apparmor can't parse 'pix' 'px' with globbing.

[zhang.lei]

apparmor_parser can't parse '/** px' '/** pix', but can parse '/** ix', why? is it a issue?

linux-l5kg:~/apparmor/z # cat /etc/SuSE-release
openSUSE 13.2 (x86_64)
VERSION = 13.2
CODENAME = Harlequin
# /etc/SuSE-release is deprecated and will be removed in the future, use /etc/os-release instead
linux-l5kg:~/apparmor/z # apparmor_parser -h
AppArmor parser version 2.9.0
Copyright (C) 1999-2008 Novell Inc.
Copyright 2009-2012 Canonical Ltd.

linux-l5kg:~/apparmor/z # cat /etc/apparmor.d/touch.aa
# Last Modified: Tue Apr 14 17:49:40 2015
#include <tunables/global>

/root/apparmor/z/touch {#flags=(complain) {
  #include <abstractions/base>
  /** pix,
}

linux-l5kg:~/apparmor/z # apparmor_parser -r /etc/apparmor.d/touch.aa
profile has merged rule with conflicting x modifiers
ERROR processing regexs for profile /root/apparmor/z/touch, failed to load

[Christian Boltz (cboltz)]

Possible explanation: abstractions/base contains some mrix rules for files in /lib*/, /opt/ and /home/

Nevertheless, the more specific rules should "win" over /** IMHO ;-)

[zhang.lei (6566230-b)]

yes, i have confirmed it, thanks.

[Christian Boltz (cboltz)]

So we know what happens, but it's still a valid bug IMHO ;-)