Ensure fagenrules handles unexpected incomplete lines #331
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi, thanks for all the work on this amazing software!
Context
While fine-tuning some rules this weekend, I ended up encountering an edge case. Basically, if any
.rules
file underrules.d
doesn't end with a proper POSIX line (ending with a newline) or a comment, the script concatenates the last line/rule of that file with the first line of the next file, resulting in a malformedcompiled.rules
.Normally, this wouldn't be an issue, as most tools and editors used to edit or create the
.rules
files add the newline character by default to ensure POSIX compliance. However, this might not always be the case, depending on users' configuration, awareness, or unexpected behavior while using these tools.For example, I just realized that Emacs opens
.rules
files infundamental-mode
, which does not add/enforce newline characters by default--usually, text files with common extensions open intext-mode
or a more specific mode, which do add/enforce newline characters by default. Anyways, that's how I noticed it.Since I ended up finding a very cheap/small solution to make the script behave consistently, regardless of dealing with incomplete lines or proper lines at the end of the file, I decided to submit this PR.
Example of steps to reproduce a malformed compiled.rules
cd /etc/fapolicyd/
printf "allow perm=open exe=example : all" >> rules.d/21-updaters.rules
fagenrules
grep "example" compiled.rules
<last rule/"line" of 21-updaters.rules + first line of the next file>
TLDR
This PR ensures
fagenrules
behaves as expected even when processing unexpected incomplete lines, preventing a malformedcompiled.rules
file.By adding
&& echo
to the concatenation loop, the following changes happen with respect to last line scenarios in.rules
files:Case 1 fixes the issue by enforcing the separation between files/lines.
Case 2 behaves as expected since awk will skip any empty line.
Case 3 same as case 2.
Tested this change downstream on Fedora 41 (1.3.4) and everything seems to be working fine.