Changes in match.c

9208c05f - apparmor: add support for 2^24 states to the dfa state machine.

Sat, 24 Aug 2024 04:40:47 +0000

apparmor: add support for 2^24 states to the dfa state machine.Currently the dfa state machine is limited by its default, next, andcheck tables using u16. Allow loading of u32 tables, and if u16 tablesare loaded map them to u32.The number of states allowed does not increase to 2^32 because thebase table uses the top 8 bits of its u32 for flags. Moving the flagsinto a separate table allowing a full 2^32 bit range wil be done ina separate patch.Link: https://gitlab.com/apparmor/apparmor/-/issues/419Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

98b824ff - apparmor: refcount the pdb

Fri, 28 Apr 2023 12:32:52 +0000

apparmor: refcount the pdbWith the move to permission tables the dfa is no longer a standalone entity when used, needing a minimum of a permission table.However it still could be shared among different pdbs each usinga different permission table.Instead of duping the permission table when sharing a pdb, add arefcount to the pdb so it can be easily shared.Reviewed-by: Georgia Garcia Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

7abbbd57 - apparmor: Fix kernel-doc warnings in apparmor/match.c

Sun, 25 Jun 2023 01:13:45 +0000

apparmor: Fix kernel-doc warnings in apparmor/match.cFix kernel-doc warnings:security/apparmor/match.c:148: warning: Function parameter or member'tables' not described in 'verify_table_headers'security/apparmor/match.c:289: warning: Excess function parameter'kr' description in 'aa_dfa_free_kref'security/apparmor/match.c:289: warning: Function parameter or member'kref' not described in 'aa_dfa_free_kref'Signed-off-by: Gaosheng Cui Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

f6c64dc3 - apparmor: Add __init annotation to aa_{setup/teardown}_dfa_engine()

Sat, 29 Oct 2022 01:25:05 +0000

apparmor: Add __init annotation to aa_{setup/teardown}_dfa_engine()The aa_setup_dfa_engine() and aa_teardown_dfa_engine() is only called inapparmor_init(), so let us add __init annotation to them.Fixes: 11c236b89d7c ("apparmor: add a default null dfa")Signed-off-by: Xiu Jianfeng Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

33fc95d8 - apparmor: preparse for state being more than just an integer

Mon, 17 Jan 2022 21:43:49 +0000

apparmor: preparse for state being more than just an integerConvert from an unsigned int to a state_t for state position. This isa step in prepping for the state position carrying some additionalflags, and a limited form of backtracking to support variables.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

c27c6bd2 - apparmor: ensure that dfa state tables have entries

Tue, 31 Mar 2020 06:37:54 +0000

apparmor: ensure that dfa state tables have entriesCurrently it is possible to specify a state machine table with 0 length,this is not valid as optional tables are specified by not definingthe table as present. Further this allows by-passing the base tablesrange check against the next/check tables.Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")Reported-by: Mike Salvatore Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

0df34a64 - apparmor: add outofband transition and use it in xattr match

Tue, 30 Jul 2019 09:42:13 +0000

apparmor: add outofband transition and use it in xattr matchThere are cases where the a special out of band transition that cannot be triggered by input is useful in separating match conditionsin the dfa encoding.The null_transition is currently used as an out of band transitionfor match conditions that can not contain a \0 in their inputbut apparmor needs an out of band transition for cases wherethe match condition is allowed to contain any input character.Achieve this by allowing for an explicit transition out of inputrange that can only be triggered by code.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

dae60293 - apparmor: add consistency check between state and dfa diff encode flags

Sat, 31 Aug 2019 22:55:45 +0000

apparmor: add consistency check between state and dfa diff encode flagsCheck that a states diff encode flag is only set if diff encode isenabled in the dfa header.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

c6596969 - apparmor: add a valid state flags check

Sat, 31 Aug 2019 22:55:06 +0000

apparmor: add a valid state flags checkAdd a check to ensure only known state flags are set on eachstate in the dfa.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

136db994 - apparmor: increase left match history buffer size

Fri, 31 May 2019 13:54:54 +0000

apparmor: increase left match history buffer sizeThere have been cases reported where a history buffer size of 8 wasnot enough to resolve conflict overlaps. Increase the buffer to andget rid of the size element which is currently just storing theconstant WB_HISTORY_SIZE.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

b886d83c - treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441

Sat, 01 Jun 2019 08:08:55 +0000

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation version 2 of the licenseextracted by the scancode license scanner the SPDX license identifier GPL-2.0-onlyhas been chosen to replace the boilerplate/reference in 315 file(s).Signed-off-by: Thomas Gleixner Reviewed-by: Allison Randal Reviewed-by: Armijn Hemel Cc: linux-spdx@vger.kernel.orgLink: https://lkml.kernel.org/r/20190531190115.503150771@linutronix.deSigned-off-by: Greg Kroah-Hartman List of files: /linux-6.15/security/apparmor/match.c

5d2371e1 - apparmor: fix typo "traverse"

Thu, 12 Apr 2018 10:34:32 +0000

apparmor: fix typo "traverse"Signed-off-by: Zygmunt Krynicki Acked-by: Christian Boltz Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

d53c9f4d - apparmor: Fix an error code in verify_table_headers()

Mon, 19 Mar 2018 09:12:31 +0000

apparmor: Fix an error code in verify_table_headers()We accidentally return a positive EPROTO instead of a negative -EPROTO.Since 71 is not an error pointer, that means it eventually results in anOops in the caller.Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")Signed-off-by: Dan Carpenter Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

21f60661 - apparmor: improve overlapping domain attachment resolution

Sun, 19 Nov 2017 03:43:13 +0000

apparmor: improve overlapping domain attachment resolutionOverlapping domain attachments using the current longest left exactmatch fail in some simple cases, and with the fix to ensure consistentbehavior by failing unresolvable attachments it becomes important todo a better job.eg. under the current match the following are unresolvable wherethe alternation is clearly a better match under the most specificleft match rule. /** /{bin/,}usr/Use a counting match that detects when a loop in the state machine isenter, and return the match count to provide a better specific leftmatch resolution.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

d901d6a2 - apparmor: dfa split verification of table headers

Tue, 08 Aug 2017 20:01:01 +0000

apparmor: dfa split verification of table headersseparate the different types of verification so they are logicallyseparate and can be reused separate of each other.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

031dcc8f - apparmor: dfa add support for state differential encoding

Tue, 08 Aug 2017 19:10:50 +0000

apparmor: dfa add support for state differential encodingState differential encoding can provide better compression forapparmor policy, without having significant impact on match time.Signed-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

074c1cd7 - apparmor: dfa move character match into a macro

Tue, 08 Aug 2017 18:58:33 +0000

apparmor: dfa move character match into a macroSigned-off-by: John Johansen List of files: /linux-6.15/security/apparmor/match.c

6e0654d2 - apparmor: use the dfa to do label parse string splitting

Wed, 06 Sep 2017 21:57:59 +0000

apparmor: use the dfa to do label parse string splittingThe current split scheme is actually wrong in that it splits ///&where that is invalid and should fail. Use the dfa to do a properbounded split without having to worry about getting the stringprocessing right in code.Signed-off-by: John Johansen Acked-by: Seth Arnold List of files: /linux-6.15/security/apparmor/match.c

cf65fabc - apparmor: add first substr match to dfa

Wed, 06 Sep 2017 09:53:15 +0000

apparmor: add first substr match to dfaSigned-off-by: John Johansen Acked-by: Seth Arnold List of files: /linux-6.15/security/apparmor/match.c

26fccd9e - doc: ReSTify apparmor.txt

Sat, 13 May 2017 11:51:45 +0000

doc: ReSTify apparmor.txtAdjusts for ReST markup and moves under LSM admin guide.Acked-by: John Johansen Signed-off-by: Kees Cook Signed-off-by: Jonathan Corbet List of files: /linux-6.15/security/apparmor/match.c