apparmor:master

Last commit made on 2021-02-25
Get this branch:
git clone -b master https://git.launchpad.net/apparmor

Branch merges

Branch information

Name:
master
Repository:
lp:apparmor

Recent commits

0f21ca6... by Christian Boltz <email address hidden> on 2021-02-25

Merge branch 'cboltz-parse-profile-start' into 'master'

split off parse_profile_start_to_storage() from parse_profile_data()

See merge request apparmor/apparmor!710

Acked-by: Steve Beattie <email address hidden>

0f1d5fd... by Christian Boltz <email address hidden> on 2021-02-25

Merge branch 'cboltz-preamble-ruletypes' into 'master'

profile_list: add preamble_ruletypes

See merge request apparmor/apparmor!708

Acked-by: Steve Beattie <email address hidden>

d5de969... by John Johansen <email address hidden> on 2021-02-17

Merge parser: replace dynamic_cast with is_type method

The dynamic_cast operator is slow as it needs to look at RTTI information and even does some string comparisons, especially in deep hierarchies. Profiling with callgrind showed that dynamic_cast can eat a huge portion of the running time, as it takes most of the time that is spent in the simplify_tree() function. For some complex profiles, the number of calls to dynamic_cast can be in the range of millions.

This commit replaces the use of dynamic_cast in the Node hierarchy with a method called is_type(), which returns true if the pointer can be casted to the specified type. It works by looking at an Node object field that is an integer with bits set for each type up in the hierarchy. Therefore, dynamic_cast is replaced by a simple bits operation.

In my tests, for complex profiles the improvement in speed even made running apparmor_parser with "-O no-expr-simplify" slower that when simplifying, apparently because the smaller trees obtained after the expression simplification require less calls to DFA::update_state_transitions(), and that compensates the now significantly slower time spent in simplify_tree(). This opens the door to maybe avoid "-O no-expr-simplify" in the snapd daemon, thus allowing faster run-time checks in the kernel.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/711
Acked-by: John Johansen <email address hidden>

b6fbe10... by John Johansen on 2021-02-16

parser: fix build issue with REALLOCARRAY check

On some systems the build of the parser is spitting out

cc: fatal error: no input files
compilation terminated.

This is being caused by the REALLOCARRAY checkfailing due to cpp trying
to check for both input and output files and not correctly falling
back to stdin/stdout if infile and outfile aren't specified.

Fix this by being explicit that infile and outfile are supposed to
use stdin and stdout.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/712
Signed-off-by: John Johansen <email address hidden>
Acked-by: Christian Boltz <email address hidden>

5aab543... by Alfonso Sanchez-Beato on 2021-02-15

parser: replace dynamic_cast with is_type method

The dynamic_cast operator is slow as it needs to look at RTTI
information and even does some string comparisons, especially in deep
hierarchies like the one for Node. Profiling with callgrind showed
that dynamic_cast can eat a huge portion of the running time, as it
takes most of the time that is spent in the simplify_tree()
function. For some complex profiles, the number of calls to
dynamic_cast can be in the range of millions.

This commit replaces the use of dynamic_cast in the Node hierarchy
with a method called is_type(), which returns true if the pointer can
be casted to the specified type. It works by looking at a Node object
field that is an integer with bits set for each type up in the
hierarchy. Therefore, dynamic_cast is replaced by a simple bits
operation.

This change can reduce the compilation times for some profiles more
that 50%, especially in arm/arm64 arch. This opens the door to maybe
avoid "-O no-expr-simplify" in the snapd daemon, as now that option
would make the compilation slower in almost all cases.

This is the example profile used in some of my tests, with this change
the run-time is around 1/3 of what it was before on an x86 laptop:

profile "test" (attach_disconnected,mediate_deleted) {
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{Close,Destroy,Enable}IC"
    peer=(label=unconfined),
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member=Reset
    peer=(label=unconfined),
dbus receive
    bus=fcitx
    peer=(label=unconfined),
dbus receive
    bus=session
    interface=org.fcitx.Fcitx.*
    peer=(label=unconfined),
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="Focus{In,Out}"
    peer=(label=unconfined),
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{CommitPreedit,Set*}"
    peer=(label=unconfined),
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.fcitx.Fcitx.InputContext
    member="{MouseEvent,ProcessKeyEvent}"
    peer=(label=unconfined),
dbus send
    bus={fcitx,session}
    path=/inputcontext_[0-9]*
    interface=org.freedesktop.DBus.Properties
    member=GetAll
    peer=(label=unconfined),
dbus (send)
    bus=session
    path=/org/a11y/bus
    interface=org.a11y.Bus
    member=GetAddress
    peer=(label=unconfined),
dbus (send)
    bus=session
    path=/org/a11y/bus
    interface=org.freedesktop.DBus.Properties
    member=Get{,All}
    peer=(label=unconfined),
dbus (receive, send)
    bus=accessibility
    path=/org/a11y/atspi/**
    peer=(label=unconfined),
dbus (send)
    bus=system
    path=/org/freedesktop/Accounts
    interface=org.freedesktop.DBus.Introspectable
    member=Introspect
    peer=(label=unconfined),
dbus (send)
    bus=system
    path=/org/freedesktop/Accounts
    interface=org.freedesktop.Accounts
    member=FindUserById
    peer=(label=unconfined),
dbus (receive, send)
    bus=system
    path=/org/freedesktop/Accounts/User[0-9]*
    interface=org.freedesktop.DBus.Properties
    member={Get,PropertiesChanged}
    peer=(label=unconfined),
dbus (send)
    bus=session
    interface=org.gtk.Actions
    member=Changed
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (receive)
    bus=session
    interface=org.gtk.Actions
    member={Activate,DescribeAll,SetState}
    peer=(label=unconfined),
dbus (receive)
    bus=session
    interface=org.gtk.Menus
    member={Start,End}
    peer=(label=unconfined),
dbus (send)
    bus=session
    interface=org.gtk.Menus
    member=Changed
    peer=(name=org.freedesktop.DBus, label=unconfined),
dbus (send)
    bus=session
    path="/com/ubuntu/MenuRegistrar"
    interface="com.ubuntu.MenuRegistrar"
    member="{Register,Unregister}{App,Surface}Menu"
    peer=(label=unconfined),
}

f7a365f... by Christian Boltz on 2021-02-14

Simplify handling of in_contained_hat

in_contained_hat is needed to know if we are already in a profile or
not. (Simply checking if we are in a hat doesn't work, because something
like "profile foo//bar" will set profile and hat at once, and later
(wrongfully) expect another "}".

However, the way how this variable was set became too complicated.

To simplify the code, set in_contained_hat directly in
parse_profile_data() RE_PROFILE_START instead of returning it via
parse_profile_start() and parse_profile_start_to_storage()

Since this change removes a return value from two functions, also adjust
the tests accordingly.

7cfda27... by Christian Boltz on 2020-12-26

split off parse_profile_start_to_storage() from parse_profile_data()

parse_profile_start_to_storage() converts the result of
parse_profile_start() into a ProfileStorage object.

No functional change, but parse_profile_data() becomes more readable.

Also extend tests to cover parse_profile_start_to_storage().

3a87b33... by John Johansen <email address hidden> on 2021-02-14

Merge Rewrite parse_profile_start() tests to use tests[] array

No functional changes, just more readable.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/709
Acked-by: John Johansen <email address hidden>

7e5c02e... by Christian Boltz on 2020-12-26

Rewrite parse_profile_start() tests to use tests[] array

No functional changes, just more readable.

33f2b36... by Christian Boltz on 2021-02-14

Un-hardcode rule list in ProfileList delete_preamble_duplicates()

Note that before this change, boolean variable definitions were not
checked in delete_preamble_duplicates().