mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-06 09:21:00 +01:00
68a9f24fb5
This patch converts the parser's variable expansion from adding new
entries for each additional variable value to incorporating an
alternation that includes all the values for the variable; e.g. given:
@{BINS}=/bin /usr/bin /sbin /usr/sbin
@{BINS}/binary ix,
rather than expanding to exntries for
/bin/binary
/usr/bin/binary
/sbin/binary
/usr/sbin/binary
one entry would remain that looks like:
{/bin,/usr/bin,/sbin,/usr/sbin}/binary
One complication with this patch is that we try to prevent mistakes for
our users with variable expansion around '/'s; it's common for people to
write profiles that contain things like:
@{BAR}=/bingo/*/ /bango/
/foo/@{BAR}/baz
We already have a post-processing step that walks entries looking
for multiple sequences of '/'s and filters them into single
'/' which worked when creating new entries for each variable
expansion. Converting to alternation expansion breaks this filtering,
so code is added that removes leading and trailing slashes in variable
values in the expansion if the character immediately preceding or
following the variable is also a slash.
The intent behind this is to reduce the amount of memory allocations
and structure walking that needed to occur in when converting from the
entry strings to the back end nodes. Examples with real world profiles
showed performance improvements ranging from 2.5% to 10%. However,
because the back end operations are sensitive to the front end inputs,
it is possible for worse results to occur; for example, it takes the
simple_tests/vars/vars_stress_0[123].sd tests significantly longer to
complete after this patch is applied (vars_stress_03.sd in particular
takes ~23 times longer). An initial analysis of profiling output in
this negative case looks like it causes the tree simplification in
the back end to do more work for unknown reasons.
On the other hand, the test simple_tests/vars/vars_dbus_9.sd
(introduced in "[patch 09/12] parser: more dbus variable testcases")
takes ~1 sec to complete on my laptop before this patch, and roughly
0.01s with this patch applied.
(One option would be to keep the "expand entries" approach as an
alternative, but I couldn't come up with a good heuristic for when
to use it instead.)
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
|
||
|---|---|---|
| .. | ||
| libapparmor_re | ||
| po | ||
| tst | ||
| apparmor-parser.spec.in | ||
| apparmor.d.pod | ||
| apparmor.pod | ||
| apparmor_parser.pod | ||
| COPYING.GPL | ||
| dbus.c | ||
| dbus.h | ||
| frob_slack_rc | ||
| immunix.h | ||
| lib.c | ||
| lib.h | ||
| Makefile | ||
| mount.c | ||
| mount.h | ||
| parser.conf | ||
| parser.h | ||
| parser_alias.c | ||
| parser_common.c | ||
| parser_include.c | ||
| parser_include.h | ||
| parser_interface.c | ||
| parser_lex.l | ||
| parser_main.c | ||
| parser_merge.c | ||
| parser_misc.c | ||
| parser_policy.c | ||
| parser_regex.c | ||
| parser_symtab.c | ||
| parser_variable.c | ||
| parser_yacc.y | ||
| policydb.h | ||
| profile.cc | ||
| profile.h | ||
| rc.aaeventd.redhat | ||
| rc.aaeventd.suse | ||
| rc.apparmor.debian | ||
| rc.apparmor.functions | ||
| rc.apparmor.redhat | ||
| rc.apparmor.slackware | ||
| rc.apparmor.suse | ||
| README | ||
| README.devel | ||
| subdomain.conf | ||
| subdomain.conf.pod | ||
| techdoc.tex | ||
| unit_test.h | ||
The apparmor_parser allows you to add, replace, and remove AppArmor policy through the use of command line options. The default is to add. `apparmor_parser --help` shows what the command line options are. You can also find more information at http://wiki.apparmor.net Please send all complaints, feature requests, rants about the software, and questions to the apparmor@lists.ubuntu.com mailing list. Bug reports can be filed against the AppArmor project on launchpad.net at https://launchpad.net/apparmor or reported to the mailing list directly for those who wish not to register for an account on launchpad. Security issues can be filed as security bugs on launchpad or directed to security@ubuntu.com. We will attempt to conform to the RFP vulnerability disclosure protocol: http://www.wiretrip.net/rfp/policy.html Thanks. -- The AppArmor development team