Searched hist:"21 f60661" (Results 1 – 4 of 4) sorted by relevance
/openbmc/linux/security/apparmor/include/ |
H A D | match.h | 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution
Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job.
eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/
Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution.
Signed-off-by: John Johansen <john.johansen@canonical.com> 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen <john.johansen@canonical.com>
|
/openbmc/linux/security/apparmor/ |
H A D | match.c | 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution
Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job.
eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/
Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution.
Signed-off-by: John Johansen <john.johansen@canonical.com> 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen <john.johansen@canonical.com>
|
H A D | domain.c | 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution
Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job.
eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/
Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution.
Signed-off-by: John Johansen <john.johansen@canonical.com> 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen <john.johansen@canonical.com>
|
H A D | apparmorfs.c | 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution
Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job.
eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/
Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution.
Signed-off-by: John Johansen <john.johansen@canonical.com> 21f60661 Sat Nov 18 21:43:13 CST 2017 John Johansen <john.johansen@canonical.com> apparmor: improve overlapping domain attachment resolution Overlapping domain attachments using the current longest left exact match fail in some simple cases, and with the fix to ensure consistent behavior by failing unresolvable attachments it becomes important to do a better job. eg. under the current match the following are unresolvable where the alternation is clearly a better match under the most specific left match rule. /** /{bin/,}usr/ Use a counting match that detects when a loop in the state machine is enter, and return the match count to provide a better specific left match resolution. Signed-off-by: John Johansen <john.johansen@canonical.com>
|