parser: add kill.signal=XXX flag support

Add a flag that allows setting the signal used to kill the process.
This should not be normally used but can be very useful when
debugging applications, interaction with apparmor.

Signed-off-by: John Johansen <john.johansen@canonical.com>

parser/apparmor.d.pod

@@ -115,7 +115,7 @@ B<PROFILE FLAG CONDS> =  [ 'flags=' ] '(' comma or white space separated list of
 
 B<PROFILE FLAGS> = I<PROFILE MODE> | I<AUDIT_MODE> | 'mediate_deleted'
 | 'attach_disconnected' | 'attach_disconneced.path='I<ABS PATH> | 'chroot_relative'
-| 'debug' | 'interruptible'
+| 'debug' | 'interruptible' | 'kill.signal='I<SIGNAL>
 
 B<PROFILE MODE> = 'enforce' | 'complain' | 'kill' | 'unconfined' | 'prompt'
 
@@ -508,6 +508,9 @@ to debug kernel or policy problems.
 
 =item B<interruptible> Enables interrupts for prompt upcall to userspace.
 
+=item B<kill.signal>=I<SIGNALS> This changes the signal that will be
+sent by AppArmor when in kill mode or a kill rule has been violated.
+
 =back
 
 =head2 Access Modes

parser/parser.h

@@ -354,6 +354,7 @@ extern int features_supports_posix_mqueue;
 extern int features_supports_sysv_mqueue;
 extern int features_supports_io_uring;
 extern int features_supports_flag_interruptible;
+extern int features_supports_flag_signal;
 extern int kernel_supports_oob;
 extern int conf_verbose;
 extern int conf_quiet;

parser/parser_common.c

@@ -83,6 +83,7 @@ int features_supports_posix_mqueue = 0;	/* kernel supports mqueue rules */
 int features_supports_sysv_mqueue = 0;	/* kernel supports mqueue rules */
 int features_supports_io_uring = 0;	/* kernel supports io_uring rules */
 int features_supports_flag_interruptible = 0;
+int features_supports_flag_signal = 0;
 int kernel_supports_oob = 0;		/* out of band transitions */
 int conf_verbose = 0;
 int conf_quiet = 0;

parser/parser_interface.c

@@ -426,6 +426,10 @@ void sd_serialize_profile(std::ostringstream &buf, Profile *profile,
 				"disconnected");
 	}
 
+	if (profile->flags.signal && features_supports_flag_signal) {
+		sd_write_name(buf, "kill");
+		sd_write_uint32(buf, profile->flags.signal);
+	}
 	sd_write_struct(buf, "flags");
 	/* used to be flags.debug, but that's no longer supported */
 	sd_write_uint32(buf, profile->flags.flags);

parser/parser_main.c

@@ -954,6 +954,9 @@ void set_supported_features()
 	features_supports_flag_interruptible = features_intersect(kernel_features,
 						policy_features,
 						"policy/profile/interruptible");
+	features_supports_flag_signal = features_intersect(kernel_features,
+							   policy_features,
+				      "policy/profile/kill.signal");
 }
 
 static bool do_print_cache_dir(aa_features *features, int dirfd, const char *path)

parser/profile.cc

@@ -355,6 +355,11 @@ void Profile::post_parse_profile(void)
 			flags.flags &= ~FLAG_INTERRUPTIBLE;
 		}
 	}
+	if (flags.signal) {
+		if (!features_supports_flag_signal) {
+			warn_once(name, "kill.signal not supported. Ignoring");
+		}
+	}
 	post_process_file_entries(this);
 	post_process_rule_entries(this);
 }

parser/profile.h

@@ -23,6 +23,7 @@
 #include "rule.h"
 #include "libapparmor_re/aare_rules.h"
 #include "network.h"
+#include "signal.h"
 
 class Profile;
 
@@ -124,6 +125,7 @@ public:
 	int audit;
 	int path;
 	char *disconnected_path;
+	int signal;
 
 	// stupid not constructor constructors
 	void init(void)
@@ -133,6 +135,7 @@ public:
 		audit = 0;
 		path = 0;
 		disconnected_path = NULL;
+		signal = 0;
 	}
 	void init(const char *str)
 	{
@@ -166,6 +169,11 @@ public:
 			/* TODO: make this a proper parse */
 			path |= PATH_ATTACH;
 			disconnected_path = strdup(str + 25);
+		} else if (strncmp(str, "kill.signal=", 12) == 0) {
+			/* TODO: make this a proper parse */
+			signal = find_signal_mapping(str + 12);
+			if (signal == -1)
+				yyerror("unknown signal specified for kill.signal=\'%s\'\n", str + 12);
 		} else if (strcmp(str, "interruptible") == 0) {
 				flags |= FLAG_INTERRUPTIBLE;
 		} else {
@@ -185,6 +193,8 @@ public:
 
 		if (disconnected_path)
 			os << ", attach_disconnected.path=" << disconnected_path;
+		if (signal)
+			os << ", kill.signal=" << signal;
 		os << "\n";
 
 		return os;
@@ -235,6 +245,16 @@ public:
 				disconnected_path = rhs.disconnected_path;
 			}
 		}
+		if (rhs.signal) {
+			if (signal) {
+				if (signal != rhs.signal) {
+					yyerror(_("Profile flag kill.signal set to conflicting values: '%d' and '%d'"), signal, rhs.signal);
+				}
+				// same so do nothing
+			} else {
+				signal = rhs.signal;
+			}
+		}
 
 		/* if we move to dupping disconnected_path will need to have
 		 * an assignment and copy constructor and a destructor

parser/signal.cc

@@ -121,7 +121,7 @@ int parse_signal_perms(const char *str_perms, perms_t *perms, int fail)
 	return parse_X_perms("signal", AA_VALID_SIGNAL_PERMS, str_perms, perms, fail);
 }
 
-static int find_signal_mapping(const char *sig)
+int find_signal_mapping(const char *sig)
 {
 	if (strncmp("rtmin+", sig, 6) == 0) {
 		char *end;

parser/signal.h

@@ -31,6 +31,7 @@
 
 typedef set<int> Signals;
 
+int find_signal_mapping(const char *sig);
 int parse_signal_perms(const char *str_perms, perms_t *perms, int fail);
 
 class signal_rule: public perms_rule_t {

parser/tst/simple_tests/profile/flags/flags_bad67.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure bad signal value
+#=EXRESULT FAIL
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=0) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_bad68.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure bad signal value
+#=EXRESULT FAIL
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=foo) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_bad69.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure bad signal value
+#=EXRESULT FAIL
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=hup.) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok40.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure conflicting mode flags cause an error
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(prompt, kill.signal=hup) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok41.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure signal.kill works with different flags and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(enforce, kill.signal=kill) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok42.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different flags and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=int, unconfined) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok43.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different modes and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=quit, kill) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok44.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different modes and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=hup, complain) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok45.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different modes and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=ill, enforce) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok46.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different modes and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill, kill.signal=trap) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok47.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different modes and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(complain, kill.signal=bus) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok48.sd

@@ -0,0 +1,10 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different flags and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(enforce, kill.signal=usr1) {
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok49.sd

@@ -0,0 +1,12 @@
+#
+#=DESCRIPTION Ensure kill.signals works with different flags and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=stop audit) {
+  #include <includes/base>
+
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

parser/tst/simple_tests/profile/flags/flags_ok50.sd

@@ -0,0 +1,12 @@
+#
+#=DESCRIPTION Ensure kill.signal works with different flags and signals
+#=EXRESULT PASS
+# vim:syntax=subdomain
+# Last Modified: Sun Apr 17 19:44:44 2005
+#
+/does/not/exist flags=(kill.signal=emt) {
+  #include <includes/base>
+
+  /usr/X11R6/lib/lib*so* r,
+  /does/not/exist r,
+}

utils/test/test-parser-simple-tests.py

@@ -167,6 +167,9 @@ exception_not_raised = (
     'profile/flags/flags_bad64.sd',
     'profile/flags/flags_bad65.sd',
     'profile/flags/flags_bad66.sd',
+    'profile/flags/flags_bad67.sd',
+    'profile/flags/flags_bad68.sd',
+    'profile/flags/flags_bad69.sd',
     'profile/flags/flags_bad_disconnected_path1.sd',
     'profile/flags/flags_bad_disconnected_path2.sd',
     'profile/flags/flags_bad_disconnected_path3.sd',