apparmor_parser does not handle quoted files with braces in their name

[Ian Johnson]

AppArmor does not successfully compile a profile with a rule like this:

```
profile foo (attach_disconnected) {

"/foobar/some-path-with-braces-}{" rw,

}
```

It complains thusly:

$ sudo apparmor_parser -r foo.bin
apparmor_parser: Regex grouping error: Invalid number of items between {}
apparmor_parser: Regex grouping error: Invalid close }, no matching open { detected
apparmor_parser: Unable to parse input line '/foobar/some-path-with-braces-}{'
ERROR processing regexs for profile foo, failed to load

It was my understanding that since the braces are inside a quoted path, that the braces would effectively be ignored.

I'm not sure if this specific problem can be abused into an active vulnerability, so I'm filing this as a private bug until it can be analyzed to explain that it is not able / likely to be abused.

FYI, this came about as investigation into https://bugs.launchpad.net/bugs/1949368, which currently is also a private security bug.

[John Johansen (jjohansen)]

Quoting in apparmor does not disable globbing, nor variable expansion. It only allows for certain characters to be included in a name like whitespace.

To deal with regex characters you need to escape them if a literal match is needed

```
   "/foobar/some-path-with-braces-\}\{" rw,
```

[Ian Johnson (anonymouse67)]

@jjohansen, so to match a literal file with -}{, should it be both escaped and quoted ? or is it sufficient to just escape? If we were aiming for maximum safety in only allowing a very specific file pattern literally, should we just escape or should we also add quotes too?

[John Johansen (jjohansen)]

Escaping the literals is sufficient. You can certainly add quotes to not have to worry about ws.