path: root/security/apparmor/include
diff options
authorJohn Johansen <>2012-02-16 06:20:26 -0800
committerJohn Johansen <>2012-03-14 06:15:24 -0700
commit0fe1212d0539eb6c1e27d388711172d786e299cc (patch)
treeb6e653222f271f52b8d4606102ef1e6bd72b7bc2 /security/apparmor/include
parent3372b68a3c982611dcc30b3c872f8bbdee019e5e (diff)
AppArmor: Update dfa matching routines.
Update aa_dfa_match so that it doesn't result in an input string being walked twice (once to get its length and another time to match) Add a single step functions aa_dfa_next Signed-off-by: John Johansen <> Acked-by: Kees Cook <>
Diffstat (limited to 'security/apparmor/include')
2 files changed, 4 insertions, 1 deletions
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index df3649560818..248c408ddc1b 100644
--- a/security/apparmor/include/apparmor.h
+++ b/security/apparmor/include/apparmor.h
@@ -81,7 +81,7 @@ static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa,
unsigned int start)
/* the null transition only needs the string's null terminator byte */
- return aa_dfa_match_len(dfa, start, "", 1);
+ return aa_dfa_next(dfa, start, 0);
static inline bool mediated_filesystem(struct inode *inode)
diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index a4a863997bd5..775843e7f984 100644
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -116,6 +116,9 @@ unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start,
const char *str, int len);
unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start,
const char *str);
+unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state,
+ const char c);
void aa_dfa_free_kref(struct kref *kref);