[apparmor] [PATCH 5/7] Fix use of FILEGLOB in apparmor.d.pod
John Johansen
john.johansen at canonical.com
Sat Mar 21 11:53:19 UTC 2015
Refactor FILEGLOB so that it means both quoted and unquoted file globs.
Also
FILEGLOB was uncorrectly referenced in a few places where it should have
allowed for quoting.
There were also a few places that provided a parameter description with
FILEGLOB without defining that that is full equivalent to FILEGLOB.
Signed-off-by: John Johansen <john.johansen at canonical.com>
---
parser/apparmor.d.pod | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/parser/apparmor.d.pod b/parser/apparmor.d.pod
index 10808c9..2e54ee6 100644
--- a/parser/apparmor.d.pod
+++ b/parser/apparmor.d.pod
@@ -107,6 +107,12 @@ B<MOUNT EXPRESSION> = ( I<ALPHANUMERIC> | I<AARE> ) ...
B<PIVOT ROOT RULE> = [ I<QUALIFIERS> ] pivot_root [ oldroot=I<OLD PUT FILEGLOB> ] [ I<NEW ROOT FILEGLOB> ] [ -E<gt> I<PROGRAMCHILD> ]
+B<SOURCE FILEGLOB> = I<FILEGLOB>
+
+B<MOUNTPOINT FILEGLOB> = I<FILEGLOB>
+
+B<OLD PUT FILEGLOB> = I<FILEGLOB>
+
B<PTRACE_RULE> = [ I<QUALIFIERS> ] 'ptrace' [ I<PTRACE ACCESS PERMISSIONS> ] [ I<PTRACE PEER> ]
B<PTRACE ACCESS PERMISSIONS> = I<PTRACE ACCESS> | I<PTRACE ACCESS LIST>
@@ -195,9 +201,13 @@ B<UNIX ATTR COND> 'attr' '=' ( I<AARE> | '(' '"' I<AARE> '"' | I<AARE> ')' )
B<UNIX OPT COND> 'opt' '=' ( I<AARE> | '(' '"' I<AARE> '"' | I<AARE> ')' )
-B<FILE RULE> = [ I<QUALIFIERS> ] [ 'owner' ] [ 'file' ] ( ( '"' I<FILEGLOB> '"' | I<FILEGLOB> ) I<ACCESS> | [I<ACCESS> ( '"' I<FILEGLOB> '"' | I<FILEGLOB> ) ) [ -E<gt> <EXEC TARGET> ] ','
+B<FILE RULE> = [ I<QUALIFIERS> ] [ 'owner' ] [ 'file' ] ( I<FILEGLOB> I<ACCESS> | [I<ACCESS> I<FILEGLOB> ) [ -E<gt> <EXEC TARGET> ] ','
+
+B<FILEGLOB> = ( I<QUOTED FILEGLOB> | I<UNQUOTED FILEGLOB> )
+
+B<QUOTED FILEGLOB> = '"' I<UNQUOTED FILEGLOB> '"'
-B<FILEGLOB> = (must start with '/' (after variable expansion), B<AARE> have special meanings; see below. May include I<VARIABLE>. Rules with embedded spaces or tabs must be quoted. Rules must end with '/' to apply to directories.)
+B<UNQUOTED FILEGLOB> = (must start with '/' (after variable expansion), B<AARE> have special meanings; see below. May include I<VARIABLE>. Rules with embedded spaces or tabs must be quoted. Rules must end with '/' to apply to directories.)
B<ACCESS> = ( 'r' | 'w' | 'a' | 'l' | 'k' | 'm' | I<EXEC TRANSITION> )+ (not all combinations are allowed; see below.)
--
2.1.4
More information about the AppArmor
mailing list