mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/parser/tst/simple_tests/file/priority
History
John Johansen e3fca60d11 parser: add the ability to specify a priority prefix to rules 
This enables adding a priority to a rules in policy, finishing out the
priority work done to plumb priority support through the internals in
the previous patch.

Rules have a default priority of 0. The priority prefix can be added
before the other currently support rule prefixes, ie.

  [priority prefix][audit qualifier][rule mode][owner]

If present a numerical priority can be assigned to the rule, where the
greater the number the higher the priority. Eg.

    priority=1 audit file r /etc/passwd,

    priority=-1 deny file w /etc/**,

Rule priority allows the rule with the highest priority to completely
override lower priority rules where they overlap. Within a given
priority level rules will accumulate in standard apparmor fashion.

    Eg. given
        priority=1 w   /*c,
        priority=0 r   /a*,
        priority=-1 k  /*b*,

    /abc, /bc, /ac   .. will have permissions of w
    /ab, /abb, /aaa, .. will have permissions of r
    /b, /bcb, /bab,  .. will have permissions of k

User specified rule priorities are currently capped at the arbitrary
values of 1000, and -1000.

Notes:
* not all rule types support the priority prefix. Rukes like
  - network
  - capability
  - rlimits need to be reworked
  need to be reworked to properly preserve the policy rule structure.
* this patch does not support priority on rule blocks
* this patch does not support using a variable in the priority value.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-08-14 17:15:24 -07:00
..
front_perms_ok_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
front_perms_ok_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_4.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_5.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_alternations_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_alternations_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_alternations_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_append_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_bare_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_carat_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_carat_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_comma_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_comma_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_deny_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_deny_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_deny_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_deny_4.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_embedded_spaces_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_embedded_spaces_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_embedded_spaces_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_embedded_spaces_4.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_inv_char_class.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_link_audit_deny_owner_subset.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_link_owner.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_lock_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_mmap_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_mmap_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_octal_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_octal_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_other_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_other_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_other_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_quoted_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_quoted_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_quoted_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_quoted_4.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_quoted_5.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
ok_slashquote_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
stacking_ok_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_src_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_src_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_src_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_src_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_src_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_target_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_target_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_target_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_target_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var1_target_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_src_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_src_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_src_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_src_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_src_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_target_ok_audit_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_target_ok_deny_link.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_target_ok_link_1.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_target_ok_link_2.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00
var2_target_ok_link_3.sd parser: add the ability to specify a priority prefix to rules 2024-08-14 17:15:24 -07:00