Parser incorrectly treats "deny file," rules as invalid

[Tyler Hicks]

Empty file rules work with all rule modifiers except for deny:

$ echo '/t { file, }' | apparmor_parser -Qq
$ echo '/t { audit file, }' | apparmor_parser -Qq
$ echo '/t { owner file, }' | apparmor_parser -Qq
$ echo '/t { deny file, }' | apparmor_parser -Qq
AppArmor parser error, in stdin line 1: Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', 'p', or 'u'

[Jamie Strandboge (jdstrand)]

This is still an issue with 2.9.

[Christian Boltz (cboltz)]

This bug still exists in 2.10.

When fixing this, please also add a test profile with "deny file,".

[Tyler Hicks (tyhicks)]

A test now exists. The =TODO bit should be removed when this issue is fixed.

  https://bazaar.launchpad.net/~apparmor-dev/apparmor/master/view/head:/parser/tst/simple_tests/file/ok_bare_1.sd