rules: support quoted values with spaces

Rules containing a space in a dir, path, or exe value were split at the space. The truncated attribute could produce an unintended prefix match, so rule order appeared to override policy.

Add a rule token lexer that removes double-quote delimiters and preserves glob escapes. Apply it to subject and object parsing, reject malformed quotes, and document quote, percent-escape, glob, CLI, and trust-file behavior.

Add regression coverage for quoted dir, path, exe, sets, glob patterns, literal percent escapes, and parent-directory ordering.

Author: stevegrubb

ChangeLog

@@ -8,6 +8,7 @@
 - Add filter support for Debian backend
 - Add support for globbing in rules using explicit glob demarcation
 - Fix logging to syslog/journald to not deadlock on log rotation
+- Allow rules to express file/dir names with spaces using double quotes
 
 1.6
 - Many internal changes

doc/fapolicyd-cli.8

@@ -149,6 +149,15 @@ Dumps the trust db contents for inspection. This will print the original trust s
 .TP
 .B \-f, \-\-file  add|delete|update [path]
 Manage the file trust database.
+.PP
+The path is a command-line argument, not a rule-file value. Use the shell's
+quoting to pass a path containing a space, for example:
+.nf
+.B fapolicyd-cli --file add "/tmp/first last/"
+.B fapolicyd-cli --file delete "/tmp/first last/"
+.fi
+The CLI receives the unquoted path. A literal \fB%20\fP in a command-line path
+is not decoded to a space.
 .RS
 .TP 12
 .B add

doc/fapolicyd.rules.5

@@ -162,6 +162,34 @@ is still accepted)
 This option matches against the hash of the file being accessed. The accepted hash length follows the trust source, so RPM entries built with SHA512 store SHA512 digests while other sources may continue to provide SHA256. The hash in the rules should be all lowercase letters and do NOT start with 0x. Lowercase is the default output of sha256sum and sha512sum. The SHA256HASH keyword remains for compatibility but is deprecated; prefer FILE_HASH for new rules.
 .RE
 
+.SH QUOTED VALUES
+Rule fields are separated by spaces. Enclose a complete string value in double
+quotes when it contains a space. The surrounding quotes are syntax and are not
+part of the value used for matching. This applies consistently to subject
+.B exe ,
+subject and object
+.B dir ,
+and object
+.BR path :
+
+.nf
+.B allow perm=execute all : dir="/tmp/first last/"
+.B allow perm=execute exe="/tmp/first last/tool" : all
+.B allow perm=execute all : path="/tmp/first last/tool"
+.fi
+
+Double quotes can also be used in named string-set definitions and in each
+comma-separated string value. Within a quoted value, a backslash before a
+double quote or another backslash represents that character. Other backslashes
+are preserved, so glob patterns retain their normal backslash behavior.
+
+Percent escapes are not interpreted in rules. For example,
+.B dir="/tmp/first%20last/"
+matches a literal percent sign followed by \fB20\fP, not a space. A backslash
+before a space and shell-style single quotes are not rule-file quoting forms;
+double quotes are the only supported way to include a literal space in a rule
+value.
+
 .SH PATH GLOBBING
 Rule values use exact matching by default. Prefix a value with
 .B glob:
@@ -223,6 +251,21 @@ pattern. Backslash quotes a metacharacter. Recursive
 .B **
 globstar matching is not supported.
 
+When a glob value contains a space, quote the complete value, including the
+.B glob:
+prefix. For example:
+
+.nf
+.B allow perm=execute all : path="glob:/tmp/first last/*"
+.B allow perm=execute exe="glob:/tmp/first last/*" : all
+.fi
+
+The quotes are removed before glob validation and matching. The
+.B dir
+attribute remains a literal prefix and does not accept a quoted or unquoted
+.B glob:
+value.
+
 Bracket ranges such as
 .B [a-z]
 and named character classes such as

doc/fapolicyd.trust.5

@@ -5,8 +5,17 @@ fapolicyd.trust \- fapolicyd's file of trust
 The file
 .I /etc/fapolicyd/fapolicyd.trust
 contains list of trusted files/binaries for the application whitelisting daemon. You may add comments to the file by starting the line with a '#' character.
-Each line has to contain three columns and space is a valid separator. The first column contains full path to the file, the second is size of the file in bytes
-and the third is valid sha256 hash.
+Each non-comment line contains a full path, size in bytes, and a valid SHA256
+hash. Version 3 trust files write paths without escaping and find the size and
+hash by splitting at the final two spaces. A path may therefore contain spaces.
+The \fBfapolicyd-cli --file\fP commands receive ordinary shell arguments; quote
+a path containing a space in the shell, for example
+\fBfapolicyd-cli --file add "/tmp/first last/"\fP. In a version 3 trust file,
+\fB%20\fP is a literal percent sign followed by \fB20\fP, not a space.
+.sp
+Version 2 trust files are accepted for compatibility and use their legacy
+percent escaping, including \fB%20\fP for a space. Newly rewritten trust files
+use version 3, so do not use version-2 percent escapes in new entries.
 .sp
 The directory \fI/etc/fapolicyd/trust\&.d\fR can be used to store multiple trust files\&.
 This way a privileged user can split the trust database into multiple files and manage them separately through \fBfapolicyd\-cli\fR\&.

src/library/rules.c

@@ -72,6 +72,106 @@ static int assign_subject(llist *l, lnode *n, int type,
 static int assign_object(llist *l, lnode *n, int type,
 			 const char *ptr2, int lineno) __wur;
 
+enum rule_token_error {
+	RULE_TOKEN_OK = 0,
+	RULE_TOKEN_UNTERMINATED_QUOTE,
+	RULE_TOKEN_TRAILING_TEXT
+};
+
+/*
+ * next_rule_token - get one space-delimited rule token with quoted values.
+ * @cursor: current mutable position in the rule line, advanced on success.
+ * @error: receives a quoted-value syntax error, if one occurs.
+ *
+ * A double quote begins quoted text only at the start of an attribute value
+ * (immediately after '=' or ','). This preserves literal quotes elsewhere in
+ * existing unquoted values. Quotes are removed in place, and only '\\"' and
+ * '\\\\' are unescaped inside quoted text so fnmatch backslash escapes such as
+ * '\\*' reach glob evaluation unchanged.
+ *
+ * Returns: the next token, or NULL when no token remains or @error is set.
+ */
+static char *next_rule_token(char **cursor, enum rule_token_error *error)
+{
+	char *read, *write, *token;
+	bool quoted = false;
+
+	if (error)
+		*error = RULE_TOKEN_OK;
+	if (!cursor || !*cursor)
+		return NULL;
+
+	read = *cursor;
+	while (*read == ' ')
+		read++;
+	if (*read == '\0') {
+		*cursor = read;
+		return NULL;
+	}
+
+	token = read;
+	write = read;
+	while (*read) {
+		if (quoted) {
+			if (*read == '\\' &&
+			    (read[1] == '"' || read[1] == '\\')) {
+				*write++ = read[1];
+				read += 2;
+				continue;
+			}
+			if (*read == '"') {
+				quoted = false;
+				read++;
+				if (*read && *read != ' ' && *read != ',') {
+					if (error)
+						*error = RULE_TOKEN_TRAILING_TEXT;
+					return NULL;
+				}
+				continue;
+			}
+			*write++ = *read++;
+			continue;
+		}
+
+		if (*read == ' ')
+			break;
+		if (*read == '"' && read > token &&
+		    (read[-1] == '=' || read[-1] == ',')) {
+			quoted = true;
+			read++;
+			continue;
+		}
+		*write++ = *read++;
+	}
+
+	if (quoted) {
+		if (error)
+			*error = RULE_TOKEN_UNTERMINATED_QUOTE;
+		return NULL;
+	}
+
+	while (*read == ' ')
+		read++;
+	*write = '\0';
+	*cursor = read;
+	return token;
+}
+
+/*
+ * report_rule_token_error - emit an actionable rule-value lexer diagnostic.
+ * @error: quoted-value error reported by next_rule_token().
+ * @lineno: source line used for the diagnostic.
+ *
+ * Returns: none.
+ */
+static void report_rule_token_error(enum rule_token_error error, int lineno)
+{
+	if (error == RULE_TOKEN_UNTERMINATED_QUOTE)
+		msg(LOG_ERR, "Unterminated quoted value in line %d", lineno);
+	else if (error == RULE_TOKEN_TRAILING_TEXT)
+		msg(LOG_ERR, "Characters after quoted value in line %d", lineno);
+}
+
 /*
  * validate_glob_set - validate explicitly marked glob values for an attribute
  * @type: parsed subject or object attribute type.
@@ -822,12 +922,14 @@ static int assign_object(llist *l, lnode *n, int type,
 }
 
 
-static int parse_new_format(llist *l, lnode *n, int lineno)
+static int parse_new_format(llist *l, lnode *n, int lineno,
+			    char **cursor)
 {
 	int state = 0;  // 0 == subj, 1 == obj
 	char *ptr;
+	enum rule_token_error token_error;
 
-	while ((ptr = strtok(NULL, " "))) {
+	while ((ptr = next_rule_token(cursor, &token_error))) {
 		int type;
 		char *ptr2 = strchr(ptr, '=');
 
@@ -873,6 +975,10 @@ static int parse_new_format(llist *l, lnode *n, int lineno)
 			return 5;
 		}
 	}
+	if (token_error != RULE_TOKEN_OK) {
+		report_rule_token_error(token_error, lineno);
+		return 5;
+	}
 	return 0;
 }
 
@@ -1044,14 +1150,20 @@ static enum rule_parse_result nv_split(llist *l, char *buf, lnode *n,
 				       int lineno)
 {
 	char *ptr, *ptr2;
+	char *cursor = buf;
 	rformat_t format = RULE_FMT_ORIG;
 	attr_sets_t *sets = l->sets;
+	enum rule_token_error token_error;
 
 	if (strchr(buf, ':'))
 		format = RULE_FMT_COLON;
 	n->format = format;
 
-	ptr = strtok(buf, " ");
+	ptr = next_rule_token(&cursor, &token_error);
+	if (token_error != RULE_TOKEN_OK) {
+		report_rule_token_error(token_error, lineno);
+		return RULE_PARSE_ERROR;
+	}
 	if (ptr == NULL)
 		return RULE_PARSE_SKIP;
 	if (ptr[0] == '#')
@@ -1073,7 +1185,7 @@ static enum rule_parse_result nv_split(llist *l, char *buf, lnode *n,
 	// Default access permission is open
 	n->a = OPEN_ACC;
 
-	while ((ptr = strtok(NULL, " "))) {
+	while ((ptr = next_rule_token(&cursor, &token_error))) {
 		int type;
 
 		ptr2 = strchr(ptr, '=');
@@ -1104,7 +1216,7 @@ static enum rule_parse_result nv_split(llist *l, char *buf, lnode *n,
 							   lineno))
 						return RULE_PARSE_ERROR;
 				}
-				if (parse_new_format(l, n, lineno))
+				if (parse_new_format(l, n, lineno, &cursor))
 					return RULE_PARSE_ERROR;
 				goto finish_up;
 			}
@@ -1141,6 +1253,10 @@ static enum rule_parse_result nv_split(llist *l, char *buf, lnode *n,
 			return RULE_PARSE_ERROR;
 		}
 	}
+	if (token_error != RULE_TOKEN_OK) {
+		report_rule_token_error(token_error, lineno);
+		return RULE_PARSE_ERROR;
+	}
 
 finish_up:
 	// do one last sanity check for missing subj or obj