On Thu, Sep 12, 2013 at 04:08:52PM -0700, Steve Beattie wrote: > On Wed, Sep 11, 2013 at 01:47:43AM -0700, Tyler Hicks wrote: > > From: John Johansen <[email protected]> > > > > Remove use of AARE_DFA as the alternate pcre matching engine was removed > > years ago. > > I haven't figured out what's going wrong, but this patch breaks profile > loading around hats: > > $ cat /tmp/sdtest.24517-4609-fPslqn/profile > /home/ubuntu/bzr/apparmor/tests/regression/apparmor/syscall_ptrace { > > ^sub { > /proc/*/attr/current w, > } > } > > $ cat /tmp/sdtest.24517-4609-fPslqn/profile.no_hat > /home/ubuntu/bzr/apparmor/tests/regression/apparmor/syscall_ptrace { > > } > > $ sudo ../../../parser/apparmor_parser /tmp/sdtest.24517-4609-fPslqn/profile > ../../../parser/apparmor_parser: Unable to add "sub". Profile doesn't exist > > $ sudo ../../../parser/apparmor_parser -r > /tmp/sdtest.24517-4609-fPslqn/profile > ../../../parser/apparmor_parser: Unable to replace "sub". Profile doesn't > exist > > $ sudo ../../../parser/apparmor_parser > /tmp/sdtest.24517-4609-fPslqn/profile.no_hat > > $ sudo ../../../parser/apparmor_parser -r > /tmp/sdtest.24517-4609-fPslqn/profile > ../../../parser/apparmor_parser: Unable to replace > "/home/ubuntu/bzr/apparmor/tests/regression/apparmor/syscall_ptrace". > Profile doesn't conform to protocol
Alright, I think I've tracked down the specific issue from this patch:
In:
> diff --git a/parser/parser_interface.c b/parser/parser_interface.c
> index fdd610d..5c2b486 100644
> --- a/parser/parser_interface.c
> +++ b/parser/parser_interface.c
> @@ -665,18 +663,13 @@ int sd_serialize_profile(sd_serialize *p, struct
> codomain *profile,
> }
>
> /* either have a single dfa or lists of different entry types */
> - if (regex_type == AARE_DFA) {
> - if (!sd_serialize_dfa(p, profile->dfa, profile->dfa_size))
> - return 0;
> + if (!sd_serialize_dfa(p, profile->dfa, profile->dfa_size))
> + return 0;
>
> - if (!sd_serialize_xtable(p, profile->exec_table))
> - return 0;
> - } else {
> - PERROR(_("Unknown pattern type\n"));
> - return 1;
> - }
> + if (!sd_serialize_xtable(p, profile->exec_table))
> + return 0;
>
> - if (profile->hat_table && regex_type != AARE_DFA) {
> + if (profile->hat_table) {
Note that the test removed here is if regex_type != AARE_DFA, *not* if
regex_type == AARE_DFA. Since we don't support non AARE_DFA matching
anymore, the code block that follows this test should be removed
entirely, like so:
Signed-off-by: Steve Beattie <[email protected]>
---
parser/parser_interface.c | 9 ---------
1 file changed, 9 deletions(-)
Index: b/parser/parser_interface.c
===================================================================
--- a/parser/parser_interface.c
+++ b/parser/parser_interface.c
@@ -669,15 +669,6 @@ int sd_serialize_profile(sd_serialize *p
if (!sd_serialize_xtable(p, profile->exec_table))
return 0;
- if (profile->hat_table) {
- if (!sd_write_list(p, "hats"))
- return 0;
- if (load_hats(p, profile) != 0)
- return 0;
- if (!sd_write_listend(p))
- return 0;
-
- }
if (!sd_write_structend(p))
return 0;
With this incorporated into the patch, the regression tests all pass
again, in particular all the tests that loads hats.
--
Steve Beattie
<[email protected]>
http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
