mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
a6691ca53e
Expression simplification can get into an infinite loop due to eps
pairs hiding behind and alternation that can't be caught by
normalize_eps() (which exists in the first place to stop a similar
loop).
The loop in question happens in AltNode::normalize when a subtree has
the following structure.
1. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
eps alt
/\
/ \
/ \
alt eps
/\
/ \
/ \
eps eps
2. if (normalize_eps(dir)) results in
alt
/\
/ \
/ \
alt eps
/\
/ \
/ \
alt eps
/\
/ \
/ \
eps eps
3. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
alt alt
/\ /\
/ \ / \
/ \ / \
eps eps eps eps
4. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
eps alt
/\
/ \
/ \
eps alt
/\
/ \
/ \
eps eps
5. if (normalize_eps(dir)) results in
alt
/\
/ \
/ \
alt eps
/\
/ \
/ \
eps alt
/\
/ \
/ \
eps eps
6. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
eps alt
/\
/ \
/ \
alt eps
/\
/ \
/ \
eps eps
back to beginning of cycle
Fix this by detecting the creation of an eps_pair in rotate_node(),
that pair can be immediately eliminated by simplifying the tree in that
step.
In the above cycle the pair creation is caught at step 3 resulting
in
3. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
alt eps
/\
/ \
/ \
eps eps
4. elseif (child[dir]->is_type(ALT_NODE)) rotate_node too
alt
/\
/ \
/ \
eps alt
/\
/ \
/ \
eps eps
which gets reduced to
alt
/\
/ \
/ \
eps eps
breaking the normalization loop. The degenerate alt node will be caught
in turn when its parent is dealt with.
This needs to be backported to all releases
Closes: https://gitlab.com/apparmor/apparmor/-/issues/398
Fixes:
|
||
|---|---|---|
| .. | ||
| libapparmor_re | ||
| po | ||
| tst | ||
| aa-teardown | ||
| aa-teardown.pod | ||
| af_rule.cc | ||
| af_rule.h | ||
| af_unix.cc | ||
| af_unix.h | ||
| all_rule.cc | ||
| all_rule.h | ||
| apparmor.d.pod | ||
| apparmor.pod | ||
| apparmor.service | ||
| apparmor.systemd | ||
| apparmor_parser.pod | ||
| apparmor_xattrs.pod | ||
| base_af_names.h | ||
| base_cap_names.h | ||
| bignum.h | ||
| capability.h | ||
| common_flags.h | ||
| common_optarg.c | ||
| common_optarg.h | ||
| COPYING.GPL | ||
| dbus.cc | ||
| dbus.h | ||
| default_features.c | ||
| file_cache.h | ||
| frob_slack_rc | ||
| immunix.h | ||
| io_uring.cc | ||
| io_uring.h | ||
| lib.c | ||
| lib.h | ||
| Makefile | ||
| mount.cc | ||
| mount.h | ||
| mqueue.cc | ||
| mqueue.h | ||
| network.cc | ||
| network.h | ||
| parser.conf | ||
| parser.h | ||
| parser_alias.c | ||
| parser_common.c | ||
| parser_include.c | ||
| parser_include.h | ||
| parser_interface.c | ||
| parser_lex.l | ||
| parser_main.c | ||
| parser_merge.c | ||
| parser_misc.c | ||
| parser_policy.c | ||
| parser_regex.c | ||
| parser_symtab.c | ||
| parser_variable.c | ||
| parser_yacc.y | ||
| policy_cache.c | ||
| policy_cache.h | ||
| policydb.h | ||
| profile-load | ||
| profile.cc | ||
| profile.h | ||
| ptrace.cc | ||
| ptrace.h | ||
| rc.apparmor.functions | ||
| rc.apparmor.slackware | ||
| README | ||
| README.devel | ||
| rule.cc | ||
| rule.h | ||
| signal.cc | ||
| signal.h | ||
| techdoc.tex | ||
| unit_test.h | ||
| userns.cc | ||
| userns.h | ||
The apparmor_parser allows you to add, replace, and remove AppArmor policy through the use of command line options. The default is to add. `apparmor_parser --help` shows what the command line options are. You can also find more information at https://wiki.apparmor.net -- The AppArmor development team