Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure fagenrules handles unexpected incomplete lines #331

Merged
merged 1 commit into from
Feb 9, 2025

Conversation

ttybitnik
Copy link
Contributor

Hi, thanks for all the work on this amazing software!

Context

While fine-tuning some rules this weekend, I ended up encountering an edge case. Basically, if any .rules file under rules.d doesn't end with a proper POSIX line (ending with a newline) or a comment, the script concatenates the last line/rule of that file with the first line of the next file, resulting in a malformed compiled.rules.

Normally, this wouldn't be an issue, as most tools and editors used to edit or create the .rules files add the newline character by default to ensure POSIX compliance. However, this might not always be the case, depending on users' configuration, awareness, or unexpected behavior while using these tools.

For example, I just realized that Emacs opens .rules files in fundamental-mode, which does not add/enforce newline characters by default--usually, text files with common extensions open in text-mode or a more specific mode, which do add/enforce newline characters by default. Anyways, that's how I noticed it.

Since I ended up finding a very cheap/small solution to make the script behave consistently, regardless of dealing with incomplete lines or proper lines at the end of the file, I decided to submit this PR.

Example of steps to reproduce a malformed compiled.rules

  1. cd /etc/fapolicyd/
  2. printf "allow perm=open exe=example : all" >> rules.d/21-updaters.rules
  3. fagenrules
  4. grep "example" compiled.rules
allow perm=open exe=example : all# This file contains the list of all patterns. Only the ld_so pattern

<last rule/"line" of 21-updaters.rules + first line of the next file>

TLDR

This PR ensures fagenrules behaves as expected even when processing unexpected incomplete lines, preventing a malformed compiled.rules file.

By adding && echo to the concatenation loop, the following changes happen with respect to last line scenarios in .rules files:

  1. incomplete line → proper line
  2. proper line → proper line + empty line
  3. empty line → empty line + empty line

Case 1 fixes the issue by enforcing the separation between files/lines.
Case 2 behaves as expected since awk will skip any empty line.
Case 3 same as case 2.

Tested this change downstream on Fedora 41 (1.3.4) and everything seems to be working fine.

Anding echo here ensures at least one newline between each
concatenated .rules file, preventing a compiled.rules edge case.
@radosroka
Copy link
Member

Thank you for the contribution!

@radosroka radosroka merged commit b86eb34 into linux-application-whitelisting:main Feb 9, 2025
16 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants