• John Johansen's avatar
    apparmor: improve overlapping domain attachment resolution · 21f60661
    John Johansen authored
    Overlapping domain attachments using the current longest left exact
    match fail in some simple cases, and with the fix to ensure consistent
    behavior by failing unresolvable attachments it becomes important to
    do a better job.
    
    eg. under the current match the following are unresolvable where
    the alternation is clearly a better match under the most specific
    left match rule.
      /**
      /{bin/,}usr/
    
    Use a counting match that detects when a loop in the state machine is
    enter, and return the match count to provide a better specific left
    match resolution.
    Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
    21f60661
match.h 5.17 KB