mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improve validate_profile_mode() and drop PROFILE_MODE_NT_RE

Browse source 
The only difference between PROFILE_MODE_RE and PROFILE_MODE_NT_RE
was that the latter one additionally allowed 'x', which looks wrong.
(Standalone 'x' is ok for deny rules, but those are handled by
PROFILE_MODE_DENY_RE.)

This patch completely drops PROFILE_MODE_NT_RE and the related code in
validate_profile_mode().

Also wrap the two remaining regexes in '^(...)+$' instead of doing it
inside validate_profile_mode(). This makes the code more readable and
also results in a 2% performance improvement when parsing profiles.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
This commit is contained in:
Christian Boltz 2015-07-06 14:45:59 +02:00
parent ece49eefc8
commit f9cae8b1b7
1 changed files with 4 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
utils/apparmor/aa.py
View file

@ -2422,28 +2422,18 @@ def collapse_log():
if not is_known_rule(aa[profile][hat], 'network', NetworkRule(family, sock_type)):
log_dict[aamode][profile][hat]['netdomain'][family][sock_type] = True
PROFILE_MODE_RE = re.compile('r|w|l|m|k|a|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix')
PROFILE_MODE_NT_RE = re.compile('r|w|l|m|k|a|x|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix')
PROFILE_MODE_DENY_RE = re.compile('r|w|l|m|k|a|x')
PROFILE_MODE_RE = re.compile('^(r|w|l|m|k|a|ix|ux|px|pux|cx|pix|cix|Ux|Px|PUx|Cx|Pix|Cix)+$')
PROFILE_MODE_DENY_RE = re.compile('^(r|w|l|m|k|a|x)+$')
def validate_profile_mode(mode, allow, nt_name=None):
if allow == 'deny':
pattern = '^(%s)+$' % PROFILE_MODE_DENY_RE.pattern
if re.search(pattern, mode):
return True
else:
return False
elif nt_name:
pattern = '^(%s)+$' % PROFILE_MODE_NT_RE.pattern
if re.search(pattern, mode):
if PROFILE_MODE_DENY_RE.search(mode):
return True
else:
return False
else:
pattern = '^(%s)+$' % PROFILE_MODE_RE.pattern
if re.search(pattern, mode):
if PROFILE_MODE_RE.search(mode):
return True
else:
return False