mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 00:14:44 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge parser: add permission merging

Browse source 
By changing the compare function from each rule to use class_rule_t,
instead of perms_rule_t, we temporarily ignore if permissions are
different. If every rule attribute is the same, then the permissions
can be merged. This is done at the perms_rule_t's level.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1068
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen 2023-07-11 02:18:45 +00:00
commit 1dfd26aea7
9 changed files with 24 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
parser/af_rule.h
View file

@ -80,7 +80,8 @@ public:
virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
af_rule const &trhs = (rule_cast<af_rule const &>(rhs));

3
parser/dbus.h
View file

@ -65,7 +65,8 @@ public:
virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
dbus_rule const &trhs = (rule_cast<dbus_rule const &>(rhs));

3
parser/io_uring.h
View file

@ -52,7 +52,8 @@ public:
virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
return null_strcmp(label,

4
parser/mount.cc
View file

@ -649,8 +649,8 @@ static int cmp_vec_int(std::vector<unsigned int> const &lhs,
}
int mnt_rule::cmp(rule_t const &rhs) const {
// for now don't do merging of perms, only exact match
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res != 0)
return res;
mnt_rule const &rhs_mnt = rule_cast<mnt_rule const &>(rhs);

3
parser/mqueue.h
View file

@ -110,7 +110,8 @@ public:
virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
mqueue_rule const &trhs = rule_cast<mqueue_rule const &>(rhs);

3
parser/ptrace.h
View file

@ -55,7 +55,8 @@ public:
virtual bool is_mergeable(void) { return true; }
virtual int cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
return null_strcmp(peer_label,

9
parser/rule.h
View file

@ -364,6 +364,15 @@ public:
return perms - (rule_cast<perms_rule_t const &>(rhs)).perms;
}
virtual bool merge(rule_t &rhs)
{
int res = class_rule_t::merge(rhs);
if (!res)
return res;
perms |= (rule_cast<perms_rule_t const &>(rhs)).perms;
return true;
};
/* defaut perms, override/mask off if none default used */
virtual ostream &dump(ostream &os) {

3
parser/signal.cc
View file

@ -249,7 +249,8 @@ static int cmp_set_int(Signals const &lhs, Signals const &rhs)
int signal_rule::cmp(rule_t const &rhs) const
{
int res = perms_rule_t::cmp(rhs);
/* use class_rule_t instead of perms_rule_t to merge perms */
int res = class_rule_t::cmp(rhs);
if (res)
return res;
signal_rule const &trhs = rule_cast<signal_rule const &>(rhs);

1
parser/userns.h
View file

@ -47,6 +47,7 @@ public:
{
return perms_rule_t::cmp(rhs);
};
/* merge perms not required atm since there's only one permission */
protected:
virtual void warn_once(const char *name) override;