Merge tunable: add int variable

This PR only adds the digit `@{d}` and integer `@{int}` variables.

It provides two improvements from the use of the `[0-9]*` glob:
- security: the glob means "a digit followed by anything but `/`", whereas `@{int}` means "up to 10 digits"
Next to the
- stability: using glob in path with `x` can expose to path conflict, removing the glob fixed a lot of issues.

These variables are used by a lot of abstractions that could be upstream here from apparmor.d (PR will follow). It is an import from 33681e14f2/apparmor.d/tunables/multiarch.d/system where other similar variables are in use: `@{hex}`, `@{rand}`, `@{word}`, `@{u8}`, `@{u16}`, `@{u64}`, `@{int2}...@{int64}` ...
They also all could be upstreamed here.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1544
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen 2025-02-14 18:38:13 +00:00
commit 783f012074
2 changed files with 18 additions and 0 deletions

View file

@ -17,6 +17,7 @@ include <tunables/multiarch>
include <tunables/proc> include <tunables/proc>
include <tunables/alias> include <tunables/alias>
include <tunables/kernelvars> include <tunables/kernelvars>
include <tunables/system>
include <tunables/xdg-user-dirs> include <tunables/xdg-user-dirs>
include <tunables/share> include <tunables/share>
include <tunables/etc> include <tunables/etc>

View file

@ -0,0 +1,17 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
# Any digit
@{d}=[0-9]
# Integer up to 10 digits (0-9999999999)
@{int}=@{d}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}{@{d},}
include if exists <tunables/system.d>