mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

parser: fix filter slashes for link targets

Browse source 
The parser is failing to properly filter the slashes in the link name
after variable expansion. Causing match failures when multiple slashes
occur.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/153
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/723
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
This commit is contained in:
John Johansen 2021-03-14 08:50:16 -07:00
parent d4e0a94511
commit 2852e1ecdf
2 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
parser/parser_regex.c
View file

@ -642,6 +642,7 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
int pos; int pos;
vec[0] = tbuf.c_str(); vec[0] = tbuf.c_str();
if (entry->link_name) { if (entry->link_name) {
filter_slashes(entry->link_name);
ptype = convert_aaregex_to_pcre(entry->link_name, 0, glob_default, lbuf, &pos); ptype = convert_aaregex_to_pcre(entry->link_name, 0, glob_default, lbuf, &pos);
if (ptype == ePatternInvalid) if (ptype == ePatternInvalid)
return FALSE; return FALSE;

14
parser/tst/equality.sh
View file

@ -618,6 +618,20 @@ verify_binary_equality "mount rules slash filtering" \
"@{FOO}=/foo "@{FOO}=/foo
/t { mount /dev//@{FOO} -> /mnt/bar, }" /t { mount /dev//@{FOO} -> /mnt/bar, }"
# verify slash filtering for link rules
verify_binary_equality "link rules slash filtering" \
"/t { link /dev/foo -> /mnt/bar, }" \
"/t { link ///dev/foo -> /mnt/bar, }" \
"/t { link /dev/foo -> /mnt//bar, }" \
"/t { link /dev///foo -> ////mnt/bar, }" \
"@{BAR}=/mnt/
/t { link /dev///foo -> @{BAR}/bar, }" \
"@{FOO}=/dev/
/t { link @{FOO}//foo -> /mnt/bar, }" \
"@{FOO}=/dev/
@{BAR}=/mnt/
/t { link @{FOO}/foo -> @{BAR}/bar, }" \
if [ $fails -ne 0 ] || [ $errors -ne 0 ] if [ $fails -ne 0 ] || [ $errors -ne 0 ]
then then
printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 2>&1 printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 2>&1