Add fnmatch globbing to path rules

Rules could only compare exe and path attributes exactly, so policies could
not describe stable layouts containing per-user or versioned path components.

Track whether immutable string sets contain glob metacharacters, preserve ex
act AVL lookup as the fast path, and evaluate exe and path patterns with pathnam
e and leading-period boundaries. Concrete event paths and trust database keys re
main unchanged.

Add rule and attribute-set coverage for wildcard semantics, exact compatibil
ity, named sets, ordering, and path immutability. Document safe use, trust requi
rements, CLI behavior, and unsupported recursive globbing.

Author: stevegrubb

ChangeLog

@@ -6,6 +6,7 @@
 - Make fagenrules follow the generational update pattern
 - Fix Debian backend to work again
 - Add filter support for Debian backend
+- Add fnmatch globbing for exe and path rule attributes
 
 1.6
 - Many internal changes

README.md

@@ -224,6 +224,17 @@ allow, use the macro set support as illustrated in this last example. This puts
 the list into a sorted AVL tree so that searching is cut to a minimum number
 of compares.
 
+The `exe` and `path` rule attributes also accept `fnmatch` glob patterns for
+paths with a necessary variable component, such as
+`/opt/vendor/product-*/bin/tool`. Wildcards do not cross `/` or implicitly
+match a leading period, and `**` recursive matching is not supported. Continue
+to use `dir` for a complete subtree under a fixed directory and exact values or
+sets when the paths are known. A `dir` value containing glob metacharacters is
+a rule error reported by `fapolicyd-cli --check-rules`; use subject `exe` or
+object `path` when glob matching is required.
+
+A glob selects matching paths but does not trust them. In particular, it is not advisable to allow execution from a user-writable path solely because its name matches a glob. It is strongly suggested to pair an object `path` allow with object `trust=1` or an explicit `FILE_HASH`; pair a subject `exe` glob in a user-writable location with subject `trust=1`. The trust database continues to contain concrete paths; see the `fapolicyd.rules(5)` man page for the complete globbing contract.
+
 One last note, the rule engine is a first match wins system. If you are adding
 rules to allow something but it gets denied by a rule higher up, then move
 your rule above the thing that denies it. But again, if you are writing rules

TODO

@@ -1,9 +1,7 @@
 Userspace
 =========
-* Allow rules to express paths using globbing (fnmatch)
 * Don't overwrite existing timer reports if the timer is not armed
 * Improve reconfigure via SIGHUP to update configuration
 * Consider adding rule testing to cli (uid, pgm, file)
 
 * Support other packaging manifests
-

doc/fapolicyd-cli.8

@@ -76,7 +76,7 @@ matching the \fB%languages\fP macro. A non-zero status is returned when risky
 entries are found so automated workflows can gate changes.
 .TP
 .B \-\-check-rules [path]
-Parse the rules file with the daemon policy parser without loading it into the daemon. If \fIpath\fP is omitted, the command checks the active rules file, using \fI/etc/fapolicyd/fapolicyd.rules\fP when present and \fI/etc/fapolicyd/compiled.rules\fP otherwise. If both installed rules files exist, the command reports a path configuration error unless \fB\-\-lint\fP is also used. A zero exit status means the file is valid.
+Parse the rules file with the daemon policy parser without loading it into the daemon. If \fIpath\fP is omitted, the command checks the active rules file, using \fI/etc/fapolicyd/fapolicyd.rules\fP when present and \fI/etc/fapolicyd/compiled.rules\fP otherwise. If both installed rules files exist, the command reports a path configuration error unless \fB\-\-lint\fP is also used. A zero exit status means the file is valid. Glob values for \fBexe\fP and \fBpath\fP are accepted as rule syntax, but this command does not expand them or simulate which concrete paths they match. Glob metacharacters in \fBdir\fP values are rejected.
 .TP
 .B \-\-lint
 When used with \fB\-\-check-rules\fP, also emit policy-shape warnings for executable or programmatic content that can reach the default-allow path. The option may be placed before or after \fB\-\-check-rules\fP. A warning causes a non-zero exit status.

doc/fapolicyd.rules.5

@@ -59,7 +59,11 @@ This is a boolean describing whether it is required for the subject to be in the
 This is the shortened command name. When an interpreter starts a program, it usually renames the program to the script rather than the interpreter.
 .TP
 .B exe
-This is the full path to the executable. Globbing is not supported. You may also use the special keyword \fBuntrusted\fP to match on the subject not being listed in the rpm database.
+This is the full path to the executable. Exact paths and glob patterns are
+supported. See
+.B PATH GLOBBING
+below. You may also use the special keyword \fBuntrusted\fP to match on the
+subject not being listed in the rpm database.
 .TP
 .B dir
 If you wish to match a directory, then use this by giving the full path to the directory. Its recommended to end with the / to ensure it matches a directory. There are 3 keywords that \fIdir\fP supports: \fBexecdirs\fP, \fBsystemdirs\fP, \fBuntrusted\fP.
@@ -129,7 +133,11 @@ The object is the file that the subject is interacting with. The fields in the r
 This matches against any obbject. When used, this must be the only object in the rule.
 .TP
 .B path
-This is the full path to the file that will be accessed. Globbing is not supported. You may also use the special keyword \fBuntrusted\fP to match on the object not being listed in the rpm database.
+This is the full path to the file that will be accessed. Exact paths and glob
+patterns are supported. See
+.B PATH GLOBBING
+below. You may also use the special keyword \fBuntrusted\fP to match on the
+object not being listed in the rpm database.
 .TP
 .B dir
 If you wish to match on access to any file in a directory, then use this by giving the full path to the directory. Its recommended to end with the / to ensure it matches a directory. There are 3 keywords that \fIdir\fP supports: \fBexecdirs\fP, \fBsystemdirs\fP, \fBuntrusted\fP. See the \fBdir\fP option under Subject for an explanation of these keywords.
@@ -150,6 +158,97 @@ is still accepted)
 This option matches against the hash of the file being accessed. The accepted hash length follows the trust source, so RPM entries built with SHA512 store SHA512 digests while other sources may continue to provide SHA256. The hash in the rules should be all lowercase letters and do NOT start with 0x. Lowercase is the default output of sha256sum and sha512sum. The SHA256HASH keyword remains for compatibility but is deprecated; prefer FILE_HASH for new rules.
 .RE
 
+.SH PATH GLOBBING
+Glob patterns are supported only by the subject
+.B exe
+and object
+.B path
+attributes. The
+.B dir
+attribute remains a literal directory prefix; use it instead of a glob when a
+rule applies to a complete subtree rooted at a fixed directory. A
+.B dir
+value containing a glob metacharacter is rejected, including when the value
+comes from a named set. Use subject
+.B exe
+or object
+.B path
+when glob matching is required.
+
+Patterns use
+.BR fnmatch (3)
+syntax. A
+.B *
+matches zero or more characters,
+.B ?
+matches one character, and bracket expressions such as
+.B [0-9]
+match one character from the expression. Matching is case-sensitive and must
+cover the complete path. Wildcards do not match a slash, so each variable path
+component must be written explicitly. A wildcard does not match a leading
+period in a path component unless the period appears explicitly in the
+pattern. Backslash quotes a metacharacter. Recursive
+.B **
+globstar matching is not supported.
+
+Bracket ranges such as
+.B [a-z]
+and named character classes such as
+.B [[:alpha:]]
+use the locale active in the daemon. Avoid ranges and named classes when policy
+must produce identical matches in every locale; use exact alternatives or
+enumerate the intended characters instead.
+
+For example,
+.B /home/*/bin/tool
+matches
+.B /home/alice/bin/tool
+but not
+.B /home/alice/project/bin/tool
+or
+.BR /home/.admin/bin/tool .
+Glob values may appear in comma-separated attribute values and in named string
+sets. Rule order is unchanged: rules are evaluated from top to bottom, and the
+first complete rule match determines the decision.
+
+The concrete object
+.B path
+is obtained from the event file descriptor through
+.IR /proc/self/fd/ ,
+and the subject
+.B exe
+path is obtained through
+.IR /proc/PID/exe .
+Symbolic links have therefore already been followed, so a rule normally matches
+the reported target path rather than the symbolic link name used by the
+application. Hard links and mount aliases can expose different concrete paths
+for the same inode; policy that must cover those aliases needs an exact value or
+pattern for each reported path.
+
+Globbing selects paths; it does not expand the pattern, alter the path reported
+in logs, or make matching files trusted. Trust database entries continue to use
+concrete paths. An allow rule for a user-writable location should normally pair
+an object
+.B path
+glob with object
+.B trust=1
+or an explicit
+.B FILE_HASH
+constraint. A subject
+.B exe
+glob in a user-writable location should normally require subject
+.BR trust=1 .
+Otherwise, any file whose name fits the pattern can receive the allow decision.
+Prefer exact paths, named sets of exact paths, or
+.B dir
+when they express the policy because exact and prefix matching are less
+expensive than glob evaluation.
+
+.nf
+.B deny_audit perm=execute all : path=/opt/vendor/product-*/bin/tool
+.B allow perm=execute all : path=/home/*/bin/tool trust=1
+.fi
+
 .SH SETS
 Set is a named group of values of the same type. Fapolicyd internally distinguishes between INT and STRING set types. You can define your own set and use it as a value for a specific rule attribute. The definition is in key=value syntax and starts with a set name. The set name has to start with '%' and the rest is alphanumeric or '_'. The value is a comma separated list. The set type is inherited from the first item in the list. If that can be turned into number then whole list is expected to carry numbers. One can use these sets as a value for subject and object attributes. It is also possible to use a plain list as an attribute value without previous definition. The assigned set has to match the attribute type. It is not possible set groups for TRUST and PATTERN attributes.
 
@@ -202,6 +301,7 @@ The following rules illustrate the rule syntax.
 .BR fapolicyd (8),
 .B fagenrules (8),
 .BR fapolicyd-cli (8),
+.BR fnmatch (3),
 and
 .BR fapolicyd.conf (5)
 

src/library/attr-sets.c

@@ -362,6 +362,8 @@ int attr_set_append_str(attr_sets_entry_t *set, const char *str)
 		free(data);
 		return 1;
 	}
+	if (strpbrk(str, "*?["))
+		set->has_glob = true;
 
 	return 0;
 }

src/library/attr-sets.h

@@ -48,6 +48,8 @@ typedef struct attr_sets_entry {
 	char * name;
 	// STRING, SIGNED, or UNSIGNED from DATA_TYPES
 	int type;
+	// Lookup hint only; rule attributes decide whether globs are meaningful.
+	bool has_glob;
 	avl_tree_t tree;
 } attr_sets_entry_t;
 

src/library/rules.c

@@ -32,6 +32,7 @@
 #include <grp.h>
 #include <ctype.h>
 #include <stdint.h>
+#include <fnmatch.h>
 
 #include "attr-sets.h"
 #include "policy.h"
@@ -71,6 +72,35 @@ static int assign_subject(llist *l, lnode *n, int type,
 static int assign_object(llist *l, lnode *n, int type,
 			 const char *ptr2, int lineno) __wur;
 
+/*
+ * validate_dir_set - reject glob patterns on literal directory attributes
+ * @type: parsed subject or object attribute type.
+ * @set: parsed attribute value set.
+ * @lineno: rule line number used for diagnostics.
+ * @side: rule side used to make the diagnostic actionable.
+ *
+ * Directory attributes use prefix matching rather than fnmatch. Rejecting
+ * metacharacters prevents an accepted rule from silently matching a literal
+ * asterisk, question mark, or bracket instead of the intended path pattern.
+ *
+ * Returns: 0 when the set is valid for the attribute, otherwise 1.
+ */
+static int validate_dir_set(int type, const attr_sets_entry_t *set,
+			    int lineno, const char *side)
+{
+	const char *alternative;
+
+	if ((type != EXE_DIR && type != ODIR) || !set || !set->has_glob)
+		return 0;
+
+	alternative = type == EXE_DIR ? "exe" : "path";
+	msg(LOG_ERR,
+	    "rules: line:%d: %s dir does not support glob patterns; "
+	    "use %s for glob matching",
+	    lineno, side, alternative);
+	return 1;
+}
+
 /*
  * warn_deprecated_untrusted_dir - warn about the legacy dir=untrusted macro
  * @type: parsed subject or object attribute type.
@@ -594,6 +624,8 @@ static int assign_subject(llist *l, lnode *n, int type,
 	} // switch
 
 finalize:
+	if (validate_dir_set(type, n->s[i].set, lineno, "subject"))
+		goto free_and_error;
 	warn_deprecated_untrusted_dir(type, n->s[i].set, lineno, "subject");
 	n->s_count++;
 	free(tmp);
@@ -745,6 +777,8 @@ static int assign_object(llist *l, lnode *n, int type,
 
 
  finalize:
+	if (validate_dir_set(type, n->o[i].set, lineno, "object"))
+		goto free_and_error;
 	warn_deprecated_untrusted_dir(type, n->o[i].set, lineno, "object");
 	n->o_count++;
 	free(tmp);
@@ -1178,6 +1212,39 @@ static int check_dirs(unsigned int i, const char *path)
 	return 0;
 }
 
+/*
+ * path_set_match - match one concrete path against a rule string set
+ * @set: string set assigned to an exe or path rule attribute.
+ * @path: concrete executable or object path from the event.
+ *
+ * Exact lookup remains first so ordinary rules retain AVL lookup behavior and
+ * literal filenames containing metacharacters still match themselves. Globs
+ * are pathname-component scoped, case-sensitive, and require leading periods
+ * to be explicit. The event path is never changed, so trust lookup and logging
+ * continue to use the concrete path.
+ *
+ * Returns: 1 when an exact value or glob matches, otherwise 0.
+ */
+static int path_set_match(attr_sets_entry_t *set, const char *path)
+{
+	avl_iterator iterator;
+	avl_str_data_t *entry;
+
+	if (attr_set_check_str(set, path))
+		return 1;
+	if (!set || set->type != STRING || !set->has_glob || !path)
+		return 0;
+
+	for (entry = (avl_str_data_t *)avl_first(&iterator, &set->tree);
+	     entry; entry = (avl_str_data_t *)avl_next(&iterator)) {
+		if (strpbrk(entry->str, "*?[") &&
+		    fnmatch(entry->str, path, FNM_PATHNAME | FNM_PERIOD) == 0)
+			return 1;
+	}
+
+	return 0;
+}
+
 /*
  * Notes about elf program startup
  * ===============================
@@ -1456,7 +1523,7 @@ static int check_subject(lnode *r, event_t *e)
 			    !is_subj_trusted(e))
 				break;
 
-			if (!attr_set_check_str(r->s[cnt].set, subj->str))
+			if (!path_set_match(r->s[cnt].set, subj->str))
 				return 0;
 
 			break;
@@ -1592,14 +1659,6 @@ static decision_t check_object(lnode *r, event_t *e)
 
 		// fall through
 
-		case PATH:
-		  // skip if fall through
-		  if (type == PATH &&
-		      legacy_untrusted_subject_path_blocked(r, cnt, e))
-			return 0;
-
-		// fall through
-
 		case DEVICE:
 		case FILE_HASH: {
 
@@ -1617,6 +1676,21 @@ static decision_t check_object(lnode *r, event_t *e)
 		} // case
 
 
+		case PATH: {
+			if (legacy_untrusted_subject_path_blocked(r, cnt, e))
+				return 0;
+
+			if (!obj->o)
+				break;
+
+			// Globbing changes rule selection only, never object identity.
+			if (!path_set_match(r->o[cnt].set, obj->o))
+				return 0;
+
+			break;
+		} // case
+
+
 		case ODIR: {
 			int macro_match = 0;
 

src/tests/attr_sets_test.c

@@ -54,12 +54,18 @@ int main(void)
 		error(1, 0, "standalone attr_set_create failed");
 	if (attr_set_append_str(standalone, "/usr/bin/"))
 		error(1, 0, "standalone append failed");
+	if (standalone->has_glob)
+		error(1, 0, "literal string marked as glob");
 	if (!attr_set_check_str(standalone, "/usr/bin/"))
 		error(1, 0, "standalone exact check failed");
 	if (!attr_set_check_pstr(standalone, "/usr/bin/bash"))
 		error(1, 0, "standalone prefix check failed");
 	if (attr_set_append_str(standalone, "/usr/bin/") == 0)
 		error(1, 0, "duplicate string accepted");
+	if (attr_set_append_str(standalone, "/opt/app-*/bin/tool"))
+		error(1, 0, "glob string append failed");
+	if (!standalone->has_glob)
+		error(1, 0, "glob string did not set lookup hint");
 	attr_set_destroy(standalone);
 
 	attr_sets_destroy(sets);