~jjohansen/+junk/apparmor_dbus

~jjohansen/+junk/apparmor_dbus_patches » Changes from revision 1871

From Revision 1871 to 1852

Rev	Summary	Authors	Tags	Date
1871	patch parser and libapparmor to support dbus mediation patch parser and libapparmor to support dbus mediation	John Johansen		12 years ago
1870	Move rlimit start condition and rules up to be with Move rlimit start condition and rules up to be with other start conditions. The rlimit start condition was separating different rules of the base set making the lexer grammer harder to read than necessary. Signed-off-by: John Johansen <john.johansen@canonical.com>	John Johansen		12 years ago
1869	update version number to indicate we are in a dev version, u... update version number to indicate we are in a dev version, using the proposed .99 versioning to fix the version problem we had with using alpha, beta, etc. because apt and rpm have different version comparisons	John Johansen		12 years ago
1868	To reduce memory overhead of dfa creation convert to using a... To reduce memory overhead of dfa creation convert to using a Node Vector instead of a NodeSet. We need to store sets of Nodes, to compute the dfa but the C++ set is not the most efficient way to do this as, it has a has a lot of overhead just to store a single pointer. Instead we can use an array of tightly packed pointers + a some header information. We can do this because once the Set is finalized it will not change, we just need to be able to reference and compare to it. We don't use C++ Vectors as they have more overhead than a plain array and we don't need their additional functionality. We only replace the use of hashedNodeSets for non-accepting states as these sets are only used in the dfa construction, and dominate the memory usage. The accepting states still may need to be modified during minimization and there are only a small number of entries (20-30), so it does not make sense to convert them. Also introduce a NodeVec cache that serves the same purpose as the NodeSet cache that was introduced earlier. This is not abstracted this out as nicely as might be desired but avoiding the use of a custom iterator and directly iterating on the Node array allows for a small performance gain, on larger sets. This patch reduces the amount of heap memory used by dfa creation by about 4x - overhead. So for small dfas the savings is only 2-3x but on larger dfas the savings become more and more pronounced. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1867	Split the nodeset used in computing the dfa into two sets, a... Split the nodeset used in computing the dfa into two sets, accepting and non-accepting, and have the proto-state use them. To reduce memory overhead each set gains its own "cache" that make sure there is only a single instance of each NodeSet generated. And since we have a cache abstraction, move relavent stats into it. Also refactor code slightly to make caches and work_queue etc, DFA member variables instead of passing them as parameters. The split + caching results in a small reduction in memory use as the cost of ProtoState + Caching is less than the redundancy that is eliminated. However this results in a small decrease in performance. Sorry I know this really should have been split into multiple patches but the patch evolved and I got lazy and decided to just not bother splitting it. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1866	Replace usage of NodeSet with ProtoState in dfa creation. Replace usage of NodeSet with ProtoState in dfa creation. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1865	Add a new class hashedNodeSet. Add a new class hashedNodeSet. It is the functional equivalent of ProtoState. We do this to provide a new level of abstraction that ProtoState can leverage, when the node types are split. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1864	Now that we have a proper class we don't need a functor to d... Now that we have a proper class we don't need a functor to do comparisons, we can fold it into the classes operator<. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1863	Begin preparing to split accept nodes and non-accept nodes. Begin preparing to split accept nodes and non-accept nodes. Create a new ProtoState class that will encapsulate the split, but for this patch it will just contain what was done previously with NodeSet Signed-off-by: John Johansen <john.johansen@canonical.com>	John Johansen		12 years ago
1862	Rename compressed_hfa.{c,h} and TransitionTable within them ... Rename compressed_hfa.{c,h} and TransitionTable within them to chfa. This is done to be clear what TransitionTable is, as we will then add matching capabilities. Renaming the files is just to make them consistent with the class in the file. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1861	Make sure that state always has otherwise set Make sure that state always has otherwise set Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1860	Now that State Cases have been renamed, rename NodeCases bac... Now that State Cases have been renamed, rename NodeCases back to Cases. Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1859	This helps make the meaning of things a little clearer and p... This helps make the meaning of things a little clearer and provides a clear distinction betwen NodeCases, and State transitions Signed-off-by: John Johansen <john.johansen@canonical.com> Acked-by: Kees Cook <kees@ubuntu.com>	John Johansen		12 years ago
1858	AppArmor 2.7 tag AppArmor 2.7 tag	John Johansen		12 years ago
1857	AppArmor 2.7 AppArmor 2.7	John Johansen	apparmor_2.7.0	12 years ago
1856	This fixes the libapparmor log parsing library to properly p... This fixes the libapparmor log parsing library to properly parse log entries where the comm entry has been hex-encoded. This occurs when the binary being confined contains a space or other problematic character in its filename. A test case is included.	Steve Beattie		12 years ago
1855	Add a testcase for libapparmor for encoded profiles to ensur... Add a testcase for libapparmor for encoded profiles to ensure that https://bugs.launchpad.net/apparmor/+bug/897957/ is in the utils and not the parsing library itself.	Steve Beattie		12 years ago
1854	abstractions/python: for some reason, the python runtimes ne... abstractions/python: for some reason, the python runtimes need access to pyconfig.h	Steve Beattie		12 years ago
1853	/usr/sbin/traceroute6 is a symlink to /usr/sbin/traceroute. /usr/sbin/traceroute6 is a symlink to /usr/sbin/traceroute. This patch allows "network inet6 raw" in addition to the ipv4 rule. References: https://bugzilla.novell.com/show_bug.cgi?id=733312 Acked-By: Steve Beattie <sbeattie@ubuntu.com>	Christian Boltz		12 years ago
1852	rpmlint complains about an outdated FSF address in parser/CO... rpmlint complains about an outdated FSF address in parser/COPYING.GPL. This commit upgrades the COPYING.GPL file to the latest version from http://www.gnu.org/licenses/gpl-2.0.txt - which means some small text and whitespace changes and of course the correct address. Acked-by: John Johansen <john.johansen@canonical.com>	Christian Boltz		12 years ago

Older »