linux-stable.git/security/apparmor/match.c, branch v5.2

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

2019-06-05T15:37:17+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation version 2 of the license

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 315 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Allison Randal 
Reviewed-by: Armijn Hemel 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.de
Signed-off-by: Greg Kroah-Hartman

apparmor: fix typo "traverse"

2018-05-03T07:50:12+00:00

Signed-off-by: Zygmunt Krynicki 
Acked-by: Christian Boltz 
Signed-off-by: John Johansen

apparmor: Fix an error code in verify_table_headers()

2018-03-24T00:28:38+00:00

We accidentally return a positive EPROTO instead of a negative -EPROTO.
Since 71 is not an error pointer, that means it eventually results in an
Oops in the caller.

Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")
Signed-off-by: Dan Carpenter 
Signed-off-by: John Johansen

apparmor: improve overlapping domain attachment resolution

2018-02-09T19:30:02+00:00

Overlapping domain attachments using the current longest left exact
match fail in some simple cases, and with the fix to ensure consistent
behavior by failing unresolvable attachments it becomes important to
do a better job.

eg. under the current match the following are unresolvable where
the alternation is clearly a better match under the most specific
left match rule.
  /**
  /{bin/,}usr/

Use a counting match that detects when a loop in the state machine is
enter, and return the match count to provide a better specific left
match resolution.

Signed-off-by: John Johansen

apparmor: dfa split verification of table headers

2018-02-09T19:30:02+00:00

separate the different types of verification so they are logically
separate and can be reused separate of each other.

Signed-off-by: John Johansen

apparmor: dfa add support for state differential encoding

2018-02-09T19:30:01+00:00

State differential encoding can provide better compression for
apparmor policy, without having significant impact on match time.

Signed-off-by: John Johansen

apparmor: dfa move character match into a macro

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen

apparmor: use the dfa to do label parse string splitting

2018-02-09T19:30:01+00:00

The current split scheme is actually wrong in that it splits
  ///&

where that is invalid and should fail. Use the dfa to do a proper
bounded split without having to worry about getting the string
processing right in code.

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

apparmor: add first substr match to dfa

2018-02-09T19:30:01+00:00

Signed-off-by: John Johansen 
Acked-by: Seth Arnold

doc: ReSTify apparmor.txt

2017-05-18T16:32:38+00:00

Adjusts for ReST markup and moves under LSM admin guide.

Acked-by: John Johansen 
Signed-off-by: Kees Cook 
Signed-off-by: Jonathan Corbet