tree c9907b4423f352fbbb878fd4bc598a5b0ad032e9
parent 73f488cd903938e78979d50e081a0314ad142351
author John Johansen <john.johansen@canonical.com> 1511062993 -0800
committer John Johansen <john.johansen@canonical.com> 1518204602 -0800

apparmor: improve overlapping domain attachment resolution

Overlapping domain attachments using the current longest left exact
match fail in some simple cases, and with the fix to ensure consistent
behavior by failing unresolvable attachments it becomes important to
do a better job.

eg. under the current match the following are unresolvable where
the alternation is clearly a better match under the most specific
left match rule.
  /**
  /{bin/,}usr/

Use a counting match that detects when a loop in the state machine is
enter, and return the match count to provide a better specific left
match resolution.

Signed-off-by: John Johansen <john.johansen@canonical.com>