst_misc tst_symtab tst_variable tst_lib
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
TEST_CFLAGS = $(EXTRA_CFLAGS) -DUNIT_TEST -Wno-unused-result
|
|
|
|
|
TEST_OBJECTS = $(filter-out \
|
|
|
|
|
parser_lex.o \
|
|
|
|
|
parser_yacc.o \
|
2014-04-23 11:10:41 -07:00
|
|
|
common_optarg.o \
|
2015-03-25 17:09:25 -05:00
|
|
|
parser_main.o \
|
|
|
|
|
policy_cache.o, ${OBJECTS}) \
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
$(AAREOBJECTS)
|
|
|
|
|
TEST_LDFLAGS = $(AARE_LDFLAGS)
|
2015-03-25 17:09:26 -05:00
|
|
|
TEST_LDLIBS = $(AALIB)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2008-04-16 16:09:36 +00:00
|
|
|
ifdef V
|
|
|
|
|
VERBOSE = 1
|
|
|
|
|
endif
|
2006-05-31 21:30:50 +00:00
|
|
|
ifndef VERBOSE
|
|
|
|
|
VERBOSE = 0
|
|
|
|
|
endif
|
|
|
|
|
ifeq ($(VERBOSE),1)
|
|
|
|
|
BUILD_OUTPUT =
|
|
|
|
|
Q =
|
|
|
|
|
else
|
|
|
|
|
BUILD_OUTPUT = > /dev/null 2>&1
|
|
|
|
|
Q = @
|
|
|
|
|
endif
|
|
|
|
|
export Q VERBOSE BUILD_OUTPUT
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
HDRS=$(STATIC_HDRS) $(GENERATED_HDRS) parser_yacc.h $(LIBAA_HDRS) $(APPARMOR_H)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
po/${NAME}.pot: ${SRCS} ${STATIC_HDRS}
|
|
|
|
|
$(MAKE) -C po ${NAME}.pot NAME=${NAME} SOURCES="${SRCS} ${STATIC_HDRS}"
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-04-12 06:01:40 +00:00
|
|
|
techdoc.pdf: techdoc.tex
|
2015-05-03 13:42:39 +02:00
|
|
|
timestamp=$(shell date --utc "+%Y%m%d%H%M%S%z" -r $< );\
|
2012-05-09 00:41:06 +02:00
|
|
|
while pdflatex "\def\fixedpdfdate{$$timestamp}\input $<" ${BUILD_OUTPUT} || exit 1 ; \
|
2007-04-12 06:01:40 +00:00
|
|
|
grep -q "Label(s) may have changed" techdoc.log; \
|
|
|
|
|
do :; done
|
|
|
|
|
|
|
|
|
|
techdoc/index.html: techdoc.pdf
|
2007-05-15 20:02:15 +00:00
|
|
|
latex2html -show_section_numbers -split 0 -noinfo -nonavigation -noaddress techdoc.tex ${BUILD_OUTPUT}
|
2007-04-12 06:01:40 +00:00
|
|
|
|
|
|
|
|
techdoc.txt: techdoc/index.html
|
|
|
|
|
w3m -dump $< > $@
|
|
|
|
|
|
2010-03-16 15:18:55 -07:00
|
|
|
# targets arranged this way so that people who don't want full docs can
|
|
|
|
|
# pick specific targets they want.
|
2011-05-27 14:57:43 -07:00
|
|
|
arch: $(TOOLS)
|
2010-03-16 15:18:55 -07:00
|
|
|
|
|
|
|
|
manpages: $(MANPAGES)
|
|
|
|
|
|
|
|
|
|
htmlmanpages: $(HTMLMANPAGES)
|
|
|
|
|
|
|
|
|
|
pdf: techdoc.pdf
|
|
|
|
|
|
2016-12-10 10:25:31 -08:00
|
|
|
docs: manpages htmlmanpages
|
|
|
|
|
extra_docs: pdf
|
2010-03-16 15:18:55 -07:00
|
|
|
|
2011-05-27 14:57:43 -07:00
|
|
|
indep: docs
|
2011-11-10 09:36:52 -08:00
|
|
|
$(Q)$(MAKE) -C po all
|
2011-05-27 14:57:43 -07:00
|
|
|
|
|
|
|
|
all: arch indep
|
|
|
|
|
|
2013-12-06 05:31:11 -08:00
|
|
|
.PHONY: coverage
|
|
|
|
|
coverage:
|
|
|
|
|
$(MAKE) clean apparmor_parser COVERAGE=1
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2014-01-06 14:46:10 -08:00
|
|
|
ifndef USE_SYSTEM
|
|
|
|
|
$(LIBAPPARMOR_A):
|
|
|
|
|
@if [ ! -f $@ ]; then \
|
|
|
|
|
echo "error: $@ is missing. Pick one of these possible solutions:" 1>&2; \
|
|
|
|
|
echo " 1) Build against the in-tree libapparmor by building it first and then trying again. See the top-level README for help." 1>&2; \
|
|
|
|
|
echo " 2) Build against the system libapparmor by adding USE_SYSTEM=1 to your make command." 1>&2;\
|
2017-12-04 23:28:10 +00:00
|
|
|
exit 1; \
|
2014-01-06 14:46:10 -08:00
|
|
|
fi
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
apparmor_parser: $(OBJECTS) $(AAREOBJECTS) $(LIBAPPARMOR_A)
|
2013-01-14 00:10:41 +11:00
|
|
|
$(CXX) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $(OBJECTS) $(LIBS) \
|
2013-09-29 02:44:19 -07:00
|
|
|
${LEXLIB} $(AAREOBJECTS) $(AARE_LDFLAGS) $(AALIB)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_yacc.c parser_yacc.h: parser_yacc.y $(STATIC_HDRS) $(DYNAMIC_HDRS)
|
2008-11-14 16:46:16 +00:00
|
|
|
$(YACC) $(YFLAGS) -o parser_yacc.c parser_yacc.y
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_lex.c: parser_lex.l $(HDRS)
|
2006-04-11 21:52:54 +00:00
|
|
|
$(LEX) ${LEXFLAGS} -o$@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_lex.o: parser_lex.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_misc.o: parser_misc.c $(HDRS) unit_test.h
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_yacc.o: parser_yacc.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_main.o: parser_main.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_interface.o: parser_interface.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_include.o: parser_include.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_merge.o: parser_merge.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_regex.o: parser_regex.c $(HDRS) unit_test.h
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_symtab.o: parser_symtab.c $(HDRS) unit_test.h
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_variable.o: parser_variable.c $(HDRS) unit_test.h
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_policy.o: parser_policy.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_alias.o: parser_alias.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2008-04-09 09:03:17 +00:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
parser_common.o: parser_common.c $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2011-05-23 11:29:41 -07:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
mount.o: mount.cc mount.h $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2012-03-09 04:21:06 -08:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
common_optarg.o: common_optarg.c $(HDRS)
|
2014-04-23 11:10:41 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
policy_cache.o: policy_cache.c $(HDRS)
|
2015-03-25 17:09:25 -05:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
lib.o: lib.c $(HDRS) unit_test.h
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2012-08-16 16:26:03 -07:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
dbus.o: dbus.cc $(HDRS)
|
2013-09-27 16:13:22 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2013-07-31 09:05:51 -07:00
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
signal.o: signal.cc $(HDRS)
|
2014-04-23 11:35:29 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
ptrace.o: ptrace.cc $(HDRS)
|
2014-04-23 11:38:04 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2023-06-26 14:39:39 -03:00
|
|
|
network.o: network.cc $(HDRS)
|
2014-08-23 23:52:15 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
default_features.o: default_features.c $(HDRS)
|
2020-04-24 17:43:47 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
af_rule.o: af_rule.cc $(HDRS)
|
parser: first step implementing fine grained mediation for unix domain sockets
This patch implements parsing of fine grained mediation for unix domain
sockets, that have abstract and anonymous paths. Sockets with file
system paths are handled by regular file access rules.
The unix network rules follow the general fine grained network
rule pattern of
[<qualifiers>] af_name [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
specifically for af_unix this is
[<qualifiers>] 'unix' [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
<qualifiers> = [ 'audit' ] [ 'allow' | 'deny' ]
<access expr> = ( <access> | <access list> )
<access> = ( 'server' | 'create' | 'bind' | 'listen' | 'accept' |
'connect' | 'shutdown' | 'getattr' | 'setattr' |
'getopt' | 'setopt' |
'send' | 'receive' | 'r' | 'w' | 'rw' )
(some access modes are incompatible with some rules or require additional
parameters)
<access list> = '(' <access> ( [','] <WS> <access> )* ')'
<WS> = white space
<rule conds> = ( <type cond> | <protocol cond> )*
each cond can appear at most once
<type cond> = 'type' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<protocol cond> = 'protocol' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<local expr> = ( <path cond> | <attr cond> | <opt cond> )*
each cond can appear at most once
<peer expr> = 'peer' '=' ( <path cond> | <label cond> )+
each cond can appear at most once
<path cond> = 'path' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<label cond> = 'label' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')')
<attr cond> = 'attr' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<opt cond> = 'opt' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<AARE> = ?*[]{}^ ( see man page )
unix domain socket rules are accumulated so that the granted unix
socket permissions are the union of all the listed unix rule permissions.
unix domain socket rules are broad and general and become more restrictive
as further information is specified. Policy may be specified down to
the path and label level. The content of the communication is not
examined.
Some permissions are not compatible with all unix rules.
unix socket rule permissions are implied when a rule does not explicitly
state an access list. By default if a rule does not have an access list
all permissions that are compatible with the specified set of local
and peer conditionals are implied.
The 'server', 'r', 'w' and 'rw' permissions are aliases for other permissions.
server = (create, bind, listen, accept)
r = (receive, getattr, getopt)
w = (create, connect, send, setattr, setopt)
In addition it supports the v7 kernel abi semantics around generic
network rules. The v7 abi removes the masking unix and netlink
address families from the generic masking and uses fine grained
mediation for an address type if supplied.
This means that the rules
network unix,
network netlink,
are now enforced instead of ignored. The parser previously could accept
these but the kernel would ignore anything written to them. If a network
rule is supplied it takes precedence over the finer grained mediation
rule. If permission is not granted via a broad network access rule
fine grained mediation is applied.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 13:22:26 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
af_unix.o: af_unix.cc $(HDRS)
|
parser: first step implementing fine grained mediation for unix domain sockets
This patch implements parsing of fine grained mediation for unix domain
sockets, that have abstract and anonymous paths. Sockets with file
system paths are handled by regular file access rules.
The unix network rules follow the general fine grained network
rule pattern of
[<qualifiers>] af_name [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
specifically for af_unix this is
[<qualifiers>] 'unix' [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]
<qualifiers> = [ 'audit' ] [ 'allow' | 'deny' ]
<access expr> = ( <access> | <access list> )
<access> = ( 'server' | 'create' | 'bind' | 'listen' | 'accept' |
'connect' | 'shutdown' | 'getattr' | 'setattr' |
'getopt' | 'setopt' |
'send' | 'receive' | 'r' | 'w' | 'rw' )
(some access modes are incompatible with some rules or require additional
parameters)
<access list> = '(' <access> ( [','] <WS> <access> )* ')'
<WS> = white space
<rule conds> = ( <type cond> | <protocol cond> )*
each cond can appear at most once
<type cond> = 'type' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<protocol cond> = 'protocol' '=' ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )
<local expr> = ( <path cond> | <attr cond> | <opt cond> )*
each cond can appear at most once
<peer expr> = 'peer' '=' ( <path cond> | <label cond> )+
each cond can appear at most once
<path cond> = 'path' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<label cond> = 'label' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')')
<attr cond> = 'attr' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<opt cond> = 'opt' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )
<AARE> = ?*[]{}^ ( see man page )
unix domain socket rules are accumulated so that the granted unix
socket permissions are the union of all the listed unix rule permissions.
unix domain socket rules are broad and general and become more restrictive
as further information is specified. Policy may be specified down to
the path and label level. The content of the communication is not
examined.
Some permissions are not compatible with all unix rules.
unix socket rule permissions are implied when a rule does not explicitly
state an access list. By default if a rule does not have an access list
all permissions that are compatible with the specified set of local
and peer conditionals are implied.
The 'server', 'r', 'w' and 'rw' permissions are aliases for other permissions.
server = (create, bind, listen, accept)
r = (receive, getattr, getopt)
w = (create, connect, send, setattr, setopt)
In addition it supports the v7 kernel abi semantics around generic
network rules. The v7 abi removes the masking unix and netlink
address families from the generic masking and uses fine grained
mediation for an address type if supplied.
This means that the rules
network unix,
network netlink,
are now enforced instead of ignored. The parser previously could accept
these but the kernel would ignore anything written to them. If a network
rule is supplied it takes precedence over the finer grained mediation
rule. If permission is not granted via a broad network access rule
fine grained mediation is applied.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 13:22:26 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
profile.o: profile.cc $(HDRS)
|
2013-09-27 16:16:37 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
rule.o: rule.cc $(HDRS)
|
2014-04-07 03:16:50 -07:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
userns.o: userns.cc $(HDRS)
|
2022-09-29 17:40:18 -03:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2021-09-14 17:18:36 -07:00
|
|
|
mqueue.o: mqueue.cc $(HDRS)
|
2022-02-07 19:15:11 -03:00
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2023-03-20 12:28:53 -03:00
|
|
|
|
|
|
|
|
io_uring.o: io_uring.cc $(HDRS)
|
|
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
2022-02-07 19:15:11 -03:00
|
|
|
|
2023-09-21 20:39:27 -07:00
|
|
|
all_rule.o: all_rule.cc $(HDRS)
|
|
|
|
|
$(CXX) $(EXTRA_CFLAGS) -c -o $@ $<
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
parser_version.h: Makefile
|
|
|
|
|
@echo \#define PARSER_VERSION \"$(VERSION)\" > .ver
|
|
|
|
|
@mv -f .ver $@
|
|
|
|
|
|
2012-03-22 13:19:27 -07:00
|
|
|
# af_names and capabilities generation has moved to common/Make.rules,
|
|
|
|
|
# as well as the filtering that occurs for network protocols that
|
|
|
|
|
# apparmor should not mediate.
|
2009-06-10 19:20:51 +00:00
|
|
|
|
2021-10-14 12:38:27 -05:00
|
|
|
generated_af_names.h: ../common/list_af_names.sh
|
|
|
|
|
../common/list_af_names.sh > $@
|
|
|
|
|
|
|
|
|
|
af_names.h: generated_af_names.h base_af_names.h
|
2021-09-14 17:18:36 -07:00
|
|
|
@cat base_af_names.h | diff -u - generated_af_names.h | grep -v '^.AF_MAX' | grep '^\+[^+]' ; \
|
2021-10-14 12:38:27 -05:00
|
|
|
if [ $$? -eq 1 ] ; then \
|
|
|
|
|
cat base_af_names.h | LC_ALL=C sed -n -e 's/[ \t]\?AF_MAX[ \t]\+[0-9]\+,//g' -e 's/[ \t]\+\?AF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\),/#ifndef AF_\1\n# define AF_\1 \2\n#endif\nAA_GEN_NET_ENT("\L\1", \UAF_\1)\n/pg' > $@ ; \
|
|
|
|
|
cat base_af_names.h | LC_ALL=C sed -n -e 's/AF_MAX[ \t]\+\([0-9]\+\),\?.*/\n#define AA_AF_MAX \1\n/p' >> $@ ; \
|
|
|
|
|
else \
|
|
|
|
|
echo "Error: new AF names detected; please update base_af_names.h with values from generated_af_names.h" ; \
|
|
|
|
|
exit 1 ; \
|
|
|
|
|
fi
|
2007-07-27 20:29:47 +00:00
|
|
|
|
2020-06-14 16:37:51 -07:00
|
|
|
generated_cap_names.h: /usr/include/linux/capability.h
|
2020-07-02 06:37:39 -07:00
|
|
|
../common/list_capabilities.sh | LC_ALL=C sed -n -e "s/[ \\t]\\?CAP_\\([A-Z0-9_]\\+\\)/\{\"\\L\\1\", \\UCAP_\\1, NO_BACKMAP_CAP, CAPFLAG_BASE_FEATURE\},\\n/pg" > $@
|
2007-07-27 20:29:47 +00:00
|
|
|
|
2020-06-14 16:37:51 -07:00
|
|
|
cap_names.h: generated_cap_names.h base_cap_names.h
|
2020-08-26 20:11:10 -07:00
|
|
|
@LC_ALL=C sed -e 's/\([^,]*,[^,]*,\) CAP_[A-Z0-9_]\+,/\1 NO_BACKMAP_CAP,/g' base_cap_names.h | diff -u - generated_cap_names.h | grep '^\+[^+]' ; \
|
2020-06-14 16:37:51 -07:00
|
|
|
if [ $$? -eq 1 ] ; then \
|
|
|
|
|
cp base_cap_names.h $@ ; \
|
|
|
|
|
else \
|
|
|
|
|
echo "Error: new capabilities detected please update base_cap_names.h with values from generated_cap_names.h" ; \
|
2020-08-26 20:11:10 -07:00
|
|
|
LC_ALL=C sed -e 's/\([^,]*,[^,]*,\) CAP_[A-Z0-9_]\+,/\1 NO_BACKMAP_CAP,/g' base_cap_names.h | diff -u - generated_cap_names.h ; \
|
2020-06-14 16:37:51 -07:00
|
|
|
exit 1; \
|
|
|
|
|
fi
|
|
|
|
|
|
2014-04-15 14:59:41 -07:00
|
|
|
tst_lib: lib.c parser.h $(filter-out lib.o, ${TEST_OBJECTS})
|
2015-03-25 17:09:26 -05:00
|
|
|
$(CXX) $(TEST_CFLAGS) -o $@ $< $(filter-out $(<:.c=.o), ${TEST_OBJECTS}) $(TEST_LDFLAGS) $(TEST_LDLIBS)
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
|
2015-03-25 17:09:26 -05:00
|
|
|
$(CXX) $(TEST_CFLAGS) -o $@ $< $(filter-out $(<:.c=.o), ${TEST_OBJECTS}) $(TEST_LDFLAGS) $(TEST_LDLIBS)
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2007-10-01 06:12:26 +00:00
|
|
|
.SILENT: check
|
|
|
|
|
.PHONY: check
|
2014-09-15 11:30:47 -07:00
|
|
|
check: check_pod_files tests
|
2007-10-01 06:12:26 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.SILENT: tests
|
2011-08-09 00:54:14 -07:00
|
|
|
tests: apparmor_parser ${TESTS}
|
[v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.
First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.
Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.
To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).
Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
|
|
|
sh -e -c 'for test in ${TESTS} ; do echo "*** running $${test}" && ./$${test}; done'
|
2011-11-10 09:36:52 -08:00
|
|
|
$(Q)$(MAKE) -s -C tst tests
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2019-01-17 11:02:57 -08:00
|
|
|
$(AAREOBJECT): FORCE
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -C $(AAREDIR) CFLAGS="$(EXTRA_CXXFLAGS)"
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: install-redhat
|
2023-08-28 18:43:30 +02:00
|
|
|
install-redhat: install-systemd
|
2006-04-11 21:52:54 +00:00
|
|
|
|
|
|
|
|
.PHONY: install-suse
|
2018-03-18 17:50:57 +01:00
|
|
|
install-suse: install-systemd
|
2018-05-01 00:22:45 +02:00
|
|
|
install -m 755 -d $(SBINDIR)
|
|
|
|
|
ln -sf service $(SBINDIR)/rcapparmor
|
2007-02-27 02:29:16 +00:00
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: install-slackware
|
|
|
|
|
install-slackware:
|
|
|
|
|
install -m 755 -d $(APPARMOR_BIN_PREFIX)/install
|
|
|
|
|
install -m 755 frob_slack_rc $(APPARMOR_BIN_PREFIX)/install
|
|
|
|
|
install -m 755 -d $(DESTDIR)/etc/rc.d
|
|
|
|
|
install -m 755 rc.apparmor.$(subst install-,,$(@)) $(DESTDIR)/etc/rc.d/rc.apparmor
|
|
|
|
|
|
2007-03-30 16:09:50 +00:00
|
|
|
.PHONY: install-debian
|
|
|
|
|
install-debian:
|
|
|
|
|
|
2008-11-18 17:33:38 +00:00
|
|
|
.PHONY: install-unknown
|
|
|
|
|
install-unknown:
|
|
|
|
|
|
2011-05-27 14:57:43 -07:00
|
|
|
INSTALLDEPS=arch
|
2015-01-28 22:44:35 +01:00
|
|
|
|
|
|
|
|
ifndef DISTRO
|
|
|
|
|
DISTRO=$(shell if [ -f /etc/slackware-version ] ; then \
|
|
|
|
|
echo slackware ; \
|
|
|
|
|
elif [ -f /etc/debian_version ] ; then \
|
|
|
|
|
echo debian ;\
|
|
|
|
|
elif which rpm > /dev/null ; then \
|
2022-09-15 15:34:26 +03:00
|
|
|
if [ "$$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
|
2015-01-28 22:44:35 +01:00
|
|
|
echo suse ;\
|
2022-09-15 15:34:26 +03:00
|
|
|
elif [ "$$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
|
2023-08-28 18:43:30 +02:00
|
|
|
echo redhat ;\
|
2022-09-15 15:34:26 +03:00
|
|
|
elif [ "$$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
|
2023-08-28 18:43:30 +02:00
|
|
|
echo redhat ;\
|
2015-01-28 22:44:35 +01:00
|
|
|
else \
|
|
|
|
|
echo unknown ;\
|
|
|
|
|
fi ;\
|
|
|
|
|
else \
|
|
|
|
|
echo unknown ;\
|
|
|
|
|
fi)
|
|
|
|
|
endif
|
|
|
|
|
|
2006-04-11 21:52:54 +00:00
|
|
|
ifdef DISTRO
|
|
|
|
|
INSTALLDEPS+=install-$(DISTRO)
|
|
|
|
|
endif
|
|
|
|
|
|
|
|
|
|
.PHONY: install
|
2020-04-24 11:02:27 +02:00
|
|
|
install:
|
|
|
|
|
$(MAKE) install-indep
|
|
|
|
|
$(MAKE) install-arch
|
2011-05-27 14:57:43 -07:00
|
|
|
|
|
|
|
|
.PHONY: install-arch
|
|
|
|
|
install-arch: $(INSTALLDEPS)
|
2018-05-01 00:22:45 +02:00
|
|
|
install -m 755 -d $(SBINDIR)
|
|
|
|
|
install -m 755 ${TOOLS} $(SBINDIR)
|
2011-05-27 14:57:43 -07:00
|
|
|
|
|
|
|
|
.PHONY: install-indep
|
2016-04-06 12:23:48 -05:00
|
|
|
install-indep: indep
|
2006-04-11 21:52:54 +00:00
|
|
|
install -m 755 -d $(INSTALL_CONFDIR)
|
2011-10-07 14:43:54 -07:00
|
|
|
install -m 644 parser.conf $(INSTALL_CONFDIR)
|
2006-04-11 21:52:54 +00:00
|
|
|
install -m 755 -d $(APPARMOR_BIN_PREFIX)
|
|
|
|
|
install -m 755 rc.apparmor.functions $(APPARMOR_BIN_PREFIX)
|
2022-02-12 10:32:04 +00:00
|
|
|
install -m 755 profile-load $(APPARMOR_BIN_PREFIX)
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
|
|
|
|
|
$(MAKE) install_manpages DESTDIR=${DESTDIR}
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2018-03-18 17:50:57 +01:00
|
|
|
.PHONY: install-systemd
|
|
|
|
|
install-systemd:
|
|
|
|
|
install -m 755 -d $(SYSTEMD_UNIT_DIR)
|
|
|
|
|
install -m 644 apparmor.service $(SYSTEMD_UNIT_DIR)
|
2018-04-23 18:01:52 +02:00
|
|
|
install -m 755 apparmor.systemd $(APPARMOR_BIN_PREFIX)
|
2018-05-01 00:22:45 +02:00
|
|
|
install -m 755 -d $(USR_SBINDIR)
|
|
|
|
|
install -m 755 aa-teardown $(USR_SBINDIR)
|
2018-03-18 17:50:57 +01:00
|
|
|
|
2015-01-23 15:52:09 -08:00
|
|
|
ifndef VERBOSE
|
2006-05-31 21:30:50 +00:00
|
|
|
.SILENT: clean
|
2015-01-23 15:52:09 -08:00
|
|
|
endif
|
2006-04-11 21:52:54 +00:00
|
|
|
.PHONY: clean
|
2015-01-30 22:15:53 +01:00
|
|
|
clean: pod_clean
|
2013-12-06 05:31:11 -08:00
|
|
|
rm -f core core.* *.o *.s *.a *~ *.gcda *.gcno
|
|
|
|
|
rm -f gmon.out
|
2007-04-03 20:12:16 +00:00
|
|
|
rm -f $(TOOLS) $(TESTS)
|
2006-04-11 21:52:54 +00:00
|
|
|
rm -f $(LEX_C_FILES)
|
|
|
|
|
rm -f $(YACC_C_FILES)
|
|
|
|
|
rm -f $(NAME)*.tar.gz $(NAME)*.tgz
|
2021-09-14 17:18:36 -07:00
|
|
|
rm -f $(GENERATED_HDRS)
|
2012-05-09 00:41:06 +02:00
|
|
|
rm -rf techdoc.aux techdoc.out techdoc.log techdoc.pdf techdoc.toc techdoc.txt techdoc/
|
2011-11-10 09:36:52 -08:00
|
|
|
$(MAKE) -s -C $(AAREDIR) clean
|
|
|
|
|
$(MAKE) -s -C po clean
|
|
|
|
|
$(MAKE) -s -C tst clean
|
2006-04-11 21:52:54 +00:00
|
|
|
|
2019-01-17 11:02:57 -08:00
|
|
|
FORCE:
|