[apparmor] [PATCH 01/10] Fix compilation failure of deny link rules

[John Johansen]

BugLink: http://bugs.launchpad.net/bugs/1433829

The apparmor_parser fails to compile deny rules with only link permissions.

  Eg.
       deny /f l,
       deny l /f,
       deny link /f -> /d,

Will all fail to compile with the following assert

  apparmor_parser: aare_rules.cc:99: Node* convert_file_perms(int, uint32_t, uint32_t, bool): Assertion `perms != 0' failed.

NOTE: this is a minimal patch a bigger patch that cleans-up and separates
      and reorganizes file, link, exec, and change_profile rules is needed

Signed-off-by: John Johansen <john.johansen at canonical.com>
---
 parser/parser_regex.c                              | 9 +++++++--
 parser/tst/simple_tests/file/ok_audit_deny_link.sd | 9 +++++++++
 parser/tst/simple_tests/file/ok_deny_link.sd       | 9 +++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 parser/tst/simple_tests/file/ok_audit_deny_link.sd
 create mode 100644 parser/tst/simple_tests/file/ok_deny_link.sd

diff --git a/parser/parser_regex.c b/parser/parser_regex.c
index 45f7f3e..96f377a 100644
--- a/parser/parser_regex.c
+++ b/parser/parser_regex.c
@@ -522,9 +522,14 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
 	 * out by a deny rule, as both pieces of the link pair must
 	 * match.  audit info for the link is carried on the second
 	 * entry of the pair
+	 *
+	 * So if a deny rule only record it if there are permissions other
+	 * than link in the entry.
+	 * TODO: split link and change_profile entries earlier
 	 */
-	if (entry->deny && (entry->mode & AA_LINK_BITS)) {
-		if (!dfarules->add_rule(tbuf.c_str(), entry->deny,
+	if (entry->deny) {
+		if ((entry->mode & ~(AA_LINK_BITS | AA_CHANGE_PROFILE)) &&
+		    !dfarules->add_rule(tbuf.c_str(), entry->deny,
 					entry->mode & ~AA_LINK_BITS,
 					entry->audit & ~AA_LINK_BITS, dfaflags))
 			return FALSE;
diff --git a/parser/tst/simple_tests/file/ok_audit_deny_link.sd b/parser/tst/simple_tests/file/ok_audit_deny_link.sd
new file mode 100644
index 0000000..393f906
--- /dev/null
+++ b/parser/tst/simple_tests/file/ok_audit_deny_link.sd
@@ -0,0 +1,9 @@
+#
+#=DESCRIPTION simple link access test
+#=EXRESULT PASS
+#
+
+profile test {
+  audit deny link /alpha/beta -> /tmp/**,
+}
+
diff --git a/parser/tst/simple_tests/file/ok_deny_link.sd b/parser/tst/simple_tests/file/ok_deny_link.sd
new file mode 100644
index 0000000..fe0684c
--- /dev/null
+++ b/parser/tst/simple_tests/file/ok_deny_link.sd
@@ -0,0 +1,9 @@
+#
+#=DESCRIPTION simple link access test
+#=EXRESULT PASS
+#
+
+profile test {
+  deny link /alpha/beta -> /tmp/**,
+}
+
-- 
2.1.4