/* A Bison parser, made by GNU Bison 3.8.2.  */

/* Bison implementation for Yacc-like parsers in C

   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation,
   Inc.

   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */

/* As a special exception, you may create a larger work that contains
   part or all of the Bison parser skeleton and distribute that work
   under terms of your choice, so long as that work isn't itself a
   parser generator using the skeleton or a modified version thereof
   as a parser skeleton.  Alternatively, if you modify or redistribute
   the parser skeleton itself, you may (at your option) remove this
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.

   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

/* C LALR(1) parser skeleton written by Richard Stallman, by
   simplifying the original so-called "semantic" parser.  */

/* DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual,
   especially those whose name start with YY_ or yy_.  They are
   private implementation details that can be changed or removed.  */

/* All symbols defined below should begin with yy or YY, to avoid
   infringing on user name space.  This should be done even for local
   variables, as they might otherwise be expanded by user macros.
   There are some unavoidable exceptions within include files to
   define necessary library symbols; they are noted "INFRINGES ON
   USER NAME SPACE" below.  */

/* Identify Bison output, and Bison version.  */
#define YYBISON 30802

/* Bison version string.  */
#define YYBISON_VERSION "3.8.2"

/* Skeleton name.  */
#define YYSKELETON_NAME "yacc.c"

/* Pure parsers.  */
#define YYPURE 0

/* Push parsers.  */
#define YYPUSH 0

/* Pull parsers.  */
#define YYPULL 1




/* First part of user prologue.  */
#line 1 "parser_yacc.y"

/*
 *   Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
 *   NOVELL (All rights reserved)
 *   Copyright (c) 2010-2012
 *   Canonical Ltd.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of version 2 of the GNU General Public
 *   License published by the Free Software Foundation.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, contact Canonical, Ltd.
 */

#define YYERROR_VERBOSE 1
#include <limits.h>
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/apparmor.h>

#include <iostream>

/* #define DEBUG */

#include "capability.h"
#include "lib.h"
#include "parser.h"
#include "profile.h"
#include "mount.h"
#include "dbus.h"
#include "af_unix.h"
#include "parser_include.h"
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>


#define CIDR_32 htonl(0xffffffff)
#define CIDR_24 htonl(0xffffff00)
#define CIDR_16 htonl(0xffff0000)
#define CIDR_8  htonl(0xff000000)

/* undefine linux/capability.h CAP_TO_MASK */
#ifdef CAP_TO_MASK
#undef CAP_TO_MASK
#endif

#define CAP_TO_MASK(x) (1ull << (x))

#define EXEC_MODE_EMPTY		0
#define EXEC_MODE_UNSAFE	1
#define EXEC_MODE_SAFE		2

int parser_token = 0;

struct cod_entry *do_file_rule(char *id, perm32_t perms, char *link_id, char *nt);
mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      perm32_t perms);
mnt_rule *do_pivot_rule(struct cond_entry *old, char *root,
			char *transition);
static void abi_features(char *filename, bool search);


#line 147 "parser_yacc.c"

# ifndef YY_CAST
#  ifdef __cplusplus
#   define YY_CAST(Type, Val) static_cast<Type> (Val)
#   define YY_REINTERPRET_CAST(Type, Val) reinterpret_cast<Type> (Val)
#  else
#   define YY_CAST(Type, Val) ((Type) (Val))
#   define YY_REINTERPRET_CAST(Type, Val) ((Type) (Val))
#  endif
# endif
# ifndef YY_NULLPTR
#  if defined __cplusplus
#   if 201103L <= __cplusplus
#    define YY_NULLPTR nullptr
#   else
#    define YY_NULLPTR 0
#   endif
#  else
#   define YY_NULLPTR ((void*)0)
#  endif
# endif

#include "parser_yacc.h"
/* Symbol kind.  */
enum yysymbol_kind_t
{
  YYSYMBOL_YYEMPTY = -2,
  YYSYMBOL_YYEOF = 0,                      /* "end of file"  */
  YYSYMBOL_YYerror = 1,                    /* error  */
  YYSYMBOL_YYUNDEF = 2,                    /* "invalid token"  */
  YYSYMBOL_TOK_ID = 3,                     /* TOK_ID  */
  YYSYMBOL_TOK_CONDID = 4,                 /* TOK_CONDID  */
  YYSYMBOL_TOK_CONDLISTID = 5,             /* TOK_CONDLISTID  */
  YYSYMBOL_TOK_CARET = 6,                  /* TOK_CARET  */
  YYSYMBOL_TOK_OPEN = 7,                   /* TOK_OPEN  */
  YYSYMBOL_TOK_CLOSE = 8,                  /* TOK_CLOSE  */
  YYSYMBOL_TOK_MODE = 9,                   /* TOK_MODE  */
  YYSYMBOL_TOK_END_OF_RULE = 10,           /* TOK_END_OF_RULE  */
  YYSYMBOL_TOK_EQUALS = 11,                /* TOK_EQUALS  */
  YYSYMBOL_TOK_ARROW = 12,                 /* TOK_ARROW  */
  YYSYMBOL_TOK_ADD_ASSIGN = 13,            /* TOK_ADD_ASSIGN  */
  YYSYMBOL_TOK_LE = 14,                    /* TOK_LE  */
  YYSYMBOL_TOK_SET_VAR = 15,               /* TOK_SET_VAR  */
  YYSYMBOL_TOK_BOOL_VAR = 16,              /* TOK_BOOL_VAR  */
  YYSYMBOL_TOK_VALUE = 17,                 /* TOK_VALUE  */
  YYSYMBOL_TOK_IF = 18,                    /* TOK_IF  */
  YYSYMBOL_TOK_ELSE = 19,                  /* TOK_ELSE  */
  YYSYMBOL_TOK_NOT = 20,                   /* TOK_NOT  */
  YYSYMBOL_TOK_DEFINED = 21,               /* TOK_DEFINED  */
  YYSYMBOL_TOK_CHANGE_PROFILE = 22,        /* TOK_CHANGE_PROFILE  */
  YYSYMBOL_TOK_NETWORK = 23,               /* TOK_NETWORK  */
  YYSYMBOL_TOK_UNIX = 24,                  /* TOK_UNIX  */
  YYSYMBOL_TOK_CREATE = 25,                /* TOK_CREATE  */
  YYSYMBOL_TOK_SHUTDOWN = 26,              /* TOK_SHUTDOWN  */
  YYSYMBOL_TOK_ACCEPT = 27,                /* TOK_ACCEPT  */
  YYSYMBOL_TOK_CONNECT = 28,               /* TOK_CONNECT  */
  YYSYMBOL_TOK_LISTEN = 29,                /* TOK_LISTEN  */
  YYSYMBOL_TOK_SETOPT = 30,                /* TOK_SETOPT  */
  YYSYMBOL_TOK_GETOPT = 31,                /* TOK_GETOPT  */
  YYSYMBOL_TOK_SETATTR = 32,               /* TOK_SETATTR  */
  YYSYMBOL_TOK_GETATTR = 33,               /* TOK_GETATTR  */
  YYSYMBOL_TOK_HAT = 34,                   /* TOK_HAT  */
  YYSYMBOL_TOK_UNSAFE = 35,                /* TOK_UNSAFE  */
  YYSYMBOL_TOK_SAFE = 36,                  /* TOK_SAFE  */
  YYSYMBOL_TOK_COLON = 37,                 /* TOK_COLON  */
  YYSYMBOL_TOK_LINK = 38,                  /* TOK_LINK  */
  YYSYMBOL_TOK_OWNER = 39,                 /* TOK_OWNER  */
  YYSYMBOL_TOK_OTHER = 40,                 /* TOK_OTHER  */
  YYSYMBOL_TOK_SUBSET = 41,                /* TOK_SUBSET  */
  YYSYMBOL_TOK_AUDIT = 42,                 /* TOK_AUDIT  */
  YYSYMBOL_TOK_DENY = 43,                  /* TOK_DENY  */
  YYSYMBOL_TOK_ALLOW = 44,                 /* TOK_ALLOW  */
  YYSYMBOL_TOK_PROMPT = 45,                /* TOK_PROMPT  */
  YYSYMBOL_TOK_PROFILE = 46,               /* TOK_PROFILE  */
  YYSYMBOL_TOK_SET = 47,                   /* TOK_SET  */
  YYSYMBOL_TOK_ALIAS = 48,                 /* TOK_ALIAS  */
  YYSYMBOL_TOK_PTRACE = 49,                /* TOK_PTRACE  */
  YYSYMBOL_TOK_OPENPAREN = 50,             /* TOK_OPENPAREN  */
  YYSYMBOL_TOK_CLOSEPAREN = 51,            /* TOK_CLOSEPAREN  */
  YYSYMBOL_TOK_COMMA = 52,                 /* TOK_COMMA  */
  YYSYMBOL_TOK_FILE = 53,                  /* TOK_FILE  */
  YYSYMBOL_TOK_MOUNT = 54,                 /* TOK_MOUNT  */
  YYSYMBOL_TOK_REMOUNT = 55,               /* TOK_REMOUNT  */
  YYSYMBOL_TOK_UMOUNT = 56,                /* TOK_UMOUNT  */
  YYSYMBOL_TOK_PIVOTROOT = 57,             /* TOK_PIVOTROOT  */
  YYSYMBOL_TOK_IN = 58,                    /* TOK_IN  */
  YYSYMBOL_TOK_DBUS = 59,                  /* TOK_DBUS  */
  YYSYMBOL_TOK_SIGNAL = 60,                /* TOK_SIGNAL  */
  YYSYMBOL_TOK_SEND = 61,                  /* TOK_SEND  */
  YYSYMBOL_TOK_RECEIVE = 62,               /* TOK_RECEIVE  */
  YYSYMBOL_TOK_BIND = 63,                  /* TOK_BIND  */
  YYSYMBOL_TOK_READ = 64,                  /* TOK_READ  */
  YYSYMBOL_TOK_WRITE = 65,                 /* TOK_WRITE  */
  YYSYMBOL_TOK_EAVESDROP = 66,             /* TOK_EAVESDROP  */
  YYSYMBOL_TOK_PEER = 67,                  /* TOK_PEER  */
  YYSYMBOL_TOK_TRACE = 68,                 /* TOK_TRACE  */
  YYSYMBOL_TOK_TRACEDBY = 69,              /* TOK_TRACEDBY  */
  YYSYMBOL_TOK_READBY = 70,                /* TOK_READBY  */
  YYSYMBOL_TOK_ABI = 71,                   /* TOK_ABI  */
  YYSYMBOL_TOK_USERNS = 72,                /* TOK_USERNS  */
  YYSYMBOL_TOK_MQUEUE = 73,                /* TOK_MQUEUE  */
  YYSYMBOL_TOK_DELETE = 74,                /* TOK_DELETE  */
  YYSYMBOL_TOK_IO_URING = 75,              /* TOK_IO_URING  */
  YYSYMBOL_TOK_OVERRIDE_CREDS = 76,        /* TOK_OVERRIDE_CREDS  */
  YYSYMBOL_TOK_SQPOLL = 77,                /* TOK_SQPOLL  */
  YYSYMBOL_TOK_ALL = 78,                   /* TOK_ALL  */
  YYSYMBOL_TOK_PRIORITY = 79,              /* TOK_PRIORITY  */
  YYSYMBOL_TOK_RLIMIT = 80,                /* TOK_RLIMIT  */
  YYSYMBOL_TOK_SOFT_RLIMIT = 81,           /* TOK_SOFT_RLIMIT  */
  YYSYMBOL_TOK_RLIMIT_CPU = 82,            /* TOK_RLIMIT_CPU  */
  YYSYMBOL_TOK_RLIMIT_FSIZE = 83,          /* TOK_RLIMIT_FSIZE  */
  YYSYMBOL_TOK_RLIMIT_DATA = 84,           /* TOK_RLIMIT_DATA  */
  YYSYMBOL_TOK_RLIMIT_STACK = 85,          /* TOK_RLIMIT_STACK  */
  YYSYMBOL_TOK_RLIMIT_CORE = 86,           /* TOK_RLIMIT_CORE  */
  YYSYMBOL_TOK_RLIMIT_RSS = 87,            /* TOK_RLIMIT_RSS  */
  YYSYMBOL_TOK_RLIMIT_NOFILE = 88,         /* TOK_RLIMIT_NOFILE  */
  YYSYMBOL_TOK_RLIMIT_OFILE = 89,          /* TOK_RLIMIT_OFILE  */
  YYSYMBOL_TOK_RLIMIT_AS = 90,             /* TOK_RLIMIT_AS  */
  YYSYMBOL_TOK_RLIMIT_NPROC = 91,          /* TOK_RLIMIT_NPROC  */
  YYSYMBOL_TOK_RLIMIT_MEMLOCK = 92,        /* TOK_RLIMIT_MEMLOCK  */
  YYSYMBOL_TOK_RLIMIT_LOCKS = 93,          /* TOK_RLIMIT_LOCKS  */
  YYSYMBOL_TOK_RLIMIT_SIGPENDING = 94,     /* TOK_RLIMIT_SIGPENDING  */
  YYSYMBOL_TOK_RLIMIT_MSGQUEUE = 95,       /* TOK_RLIMIT_MSGQUEUE  */
  YYSYMBOL_TOK_RLIMIT_NICE = 96,           /* TOK_RLIMIT_NICE  */
  YYSYMBOL_TOK_RLIMIT_RTPRIO = 97,         /* TOK_RLIMIT_RTPRIO  */
  YYSYMBOL_TOK_CAPABILITY = 98,            /* TOK_CAPABILITY  */
  YYSYMBOL_TOK_FLAGS = 99,                 /* TOK_FLAGS  */
  YYSYMBOL_YYACCEPT = 100,                 /* $accept  */
  YYSYMBOL_list = 101,                     /* list  */
  YYSYMBOL_102_1 = 102,                    /* $@1  */
  YYSYMBOL_profilelist = 103,              /* profilelist  */
  YYSYMBOL_opt_profile_flag = 104,         /* opt_profile_flag  */
  YYSYMBOL_opt_id = 105,                   /* opt_id  */
  YYSYMBOL_opt_id_or_var = 106,            /* opt_id_or_var  */
  YYSYMBOL_profile_base = 107,             /* profile_base  */
  YYSYMBOL_108_2 = 108,                    /* @2  */
  YYSYMBOL_profile = 109,                  /* profile  */
  YYSYMBOL_local_profile = 110,            /* local_profile  */
  YYSYMBOL_hat = 111,                      /* hat  */
  YYSYMBOL_preamble = 112,                 /* preamble  */
  YYSYMBOL_alias = 113,                    /* alias  */
  YYSYMBOL_varassign = 114,                /* varassign  */
  YYSYMBOL_valuelist = 115,                /* valuelist  */
  YYSYMBOL_flags = 116,                    /* flags  */
  YYSYMBOL_opt_flags = 117,                /* opt_flags  */
  YYSYMBOL_flagvals = 118,                 /* flagvals  */
  YYSYMBOL_flagval = 119,                  /* flagval  */
  YYSYMBOL_opt_subset_flag = 120,          /* opt_subset_flag  */
  YYSYMBOL_opt_priority = 121,             /* opt_priority  */
  YYSYMBOL_opt_audit_flag = 122,           /* opt_audit_flag  */
  YYSYMBOL_opt_owner_flag = 123,           /* opt_owner_flag  */
  YYSYMBOL_opt_rule_mode = 124,            /* opt_rule_mode  */
  YYSYMBOL_opt_prefix = 125,               /* opt_prefix  */
  YYSYMBOL_rules = 126,                    /* rules  */
  YYSYMBOL_block = 127,                    /* block  */
  YYSYMBOL_prefix_rule = 128,              /* prefix_rule  */
  YYSYMBOL_cond_rule = 129,                /* cond_rule  */
  YYSYMBOL_expr = 130,                     /* expr  */
  YYSYMBOL_id_or_var = 131,                /* id_or_var  */
  YYSYMBOL_opt_target = 132,               /* opt_target  */
  YYSYMBOL_opt_named_transition = 133,     /* opt_named_transition  */
  YYSYMBOL_rule = 134,                     /* rule  */
  YYSYMBOL_abi_rule = 135,                 /* abi_rule  */
  YYSYMBOL_opt_exec_mode = 136,            /* opt_exec_mode  */
  YYSYMBOL_opt_file = 137,                 /* opt_file  */
  YYSYMBOL_frule = 138,                    /* frule  */
  YYSYMBOL_file_rule = 139,                /* file_rule  */
  YYSYMBOL_file_rule_tail = 140,           /* file_rule_tail  */
  YYSYMBOL_link_rule = 141,                /* link_rule  */
  YYSYMBOL_network_rule = 142,             /* network_rule  */
  YYSYMBOL_cond = 143,                     /* cond  */
  YYSYMBOL_opt_conds = 144,                /* opt_conds  */
  YYSYMBOL_cond_list = 145,                /* cond_list  */
  YYSYMBOL_opt_cond_list = 146,            /* opt_cond_list  */
  YYSYMBOL_mnt_rule = 147,                 /* mnt_rule  */
  YYSYMBOL_dbus_perm = 148,                /* dbus_perm  */
  YYSYMBOL_dbus_perms = 149,               /* dbus_perms  */
  YYSYMBOL_opt_dbus_perm = 150,            /* opt_dbus_perm  */
  YYSYMBOL_dbus_rule = 151,                /* dbus_rule  */
  YYSYMBOL_net_perm = 152,                 /* net_perm  */
  YYSYMBOL_net_perms = 153,                /* net_perms  */
  YYSYMBOL_opt_net_perm = 154,             /* opt_net_perm  */
  YYSYMBOL_unix_rule = 155,                /* unix_rule  */
  YYSYMBOL_signal_perm = 156,              /* signal_perm  */
  YYSYMBOL_signal_perms = 157,             /* signal_perms  */
  YYSYMBOL_opt_signal_perm = 158,          /* opt_signal_perm  */
  YYSYMBOL_signal_rule = 159,              /* signal_rule  */
  YYSYMBOL_ptrace_perm = 160,              /* ptrace_perm  */
  YYSYMBOL_ptrace_perms = 161,             /* ptrace_perms  */
  YYSYMBOL_opt_ptrace_perm = 162,          /* opt_ptrace_perm  */
  YYSYMBOL_ptrace_rule = 163,              /* ptrace_rule  */
  YYSYMBOL_userns_perm = 164,              /* userns_perm  */
  YYSYMBOL_userns_perms = 165,             /* userns_perms  */
  YYSYMBOL_opt_userns_perm = 166,          /* opt_userns_perm  */
  YYSYMBOL_userns_rule = 167,              /* userns_rule  */
  YYSYMBOL_mqueue_perm = 168,              /* mqueue_perm  */
  YYSYMBOL_mqueue_perms = 169,             /* mqueue_perms  */
  YYSYMBOL_opt_mqueue_perm = 170,          /* opt_mqueue_perm  */
  YYSYMBOL_mqueue_rule = 171,              /* mqueue_rule  */
  YYSYMBOL_io_uring_perm = 172,            /* io_uring_perm  */
  YYSYMBOL_io_uring_perms = 173,           /* io_uring_perms  */
  YYSYMBOL_opt_io_uring_perm = 174,        /* opt_io_uring_perm  */
  YYSYMBOL_io_uring_rule = 175,            /* io_uring_rule  */
  YYSYMBOL_all_rule = 176,                 /* all_rule  */
  YYSYMBOL_hat_start = 177,                /* hat_start  */
  YYSYMBOL_file_perms = 178,               /* file_perms  */
  YYSYMBOL_change_profile = 179,           /* change_profile  */
  YYSYMBOL_capability = 180,               /* capability  */
  YYSYMBOL_caps = 181                      /* caps  */
};
typedef enum yysymbol_kind_t yysymbol_kind_t;




#ifdef short
# undef short
#endif

/* On compilers that do not define __PTRDIFF_MAX__ etc., make sure
   <limits.h> and (if available) <stdint.h> are included
   so that the code can choose integer types of a good width.  */

#ifndef __PTRDIFF_MAX__
# include <limits.h> /* INFRINGES ON USER NAME SPACE */
# if defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stdint.h> /* INFRINGES ON USER NAME SPACE */
#  define YY_STDINT_H
# endif
#endif

/* Narrow types that promote to a signed type and that can represent a
   signed or unsigned integer of at least N bits.  In tables they can
   save space and decrease cache pressure.  Promoting to a signed type
   helps avoid bugs in integer arithmetic.  */

#ifdef __INT_LEAST8_MAX__
typedef __INT_LEAST8_TYPE__ yytype_int8;
#elif defined YY_STDINT_H
typedef int_least8_t yytype_int8;
#else
typedef signed char yytype_int8;
#endif

#ifdef __INT_LEAST16_MAX__
typedef __INT_LEAST16_TYPE__ yytype_int16;
#elif defined YY_STDINT_H
typedef int_least16_t yytype_int16;
#else
typedef short yytype_int16;
#endif

/* Work around bug in HP-UX 11.23, which defines these macros
   incorrectly for preprocessor constants.  This workaround can likely
   be removed in 2023, as HPE has promised support for HP-UX 11.23
   (aka HP-UX 11i v2) only through the end of 2022; see Table 2 of
   <https://h20195.www2.hpe.com/V2/getpdf.aspx/4AA4-7673ENW.pdf>.  */
#ifdef __hpux
# undef UINT_LEAST8_MAX
# undef UINT_LEAST16_MAX
# define UINT_LEAST8_MAX 255
# define UINT_LEAST16_MAX 65535
#endif

#if defined __UINT_LEAST8_MAX__ && __UINT_LEAST8_MAX__ <= __INT_MAX__
typedef __UINT_LEAST8_TYPE__ yytype_uint8;
#elif (!defined __UINT_LEAST8_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST8_MAX <= INT_MAX)
typedef uint_least8_t yytype_uint8;
#elif !defined __UINT_LEAST8_MAX__ && UCHAR_MAX <= INT_MAX
typedef unsigned char yytype_uint8;
#else
typedef short yytype_uint8;
#endif

#if defined __UINT_LEAST16_MAX__ && __UINT_LEAST16_MAX__ <= __INT_MAX__
typedef __UINT_LEAST16_TYPE__ yytype_uint16;
#elif (!defined __UINT_LEAST16_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST16_MAX <= INT_MAX)
typedef uint_least16_t yytype_uint16;
#elif !defined __UINT_LEAST16_MAX__ && USHRT_MAX <= INT_MAX
typedef unsigned short yytype_uint16;
#else
typedef int yytype_uint16;
#endif

#ifndef YYPTRDIFF_T
# if defined __PTRDIFF_TYPE__ && defined __PTRDIFF_MAX__
#  define YYPTRDIFF_T __PTRDIFF_TYPE__
#  define YYPTRDIFF_MAXIMUM __PTRDIFF_MAX__
# elif defined PTRDIFF_MAX
#  ifndef ptrdiff_t
#   include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  endif
#  define YYPTRDIFF_T ptrdiff_t
#  define YYPTRDIFF_MAXIMUM PTRDIFF_MAX
# else
#  define YYPTRDIFF_T long
#  define YYPTRDIFF_MAXIMUM LONG_MAX
# endif
#endif

#ifndef YYSIZE_T
# ifdef __SIZE_TYPE__
#  define YYSIZE_T __SIZE_TYPE__
# elif defined size_t
#  define YYSIZE_T size_t
# elif defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  define YYSIZE_T size_t
# else
#  define YYSIZE_T unsigned
# endif
#endif

#define YYSIZE_MAXIMUM                                  \
  YY_CAST (YYPTRDIFF_T,                                 \
           (YYPTRDIFF_MAXIMUM < YY_CAST (YYSIZE_T, -1)  \
            ? YYPTRDIFF_MAXIMUM                         \
            : YY_CAST (YYSIZE_T, -1)))

#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X))


/* Stored state numbers (used for stacks). */
typedef yytype_int16 yy_state_t;

/* State numbers in computations.  */
typedef int yy_state_fast_t;

#ifndef YY_
# if defined YYENABLE_NLS && YYENABLE_NLS
#  if ENABLE_NLS
#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
#   define YY_(Msgid) dgettext ("bison-runtime", Msgid)
#  endif
# endif
# ifndef YY_
#  define YY_(Msgid) Msgid
# endif
#endif


#ifndef YY_ATTRIBUTE_PURE
# if defined __GNUC__ && 2 < __GNUC__ + (96 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_PURE __attribute__ ((__pure__))
# else
#  define YY_ATTRIBUTE_PURE
# endif
#endif

#ifndef YY_ATTRIBUTE_UNUSED
# if defined __GNUC__ && 2 < __GNUC__ + (7 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_UNUSED __attribute__ ((__unused__))
# else
#  define YY_ATTRIBUTE_UNUSED
# endif
#endif

/* Suppress unused-variable warnings by "using" E.  */
#if ! defined lint || defined __GNUC__
# define YY_USE(E) ((void) (E))
#else
# define YY_USE(E) /* empty */
#endif

/* Suppress an incorrect diagnostic about yylval being uninitialized.  */
#if defined __GNUC__ && ! defined __ICC && 406 <= __GNUC__ * 100 + __GNUC_MINOR__
# if __GNUC__ * 100 + __GNUC_MINOR__ < 407
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")
# else
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")              \
    _Pragma ("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
# endif
# define YY_IGNORE_MAYBE_UNINITIALIZED_END      \
    _Pragma ("GCC diagnostic pop")
#else
# define YY_INITIAL_VALUE(Value) Value
#endif
#ifndef YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_END
#endif
#ifndef YY_INITIAL_VALUE
# define YY_INITIAL_VALUE(Value) /* Nothing. */
#endif

#if defined __cplusplus && defined __GNUC__ && ! defined __ICC && 6 <= __GNUC__
# define YY_IGNORE_USELESS_CAST_BEGIN                          \
    _Pragma ("GCC diagnostic push")                            \
    _Pragma ("GCC diagnostic ignored \"-Wuseless-cast\"")
# define YY_IGNORE_USELESS_CAST_END            \
    _Pragma ("GCC diagnostic pop")
#endif
#ifndef YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_END
#endif


#define YY_ASSERT(E) ((void) (0 && (E)))

#if 1

/* The parser invokes alloca or malloc; define the necessary symbols.  */

# ifdef YYSTACK_USE_ALLOCA
#  if YYSTACK_USE_ALLOCA
#   ifdef __GNUC__
#    define YYSTACK_ALLOC __builtin_alloca
#   elif defined __BUILTIN_VA_ARG_INCR
#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
#   elif defined _AIX
#    define YYSTACK_ALLOC __alloca
#   elif defined _MSC_VER
#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
#    define alloca _alloca
#   else
#    define YYSTACK_ALLOC alloca
#    if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS
#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
      /* Use EXIT_SUCCESS as a witness for stdlib.h.  */
#     ifndef EXIT_SUCCESS
#      define EXIT_SUCCESS 0
#     endif
#    endif
#   endif
#  endif
# endif

# ifdef YYSTACK_ALLOC
   /* Pacify GCC's 'empty if-body' warning.  */
#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (0)
#  ifndef YYSTACK_ALLOC_MAXIMUM
    /* The OS might guarantee only one guard page at the bottom of the stack,
       and a page size can be as small as 4096 bytes.  So we cannot safely
       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
       to allow for a few compiler-allocated temporary stack slots.  */
#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
#  endif
# else
#  define YYSTACK_ALLOC YYMALLOC
#  define YYSTACK_FREE YYFREE
#  ifndef YYSTACK_ALLOC_MAXIMUM
#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
#  endif
#  if (defined __cplusplus && ! defined EXIT_SUCCESS \
       && ! ((defined YYMALLOC || defined malloc) \
             && (defined YYFREE || defined free)))
#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
#   ifndef EXIT_SUCCESS
#    define EXIT_SUCCESS 0
#   endif
#  endif
#  ifndef YYMALLOC
#   define YYMALLOC malloc
#   if ! defined malloc && ! defined EXIT_SUCCESS
void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
#  ifndef YYFREE
#   define YYFREE free
#   if ! defined free && ! defined EXIT_SUCCESS
void free (void *); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
# endif
#endif /* 1 */

#if (! defined yyoverflow \
     && (! defined __cplusplus \
         || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))

/* A type that is properly aligned for any stack member.  */
union yyalloc
{
  yy_state_t yyss_alloc;
  YYSTYPE yyvs_alloc;
};

/* The size of the maximum gap between one aligned stack and the next.  */
# define YYSTACK_GAP_MAXIMUM (YYSIZEOF (union yyalloc) - 1)

/* The size of an array large to enough to hold all stacks, each with
   N elements.  */
# define YYSTACK_BYTES(N) \
     ((N) * (YYSIZEOF (yy_state_t) + YYSIZEOF (YYSTYPE)) \
      + YYSTACK_GAP_MAXIMUM)

# define YYCOPY_NEEDED 1

/* Relocate STACK from its old location to the new one.  The
   local variables YYSIZE and YYSTACKSIZE give the old and new number of
   elements in the stack, and YYPTR gives the new location of the
   stack.  Advance YYPTR to a properly aligned location for the next
   stack.  */
# define YYSTACK_RELOCATE(Stack_alloc, Stack)                           \
    do                                                                  \
      {                                                                 \
        YYPTRDIFF_T yynewbytes;                                         \
        YYCOPY (&yyptr->Stack_alloc, Stack, yysize);                    \
        Stack = &yyptr->Stack_alloc;                                    \
        yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \
        yyptr += yynewbytes / YYSIZEOF (*yyptr);                        \
      }                                                                 \
    while (0)

#endif

#if defined YYCOPY_NEEDED && YYCOPY_NEEDED
/* Copy COUNT objects from SRC to DST.  The source and destination do
   not overlap.  */
# ifndef YYCOPY
#  if defined __GNUC__ && 1 < __GNUC__
#   define YYCOPY(Dst, Src, Count) \
      __builtin_memcpy (Dst, Src, YY_CAST (YYSIZE_T, (Count)) * sizeof (*(Src)))
#  else
#   define YYCOPY(Dst, Src, Count)              \
      do                                        \
        {                                       \
          YYPTRDIFF_T yyi;                      \
          for (yyi = 0; yyi < (Count); yyi++)   \
            (Dst)[yyi] = (Src)[yyi];            \
        }                                       \
      while (0)
#  endif
# endif
#endif /* !YYCOPY_NEEDED */

/* YYFINAL -- State number of the termination state.  */
#define YYFINAL  3
/* YYLAST -- Last index in YYTABLE.  */
#define YYLAST   396

/* YYNTOKENS -- Number of terminals.  */
#define YYNTOKENS  100
/* YYNNTS -- Number of nonterminals.  */
#define YYNNTS  82
/* YYNRULES -- Number of rules.  */
#define YYNRULES  226
/* YYNSTATES -- Number of states.  */
#define YYNSTATES  344

/* YYMAXUTOK -- Last valid token kind.  */
#define YYMAXUTOK   354


/* YYTRANSLATE(TOKEN-NUM) -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex, with out-of-bounds checking.  */
#define YYTRANSLATE(YYX)                                \
  (0 <= (YYX) && (YYX) <= YYMAXUTOK                     \
   ? YY_CAST (yysymbol_kind_t, yytranslate[YYX])        \
   : YYSYMBOL_YYUNDEF)

/* YYTRANSLATE[TOKEN-NUM] -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex.  */
static const yytype_int8 yytranslate[] =
{
       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
      35,    36,    37,    38,    39,    40,    41,    42,    43,    44,
      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
      85,    86,    87,    88,    89,    90,    91,    92,    93,    94,
      95,    96,    97,    98,    99
};

#if YYDEBUG
/* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
static const yytype_int16 yyrline[] =
{
       0,   320,   320,   319,   347,   349,   355,   356,   357,   359,
     360,   362,   363,   366,   365,   433,   453,   463,   479,   480,
     481,   482,   484,   492,   519,   547,   567,   577,   588,   595,
     596,   604,   609,   615,   620,   629,   630,   631,   634,   635,
     650,   651,   653,   654,   655,   657,   658,   659,   660,   662,
     670,   679,   681,   695,   700,   730,   752,   753,   754,   755,
     756,   757,   758,   759,   760,   762,   771,   791,   810,   819,
     828,   834,   933,   946,   961,   976,   983,   991,   999,  1007,
    1008,  1010,  1011,  1013,  1014,  1019,  1020,  1022,  1028,  1035,
    1036,  1037,  1039,  1040,  1042,  1047,  1065,  1076,  1079,  1094,
    1103,  1113,  1126,  1140,  1155,  1164,  1178,  1188,  1197,  1198,
    1204,  1210,  1211,  1213,  1218,  1223,  1228,  1233,  1238,  1256,
    1257,  1258,  1259,  1260,  1261,  1262,  1268,  1269,  1270,  1272,
    1273,  1274,  1276,  1292,  1326,  1327,  1328,  1329,  1330,  1331,
    1332,  1333,  1334,  1335,  1336,  1337,  1338,  1339,  1340,  1346,
    1347,  1348,  1350,  1351,  1352,  1354,  1370,  1384,  1385,  1386,
    1387,  1388,  1394,  1395,  1396,  1398,  1399,  1400,  1402,  1408,
    1426,  1427,  1428,  1429,  1430,  1431,  1437,  1438,  1439,  1441,
    1442,  1443,  1445,  1451,  1461,  1463,  1464,  1465,  1467,  1468,
    1469,  1471,  1477,  1501,  1502,  1503,  1504,  1505,  1506,  1507,
    1508,  1514,  1515,  1516,  1518,  1519,  1520,  1522,  1527,  1533,
    1545,  1546,  1548,  1549,  1550,  1552,  1553,  1554,  1556,  1565,
    1573,  1574,  1576,  1584,  1630,  1639,  1640
};
#endif

/** Accessing symbol of state STATE.  */
#define YY_ACCESSING_SYMBOL(State) YY_CAST (yysymbol_kind_t, yystos[State])

#if 1
/* The user-facing name of the symbol whose (internal) number is
   YYSYMBOL.  No bounds checking.  */
static const char *yysymbol_name (yysymbol_kind_t yysymbol) YY_ATTRIBUTE_UNUSED;

/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
static const char *const yytname[] =
{
  "\"end of file\"", "error", "\"invalid token\"", "TOK_ID", "TOK_CONDID",
  "TOK_CONDLISTID", "TOK_CARET", "TOK_OPEN", "TOK_CLOSE", "TOK_MODE",
  "TOK_END_OF_RULE", "TOK_EQUALS", "TOK_ARROW", "TOK_ADD_ASSIGN", "TOK_LE",
  "TOK_SET_VAR", "TOK_BOOL_VAR", "TOK_VALUE", "TOK_IF", "TOK_ELSE",
  "TOK_NOT", "TOK_DEFINED", "TOK_CHANGE_PROFILE", "TOK_NETWORK",
  "TOK_UNIX", "TOK_CREATE", "TOK_SHUTDOWN", "TOK_ACCEPT", "TOK_CONNECT",
  "TOK_LISTEN", "TOK_SETOPT", "TOK_GETOPT", "TOK_SETATTR", "TOK_GETATTR",
  "TOK_HAT", "TOK_UNSAFE", "TOK_SAFE", "TOK_COLON", "TOK_LINK",
  "TOK_OWNER", "TOK_OTHER", "TOK_SUBSET", "TOK_AUDIT", "TOK_DENY",
  "TOK_ALLOW", "TOK_PROMPT", "TOK_PROFILE", "TOK_SET", "TOK_ALIAS",
  "TOK_PTRACE", "TOK_OPENPAREN", "TOK_CLOSEPAREN", "TOK_COMMA", "TOK_FILE",
  "TOK_MOUNT", "TOK_REMOUNT", "TOK_UMOUNT", "TOK_PIVOTROOT", "TOK_IN",
  "TOK_DBUS", "TOK_SIGNAL", "TOK_SEND", "TOK_RECEIVE", "TOK_BIND",
  "TOK_READ", "TOK_WRITE", "TOK_EAVESDROP", "TOK_PEER", "TOK_TRACE",
  "TOK_TRACEDBY", "TOK_READBY", "TOK_ABI", "TOK_USERNS", "TOK_MQUEUE",
  "TOK_DELETE", "TOK_IO_URING", "TOK_OVERRIDE_CREDS", "TOK_SQPOLL",
  "TOK_ALL", "TOK_PRIORITY", "TOK_RLIMIT", "TOK_SOFT_RLIMIT",
  "TOK_RLIMIT_CPU", "TOK_RLIMIT_FSIZE", "TOK_RLIMIT_DATA",
  "TOK_RLIMIT_STACK", "TOK_RLIMIT_CORE", "TOK_RLIMIT_RSS",
  "TOK_RLIMIT_NOFILE", "TOK_RLIMIT_OFILE", "TOK_RLIMIT_AS",
  "TOK_RLIMIT_NPROC", "TOK_RLIMIT_MEMLOCK", "TOK_RLIMIT_LOCKS",
  "TOK_RLIMIT_SIGPENDING", "TOK_RLIMIT_MSGQUEUE", "TOK_RLIMIT_NICE",
  "TOK_RLIMIT_RTPRIO", "TOK_CAPABILITY", "TOK_FLAGS", "$accept", "list",
  "$@1", "profilelist", "opt_profile_flag", "opt_id", "opt_id_or_var",
  "profile_base", "@2", "profile", "local_profile", "hat", "preamble",
  "alias", "varassign", "valuelist", "flags", "opt_flags", "flagvals",
  "flagval", "opt_subset_flag", "opt_priority", "opt_audit_flag",
  "opt_owner_flag", "opt_rule_mode", "opt_prefix", "rules", "block",
  "prefix_rule", "cond_rule", "expr", "id_or_var", "opt_target",
  "opt_named_transition", "rule", "abi_rule", "opt_exec_mode", "opt_file",
  "frule", "file_rule", "file_rule_tail", "link_rule", "network_rule",
  "cond", "opt_conds", "cond_list", "opt_cond_list", "mnt_rule",
  "dbus_perm", "dbus_perms", "opt_dbus_perm", "dbus_rule", "net_perm",
  "net_perms", "opt_net_perm", "unix_rule", "signal_perm", "signal_perms",
  "opt_signal_perm", "signal_rule", "ptrace_perm", "ptrace_perms",
  "opt_ptrace_perm", "ptrace_rule", "userns_perm", "userns_perms",
  "opt_userns_perm", "userns_rule", "mqueue_perm", "mqueue_perms",
  "opt_mqueue_perm", "mqueue_rule", "io_uring_perm", "io_uring_perms",
  "opt_io_uring_perm", "io_uring_rule", "all_rule", "hat_start",
  "file_perms", "change_profile", "capability", "caps", YY_NULLPTR
};

static const char *
yysymbol_name (yysymbol_kind_t yysymbol)
{
  return yytname[yysymbol];
}
#endif

#define YYPACT_NINF (-247)

#define yypact_value_is_default(Yyn) \
  ((Yyn) == YYPACT_NINF)

#define YYTABLE_NINF (-30)

#define yytable_value_is_error(Yyn) \
  0

/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
   STATE-NUM.  */
static const yytype_int16 yypact[] =
{
    -247,    37,    64,  -247,   112,    29,    46,    22,  -247,  -247,
    -247,  -247,    80,    80,   121,   145,   150,   165,   159,  -247,
     171,   171,  -247,   164,  -247,  -247,  -247,  -247,  -247,   207,
    -247,  -247,  -247,   217,    15,  -247,  -247,  -247,  -247,   229,
    -247,   250,  -247,    19,   226,   285,   292,   248,  -247,  -247,
    -247,   297,     8,  -247,  -247,    12,  -247,     2,  -247,  -247,
      38,  -247,  -247,   153,   266,  -247,   262,   207,   237,   307,
    -247,  -247,   277,    -2,  -247,  -247,   207,  -247,    80,    80,
    -247,   262,   231,   314,  -247,   319,   308,  -247,   241,  -247,
     184,   280,   280,   204,   144,   316,  -247,  -247,  -247,  -247,
     178,   331,    17,   104,    24,   317,  -247,  -247,  -247,  -247,
     184,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,    71,    76,  -247,  -247,
    -247,   305,   315,  -247,  -247,  -247,  -247,   218,    84,  -247,
    -247,   343,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
     344,  -247,  -247,  -247,    15,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,   284,   284,   284,   284,
    -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,   170,   208,  -247,  -247,  -247,    88,
     332,  -247,  -247,  -247,  -247,  -247,   338,   239,   348,   288,
     288,   340,   132,   220,   267,   345,   346,   341,    82,   288,
     311,   225,   174,   271,   107,   270,    10,   288,  -247,  -247,
    -247,   349,  -247,   204,  -247,  -247,   343,    15,   347,  -247,
     306,  -247,  -247,   288,   350,   351,    15,  -247,   168,  -247,
    -247,  -247,  -247,  -247,  -247,    15,   354,  -247,   189,  -247,
     355,  -247,   198,  -247,  -247,  -247,    90,  -247,  -247,  -247,
     157,  -247,   356,  -247,  -247,    28,  -247,   364,    23,    15,
     367,  -247,  -247,  -247,   288,   368,  -247,  -247,   369,  -247,
     291,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,  -247,
    -247,  -247,   370,   338,  -247,   372,  -247,  -247,   373,  -247,
     374,  -247,  -247,  -247
};

/* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
   Performed when YYTABLE does not specify something else to do.  Zero
   means the default is an error.  */
static const yytype_uint8 yydefact[] =
{
      18,     0,     2,     1,     0,     0,     0,     0,     4,    19,
      20,    21,     0,     0,     0,     0,     0,     0,     3,    26,
      23,    24,    25,     0,    87,    88,   220,   221,     7,     0,
       5,     8,    27,     0,    11,    15,    22,    79,    80,   111,
      12,     0,   112,    28,     0,     0,     0,     0,   108,    30,
      13,     0,     0,    50,    34,     0,    33,   104,   110,   109,
      38,    31,    32,     0,     0,    14,     0,     0,     0,     0,
      69,    68,    40,    92,    70,    51,     0,   105,     0,     0,
      76,     0,     0,     0,    16,     0,     0,    41,    45,    50,
      89,   152,   152,    35,   179,    93,   108,   108,   108,   108,
     129,   165,   188,   204,   215,     0,   225,    54,    65,    52,
      89,    85,    86,    55,    56,    57,    60,    58,    59,    61,
      62,    63,    64,    66,    67,    17,     0,     0,    75,    77,
      78,    72,     0,    39,    47,    46,    48,    42,    38,    90,
      91,     9,   148,   133,   134,   139,   137,   138,   136,   143,
     142,   141,   140,   149,   144,   145,   135,   146,   147,   153,
     108,   108,    37,    36,     0,   175,   169,   176,   172,   173,
     170,   171,   174,   180,   108,    96,     9,     9,     9,     9,
     125,   118,   126,   120,   121,   119,   122,   123,   124,   130,
     108,   161,   156,   162,   157,   158,   159,   160,   166,   108,
     183,   184,   185,   189,   108,   194,   200,   192,   193,   197,
     196,   201,   199,   198,   195,   205,   108,   209,   212,   210,
     211,   216,   108,   219,     0,     0,    97,   106,   107,     0,
       0,    43,    44,    49,    53,    10,    83,     0,   108,   111,
     111,     0,     0,     0,     0,     0,     0,    81,     0,   111,
       0,     0,     0,     0,     0,     0,     0,   111,   226,   224,
     222,     0,    98,    35,    73,    74,     9,     0,     0,   154,
       0,   150,   108,   111,     0,     0,     0,   181,     0,   177,
     182,   113,   108,   115,   116,     0,     0,   131,     0,   127,
       0,   167,     0,   163,   168,   190,     0,   186,   191,   206,
       0,   202,     0,   207,   217,     0,   213,     0,    83,     0,
       0,    84,   223,   151,   111,     0,   101,   155,     0,   178,
       0,    82,   117,   128,   132,   164,   187,   203,   208,   214,
     218,    99,     0,    83,    71,     0,   102,   100,     0,    94,
       0,   103,   114,    95
};

/* YYPGOTO[NTERM-NUM].  */
static const yytype_int16 yypgoto[] =
{
    -247,  -247,  -247,  -247,  -247,  -168,  -247,   -48,  -247,  -247,
    -247,  -247,  -247,  -247,  -247,     3,  -247,  -247,  -247,   299,
      96,  -247,  -247,  -247,  -247,  -247,   296,   -79,  -247,   158,
     309,  -157,  -247,  -129,  -247,   384,   278,  -247,  -247,  -247,
    -247,  -247,  -247,  -247,   -96,  -247,  -225,  -247,  -205,  -247,
    -247,  -247,   -21,  -247,   302,  -247,  -217,  -247,  -247,  -247,
     -86,  -247,  -247,  -247,  -246,  -247,  -247,  -247,  -223,  -247,
    -247,  -247,  -239,  -247,  -247,  -247,  -247,   371,   130,  -247,
    -247,  -247
};

/* YYDEFGOTO[NTERM-NUM].  */
static const yytype_int16 yydefgoto[] =
{
       0,     1,     8,    18,    29,   236,    39,    35,    53,    30,
      70,    71,     2,     9,    10,    20,    46,    47,    55,    56,
     164,    72,    88,   233,   137,    73,    60,   107,   108,    74,
      83,    40,   286,   268,   109,    75,   141,   110,   262,   111,
     226,   112,   113,    59,    52,    42,    43,   114,   189,   248,
     190,   115,   159,   237,   160,   116,   198,   250,   199,   117,
     173,   242,   174,   118,   203,   252,   204,   119,   215,   254,
     216,   120,   221,   256,   222,   121,   122,    76,   263,   123,
     124,   224
};

/* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
   positive, shift that token.  If negative, reduce the rule whose
   number is the opposite.  If YYTABLE_NINF, syntax error.  */
static const yytype_int16 yytable[] =
{
     176,   177,   178,   179,   131,    89,   297,   241,   244,   245,
     246,   247,    57,    63,   274,   275,    21,   306,    37,    84,
      90,    91,    92,    45,   290,    16,    37,   217,   125,    54,
      38,   301,   307,   293,   200,   267,    93,     3,    38,    17,
      14,   217,   201,   289,    26,   217,    65,    94,   315,    15,
     326,    95,    96,    97,    98,    99,    66,   100,   101,    58,
      64,   304,   305,    61,   239,   240,   329,   202,   261,   -29,
     102,   103,    27,   104,   218,   325,   105,   327,   243,     4,
       5,   126,   127,   323,    67,    68,   219,   220,    32,   335,
      26,   180,   234,    32,   249,    89,   106,    19,   310,   181,
     219,   220,    66,   251,   219,   220,    66,   200,   253,     7,
     311,   205,     6,   206,   205,   201,   206,    69,    27,   318,
     255,   207,   227,    12,   207,    13,   257,   228,   321,   208,
      67,    68,   208,   287,   288,     7,   209,   210,    22,   209,
     210,   165,   273,   183,   184,   185,   186,   187,   188,   166,
     264,   331,   333,   165,   211,     7,   279,    23,   299,   300,
      24,   166,    -6,    69,   205,    26,   206,    33,   212,   213,
      77,   212,   213,   258,   207,    25,   314,   165,   214,   332,
     259,   214,   208,   277,   278,   166,   320,   180,    32,   209,
     210,   200,   319,    27,   167,   181,   168,   169,   180,   201,
     170,   171,   172,    78,   340,    28,   181,   191,   168,   169,
      34,    37,   170,   171,   172,   192,   271,   260,   162,   139,
     140,   212,   213,    38,    57,   295,   296,    36,   182,    57,
     280,   214,   168,   169,    41,   294,   170,   171,   172,   183,
     184,   185,   186,   187,   188,   163,   129,   130,   142,   313,
     183,   184,   185,   186,   187,   188,   143,   231,   232,   194,
     195,    44,   196,   197,   144,   145,   146,   147,   148,   149,
     150,   151,   152,   302,    57,    57,    48,   281,    80,   282,
     303,   298,    81,    82,   134,   135,   136,   235,    57,   142,
     269,   270,    57,    41,   338,    57,    49,   143,    51,    50,
     154,   155,   156,   157,   158,   144,   145,   146,   147,   148,
     149,   150,   151,   152,    54,   142,    79,    85,    86,    87,
     191,    89,   132,   143,   229,   133,   175,   223,   192,   230,
     153,   144,   145,   146,   147,   148,   149,   150,   151,   152,
     191,   154,   155,   156,   157,   158,   235,   238,   192,   266,
     267,   272,   276,   285,    62,   283,   284,   312,   260,   309,
     316,   317,   291,   292,   322,   324,   328,   154,   155,   156,
     157,   158,   194,   195,   330,   196,   197,   334,   336,   337,
     339,   193,   341,   342,   343,   138,    11,   265,   225,    31,
     128,   308,   194,   195,   161,   196,   197
};

static const yytype_int16 yycheck[] =
{
      96,    97,    98,    99,    83,     7,   252,   164,   176,   177,
     178,   179,     4,    11,   239,   240,    13,   256,     3,    67,
      22,    23,    24,     4,   249,     3,     3,    17,    76,    17,
      15,   254,   257,   250,    17,    12,    38,     0,    15,    17,
      11,    17,    25,   248,     6,    17,     8,    49,   273,     3,
     296,    53,    54,    55,    56,    57,    18,    59,    60,    51,
      58,    51,    52,    51,   160,   161,   305,    50,   225,    50,
      72,    73,    34,    75,    50,   292,    78,   300,   174,    15,
      16,    78,    79,   288,    46,    47,    76,    77,    17,   314,
       6,     9,     8,    17,   190,     7,    98,    17,   266,    17,
      76,    77,    18,   199,    76,    77,    18,    17,   204,    71,
     267,     7,    48,     9,     7,    25,     9,    79,    34,   276,
     216,    17,    51,    11,    17,    13,   222,    51,   285,    25,
      46,    47,    25,    51,    52,    71,    32,    33,    17,    32,
      33,     9,   238,    61,    62,    63,    64,    65,    66,    17,
     229,   308,   309,     9,    50,    71,   242,    12,    51,    52,
      10,    17,     3,    79,     7,     6,     9,     3,    64,    65,
      17,    64,    65,     3,    17,    10,   272,     9,    74,   308,
      10,    74,    25,    51,    52,    17,   282,     9,    17,    32,
      33,    17,   278,    34,    50,    17,    64,    65,     9,    25,
      68,    69,    70,    50,   333,    46,    17,     9,    64,    65,
       3,     3,    68,    69,    70,    17,   237,     9,    14,    35,
      36,    64,    65,    15,     4,    51,    52,    10,    50,     4,
      10,    74,    64,    65,     5,    10,    68,    69,    70,    61,
      62,    63,    64,    65,    66,    41,    15,    16,     9,   270,
      61,    62,    63,    64,    65,    66,    17,    39,    40,    61,
      62,    11,    64,    65,    25,    26,    27,    28,    29,    30,
      31,    32,    33,     3,     4,     4,    50,    10,    16,    12,
      10,    10,    20,    21,    43,    44,    45,     3,     4,     9,
      51,    52,     4,     5,     3,     4,    11,    17,    50,     7,
      61,    62,    63,    64,    65,    25,    26,    27,    28,    29,
      30,    31,    32,    33,    17,     9,    50,    80,    11,    42,
       9,     7,     3,    17,    19,    17,    10,    10,    17,    14,
      50,    25,    26,    27,    28,    29,    30,    31,    32,    33,
       9,    61,    62,    63,    64,    65,     3,     3,    17,    17,
      12,     3,    12,    12,    55,    10,    10,    10,     9,   263,
      10,    10,    51,    52,    10,    10,    10,    61,    62,    63,
      64,    65,    61,    62,    10,    64,    65,    10,    10,    10,
      10,    50,    10,    10,    10,    89,     2,   229,   110,    18,
      81,   261,    61,    62,    92,    64,    65
};

/* YYSTOS[STATE-NUM] -- The symbol kind of the accessing symbol of
   state STATE-NUM.  */
static const yytype_uint8 yystos[] =
{
       0,   101,   112,     0,    15,    16,    48,    71,   102,   113,
     114,   135,    11,    13,    11,     3,     3,    17,   103,    17,
     115,   115,    17,    12,    10,    10,     6,    34,    46,   104,
     109,   177,    17,     3,     3,   107,    10,     3,    15,   106,
     131,     5,   145,   146,    11,     4,   116,   117,    50,    11,
       7,    50,   144,   108,    17,   118,   119,     4,    51,   143,
     126,    51,   119,    11,    58,     8,    18,    46,    47,    79,
     110,   111,   121,   125,   129,   135,   177,    17,    50,    50,
      16,    20,    21,   130,   107,    80,    11,    42,   122,     7,
      22,    23,    24,    38,    49,    53,    54,    55,    56,    57,
      59,    60,    72,    73,    75,    78,    98,   127,   128,   134,
     137,   139,   141,   142,   147,   151,   155,   159,   163,   167,
     171,   175,   176,   179,   180,   107,   115,   115,   130,    15,
      16,   127,     3,    17,    43,    44,    45,   124,   126,    35,
      36,   136,     9,    17,    25,    26,    27,    28,    29,    30,
      31,    32,    33,    50,    61,    62,    63,    64,    65,   152,
     154,   154,    14,    41,   120,     9,    17,    50,    64,    65,
      68,    69,    70,   160,   162,    10,   144,   144,   144,   144,
       9,    17,    50,    61,    62,    63,    64,    65,    66,   148,
     150,     9,    17,    50,    61,    62,    64,    65,   156,   158,
      17,    25,    50,   164,   166,     7,     9,    17,    25,    32,
      33,    50,    64,    65,    74,   168,   170,    17,    50,    76,
      77,   172,   174,    10,   181,   136,   140,    51,    51,    19,
      14,    39,    40,   123,     8,     3,   105,   153,     3,   144,
     144,   131,   161,   144,   105,   105,   105,   105,   149,   144,
     157,   144,   165,   144,   169,   144,   173,   144,     3,    10,
       9,   131,   138,   178,   127,   129,    17,    12,   133,    51,
      52,   152,     3,   144,   146,   146,    12,    51,    52,   160,
      10,    10,    12,    10,    10,    12,   132,    51,    52,   148,
     146,    51,    52,   156,    10,    51,    52,   164,    10,    51,
      52,   168,     3,    10,    51,    52,   172,   146,   178,   120,
     105,   131,    10,   152,   144,   146,    10,    10,   131,   160,
     144,   131,    10,   148,    10,   156,   164,   168,    10,   172,
      10,   131,   133,   131,    10,   146,    10,    10,     3,    10,
     133,    10,    10,    10
};

/* YYR1[RULE-NUM] -- Symbol kind of the left-hand side of rule RULE-NUM.  */
static const yytype_uint8 yyr1[] =
{
       0,   100,   102,   101,   103,   103,   104,   104,   104,   105,
     105,   106,   106,   108,   107,   109,   110,   111,   112,   112,
     112,   112,   113,   114,   114,   114,   115,   115,   116,   117,
     117,   116,   118,   118,   119,   120,   120,   120,   121,   121,
     122,   122,   123,   123,   123,   124,   124,   124,   124,   125,
     126,   126,   126,   127,   126,   126,   128,   128,   128,   128,
     128,   128,   128,   128,   128,   126,   126,   126,   126,   126,
     126,   126,   129,   129,   129,   130,   130,   130,   130,   131,
     131,   132,   132,   133,   133,   134,   134,   135,   135,   136,
     136,   136,   137,   137,   138,   138,   139,   139,   140,   140,
     141,   142,   142,   142,   143,   143,   143,   143,   144,   144,
     145,   146,   146,   147,   147,   147,   147,   147,   148,   148,
     148,   148,   148,   148,   148,   148,   149,   149,   149,   150,
     150,   150,   151,   152,   152,   152,   152,   152,   152,   152,
     152,   152,   152,   152,   152,   152,   152,   152,   152,   153,
     153,   153,   154,   154,   154,   155,   156,   156,   156,   156,
     156,   156,   157,   157,   157,   158,   158,   158,   159,   160,
     160,   160,   160,   160,   160,   160,   161,   161,   161,   162,
     162,   162,   163,   164,   164,   165,   165,   165,   166,   166,
     166,   167,   168,   168,   168,   168,   168,   168,   168,   168,
     168,   169,   169,   169,   170,   170,   170,   171,   171,   172,
     172,   172,   173,   173,   173,   174,   174,   174,   175,   176,
     177,   177,   178,   179,   180,   181,   181
};

/* YYR2[RULE-NUM] -- Number of symbols on the right-hand side of rule RULE-NUM.  */
static const yytype_int8 yyr2[] =
{
       0,     2,     0,     3,     0,     2,     0,     1,     1,     0,
       1,     0,     1,     0,     8,     2,     2,     2,     0,     2,
       2,     2,     5,     3,     3,     3,     1,     2,     0,     0,
       2,     4,     2,     1,     1,     0,     1,     1,     0,     3,
       0,     1,     0,     1,     1,     0,     1,     1,     1,     4,
       0,     2,     3,     3,     3,     3,     1,     1,     1,     1,
       1,     1,     1,     1,     1,     3,     3,     3,     2,     2,
       2,     8,     3,     5,     5,     2,     1,     2,     2,     1,
       1,     0,     2,     0,     2,     1,     1,     3,     3,     0,
       1,     1,     0,     1,     4,     5,     2,     2,     2,     4,
       6,     5,     6,     7,     1,     3,     5,     5,     0,     2,
       5,     0,     1,     4,     7,     4,     4,     5,     1,     1,
       1,     1,     1,     1,     1,     1,     0,     2,     3,     0,
       1,     3,     5,     1,     1,     1,     1,     1,     1,     1,
       1,     1,     1,     1,     1,     1,     1,     1,     1,     0,
       2,     3,     0,     1,     3,     5,     1,     1,     1,     1,
       1,     1,     0,     2,     3,     0,     1,     3,     4,     1,
       1,     1,     1,     1,     1,     1,     0,     2,     3,     0,
       1,     3,     4,     1,     1,     0,     2,     3,     0,     1,
       3,     4,     1,     1,     1,     1,     1,     1,     1,     1,
       1,     0,     2,     3,     0,     1,     3,     4,     5,     1,
       1,     1,     0,     2,     3,     0,     1,     3,     5,     2,
       1,     1,     1,     5,     3,     0,     2
};


enum { YYENOMEM = -2 };

#define yyerrok         (yyerrstatus = 0)
#define yyclearin       (yychar = YYEMPTY)

#define YYACCEPT        goto yyacceptlab
#define YYABORT         goto yyabortlab
#define YYERROR         goto yyerrorlab
#define YYNOMEM         goto yyexhaustedlab


#define YYRECOVERING()  (!!yyerrstatus)

#define YYBACKUP(Token, Value)                                    \
  do                                                              \
    if (yychar == YYEMPTY)                                        \
      {                                                           \
        yychar = (Token);                                         \
        yylval = (Value);                                         \
        YYPOPSTACK (yylen);                                       \
        yystate = *yyssp;                                         \
        goto yybackup;                                            \
      }                                                           \
    else                                                          \
      {                                                           \
        yyerror (YY_("syntax error: cannot back up")); \
        YYERROR;                                                  \
      }                                                           \
  while (0)

/* Backward compatibility with an undocumented macro.
   Use YYerror or YYUNDEF. */
#define YYERRCODE YYUNDEF


/* Enable debugging if requested.  */
#if YYDEBUG

# ifndef YYFPRINTF
#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
#  define YYFPRINTF fprintf
# endif

# define YYDPRINTF(Args)                        \
do {                                            \
  if (yydebug)                                  \
    YYFPRINTF Args;                             \
} while (0)




# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)                    \
do {                                                                      \
  if (yydebug)                                                            \
    {                                                                     \
      YYFPRINTF (stderr, "%s ", Title);                                   \
      yy_symbol_print (stderr,                                            \
                  Kind, Value); \
      YYFPRINTF (stderr, "\n");                                           \
    }                                                                     \
} while (0)


/*-----------------------------------.
| Print this symbol's value on YYO.  |
`-----------------------------------*/

static void
yy_symbol_value_print (FILE *yyo,
                       yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  FILE *yyoutput = yyo;
  YY_USE (yyoutput);
  if (!yyvaluep)
    return;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/*---------------------------.
| Print this symbol on YYO.  |
`---------------------------*/

static void
yy_symbol_print (FILE *yyo,
                 yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  YYFPRINTF (yyo, "%s %s (",
             yykind < YYNTOKENS ? "token" : "nterm", yysymbol_name (yykind));

  yy_symbol_value_print (yyo, yykind, yyvaluep);
  YYFPRINTF (yyo, ")");
}

/*------------------------------------------------------------------.
| yy_stack_print -- Print the state stack from its BOTTOM up to its |
| TOP (included).                                                   |
`------------------------------------------------------------------*/

static void
yy_stack_print (yy_state_t *yybottom, yy_state_t *yytop)
{
  YYFPRINTF (stderr, "Stack now");
  for (; yybottom <= yytop; yybottom++)
    {
      int yybot = *yybottom;
      YYFPRINTF (stderr, " %d", yybot);
    }
  YYFPRINTF (stderr, "\n");
}

# define YY_STACK_PRINT(Bottom, Top)                            \
do {                                                            \
  if (yydebug)                                                  \
    yy_stack_print ((Bottom), (Top));                           \
} while (0)


/*------------------------------------------------.
| Report that the YYRULE is going to be reduced.  |
`------------------------------------------------*/

static void
yy_reduce_print (yy_state_t *yyssp, YYSTYPE *yyvsp,
                 int yyrule)
{
  int yylno = yyrline[yyrule];
  int yynrhs = yyr2[yyrule];
  int yyi;
  YYFPRINTF (stderr, "Reducing stack by rule %d (line %d):\n",
             yyrule - 1, yylno);
  /* The symbols being reduced.  */
  for (yyi = 0; yyi < yynrhs; yyi++)
    {
      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
      yy_symbol_print (stderr,
                       YY_ACCESSING_SYMBOL (+yyssp[yyi + 1 - yynrhs]),
                       &yyvsp[(yyi + 1) - (yynrhs)]);
      YYFPRINTF (stderr, "\n");
    }
}

# define YY_REDUCE_PRINT(Rule)          \
do {                                    \
  if (yydebug)                          \
    yy_reduce_print (yyssp, yyvsp, Rule); \
} while (0)

/* Nonzero means print parse trace.  It is left uninitialized so that
   multiple parsers can coexist.  */
int yydebug;
#else /* !YYDEBUG */
# define YYDPRINTF(Args) ((void) 0)
# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)
# define YY_STACK_PRINT(Bottom, Top)
# define YY_REDUCE_PRINT(Rule)
#endif /* !YYDEBUG */


/* YYINITDEPTH -- initial size of the parser's stacks.  */
#ifndef YYINITDEPTH
# define YYINITDEPTH 200
#endif

/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
   if the built-in stack extension method is used).

   Do not make this value too large; the results are undefined if
   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
   evaluated with infinite-precision integer arithmetic.  */

#ifndef YYMAXDEPTH
# define YYMAXDEPTH 10000
#endif


/* Context of a parse error.  */
typedef struct
{
  yy_state_t *yyssp;
  yysymbol_kind_t yytoken;
} yypcontext_t;

/* Put in YYARG at most YYARGN of the expected tokens given the
   current YYCTX, and return the number of tokens stored in YYARG.  If
   YYARG is null, return the number of expected tokens (guaranteed to
   be less than YYNTOKENS).  Return YYENOMEM on memory exhaustion.
   Return 0 if there are more than YYARGN expected tokens, yet fill
   YYARG up to YYARGN. */
static int
yypcontext_expected_tokens (const yypcontext_t *yyctx,
                            yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  int yyn = yypact[+*yyctx->yyssp];
  if (!yypact_value_is_default (yyn))
    {
      /* Start YYX at -YYN if negative to avoid negative indexes in
         YYCHECK.  In other words, skip the first -YYN actions for
         this state because they are default actions.  */
      int yyxbegin = yyn < 0 ? -yyn : 0;
      /* Stay within bounds of both yycheck and yytname.  */
      int yychecklim = YYLAST - yyn + 1;
      int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
      int yyx;
      for (yyx = yyxbegin; yyx < yyxend; ++yyx)
        if (yycheck[yyx + yyn] == yyx && yyx != YYSYMBOL_YYerror
            && !yytable_value_is_error (yytable[yyx + yyn]))
          {
            if (!yyarg)
              ++yycount;
            else if (yycount == yyargn)
              return 0;
            else
              yyarg[yycount++] = YY_CAST (yysymbol_kind_t, yyx);
          }
    }
  if (yyarg && yycount == 0 && 0 < yyargn)
    yyarg[0] = YYSYMBOL_YYEMPTY;
  return yycount;
}




#ifndef yystrlen
# if defined __GLIBC__ && defined _STRING_H
#  define yystrlen(S) (YY_CAST (YYPTRDIFF_T, strlen (S)))
# else
/* Return the length of YYSTR.  */
static YYPTRDIFF_T
yystrlen (const char *yystr)
{
  YYPTRDIFF_T yylen;
  for (yylen = 0; yystr[yylen]; yylen++)
    continue;
  return yylen;
}
# endif
#endif

#ifndef yystpcpy
# if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
#  define yystpcpy stpcpy
# else
/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
   YYDEST.  */
static char *
yystpcpy (char *yydest, const char *yysrc)
{
  char *yyd = yydest;
  const char *yys = yysrc;

  while ((*yyd++ = *yys++) != '\0')
    continue;

  return yyd - 1;
}
# endif
#endif

#ifndef yytnamerr
/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
   quotes and backslashes, so that it's suitable for yyerror.  The
   heuristic is that double-quoting is unnecessary unless the string
   contains an apostrophe, a comma, or backslash (other than
   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
   null, do not copy; instead, return the length of what the result
   would have been.  */
static YYPTRDIFF_T
yytnamerr (char *yyres, const char *yystr)
{
  if (*yystr == '"')
    {
      YYPTRDIFF_T yyn = 0;
      char const *yyp = yystr;
      for (;;)
        switch (*++yyp)
          {
          case '\'':
          case ',':
            goto do_not_strip_quotes;

          case '\\':
            if (*++yyp != '\\')
              goto do_not_strip_quotes;
            else
              goto append;

          append:
          default:
            if (yyres)
              yyres[yyn] = *yyp;
            yyn++;
            break;

          case '"':
            if (yyres)
              yyres[yyn] = '\0';
            return yyn;
          }
    do_not_strip_quotes: ;
    }

  if (yyres)
    return yystpcpy (yyres, yystr) - yyres;
  else
    return yystrlen (yystr);
}
#endif


static int
yy_syntax_error_arguments (const yypcontext_t *yyctx,
                           yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  /* There are many possibilities here to consider:
     - If this state is a consistent state with a default action, then
       the only way this function was invoked is if the default action
       is an error action.  In that case, don't check for expected
       tokens because there are none.
     - The only way there can be no lookahead present (in yychar) is if
       this state is a consistent state with a default action.  Thus,
       detecting the absence of a lookahead is sufficient to determine
       that there is no unexpected or expected token to report.  In that
       case, just report a simple "syntax error".
     - Don't assume there isn't a lookahead just because this state is a
       consistent state with a default action.  There might have been a
       previous inconsistent state, consistent state with a non-default
       action, or user semantic action that manipulated yychar.
     - Of course, the expected token list depends on states to have
       correct lookahead information, and it depends on the parser not
       to perform extra reductions after fetching a lookahead from the
       scanner and before detecting a syntax error.  Thus, state merging
       (from LALR or IELR) and default reductions corrupt the expected
       token list.  However, the list is correct for canonical LR with
       one exception: it will still contain any token that will not be
       accepted due to an error action in a later state.
  */
  if (yyctx->yytoken != YYSYMBOL_YYEMPTY)
    {
      int yyn;
      if (yyarg)
        yyarg[yycount] = yyctx->yytoken;
      ++yycount;
      yyn = yypcontext_expected_tokens (yyctx,
                                        yyarg ? yyarg + 1 : yyarg, yyargn - 1);
      if (yyn == YYENOMEM)
        return YYENOMEM;
      else
        yycount += yyn;
    }
  return yycount;
}

/* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message
   about the unexpected token YYTOKEN for the state stack whose top is
   YYSSP.

   Return 0 if *YYMSG was successfully written.  Return -1 if *YYMSG is
   not large enough to hold the message.  In that case, also set
   *YYMSG_ALLOC to the required number of bytes.  Return YYENOMEM if the
   required number of bytes is too large to store.  */
static int
yysyntax_error (YYPTRDIFF_T *yymsg_alloc, char **yymsg,
                const yypcontext_t *yyctx)
{
  enum { YYARGS_MAX = 5 };
  /* Internationalized format string. */
  const char *yyformat = YY_NULLPTR;
  /* Arguments of yyformat: reported tokens (one for the "unexpected",
     one per "expected"). */
  yysymbol_kind_t yyarg[YYARGS_MAX];
  /* Cumulated lengths of YYARG.  */
  YYPTRDIFF_T yysize = 0;

  /* Actual size of YYARG. */
  int yycount = yy_syntax_error_arguments (yyctx, yyarg, YYARGS_MAX);
  if (yycount == YYENOMEM)
    return YYENOMEM;

  switch (yycount)
    {
#define YYCASE_(N, S)                       \
      case N:                               \
        yyformat = S;                       \
        break
    default: /* Avoid compiler warnings. */
      YYCASE_(0, YY_("syntax error"));
      YYCASE_(1, YY_("syntax error, unexpected %s"));
      YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
      YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s"));
      YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s"));
      YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s"));
#undef YYCASE_
    }

  /* Compute error message size.  Don't count the "%s"s, but reserve
     room for the terminator.  */
  yysize = yystrlen (yyformat) - 2 * yycount + 1;
  {
    int yyi;
    for (yyi = 0; yyi < yycount; ++yyi)
      {
        YYPTRDIFF_T yysize1
          = yysize + yytnamerr (YY_NULLPTR, yytname[yyarg[yyi]]);
        if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
          yysize = yysize1;
        else
          return YYENOMEM;
      }
  }

  if (*yymsg_alloc < yysize)
    {
      *yymsg_alloc = 2 * yysize;
      if (! (yysize <= *yymsg_alloc
             && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
        *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
      return -1;
    }

  /* Avoid sprintf, as that infringes on the user's name space.
     Don't have undefined behavior even if the translation
     produced a string with the wrong number of "%s"s.  */
  {
    char *yyp = *yymsg;
    int yyi = 0;
    while ((*yyp = *yyformat) != '\0')
      if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount)
        {
          yyp += yytnamerr (yyp, yytname[yyarg[yyi++]]);
          yyformat += 2;
        }
      else
        {
          ++yyp;
          ++yyformat;
        }
  }
  return 0;
}


/*-----------------------------------------------.
| Release the memory associated to this symbol.  |
`-----------------------------------------------*/

static void
yydestruct (const char *yymsg,
            yysymbol_kind_t yykind, YYSTYPE *yyvaluep)
{
  YY_USE (yyvaluep);
  if (!yymsg)
    yymsg = "Deleting";
  YY_SYMBOL_PRINT (yymsg, yykind, yyvaluep, yylocationp);

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/* Lookahead token kind.  */
int yychar;

/* The semantic value of the lookahead symbol.  */
YYSTYPE yylval;
/* Number of syntax errors so far.  */
int yynerrs;




/*----------.
| yyparse.  |
`----------*/

int
yyparse (void)
{
    yy_state_fast_t yystate = 0;
    /* Number of tokens to shift before error messages enabled.  */
    int yyerrstatus = 0;

    /* Refer to the stacks through separate pointers, to allow yyoverflow
       to reallocate them elsewhere.  */

    /* Their size.  */
    YYPTRDIFF_T yystacksize = YYINITDEPTH;

    /* The state stack: array, bottom, top.  */
    yy_state_t yyssa[YYINITDEPTH];
    yy_state_t *yyss = yyssa;
    yy_state_t *yyssp = yyss;

    /* The semantic value stack: array, bottom, top.  */
    YYSTYPE yyvsa[YYINITDEPTH];
    YYSTYPE *yyvs = yyvsa;
    YYSTYPE *yyvsp = yyvs;

  int yyn;
  /* The return value of yyparse.  */
  int yyresult;
  /* Lookahead symbol kind.  */
  yysymbol_kind_t yytoken = YYSYMBOL_YYEMPTY;
  /* The variables used to return semantic value and location from the
     action routines.  */
  YYSTYPE yyval;

  /* Buffer for error messages, and its allocated size.  */
  char yymsgbuf[128];
  char *yymsg = yymsgbuf;
  YYPTRDIFF_T yymsg_alloc = sizeof yymsgbuf;

#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))

  /* The number of symbols on the RHS of the reduced rule.
     Keep to zero when no symbol should be popped.  */
  int yylen = 0;

  YYDPRINTF ((stderr, "Starting parse\n"));

  yychar = YYEMPTY; /* Cause a token to be read.  */

  goto yysetstate;


/*------------------------------------------------------------.
| yynewstate -- push a new state, which is found in yystate.  |
`------------------------------------------------------------*/
yynewstate:
  /* In all cases, when you get here, the value and location stacks
     have just been pushed.  So pushing a state here evens the stacks.  */
  yyssp++;


/*--------------------------------------------------------------------.
| yysetstate -- set current state (the top of the stack) to yystate.  |
`--------------------------------------------------------------------*/
yysetstate:
  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
  YY_ASSERT (0 <= yystate && yystate < YYNSTATES);
  YY_IGNORE_USELESS_CAST_BEGIN
  *yyssp = YY_CAST (yy_state_t, yystate);
  YY_IGNORE_USELESS_CAST_END
  YY_STACK_PRINT (yyss, yyssp);

  if (yyss + yystacksize - 1 <= yyssp)
#if !defined yyoverflow && !defined YYSTACK_RELOCATE
    YYNOMEM;
#else
    {
      /* Get the current used size of the three stacks, in elements.  */
      YYPTRDIFF_T yysize = yyssp - yyss + 1;

# if defined yyoverflow
      {
        /* Give user a chance to reallocate the stack.  Use copies of
           these so that the &'s don't force the real ones into
           memory.  */
        yy_state_t *yyss1 = yyss;
        YYSTYPE *yyvs1 = yyvs;

        /* Each stack pointer address is followed by the size of the
           data in use in that stack, in bytes.  This used to be a
           conditional around just the two extra args, but that might
           be undefined if yyoverflow is a macro.  */
        yyoverflow (YY_("memory exhausted"),
                    &yyss1, yysize * YYSIZEOF (*yyssp),
                    &yyvs1, yysize * YYSIZEOF (*yyvsp),
                    &yystacksize);
        yyss = yyss1;
        yyvs = yyvs1;
      }
# else /* defined YYSTACK_RELOCATE */
      /* Extend the stack our own way.  */
      if (YYMAXDEPTH <= yystacksize)
        YYNOMEM;
      yystacksize *= 2;
      if (YYMAXDEPTH < yystacksize)
        yystacksize = YYMAXDEPTH;

      {
        yy_state_t *yyss1 = yyss;
        union yyalloc *yyptr =
          YY_CAST (union yyalloc *,
                   YYSTACK_ALLOC (YY_CAST (YYSIZE_T, YYSTACK_BYTES (yystacksize))));
        if (! yyptr)
          YYNOMEM;
        YYSTACK_RELOCATE (yyss_alloc, yyss);
        YYSTACK_RELOCATE (yyvs_alloc, yyvs);
#  undef YYSTACK_RELOCATE
        if (yyss1 != yyssa)
          YYSTACK_FREE (yyss1);
      }
# endif

      yyssp = yyss + yysize - 1;
      yyvsp = yyvs + yysize - 1;

      YY_IGNORE_USELESS_CAST_BEGIN
      YYDPRINTF ((stderr, "Stack size increased to %ld\n",
                  YY_CAST (long, yystacksize)));
      YY_IGNORE_USELESS_CAST_END

      if (yyss + yystacksize - 1 <= yyssp)
        YYABORT;
    }
#endif /* !defined yyoverflow && !defined YYSTACK_RELOCATE */


  if (yystate == YYFINAL)
    YYACCEPT;

  goto yybackup;


/*-----------.
| yybackup.  |
`-----------*/
yybackup:
  /* Do appropriate processing given the current state.  Read a
     lookahead token if we need one and don't already have one.  */

  /* First try to decide what to do without reference to lookahead token.  */
  yyn = yypact[yystate];
  if (yypact_value_is_default (yyn))
    goto yydefault;

  /* Not known => get a lookahead token if don't already have one.  */

  /* YYCHAR is either empty, or end-of-input, or a valid lookahead.  */
  if (yychar == YYEMPTY)
    {
      YYDPRINTF ((stderr, "Reading a token\n"));
      yychar = yylex ();
    }

  if (yychar <= YYEOF)
    {
      yychar = YYEOF;
      yytoken = YYSYMBOL_YYEOF;
      YYDPRINTF ((stderr, "Now at end of input.\n"));
    }
  else if (yychar == YYerror)
    {
      /* The scanner already issued an error message, process directly
         to error recovery.  But do not keep the error token as
         lookahead, it is too special and may lead us to an endless
         loop in error recovery. */
      yychar = YYUNDEF;
      yytoken = YYSYMBOL_YYerror;
      goto yyerrlab1;
    }
  else
    {
      yytoken = YYTRANSLATE (yychar);
      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
    }

  /* If the proper action on seeing token YYTOKEN is to reduce or to
     detect an error, take that action.  */
  yyn += yytoken;
  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
    goto yydefault;
  yyn = yytable[yyn];
  if (yyn <= 0)
    {
      if (yytable_value_is_error (yyn))
        goto yyerrlab;
      yyn = -yyn;
      goto yyreduce;
    }

  /* Count tokens shifted since error; after three, turn off error
     status.  */
  if (yyerrstatus)
    yyerrstatus--;

  /* Shift the lookahead token.  */
  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
  yystate = yyn;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END

  /* Discard the shifted token.  */
  yychar = YYEMPTY;
  goto yynewstate;


/*-----------------------------------------------------------.
| yydefault -- do the default action for the current state.  |
`-----------------------------------------------------------*/
yydefault:
  yyn = yydefact[yystate];
  if (yyn == 0)
    goto yyerrlab;
  goto yyreduce;


/*-----------------------------.
| yyreduce -- do a reduction.  |
`-----------------------------*/
yyreduce:
  /* yyn is the number of a rule to reduce with.  */
  yylen = yyr2[yyn];

  /* If YYLEN is nonzero, implement the default value of the action:
     '$$ = $1'.

     Otherwise, the following line sets YYVAL to garbage.
     This behavior is undocumented and Bison
     users should not rely upon it.  Assigning to YYVAL
     unconditionally makes the parser a bit smaller, and it avoids a
     GCC warning that YYVAL may be used uninitialized.  */
  yyval = yyvsp[1-yylen];


  YY_REDUCE_PRINT (yyn);
  switch (yyn)
    {
  case 2: /* $@1: %empty  */
#line 320 "parser_yacc.y"
        {
		/* make sure abi is setup */
		if (override_features) {
			if (policy_features)
				aa_features_unref(policy_features);
			policy_features = aa_features_ref(override_features);
		} else if (policy_features == NULL) {
			if (pinned_features) {
				policy_features = aa_features_ref(pinned_features);
			/* use default feature abi */
			} else {
				if (aa_features_new_from_string(&policy_features,
								default_features_abi,
								strlen(default_features_abi))) {
					yyerror(_("Failed to setup default policy feature abi"));
				}
				pwarn(WARN_ABI, _("%s: File '%s' missing feature abi, falling back to default policy feature abi\n"), progname, current_filename);
			}
		}
		if (!add_cap_feature_mask(policy_features,
					  CAPFLAG_POLICY_FEATURE))
			yyerror(_("Failed to add policy capabilities to known capabilities set"));
		set_supported_features();

	}
#line 1905 "parser_yacc.c"
    break;

  case 4: /* profilelist: %empty  */
#line 347 "parser_yacc.y"
                { /* nothing */ }
#line 1911 "parser_yacc.c"
    break;

  case 5: /* profilelist: profilelist profile  */
#line 350 "parser_yacc.y"
        {
		PDEBUG("Matched: list profile\n");
		add_to_list((yyvsp[0].prof));
	}
#line 1920 "parser_yacc.c"
    break;

  case 6: /* opt_profile_flag: %empty  */
#line 355 "parser_yacc.y"
                  { /* nothing */ (yyval.integer) = 0; }
#line 1926 "parser_yacc.c"
    break;

  case 7: /* opt_profile_flag: TOK_PROFILE  */
#line 356 "parser_yacc.y"
                      { (yyval.integer) = 1; }
#line 1932 "parser_yacc.c"
    break;

  case 8: /* opt_profile_flag: hat_start  */
#line 357 "parser_yacc.y"
                    { (yyval.integer) = 2; }
#line 1938 "parser_yacc.c"
    break;

  case 9: /* opt_id: %empty  */
#line 359 "parser_yacc.y"
        { /* nothing */ (yyval.id) = NULL; }
#line 1944 "parser_yacc.c"
    break;

  case 10: /* opt_id: TOK_ID  */
#line 360 "parser_yacc.y"
                 { (yyval.id) = (yyvsp[0].id); }
#line 1950 "parser_yacc.c"
    break;

  case 11: /* opt_id_or_var: %empty  */
#line 362 "parser_yacc.y"
               { /* nothing */ (yyval.id) = NULL; }
#line 1956 "parser_yacc.c"
    break;

  case 12: /* opt_id_or_var: id_or_var  */
#line 363 "parser_yacc.y"
                    { (yyval.id) = (yyvsp[0].id); }
#line 1962 "parser_yacc.c"
    break;

  case 13: /* @2: %empty  */
#line 366 "parser_yacc.y"
        {
		/* mid rule action
		 * save current cache, restore at end of block
		 */
		(yyval.includecache) = g_includecache;
		g_includecache = new IncludeCache_t();
	}
#line 1974 "parser_yacc.c"
    break;

  case 14: /* profile_base: TOK_ID opt_id_or_var opt_cond_list flags TOK_OPEN @2 rules TOK_CLOSE  */
#line 374 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[-1].prof);
		bool self_stack = false;

		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		parse_label(&self_stack, &prof->ns, &prof->name, (yyvsp[-7].id), true);
		free((yyvsp[-7].id));

		if (self_stack) {
			yyerror(_("Profile names must begin with a '/' or a namespace"));
		}

		/* Honor the --namespace-string command line option */
		if (profile_ns) {
			/**
			 * Print warning if the profile specified a namespace
			 * different than the one specified with the
			 * --namespace-string command line option
			 */
			if (prof->ns && strcmp(prof->ns, profile_ns))
				pwarn(WARN_OVERRIDE, "%s: -n %s overriding policy specified namespace :%s:\n",
				      progname, profile_ns, prof->ns);

			free(prof->ns);
			prof->ns = strdup(profile_ns);
			if (!prof->ns)
				yyerror(_("Memory allocation error."));
		}

		prof->attachment = (yyvsp[-6].id);
		if ((yyvsp[-6].id) && !((yyvsp[-6].id)[0] == '/' || strncmp((yyvsp[-6].id), "@{", 2) == 0))
			yyerror(_("Profile attachment must begin with a '/' or variable."));
		if ((yyvsp[-5].cond_entry_list).name) {
			if (strcmp((yyvsp[-5].cond_entry_list).name, "xattrs") != 0)
				yyerror(_("profile id: invalid conditional group %s=()"), (yyvsp[-5].cond_entry_list).name);
			free ((yyvsp[-5].cond_entry_list).name);
			(yyvsp[-5].cond_entry_list).name = NULL;
			prof->xattrs = (yyvsp[-5].cond_entry_list);
		}
		prof->flags = (yyvsp[-4].flags);
		if (force_complain && kernel_abi_version == 5)
			/* newer abis encode force complain as part of the
			 * header
			 */
			prof->flags.mode = MODE_COMPLAIN;

		prof->post_parse_profile();
		prof->flags.debug(cerr);

		/* restore previous blocks include cache */
		delete g_includecache;
		g_includecache = (yyvsp[-2].includecache);
		(yyval.prof) = prof;

	}
#line 2037 "parser_yacc.c"
    break;

  case 15: /* profile: opt_profile_flag profile_base  */
#line 434 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof)->ns)
			PDEBUG("Matched: :%s://%s { ... }\n", (yyvsp[0].prof)->ns, (yyvsp[0].prof)->name);
		else
			PDEBUG("Matched: %s { ... }\n", (yyvsp[0].prof)->name);

		if ((yyvsp[0].prof)->name[0] == '/')
			pwarn(WARN_DEPRECATED, _("The use of file paths as profile names is deprecated. See man apparmor.d for more information\n"));

		if ((yyvsp[0].prof)->name[0] != '/' && !((yyvsp[-1].integer) || (yyvsp[0].prof)->ns))
			yyerror(_("Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."));

		if ((yyvsp[-1].integer) == 2)
			prof->flags.flags |= FLAG_HAT;
		(yyval.prof) = prof;
	}
#line 2060 "parser_yacc.c"
    break;

  case 16: /* local_profile: TOK_PROFILE profile_base  */
#line 454 "parser_yacc.y"
        {

		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof))
			PDEBUG("Matched: local profile %s { ... }\n", prof->name);
		(yyval.prof) = prof;
	}
#line 2073 "parser_yacc.c"
    break;

  case 17: /* hat: hat_start profile_base  */
#line 464 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);
		if ((yyvsp[0].prof))
			PDEBUG("Matched: hat %s { ... }\n", prof->name);
		/*
		 * It isn't clear what a xattrs match on a hat profile
		 * should do, disallow it for now.
		 */
		if ((yyvsp[0].prof)->xattrs.list)
			yyerror("hat profiles can't use xattrs matches");

		prof->flags.flags |= FLAG_HAT;
		(yyval.prof) = prof;
	}
#line 2092 "parser_yacc.c"
    break;

  case 18: /* preamble: %empty  */
#line 479 "parser_yacc.y"
          { /* nothing */ }
#line 2098 "parser_yacc.c"
    break;

  case 19: /* preamble: preamble alias  */
#line 480 "parser_yacc.y"
                         { /* nothing */ }
#line 2104 "parser_yacc.c"
    break;

  case 20: /* preamble: preamble varassign  */
#line 481 "parser_yacc.y"
                             { /* nothing */ }
#line 2110 "parser_yacc.c"
    break;

  case 21: /* preamble: preamble abi_rule  */
#line 482 "parser_yacc.y"
                            { /* nothing */ }
#line 2116 "parser_yacc.c"
    break;

  case 22: /* alias: TOK_ALIAS TOK_ID TOK_ARROW TOK_ID TOK_END_OF_RULE  */
#line 485 "parser_yacc.y"
        {
		if (!new_alias((yyvsp[-3].id), (yyvsp[-1].id)))
			yyerror(_("Failed to create alias %s -> %s\n"), (yyvsp[-3].id), (yyvsp[-1].id));
		free((yyvsp[-3].id));
		free((yyvsp[-1].id));
	}
#line 2127 "parser_yacc.c"
    break;

  case 23: /* varassign: TOK_SET_VAR TOK_EQUALS valuelist  */
#line 493 "parser_yacc.y"
        {
		struct value_list *list = (yyvsp[0].val_list);
		char *var_name = process_var((yyvsp[-2].set_var));
		int err;
		if (!list || !list->value)
			yyerror("Assert: valuelist returned NULL");
		PDEBUG("Matched: set assignment for (%s)\n", (yyvsp[-2].set_var));
		err = new_set_var(var_name, list->value);
		if (err) {
			free(var_name);
			yyerror("variable %s was previously declared", (yyvsp[-2].set_var));
			/* FIXME: it'd be handy to report the previous location */
		}
		for (list = list->next; list; list = list->next) {
			err = add_set_value(var_name, list->value);
			if (err) {
				free(var_name);
				yyerror("Error adding %s to set var %s",
					list->value, (yyvsp[-2].set_var));
			}
		}
		free_value_list((yyvsp[0].val_list));
		free(var_name);
		free((yyvsp[-2].set_var));
	}
#line 2157 "parser_yacc.c"
    break;

  case 24: /* varassign: TOK_SET_VAR TOK_ADD_ASSIGN valuelist  */
#line 520 "parser_yacc.y"
        {
		struct value_list *list = (yyvsp[0].val_list);
		char *var_name = process_var((yyvsp[-2].set_var));
		int err;
		if (!list || !list->value)
			yyerror("Assert: valuelist returned NULL");
		PDEBUG("Matched: additive assignment for (%s)\n", (yyvsp[-2].set_var));
		/* do the first one outside the loop, subsequent
		 * failures are indicative of symtab failures */
		err = add_set_value(var_name, list->value);
		if (err) {
			free(var_name);
			yyerror("variable %s was not previously declared, but is being assigned additional values", (yyvsp[-2].set_var));
		}
		for (list = list->next; list; list = list->next) {
			err = add_set_value(var_name, list->value);
			if (err) {
				free(var_name);
				yyerror("Error adding %s to set var %s",
					list->value, (yyvsp[-2].set_var));
			}
		}
		free_value_list((yyvsp[0].val_list));
		free(var_name);
		free((yyvsp[-2].set_var));
	}
#line 2188 "parser_yacc.c"
    break;

  case 25: /* varassign: TOK_BOOL_VAR TOK_EQUALS TOK_VALUE  */
#line 548 "parser_yacc.y"
        {
		int boolean, err;
		char *var_name = process_var((yyvsp[-2].bool_var));
		PDEBUG("Matched: boolean assignment (%s) to %s\n", (yyvsp[-2].bool_var), (yyvsp[0].var_val));
		boolean = str_to_boolean((yyvsp[0].var_val));
		if (boolean == -1) {
			yyerror("Invalid boolean assignment for (%s): %s is not true or false",
				(yyvsp[-2].bool_var), (yyvsp[0].var_val));
		}
		err = add_boolean_var(var_name, boolean);
		free(var_name);
		if (err) {
			yyerror("variable %s was previously declared", (yyvsp[-2].bool_var));
			/* FIXME: it'd be handy to report the previous location */
		}
		free((yyvsp[-2].bool_var));
		free((yyvsp[0].var_val));
	}
#line 2211 "parser_yacc.c"
    break;

  case 26: /* valuelist: TOK_VALUE  */
#line 568 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value (%s)\n", (yyvsp[0].var_val));

		(yyval.val_list) = val;
	}
#line 2224 "parser_yacc.c"
    break;

  case 27: /* valuelist: valuelist TOK_VALUE  */
#line 578 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value list\n");

		list_append((yyvsp[-1].val_list), val);
		(yyval.val_list) = (yyvsp[-1].val_list);
	}
#line 2238 "parser_yacc.c"
    break;

  case 28: /* flags: %empty  */
#line 588 "parser_yacc.y"
        { /* nothing */
		flagvals fv;

		fv.init();
		(yyval.flags) = fv;
	}
#line 2249 "parser_yacc.c"
    break;

  case 29: /* opt_flags: %empty  */
#line 595 "parser_yacc.y"
           { /* nothing */ (yyval.boolean) = false; }
#line 2255 "parser_yacc.c"
    break;

  case 30: /* opt_flags: TOK_CONDID TOK_EQUALS  */
#line 597 "parser_yacc.y"
        {
		if (strcmp((yyvsp[-1].id), "flags") != 0)
			yyerror("expected flags= got %s=", (yyvsp[-1].id));
		free((yyvsp[-1].id));
		(yyval.boolean) = true;
	}
#line 2266 "parser_yacc.c"
    break;

  case 31: /* flags: opt_flags TOK_OPENPAREN flagvals TOK_CLOSEPAREN  */
#line 605 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2274 "parser_yacc.c"
    break;

  case 32: /* flagvals: flagvals flagval  */
#line 610 "parser_yacc.y"
        {
		(yyvsp[-1].flags).merge((yyvsp[0].flags));
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2283 "parser_yacc.c"
    break;

  case 33: /* flagvals: flagval  */
#line 616 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[0].flags);
	}
#line 2291 "parser_yacc.c"
    break;

  case 34: /* flagval: TOK_VALUE  */
#line 621 "parser_yacc.y"
        {
		flagvals fv;

		fv.init((yyvsp[0].var_val));
		free((yyvsp[0].var_val));
		(yyval.flags) = fv;
	}
#line 2303 "parser_yacc.c"
    break;

  case 35: /* opt_subset_flag: %empty  */
#line 629 "parser_yacc.y"
                 { /* nothing */ (yyval.boolean) = false; }
#line 2309 "parser_yacc.c"
    break;

  case 36: /* opt_subset_flag: TOK_SUBSET  */
#line 630 "parser_yacc.y"
                     { (yyval.boolean) = true; }
#line 2315 "parser_yacc.c"
    break;

  case 37: /* opt_subset_flag: TOK_LE  */
#line 631 "parser_yacc.y"
                 { (yyval.boolean) = true; }
#line 2321 "parser_yacc.c"
    break;

  case 38: /* opt_priority: %empty  */
#line 634 "parser_yacc.y"
              { (yyval.integer) = 0; }
#line 2327 "parser_yacc.c"
    break;

  case 39: /* opt_priority: TOK_PRIORITY TOK_EQUALS TOK_VALUE  */
#line 636 "parser_yacc.y"
        {
		char *end;
		long tmp = strtol((yyvsp[0].var_val), &end, 10);
		if (end == (yyvsp[0].var_val) || *end != '\0')
			yyerror("invalid priority %s", (yyvsp[0].var_val));
		free((yyvsp[0].var_val));
		/* see note on mediates_priority */
		if (tmp > MAX_POLICY_PRIORITY)
			yyerror("invalid priority %l > %d", tmp, MAX_POLICY_PRIORITY);
		if (tmp < MIN_POLICY_PRIORITY)
			yyerror("invalid priority %l > %d", tmp, MIN_POLICY_PRIORITY);
		(yyval.integer) = tmp;
	}
#line 2345 "parser_yacc.c"
    break;

  case 40: /* opt_audit_flag: %empty  */
#line 650 "parser_yacc.y"
                { /* nothing */ (yyval.audit) = AUDIT_UNSPECIFIED; }
#line 2351 "parser_yacc.c"
    break;

  case 41: /* opt_audit_flag: TOK_AUDIT  */
#line 651 "parser_yacc.y"
                    { (yyval.audit) = AUDIT_FORCE; }
#line 2357 "parser_yacc.c"
    break;

  case 42: /* opt_owner_flag: %empty  */
#line 653 "parser_yacc.y"
                { /* nothing */ (yyval.owner) = OWNER_UNSPECIFIED; }
#line 2363 "parser_yacc.c"
    break;

  case 43: /* opt_owner_flag: TOK_OWNER  */
#line 654 "parser_yacc.y"
                    { (yyval.owner) = OWNER_SPECIFIED; }
#line 2369 "parser_yacc.c"
    break;

  case 44: /* opt_owner_flag: TOK_OTHER  */
#line 655 "parser_yacc.y"
                    { (yyval.owner) = OWNER_NOT; }
#line 2375 "parser_yacc.c"
    break;

  case 45: /* opt_rule_mode: %empty  */
#line 657 "parser_yacc.y"
               { /* nothing */ (yyval.rule_mode) = RULE_UNSPECIFIED; }
#line 2381 "parser_yacc.c"
    break;

  case 46: /* opt_rule_mode: TOK_ALLOW  */
#line 658 "parser_yacc.y"
                    { (yyval.rule_mode) = RULE_ALLOW; }
#line 2387 "parser_yacc.c"
    break;

  case 47: /* opt_rule_mode: TOK_DENY  */
#line 659 "parser_yacc.y"
                   { (yyval.rule_mode) = RULE_DENY; }
#line 2393 "parser_yacc.c"
    break;

  case 48: /* opt_rule_mode: TOK_PROMPT  */
#line 660 "parser_yacc.y"
                     { (yyval.rule_mode) = RULE_PROMPT; }
#line 2399 "parser_yacc.c"
    break;

  case 49: /* opt_prefix: opt_priority opt_audit_flag opt_rule_mode opt_owner_flag  */
#line 663 "parser_yacc.y"
        {
		(yyval.prefix).priority = (yyvsp[-3].integer);
		(yyval.prefix).audit = (yyvsp[-2].audit);
		(yyval.prefix).rule_mode = (yyvsp[-1].rule_mode);
		(yyval.prefix).owner = (yyvsp[0].owner);
	}
#line 2410 "parser_yacc.c"
    break;

  case 50: /* rules: %empty  */
#line 670 "parser_yacc.y"
        { /* nothing */ 
	Profile *prof = new Profile();
		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		(yyval.prof) = prof;
	}
#line 2423 "parser_yacc.c"
    break;

  case 51: /* rules: rules abi_rule  */
#line 679 "parser_yacc.y"
                      { /* nothing */ }
#line 2429 "parser_yacc.c"
    break;

  case 52: /* rules: rules opt_prefix rule  */
#line 682 "parser_yacc.y"
        {
		const char *error;
		PDEBUG("matched: rules rule\n");
		PDEBUG("rules rule: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `rule' returned NULL."));
		if (!entry_add_prefix((yyvsp[0].user_entry), (yyvsp[-1].prefix), error)) {
			yyerror(_("%s"), error);
		}
		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2446 "parser_yacc.c"
    break;

  case 53: /* block: TOK_OPEN rules TOK_CLOSE  */
#line 696 "parser_yacc.y"
        {
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2454 "parser_yacc.c"
    break;

  case 54: /* rules: rules opt_prefix block  */
#line 701 "parser_yacc.y"
        {
		struct cod_entry *entry, *tmp;

		if (((yyvsp[-1].prefix)).priority != 0) {
			yyerror(_("priority is not allowed on rule blocks"));
		}
		PDEBUG("matched: %s%s%sblock\n",
		       (yyvsp[-1].prefix).audit == AUDIT_FORCE ? "audit " : "",
		       (yyvsp[-1].prefix).rule_mode == RULE_DENY ? "deny " : "",
		       (yyvsp[-1].prefix).rule_mode == RULE_PROMPT ? "prompt " : "",
		       (yyvsp[-1].prefix).owner == OWNER_SPECIFIED ? "owner " : "");
		list_for_each_safe((yyvsp[0].prof)->entries, entry, tmp) {
			const char *error;
			entry->next = NULL;
			if (!entry_add_prefix(entry, (yyvsp[-1].prefix), error)) {
				yyerror(_("%s"), error);
			}
			/* transfer rule for now, TODO keep block and just
			 * apply add_prefix to block rule and have it do
			 * the work
			 */
			add_entry_to_policy((yyvsp[-2].prof), entry);
		}
		(yyvsp[0].prof)->entries = NULL;
		// fix me transfer rules and free sub profile
		delete (yyvsp[0].prof);
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2487 "parser_yacc.c"
    break;

  case 55: /* rules: rules opt_prefix network_rule  */
#line 731 "parser_yacc.y"
        {
		const char *error;
		if (!(yyvsp[0].network_entry)->add_prefix((yyvsp[-1].prefix), error))
			yyerror(error);
		/* class members need to be updated after prefix is added */
		(yyvsp[0].network_entry)->update_compat_net();

		auto nm_af_unix = (yyvsp[0].network_entry)->network_map.find(AF_UNIX);
		if (nm_af_unix != (yyvsp[0].network_entry)->network_map.end()) {
			for (auto& entry : nm_af_unix->second) {
				unix_rule *rule = new unix_rule(entry.type,
								(yyvsp[-1].prefix).audit, (yyvsp[-1].prefix).rule_mode);
				if (!rule)
					yyerror(_("Memory allocation error."));
				(yyvsp[-2].prof)->rule_ents.push_back(rule);
			}
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].network_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2512 "parser_yacc.c"
    break;

  case 56: /* prefix_rule: mnt_rule  */
#line 752 "parser_yacc.y"
                       { (yyval.prefix_entry) = (yyvsp[0].mnt_entry); }
#line 2518 "parser_yacc.c"
    break;

  case 57: /* prefix_rule: dbus_rule  */
#line 753 "parser_yacc.y"
                    { (yyval.prefix_entry) = (yyvsp[0].dbus_entry); }
#line 2524 "parser_yacc.c"
    break;

  case 58: /* prefix_rule: signal_rule  */
#line 754 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].signal_entry); }
#line 2530 "parser_yacc.c"
    break;

  case 59: /* prefix_rule: ptrace_rule  */
#line 755 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].ptrace_entry); }
#line 2536 "parser_yacc.c"
    break;

  case 60: /* prefix_rule: unix_rule  */
#line 756 "parser_yacc.y"
                    { (yyval.prefix_entry) = (yyvsp[0].unix_entry); }
#line 2542 "parser_yacc.c"
    break;

  case 61: /* prefix_rule: userns_rule  */
#line 757 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].userns_entry); }
#line 2548 "parser_yacc.c"
    break;

  case 62: /* prefix_rule: mqueue_rule  */
#line 758 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].mqueue_entry); }
#line 2554 "parser_yacc.c"
    break;

  case 63: /* prefix_rule: io_uring_rule  */
#line 759 "parser_yacc.y"
                        { (yyval.prefix_entry) = (yyvsp[0].io_uring_entry); }
#line 2560 "parser_yacc.c"
    break;

  case 64: /* prefix_rule: all_rule  */
#line 760 "parser_yacc.y"
                   { (yyval.prefix_entry) = (yyvsp[0].all_entry); }
#line 2566 "parser_yacc.c"
    break;

  case 65: /* rules: rules opt_prefix prefix_rule  */
#line 763 "parser_yacc.y"
        {
		const char *error;
		if (!(yyvsp[0].prefix_entry)->add_prefix((yyvsp[-1].prefix), error))
			yyerror(error);
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].prefix_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2578 "parser_yacc.c"
    break;

  case 66: /* rules: rules opt_prefix change_profile  */
#line 772 "parser_yacc.y"
        {
		PDEBUG("matched: rules change_profile\n");
		PDEBUG("rules change_profile: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `change_profile' returned NULL."));
		if ((yyvsp[-1].prefix).owner != OWNER_UNSPECIFIED)
			yyerror(_("owner conditional not allowed on unix rules"));
		if (((yyvsp[-1].prefix).rule_mode == RULE_DENY) && (yyvsp[-1].prefix).audit == AUDIT_FORCE) {
			(yyvsp[0].user_entry)->rule_mode = RULE_DENY;
		} else if ((yyvsp[-1].prefix).rule_mode == RULE_DENY) {
			(yyvsp[0].user_entry)->rule_mode = RULE_DENY;
			(yyvsp[0].user_entry)->audit = AUDIT_FORCE;
		} else if ((yyvsp[-1].prefix).audit != AUDIT_UNSPECIFIED) {
			(yyvsp[0].user_entry)->audit = (yyvsp[-1].prefix).audit;
		}
		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2601 "parser_yacc.c"
    break;

  case 67: /* rules: rules opt_prefix capability  */
#line 792 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner != OWNER_UNSPECIFIED)
			yyerror(_("owner conditional not allowed on capability rules"));

		if ((yyvsp[-1].prefix).rule_mode == RULE_DENY && (yyvsp[-1].prefix).audit == AUDIT_FORCE) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
		} else if ((yyvsp[-1].prefix).rule_mode == RULE_DENY) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
			(yyvsp[-2].prof)->caps.quiet |= (yyvsp[0].cap);
		} else {
			(yyvsp[-2].prof)->caps.allow |= (yyvsp[0].cap);
			if ((yyvsp[-1].prefix).audit != AUDIT_UNSPECIFIED)
				(yyvsp[-2].prof)->caps.audit |= (yyvsp[0].cap);
		}

		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2623 "parser_yacc.c"
    break;

  case 68: /* rules: rules hat  */
#line 811 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'hat rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2635 "parser_yacc.c"
    break;

  case 69: /* rules: rules local_profile  */
#line 820 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'local_profile rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2647 "parser_yacc.c"
    break;

  case 70: /* rules: rules cond_rule  */
#line 829 "parser_yacc.y"
        {
		PDEBUG("Matched: conditional rules\n");
		(yyval.prof) = merge_policy((yyvsp[-1].prof), (yyvsp[0].prof));
	}
#line 2656 "parser_yacc.c"
    break;

  case 71: /* rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE opt_id TOK_END_OF_RULE  */
#line 835 "parser_yacc.y"
        {
		rlim_t value = RLIM_INFINITY;
		long long tmp;
		char *end;

		int limit = get_rlimit((yyvsp[-4].id));
		if (limit == -1)
			yyerror("INVALID RLIMIT '%s'\n", (yyvsp[-4].id));

		if (strcmp((yyvsp[-2].var_val), "infinity") == 0) {
			value = RLIM_INFINITY;
		} else {
			const char *kb = "KB";
			const char *mb = "MB";
			const char *gb = "GB";

			tmp = strtoll((yyvsp[-2].var_val), &end, 0);
			switch (limit) {
			case RLIMIT_CPU:
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				tmp = convert_time_units(tmp, SECONDS_P_MS, (yyvsp[-1].id));
				if (tmp == -1LL)
					yyerror("RLIMIT '%s %s' < minimum value of 1s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				else if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'cpu' no units specified using default units of seconds\n"));
				value = tmp;
				break;
#ifdef RLIMIT_RTTIME
			case RLIMIT_RTTIME:
				/* RTTIME is measured in microseconds */
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				tmp = convert_time_units(tmp, 1LL, (yyvsp[-1].id));
				if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'rttime' no units specified using default units of microseconds\n"));
				value = tmp;
				break;
#endif
			case RLIMIT_NOFILE:
			case RLIMIT_NPROC:
			case RLIMIT_LOCKS:
			case RLIMIT_SIGPENDING:
#ifdef RLIMIT_RTPRIO
			case RLIMIT_RTPRIO:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id) || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				value = tmp;
				break;
#endif
#ifdef RLIMIT_NICE
			case RLIMIT_NICE:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id))
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (tmp < -20 || tmp > 19)
					yyerror("RLIMIT '%s' out of range (-20 .. 19) %d\n", (yyvsp[-4].id), tmp);
				value = tmp + 20;
				break;
#endif
			case RLIMIT_FSIZE:
			case RLIMIT_DATA:
			case RLIMIT_STACK:
			case RLIMIT_CORE:
			case RLIMIT_RSS:
			case RLIMIT_AS:
			case RLIMIT_MEMLOCK:
			case RLIMIT_MSGQUEUE:
				if ((yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id)) {
					; /* use default of bytes */
				} else if (strstr(kb, (yyvsp[-1].id)) == kb) {
					tmp *= 1024;
				} else if (strstr(mb, (yyvsp[-1].id)) == mb) {
					tmp *= 1024*1024;
				} else if (strstr(gb, (yyvsp[-1].id)) == gb) {
					tmp *= 1024*1024*1024;
				} else {
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id));
				}
				value = tmp;
				break;
			default:
				yyerror("Unknown RLIMIT %d\n", (yyvsp[-4].id));
			}
		}
		(yyvsp[-7].prof)->rlimits.specified |= 1 << limit;
		(yyvsp[-7].prof)->rlimits.limits[limit] = value;
		free((yyvsp[-4].id));
		free((yyvsp[-2].var_val));
		(yyval.prof) = (yyvsp[-7].prof);
	}
#line 2757 "parser_yacc.c"
    break;

  case 72: /* cond_rule: TOK_IF expr block  */
#line 934 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional rules\n");
		if ((yyvsp[-1].cond)->eval()) {
			ret = (yyvsp[0].prof);
		} else {
			delete (yyvsp[0].prof);
		}
		delete (yyvsp[-1].cond);
		(yyval.prof) = ret;
	}
#line 2773 "parser_yacc.c"
    break;

  case 73: /* cond_rule: TOK_IF expr block TOK_ELSE block  */
#line 947 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else rules\n");
		if ((yyvsp[-3].cond)->eval()) {
			ret = (yyvsp[-2].prof);
			delete (yyvsp[0].prof);
		} else {
			ret = (yyvsp[0].prof);
			delete (yyvsp[-2].prof);
		}
		delete (yyvsp[-3].cond);
		(yyval.prof) = ret;
	}
#line 2791 "parser_yacc.c"
    break;

  case 74: /* cond_rule: TOK_IF expr block TOK_ELSE cond_rule  */
#line 962 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else-if rules\n");
		if ((yyvsp[-3].cond)->eval()) {
			ret = (yyvsp[-2].prof);
			delete (yyvsp[0].prof);
		} else {
			ret = (yyvsp[0].prof);
			delete (yyvsp[-2].prof);
		}
		delete (yyvsp[-3].cond);
		(yyval.prof) = ret;
	}
#line 2809 "parser_yacc.c"
    break;

  case 75: /* expr: TOK_NOT expr  */
#line 977 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr(!(yyvsp[0].cond)->eval());
		delete (yyvsp[0].cond);
		(yyval.cond) = conds;
	}
#line 2819 "parser_yacc.c"
    break;

  case 76: /* expr: TOK_BOOL_VAR  */
#line 984 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].bool_var), false);
		PDEBUG("Matched: boolean expr %s value: %d\n", (yyvsp[0].bool_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].bool_var));
	}
#line 2830 "parser_yacc.c"
    break;

  case 77: /* expr: TOK_DEFINED TOK_SET_VAR  */
#line 992 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].set_var), true);
		PDEBUG("Matched: defined set expr %s value %d\n", (yyvsp[0].set_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].set_var));
	}
#line 2841 "parser_yacc.c"
    break;

  case 78: /* expr: TOK_DEFINED TOK_BOOL_VAR  */
#line 1000 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].bool_var), false);
		PDEBUG("Matched: defined set expr %s value %d\n", (yyvsp[0].bool_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].bool_var));
	}
#line 2852 "parser_yacc.c"
    break;

  case 79: /* id_or_var: TOK_ID  */
#line 1007 "parser_yacc.y"
                  { (yyval.id) = (yyvsp[0].id); }
#line 2858 "parser_yacc.c"
    break;

  case 80: /* id_or_var: TOK_SET_VAR  */
#line 1008 "parser_yacc.y"
                       { (yyval.id) = (yyvsp[0].set_var); }
#line 2864 "parser_yacc.c"
    break;

  case 81: /* opt_target: %empty  */
#line 1010 "parser_yacc.y"
                          { (yyval.id) = NULL; }
#line 2870 "parser_yacc.c"
    break;

  case 82: /* opt_target: TOK_ARROW id_or_var  */
#line 1011 "parser_yacc.y"
                                { (yyval.id) = (yyvsp[0].id); }
#line 2876 "parser_yacc.c"
    break;

  case 83: /* opt_named_transition: %empty  */
#line 1013 "parser_yacc.y"
                      { /* nothing */ (yyval.id) = NULL; }
#line 2882 "parser_yacc.c"
    break;

  case 84: /* opt_named_transition: TOK_ARROW id_or_var  */
#line 1015 "parser_yacc.y"
        {
		(yyval.id) = (yyvsp[0].id);
	}
#line 2890 "parser_yacc.c"
    break;

  case 85: /* rule: file_rule  */
#line 1019 "parser_yacc.y"
                { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 2896 "parser_yacc.c"
    break;

  case 86: /* rule: link_rule  */
#line 1020 "parser_yacc.y"
                    { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 2902 "parser_yacc.c"
    break;

  case 87: /* abi_rule: TOK_ABI TOK_ID TOK_END_OF_RULE  */
#line 1023 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].id), true);
		free((yyvsp[-1].id));
		/* $$ = nothing, not used */
	}
#line 2912 "parser_yacc.c"
    break;

  case 88: /* abi_rule: TOK_ABI TOK_VALUE TOK_END_OF_RULE  */
#line 1029 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].var_val), false);
		free((yyvsp[-1].var_val));
		/* $$ = nothing, not used */
	}
#line 2922 "parser_yacc.c"
    break;

  case 89: /* opt_exec_mode: %empty  */
#line 1035 "parser_yacc.y"
               { /* nothing */ (yyval.integer) = EXEC_MODE_EMPTY; }
#line 2928 "parser_yacc.c"
    break;

  case 90: /* opt_exec_mode: TOK_UNSAFE  */
#line 1036 "parser_yacc.y"
                     { (yyval.integer) = EXEC_MODE_UNSAFE; }
#line 2934 "parser_yacc.c"
    break;

  case 91: /* opt_exec_mode: TOK_SAFE  */
#line 1037 "parser_yacc.y"
                   { (yyval.integer) = EXEC_MODE_SAFE; }
#line 2940 "parser_yacc.c"
    break;

  case 92: /* opt_file: %empty  */
#line 1039 "parser_yacc.y"
          { /* nothing */ (yyval.boolean) = false; }
#line 2946 "parser_yacc.c"
    break;

  case 93: /* opt_file: TOK_FILE  */
#line 1040 "parser_yacc.y"
                   { (yyval.boolean) = true; }
#line 2952 "parser_yacc.c"
    break;

  case 94: /* frule: id_or_var file_perms opt_named_transition TOK_END_OF_RULE  */
#line 1043 "parser_yacc.y"
        {
		(yyval.user_entry) = do_file_rule((yyvsp[-3].id), (yyvsp[-2].fperms), NULL, (yyvsp[-1].id));
	}
#line 2960 "parser_yacc.c"
    break;

  case 95: /* frule: file_perms opt_subset_flag id_or_var opt_named_transition TOK_END_OF_RULE  */
#line 1048 "parser_yacc.y"
        {
		if ((yyvsp[-3].boolean) && ((yyvsp[-4].fperms) & ~AA_LINK_BITS))
			yyerror(_("subset can only be used with link rules."));
		if ((yyvsp[-1].id) && ((yyvsp[-4].fperms) & AA_LINK_BITS) && ((yyvsp[-4].fperms) & AA_EXEC_BITS))
			yyerror(_("link and exec perms conflict on a file rule using ->"));
		if ((yyvsp[-1].id) && label_contains_ns((yyvsp[-1].id)) && ((yyvsp[-4].fperms) & AA_LINK_BITS))
			yyerror(_("link perms are not allowed on a named profile transition.\n"));

		if (((yyvsp[-4].fperms) & AA_LINK_BITS)) {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fperms), (yyvsp[-1].id), NULL);
			(yyval.user_entry)->subset = (yyvsp[-3].boolean);

		} else {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fperms), NULL, (yyvsp[-1].id));
		}
 	}
#line 2981 "parser_yacc.c"
    break;

  case 96: /* file_rule: TOK_FILE TOK_END_OF_RULE  */
#line 1066 "parser_yacc.y"
        {
		char *path = strdup("/{**,}");
		int perms = ((AA_BASE_PERMS & ~AA_EXEC_TYPE) |
			     (AA_EXEC_INHERIT | AA_MAY_EXEC));
		/* duplicate to other permission set */
		perms |= perms << AA_OTHER_SHIFT;
		if (!path)
			yyerror(_("Memory allocation error."));
		(yyval.user_entry) = do_file_rule(path, perms, NULL, NULL);
	}
#line 2996 "parser_yacc.c"
    break;

  case 97: /* file_rule: opt_file file_rule_tail  */
#line 1076 "parser_yacc.y"
                                  { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 3002 "parser_yacc.c"
    break;

  case 98: /* file_rule_tail: opt_exec_mode frule  */
#line 1080 "parser_yacc.y"
        {
		if ((yyvsp[-1].integer) != EXEC_MODE_EMPTY) {
			if (!((yyvsp[0].user_entry)->perms & AA_EXEC_BITS))
				yyerror(_("unsafe rule missing exec permissions"));
			if ((yyvsp[-1].integer) == EXEC_MODE_UNSAFE) {
				(yyvsp[0].user_entry)->perms |= (((yyvsp[0].user_entry)->perms & AA_EXEC_BITS) << 8) &
					 ALL_AA_EXEC_UNSAFE;
			}
			else if ((yyvsp[-1].integer) == EXEC_MODE_SAFE)
				(yyvsp[0].user_entry)->perms &= ~ALL_AA_EXEC_UNSAFE;
		}
		(yyval.user_entry) = (yyvsp[0].user_entry);
	}
#line 3020 "parser_yacc.c"
    break;

  case 99: /* file_rule_tail: opt_exec_mode id_or_var file_perms id_or_var  */
#line 1095 "parser_yacc.y"
        {
		/* Oopsie, we appear to be missing an EOL marker. If we
		 * were *smart*, we could work around it. Since we're
		 * obviously not smart, we'll just punt with a more
		 * sensible error. */
		yyerror(_("missing an end of line character? (entry: %s)"), (yyvsp[-2].id));
	}
#line 3032 "parser_yacc.c"
    break;

  case 100: /* link_rule: TOK_LINK opt_subset_flag id_or_var TOK_ARROW id_or_var TOK_END_OF_RULE  */
#line 1104 "parser_yacc.y"
        {
		struct cod_entry *entry;
		PDEBUG("Matched: link tok_id (%s) -> (%s)\n", (yyvsp[-3].id), (yyvsp[-1].id));
		entry = new_entry((yyvsp[-3].id), AA_LINK_BITS, (yyvsp[-1].id));
		entry->subset = (yyvsp[-4].boolean);
		PDEBUG("rule.entry: link (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 3045 "parser_yacc.c"
    break;

  case 101: /* network_rule: TOK_NETWORK opt_net_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1114 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		(yyval.network_entry) = entry;
	}
#line 3061 "parser_yacc.c"
    break;

  case 102: /* network_rule: TOK_NETWORK opt_net_perm TOK_ID opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1127 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-4].fperms), (yyvsp[-3].id), NULL, NULL, (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		free((yyvsp[-3].id));
		(yyval.network_entry) = entry;
	}
#line 3078 "parser_yacc.c"
    break;

  case 103: /* network_rule: TOK_NETWORK opt_net_perm TOK_ID TOK_ID opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1141 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-5].fperms), (yyvsp[-4].id), (yyvsp[-3].id), NULL, (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		free((yyvsp[-4].id));
		free((yyvsp[-3].id));
		(yyval.network_entry) = entry;
	}
#line 3096 "parser_yacc.c"
    break;

  case 104: /* cond: TOK_CONDID  */
#line 1156 "parser_yacc.y"
        {
		struct cond_entry *ent;
		ent = new_cond_entry((yyvsp[0].id), 0, NULL);
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3108 "parser_yacc.c"
    break;

  case 105: /* cond: TOK_CONDID TOK_EQUALS TOK_VALUE  */
#line 1165 "parser_yacc.y"
        {
		struct cond_entry *ent;
		struct value_list *value = new_value_list((yyvsp[0].var_val));
		if (!value)
			yyerror(_("Memory allocation error."));
		ent = new_cond_entry((yyvsp[-2].id), 1, value);
		if (!ent) {
			free_value_list(value);
			yyerror(_("Memory allocation error."));
		}
		(yyval.cond_entry) = ent;
	}
#line 3125 "parser_yacc.c"
    break;

  case 106: /* cond: TOK_CONDID TOK_EQUALS TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1179 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), 1, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3137 "parser_yacc.c"
    break;

  case 107: /* cond: TOK_CONDID TOK_IN TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1189 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), 0, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3149 "parser_yacc.c"
    break;

  case 108: /* opt_conds: %empty  */
#line 1197 "parser_yacc.y"
           { /* nothing */ (yyval.cond_entry) = NULL; }
#line 3155 "parser_yacc.c"
    break;

  case 109: /* opt_conds: opt_conds cond  */
#line 1199 "parser_yacc.y"
        {
		(yyvsp[0].cond_entry)->next = (yyvsp[-1].cond_entry);
		(yyval.cond_entry) = (yyvsp[0].cond_entry);
	}
#line 3164 "parser_yacc.c"
    break;

  case 110: /* cond_list: TOK_CONDLISTID TOK_EQUALS TOK_OPENPAREN opt_conds TOK_CLOSEPAREN  */
#line 1205 "parser_yacc.y"
        {
		(yyval.cond_entry_list).name = (yyvsp[-4].id);
		(yyval.cond_entry_list).list = (yyvsp[-1].cond_entry);
	}
#line 3173 "parser_yacc.c"
    break;

  case 111: /* opt_cond_list: %empty  */
#line 1210 "parser_yacc.y"
               { /* nothing */ (yyval.cond_entry_list) = { NULL, NULL }; }
#line 3179 "parser_yacc.c"
    break;

  case 112: /* opt_cond_list: cond_list  */
#line 1211 "parser_yacc.y"
                    { (yyval.cond_entry_list) = (yyvsp[0].cond_entry_list); }
#line 3185 "parser_yacc.c"
    break;

  case 113: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1214 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), (yyvsp[-1].id), NULL, NULL, AA_MAY_MOUNT);
	}
#line 3193 "parser_yacc.c"
    break;

  case 114: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_ARROW opt_conds TOK_ID TOK_END_OF_RULE  */
#line 1219 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-5].cond_entry), (yyvsp[-4].id), (yyvsp[-2].cond_entry), (yyvsp[-1].id), AA_MAY_MOUNT);
	}
#line 3201 "parser_yacc.c"
    break;

  case 115: /* mnt_rule: TOK_REMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1224 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_DUMMY_REMOUNT);
	}
#line 3209 "parser_yacc.c"
    break;

  case 116: /* mnt_rule: TOK_UMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1229 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_MAY_UMOUNT);
	}
#line 3217 "parser_yacc.c"
    break;

  case 117: /* mnt_rule: TOK_PIVOTROOT opt_conds opt_id opt_target TOK_END_OF_RULE  */
#line 1234 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_pivot_rule((yyvsp[-3].cond_entry), (yyvsp[-2].id), (yyvsp[-1].id));
	}
#line 3225 "parser_yacc.c"
    break;

  case 118: /* dbus_perm: TOK_VALUE  */
#line 1239 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fperms) = AA_DBUS_BIND;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_DBUS_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_DBUS_RECEIVE;
		else if (strcmp((yyvsp[0].var_val), "eavesdrop") == 0)
			(yyval.fperms) = AA_DBUS_EAVESDROP;
		else if ((yyvsp[0].var_val)) {
			parse_dbus_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3247 "parser_yacc.c"
    break;

  case 119: /* dbus_perm: TOK_BIND  */
#line 1256 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_BIND; }
#line 3253 "parser_yacc.c"
    break;

  case 120: /* dbus_perm: TOK_SEND  */
#line 1257 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_SEND; }
#line 3259 "parser_yacc.c"
    break;

  case 121: /* dbus_perm: TOK_RECEIVE  */
#line 1258 "parser_yacc.y"
                      { (yyval.fperms) = AA_DBUS_RECEIVE; }
#line 3265 "parser_yacc.c"
    break;

  case 122: /* dbus_perm: TOK_READ  */
#line 1259 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_RECEIVE; }
#line 3271 "parser_yacc.c"
    break;

  case 123: /* dbus_perm: TOK_WRITE  */
#line 1260 "parser_yacc.y"
                    { (yyval.fperms) = AA_DBUS_SEND; }
#line 3277 "parser_yacc.c"
    break;

  case 124: /* dbus_perm: TOK_EAVESDROP  */
#line 1261 "parser_yacc.y"
                        { (yyval.fperms) = AA_DBUS_EAVESDROP; }
#line 3283 "parser_yacc.c"
    break;

  case 125: /* dbus_perm: TOK_MODE  */
#line 1263 "parser_yacc.y"
        {
		parse_dbus_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3292 "parser_yacc.c"
    break;

  case 126: /* dbus_perms: %empty  */
#line 1268 "parser_yacc.y"
            { /* nothing */ (yyval.fperms) = 0; }
#line 3298 "parser_yacc.c"
    break;

  case 127: /* dbus_perms: dbus_perms dbus_perm  */
#line 1269 "parser_yacc.y"
                               { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3304 "parser_yacc.c"
    break;

  case 128: /* dbus_perms: dbus_perms TOK_COMMA dbus_perm  */
#line 1270 "parser_yacc.y"
                                         { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3310 "parser_yacc.c"
    break;

  case 129: /* opt_dbus_perm: %empty  */
#line 1272 "parser_yacc.y"
               { /* nothing */ (yyval.fperms) = 0; }
#line 3316 "parser_yacc.c"
    break;

  case 130: /* opt_dbus_perm: dbus_perm  */
#line 1273 "parser_yacc.y"
                     { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3322 "parser_yacc.c"
    break;

  case 131: /* opt_dbus_perm: TOK_OPENPAREN dbus_perms TOK_CLOSEPAREN  */
#line 1274 "parser_yacc.y"
                                                  { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3328 "parser_yacc.c"
    break;

  case 132: /* dbus_rule: TOK_DBUS opt_dbus_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1277 "parser_yacc.y"
        {
		dbus_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("dbus rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new dbus_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.dbus_entry) = ent;
	}
#line 3347 "parser_yacc.c"
    break;

  case 133: /* net_perm: TOK_VALUE  */
#line 1293 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_NET_CREATE;
		else if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fperms) = AA_NET_BIND;
		else if (strcmp((yyvsp[0].var_val), "listen") == 0)
			(yyval.fperms) = AA_NET_LISTEN;
		else if (strcmp((yyvsp[0].var_val), "accept") == 0)
			(yyval.fperms) = AA_NET_ACCEPT;
		else if (strcmp((yyvsp[0].var_val), "connect") == 0)
			(yyval.fperms) = AA_NET_CONNECT;
		else if (strcmp((yyvsp[0].var_val), "shutdown") == 0)
			(yyval.fperms) = AA_NET_SHUTDOWN;
		else if (strcmp((yyvsp[0].var_val), "getattr") == 0)
			(yyval.fperms) = AA_NET_GETATTR;
		else if (strcmp((yyvsp[0].var_val), "setattr") == 0)
			(yyval.fperms) = AA_NET_SETATTR;
		else if (strcmp((yyvsp[0].var_val), "getopt") == 0)
			(yyval.fperms) = AA_NET_GETOPT;
		else if (strcmp((yyvsp[0].var_val), "setopt") == 0)
			(yyval.fperms) = AA_NET_SETOPT;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_NET_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_NET_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_net_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3385 "parser_yacc.c"
    break;

  case 134: /* net_perm: TOK_CREATE  */
#line 1326 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_CREATE; }
#line 3391 "parser_yacc.c"
    break;

  case 135: /* net_perm: TOK_BIND  */
#line 1327 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_BIND; }
#line 3397 "parser_yacc.c"
    break;

  case 136: /* net_perm: TOK_LISTEN  */
#line 1328 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_LISTEN; }
#line 3403 "parser_yacc.c"
    break;

  case 137: /* net_perm: TOK_ACCEPT  */
#line 1329 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_ACCEPT; }
#line 3409 "parser_yacc.c"
    break;

  case 138: /* net_perm: TOK_CONNECT  */
#line 1330 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_CONNECT; }
#line 3415 "parser_yacc.c"
    break;

  case 139: /* net_perm: TOK_SHUTDOWN  */
#line 1331 "parser_yacc.y"
                       { (yyval.fperms) = AA_NET_SHUTDOWN; }
#line 3421 "parser_yacc.c"
    break;

  case 140: /* net_perm: TOK_GETATTR  */
#line 1332 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_GETATTR; }
#line 3427 "parser_yacc.c"
    break;

  case 141: /* net_perm: TOK_SETATTR  */
#line 1333 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_SETATTR; }
#line 3433 "parser_yacc.c"
    break;

  case 142: /* net_perm: TOK_GETOPT  */
#line 1334 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_GETOPT; }
#line 3439 "parser_yacc.c"
    break;

  case 143: /* net_perm: TOK_SETOPT  */
#line 1335 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_SETOPT; }
#line 3445 "parser_yacc.c"
    break;

  case 144: /* net_perm: TOK_SEND  */
#line 1336 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_SEND; }
#line 3451 "parser_yacc.c"
    break;

  case 145: /* net_perm: TOK_RECEIVE  */
#line 1337 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_RECEIVE; }
#line 3457 "parser_yacc.c"
    break;

  case 146: /* net_perm: TOK_READ  */
#line 1338 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_RECEIVE; }
#line 3463 "parser_yacc.c"
    break;

  case 147: /* net_perm: TOK_WRITE  */
#line 1339 "parser_yacc.y"
                    { (yyval.fperms) = AA_NET_SEND; }
#line 3469 "parser_yacc.c"
    break;

  case 148: /* net_perm: TOK_MODE  */
#line 1341 "parser_yacc.y"
        {
		parse_unix_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3478 "parser_yacc.c"
    break;

  case 149: /* net_perms: %empty  */
#line 1346 "parser_yacc.y"
           { /* nothing */ (yyval.fperms) = 0; }
#line 3484 "parser_yacc.c"
    break;

  case 150: /* net_perms: net_perms net_perm  */
#line 1347 "parser_yacc.y"
                             { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3490 "parser_yacc.c"
    break;

  case 151: /* net_perms: net_perms TOK_COMMA net_perm  */
#line 1348 "parser_yacc.y"
                                       { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3496 "parser_yacc.c"
    break;

  case 152: /* opt_net_perm: %empty  */
#line 1350 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3502 "parser_yacc.c"
    break;

  case 153: /* opt_net_perm: net_perm  */
#line 1351 "parser_yacc.y"
                    { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3508 "parser_yacc.c"
    break;

  case 154: /* opt_net_perm: TOK_OPENPAREN net_perms TOK_CLOSEPAREN  */
#line 1352 "parser_yacc.y"
                                                 { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3514 "parser_yacc.c"
    break;

  case 155: /* unix_rule: TOK_UNIX opt_net_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1355 "parser_yacc.y"
        {
		unix_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("unix rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new unix_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.unix_entry) = ent;
	}
#line 3533 "parser_yacc.c"
    break;

  case 156: /* signal_perm: TOK_VALUE  */
#line 1371 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MAY_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MAY_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_signal_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3551 "parser_yacc.c"
    break;

  case 157: /* signal_perm: TOK_SEND  */
#line 1384 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_SEND; }
#line 3557 "parser_yacc.c"
    break;

  case 158: /* signal_perm: TOK_RECEIVE  */
#line 1385 "parser_yacc.y"
                      { (yyval.fperms) = AA_MAY_RECEIVE; }
#line 3563 "parser_yacc.c"
    break;

  case 159: /* signal_perm: TOK_READ  */
#line 1386 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_RECEIVE; }
#line 3569 "parser_yacc.c"
    break;

  case 160: /* signal_perm: TOK_WRITE  */
#line 1387 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_SEND; }
#line 3575 "parser_yacc.c"
    break;

  case 161: /* signal_perm: TOK_MODE  */
#line 1389 "parser_yacc.y"
        {
		parse_signal_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3584 "parser_yacc.c"
    break;

  case 162: /* signal_perms: %empty  */
#line 1394 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3590 "parser_yacc.c"
    break;

  case 163: /* signal_perms: signal_perms signal_perm  */
#line 1395 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3596 "parser_yacc.c"
    break;

  case 164: /* signal_perms: signal_perms TOK_COMMA signal_perm  */
#line 1396 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3602 "parser_yacc.c"
    break;

  case 165: /* opt_signal_perm: %empty  */
#line 1398 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 3608 "parser_yacc.c"
    break;

  case 166: /* opt_signal_perm: signal_perm  */
#line 1399 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3614 "parser_yacc.c"
    break;

  case 167: /* opt_signal_perm: TOK_OPENPAREN signal_perms TOK_CLOSEPAREN  */
#line 1400 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3620 "parser_yacc.c"
    break;

  case 168: /* signal_rule: TOK_SIGNAL opt_signal_perm opt_conds TOK_END_OF_RULE  */
#line 1403 "parser_yacc.y"
        {
		signal_rule *ent = new signal_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.signal_entry) = ent;
	}
#line 3629 "parser_yacc.c"
    break;

  case 169: /* ptrace_perm: TOK_VALUE  */
#line 1409 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "trace") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MAY_TRACE;
		else if (strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MAY_READ;
		else if (strcmp((yyvsp[0].var_val), "tracedby") == 0)
			(yyval.fperms) = AA_MAY_TRACEDBY;
		else if (strcmp((yyvsp[0].var_val), "readby") == 0)
			(yyval.fperms) = AA_MAY_READBY;
		else if ((yyvsp[0].var_val))
			parse_ptrace_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3651 "parser_yacc.c"
    break;

  case 170: /* ptrace_perm: TOK_TRACE  */
#line 1426 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_TRACE; }
#line 3657 "parser_yacc.c"
    break;

  case 171: /* ptrace_perm: TOK_TRACEDBY  */
#line 1427 "parser_yacc.y"
                       { (yyval.fperms) = AA_MAY_TRACEDBY; }
#line 3663 "parser_yacc.c"
    break;

  case 172: /* ptrace_perm: TOK_READ  */
#line 1428 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_READ; }
#line 3669 "parser_yacc.c"
    break;

  case 173: /* ptrace_perm: TOK_WRITE  */
#line 1429 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_TRACE; }
#line 3675 "parser_yacc.c"
    break;

  case 174: /* ptrace_perm: TOK_READBY  */
#line 1430 "parser_yacc.y"
                     { (yyval.fperms) = AA_MAY_READBY; }
#line 3681 "parser_yacc.c"
    break;

  case 175: /* ptrace_perm: TOK_MODE  */
#line 1432 "parser_yacc.y"
        {
		parse_ptrace_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3690 "parser_yacc.c"
    break;

  case 176: /* ptrace_perms: %empty  */
#line 1437 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3696 "parser_yacc.c"
    break;

  case 177: /* ptrace_perms: ptrace_perms ptrace_perm  */
#line 1438 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3702 "parser_yacc.c"
    break;

  case 178: /* ptrace_perms: ptrace_perms TOK_COMMA ptrace_perm  */
#line 1439 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3708 "parser_yacc.c"
    break;

  case 179: /* opt_ptrace_perm: %empty  */
#line 1441 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 3714 "parser_yacc.c"
    break;

  case 180: /* opt_ptrace_perm: ptrace_perm  */
#line 1442 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3720 "parser_yacc.c"
    break;

  case 181: /* opt_ptrace_perm: TOK_OPENPAREN ptrace_perms TOK_CLOSEPAREN  */
#line 1443 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3726 "parser_yacc.c"
    break;

  case 182: /* ptrace_rule: TOK_PTRACE opt_ptrace_perm opt_conds TOK_END_OF_RULE  */
#line 1446 "parser_yacc.y"
        {
		ptrace_rule *ent = new ptrace_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.ptrace_entry) = ent;
	}
#line 3735 "parser_yacc.c"
    break;

  case 183: /* userns_perm: TOK_VALUE  */
#line 1452 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_USERNS_CREATE;
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3749 "parser_yacc.c"
    break;

  case 184: /* userns_perm: TOK_CREATE  */
#line 1461 "parser_yacc.y"
                     { (yyval.fperms) = AA_USERNS_CREATE; }
#line 3755 "parser_yacc.c"
    break;

  case 185: /* userns_perms: %empty  */
#line 1463 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3761 "parser_yacc.c"
    break;

  case 186: /* userns_perms: userns_perms userns_perm  */
#line 1464 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3767 "parser_yacc.c"
    break;

  case 187: /* userns_perms: userns_perms TOK_COMMA userns_perm  */
#line 1465 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3773 "parser_yacc.c"
    break;

  case 188: /* opt_userns_perm: %empty  */
#line 1467 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 3779 "parser_yacc.c"
    break;

  case 189: /* opt_userns_perm: userns_perm  */
#line 1468 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3785 "parser_yacc.c"
    break;

  case 190: /* opt_userns_perm: TOK_OPENPAREN userns_perms TOK_CLOSEPAREN  */
#line 1469 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3791 "parser_yacc.c"
    break;

  case 191: /* userns_rule: TOK_USERNS opt_userns_perm opt_conds TOK_END_OF_RULE  */
#line 1472 "parser_yacc.y"
        {
		userns_rule *ent = new userns_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.userns_entry) = ent;
	}
#line 3800 "parser_yacc.c"
    break;

  case 192: /* mqueue_perm: TOK_VALUE  */
#line 1478 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_MQUEUE_CREATE;
		else if (strcmp((yyvsp[0].var_val), "open") == 0)
			(yyval.fperms) = AA_MQUEUE_OPEN;
		else if (strcmp((yyvsp[0].var_val), "delete") == 0)
			(yyval.fperms) = AA_MQUEUE_DELETE;
		else if (strcmp((yyvsp[0].var_val), "getattr") == 0)
			(yyval.fperms) = AA_MQUEUE_GETATTR;
		else if (strcmp((yyvsp[0].var_val), "setattr") == 0)
			(yyval.fperms) = AA_MQUEUE_SETATTR;
		else if (strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MQUEUE_WRITE;
		else if (strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MQUEUE_READ;
		else if ((yyvsp[0].var_val)) {
			parse_mqueue_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3828 "parser_yacc.c"
    break;

  case 193: /* mqueue_perm: TOK_CREATE  */
#line 1501 "parser_yacc.y"
                     { (yyval.fperms) = AA_MQUEUE_CREATE; }
#line 3834 "parser_yacc.c"
    break;

  case 194: /* mqueue_perm: TOK_OPEN  */
#line 1502 "parser_yacc.y"
                   { (yyval.fperms) = AA_MQUEUE_OPEN; }
#line 3840 "parser_yacc.c"
    break;

  case 195: /* mqueue_perm: TOK_DELETE  */
#line 1503 "parser_yacc.y"
                     { (yyval.fperms) = AA_MQUEUE_DELETE; }
#line 3846 "parser_yacc.c"
    break;

  case 196: /* mqueue_perm: TOK_GETATTR  */
#line 1504 "parser_yacc.y"
                      { (yyval.fperms) = AA_MQUEUE_GETATTR; }
#line 3852 "parser_yacc.c"
    break;

  case 197: /* mqueue_perm: TOK_SETATTR  */
#line 1505 "parser_yacc.y"
                      { (yyval.fperms) = AA_MQUEUE_SETATTR; }
#line 3858 "parser_yacc.c"
    break;

  case 198: /* mqueue_perm: TOK_WRITE  */
#line 1506 "parser_yacc.y"
                    { (yyval.fperms) = AA_MQUEUE_WRITE; }
#line 3864 "parser_yacc.c"
    break;

  case 199: /* mqueue_perm: TOK_READ  */
#line 1507 "parser_yacc.y"
                   { (yyval.fperms) = AA_MQUEUE_READ; }
#line 3870 "parser_yacc.c"
    break;

  case 200: /* mqueue_perm: TOK_MODE  */
#line 1509 "parser_yacc.y"
        {
		parse_mqueue_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3879 "parser_yacc.c"
    break;

  case 201: /* mqueue_perms: %empty  */
#line 1514 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3885 "parser_yacc.c"
    break;

  case 202: /* mqueue_perms: mqueue_perms mqueue_perm  */
#line 1515 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3891 "parser_yacc.c"
    break;

  case 203: /* mqueue_perms: mqueue_perms TOK_COMMA mqueue_perm  */
#line 1516 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3897 "parser_yacc.c"
    break;

  case 204: /* opt_mqueue_perm: %empty  */
#line 1518 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 3903 "parser_yacc.c"
    break;

  case 205: /* opt_mqueue_perm: mqueue_perm  */
#line 1519 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3909 "parser_yacc.c"
    break;

  case 206: /* opt_mqueue_perm: TOK_OPENPAREN mqueue_perms TOK_CLOSEPAREN  */
#line 1520 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3915 "parser_yacc.c"
    break;

  case 207: /* mqueue_rule: TOK_MQUEUE opt_mqueue_perm opt_conds TOK_END_OF_RULE  */
#line 1523 "parser_yacc.y"
        {
		mqueue_rule *ent = new mqueue_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.mqueue_entry) = ent;
	}
#line 3924 "parser_yacc.c"
    break;

  case 208: /* mqueue_rule: TOK_MQUEUE opt_mqueue_perm opt_conds TOK_ID TOK_END_OF_RULE  */
#line 1528 "parser_yacc.y"
        {
		mqueue_rule *ent = new mqueue_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].id));
		(yyval.mqueue_entry) = ent;
	}
#line 3933 "parser_yacc.c"
    break;

  case 209: /* io_uring_perm: TOK_VALUE  */
#line 1534 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "override_creds") == 0)
			(yyval.fperms) = AA_IO_URING_OVERRIDE_CREDS;
		else if (strcmp((yyvsp[0].var_val), "sqpoll") == 0)
			(yyval.fperms) = AA_IO_URING_SQPOLL;
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3949 "parser_yacc.c"
    break;

  case 210: /* io_uring_perm: TOK_OVERRIDE_CREDS  */
#line 1545 "parser_yacc.y"
                             { (yyval.fperms) = AA_IO_URING_OVERRIDE_CREDS; }
#line 3955 "parser_yacc.c"
    break;

  case 211: /* io_uring_perm: TOK_SQPOLL  */
#line 1546 "parser_yacc.y"
                     { (yyval.fperms) = AA_IO_URING_SQPOLL; }
#line 3961 "parser_yacc.c"
    break;

  case 212: /* io_uring_perms: %empty  */
#line 1548 "parser_yacc.y"
                { /* nothing */ (yyval.fperms) = 0; }
#line 3967 "parser_yacc.c"
    break;

  case 213: /* io_uring_perms: io_uring_perms io_uring_perm  */
#line 1549 "parser_yacc.y"
                                       { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3973 "parser_yacc.c"
    break;

  case 214: /* io_uring_perms: io_uring_perms TOK_COMMA io_uring_perm  */
#line 1550 "parser_yacc.y"
                                                 { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3979 "parser_yacc.c"
    break;

  case 215: /* opt_io_uring_perm: %empty  */
#line 1552 "parser_yacc.y"
                   { /* nothing */ (yyval.fperms) = 0; }
#line 3985 "parser_yacc.c"
    break;

  case 216: /* opt_io_uring_perm: io_uring_perm  */
#line 1553 "parser_yacc.y"
                        { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3991 "parser_yacc.c"
    break;

  case 217: /* opt_io_uring_perm: TOK_OPENPAREN io_uring_perms TOK_CLOSEPAREN  */
#line 1554 "parser_yacc.y"
                                                      { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3997 "parser_yacc.c"
    break;

  case 218: /* io_uring_rule: TOK_IO_URING opt_io_uring_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1557 "parser_yacc.y"
        {
		io_uring_rule *ent;
		ent = new io_uring_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.io_uring_entry) = ent;
	}
#line 4009 "parser_yacc.c"
    break;

  case 219: /* all_rule: TOK_ALL TOK_END_OF_RULE  */
#line 1566 "parser_yacc.y"
        {
		all_rule *ent = new all_rule();
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.all_entry) = ent;
	}
#line 4020 "parser_yacc.c"
    break;

  case 220: /* hat_start: TOK_CARET  */
#line 1573 "parser_yacc.y"
                     {}
#line 4026 "parser_yacc.c"
    break;

  case 221: /* hat_start: TOK_HAT  */
#line 1574 "parser_yacc.y"
                  {}
#line 4032 "parser_yacc.c"
    break;

  case 222: /* file_perms: TOK_MODE  */
#line 1577 "parser_yacc.y"
        {
		/* A single TOK_MODE maps to the same permission in all
		 * of user::other */
		(yyval.fperms) = parse_perms((yyvsp[0].mode));
		free((yyvsp[0].mode));
	}
#line 4043 "parser_yacc.c"
    break;

  case 223: /* change_profile: TOK_CHANGE_PROFILE opt_exec_mode opt_id opt_named_transition TOK_END_OF_RULE  */
#line 1585 "parser_yacc.y"
        {
		struct cod_entry *entry;
		perm32_t perms = AA_CHANGE_PROFILE;
		int exec_mode = (yyvsp[-3].integer);
		char *exec = (yyvsp[-2].id);
		char *target = (yyvsp[-1].id);

		if (exec) {
			/* exec bits required to trigger rule conflict if
			 * for overlapping safe and unsafe exec rules
			 */
			perms |= AA_EXEC_BITS;
			if (exec_mode == EXEC_MODE_UNSAFE)
				perms |= ALL_AA_EXEC_UNSAFE;
			else if (exec_mode == EXEC_MODE_SAFE &&
				 !features_supports_stacking) {
				pwarn(WARN_RULE_DOWNGRADED, "downgrading change_profile safe rule to unsafe due to lack of necessary kernel support\n");
				/**
				 * No need to do anything because 'unsafe' exec
				 * mode is the only supported mode of
				 * change_profile rules in non-stacking kernels
				 */
			}
		} else if (exec_mode != EXEC_MODE_EMPTY)
			yyerror(_("Exec condition is required when unsafe or safe keywords are present"));
		if (exec && !(exec[0] == '/' || strncmp(exec, "@{", 2) == 0))
			yyerror(_("Exec condition must begin with '/'."));

		if (target) {
			PDEBUG("Matched change_profile: tok_id (%s)\n", target);
		} else {
			PDEBUG("Matched change_profile,\n");
			target = strdup("**");
			if (!target)
				yyerror(_("Memory allocation error."));
		}

		entry = new_entry(target, perms, exec);
		if (!entry)
			yyerror(_("Memory allocation error."));

		PDEBUG("change_profile.entry: (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 4092 "parser_yacc.c"
    break;

  case 224: /* capability: TOK_CAPABILITY caps TOK_END_OF_RULE  */
#line 1631 "parser_yacc.y"
        {
		if ((yyvsp[-1].cap) == 0) {
			/* bare capability keyword - set all caps */
			(yyval.cap) = 0xffffffffffffffff;
		} else
			(yyval.cap) = (yyvsp[-1].cap);
	}
#line 4104 "parser_yacc.c"
    break;

  case 225: /* caps: %empty  */
#line 1639 "parser_yacc.y"
      { /* nothing */ (yyval.cap) = 0; }
#line 4110 "parser_yacc.c"
    break;

  case 226: /* caps: caps TOK_ID  */
#line 1641 "parser_yacc.y"
        {
		int backmap, cap = name_to_capability((yyvsp[0].id));
		if (cap == -1)
			yyerror(_("Invalid capability %s."), (yyvsp[0].id));
		free((yyvsp[0].id));
		backmap = capability_backmap(cap);
		if (backmap != NO_BACKMAP_CAP && !capability_in_kernel(cap)) {
			/* TODO: special backmap warning */
			cap = backmap;
		}
		(yyval.cap) = (yyvsp[-1].cap) | CAP_TO_MASK(cap);
	}
#line 4127 "parser_yacc.c"
    break;


#line 4131 "parser_yacc.c"

      default: break;
    }
  /* User semantic actions sometimes alter yychar, and that requires
     that yytoken be updated with the new translation.  We take the
     approach of translating immediately before every use of yytoken.
     One alternative is translating here after every semantic action,
     but that translation would be missed if the semantic action invokes
     YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or
     if it invokes YYBACKUP.  In the case of YYABORT or YYACCEPT, an
     incorrect destructor might then be invoked immediately.  In the
     case of YYERROR or YYBACKUP, subsequent parser actions might lead
     to an incorrect destructor call or verbose syntax error message
     before the lookahead is translated.  */
  YY_SYMBOL_PRINT ("-> $$ =", YY_CAST (yysymbol_kind_t, yyr1[yyn]), &yyval, &yyloc);

  YYPOPSTACK (yylen);
  yylen = 0;

  *++yyvsp = yyval;

  /* Now 'shift' the result of the reduction.  Determine what state
     that goes to, based on the state we popped back to and the rule
     number reduced by.  */
  {
    const int yylhs = yyr1[yyn] - YYNTOKENS;
    const int yyi = yypgoto[yylhs] + *yyssp;
    yystate = (0 <= yyi && yyi <= YYLAST && yycheck[yyi] == *yyssp
               ? yytable[yyi]
               : yydefgoto[yylhs]);
  }

  goto yynewstate;


/*--------------------------------------.
| yyerrlab -- here on detecting error.  |
`--------------------------------------*/
yyerrlab:
  /* Make sure we have latest lookahead translation.  See comments at
     user semantic actions for why this is necessary.  */
  yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar);
  /* If not already recovering from an error, report this error.  */
  if (!yyerrstatus)
    {
      ++yynerrs;
      {
        yypcontext_t yyctx
          = {yyssp, yytoken};
        char const *yymsgp = YY_("syntax error");
        int yysyntax_error_status;
        yysyntax_error_status = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
        if (yysyntax_error_status == 0)
          yymsgp = yymsg;
        else if (yysyntax_error_status == -1)
          {
            if (yymsg != yymsgbuf)
              YYSTACK_FREE (yymsg);
            yymsg = YY_CAST (char *,
                             YYSTACK_ALLOC (YY_CAST (YYSIZE_T, yymsg_alloc)));
            if (yymsg)
              {
                yysyntax_error_status
                  = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
                yymsgp = yymsg;
              }
            else
              {
                yymsg = yymsgbuf;
                yymsg_alloc = sizeof yymsgbuf;
                yysyntax_error_status = YYENOMEM;
              }
          }
        yyerror (yymsgp);
        if (yysyntax_error_status == YYENOMEM)
          YYNOMEM;
      }
    }

  if (yyerrstatus == 3)
    {
      /* If just tried and failed to reuse lookahead token after an
         error, discard it.  */

      if (yychar <= YYEOF)
        {
          /* Return failure if at end of input.  */
          if (yychar == YYEOF)
            YYABORT;
        }
      else
        {
          yydestruct ("Error: discarding",
                      yytoken, &yylval);
          yychar = YYEMPTY;
        }
    }

  /* Else will try to reuse lookahead token after shifting the error
     token.  */
  goto yyerrlab1;


/*---------------------------------------------------.
| yyerrorlab -- error raised explicitly by YYERROR.  |
`---------------------------------------------------*/
yyerrorlab:
  /* Pacify compilers when the user code never invokes YYERROR and the
     label yyerrorlab therefore never appears in user code.  */
  if (0)
    YYERROR;
  ++yynerrs;

  /* Do not reclaim the symbols of the rule whose action triggered
     this YYERROR.  */
  YYPOPSTACK (yylen);
  yylen = 0;
  YY_STACK_PRINT (yyss, yyssp);
  yystate = *yyssp;
  goto yyerrlab1;


/*-------------------------------------------------------------.
| yyerrlab1 -- common code for both syntax error and YYERROR.  |
`-------------------------------------------------------------*/
yyerrlab1:
  yyerrstatus = 3;      /* Each real token shifted decrements this.  */

  /* Pop stack until we find a state that shifts the error token.  */
  for (;;)
    {
      yyn = yypact[yystate];
      if (!yypact_value_is_default (yyn))
        {
          yyn += YYSYMBOL_YYerror;
          if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYSYMBOL_YYerror)
            {
              yyn = yytable[yyn];
              if (0 < yyn)
                break;
            }
        }

      /* Pop the current state because it cannot handle the error token.  */
      if (yyssp == yyss)
        YYABORT;


      yydestruct ("Error: popping",
                  YY_ACCESSING_SYMBOL (yystate), yyvsp);
      YYPOPSTACK (1);
      yystate = *yyssp;
      YY_STACK_PRINT (yyss, yyssp);
    }

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END


  /* Shift the error token.  */
  YY_SYMBOL_PRINT ("Shifting", YY_ACCESSING_SYMBOL (yyn), yyvsp, yylsp);

  yystate = yyn;
  goto yynewstate;


/*-------------------------------------.
| yyacceptlab -- YYACCEPT comes here.  |
`-------------------------------------*/
yyacceptlab:
  yyresult = 0;
  goto yyreturnlab;


/*-----------------------------------.
| yyabortlab -- YYABORT comes here.  |
`-----------------------------------*/
yyabortlab:
  yyresult = 1;
  goto yyreturnlab;


/*-----------------------------------------------------------.
| yyexhaustedlab -- YYNOMEM (memory exhaustion) comes here.  |
`-----------------------------------------------------------*/
yyexhaustedlab:
  yyerror (YY_("memory exhausted"));
  yyresult = 2;
  goto yyreturnlab;


/*----------------------------------------------------------.
| yyreturnlab -- parsing is finished, clean up and return.  |
`----------------------------------------------------------*/
yyreturnlab:
  if (yychar != YYEMPTY)
    {
      /* Make sure we have latest lookahead translation.  See comments at
         user semantic actions for why this is necessary.  */
      yytoken = YYTRANSLATE (yychar);
      yydestruct ("Cleanup: discarding lookahead",
                  yytoken, &yylval);
    }
  /* Do not reclaim the symbols of the rule whose action triggered
     this YYABORT or YYACCEPT.  */
  YYPOPSTACK (yylen);
  YY_STACK_PRINT (yyss, yyssp);
  while (yyssp != yyss)
    {
      yydestruct ("Cleanup: popping",
                  YY_ACCESSING_SYMBOL (+*yyssp), yyvsp);
      YYPOPSTACK (1);
    }
#ifndef yyoverflow
  if (yyss != yyssa)
    YYSTACK_FREE (yyss);
#endif
  if (yymsg != yymsgbuf)
    YYSTACK_FREE (yymsg);
  return yyresult;
}

#line 1654 "parser_yacc.y"

#define MAXBUFSIZE 4096

void vprintyyerror(const char *msg, va_list argptr)
{
	char buf[MAXBUFSIZE];

	vsnprintf(buf, sizeof(buf), msg, argptr);

	if (profilename) {
		PERROR(_("AppArmor parser error for %s%s%s at line %d: %s\n"),
		       profilename,
		       current_filename ? " in profile " : "",
		       current_filename ? current_filename : "",
		       current_lineno, buf);
	} else {
		PERROR(_("AppArmor parser error at line %d: %s\n"),
		       current_lineno, buf);
	}
}

void printyyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);
}

void yyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);

	exit(1);
}

struct cod_entry *do_file_rule(char *id, perm32_t perms, char *link_id, char *nt)
{
		struct cod_entry *entry;
		PDEBUG("Matched: tok_id (%s) tok_perms (0x%x)\n", id, perms);
		entry = new_entry(id, perms, link_id);
		if (!entry)
			yyerror(_("Memory allocation error."));
		entry->nt_name = nt;
		PDEBUG("rule.entry: (%s)\n", entry->name);
		return entry;
}

static const char *mnt_cond_msg[] = {"",
			 " not allowed as source conditional",
			 " not allowed as target conditional",
			 "",
			 NULL};

int verify_mnt_conds(struct cond_entry *conds, int src)
{
	struct cond_entry *entry;
	int error = 0;

	if (!conds)
		return 0;

	list_for_each(conds, entry) {
		int res = is_valid_mnt_cond(entry->name, src);
		if (res <= 0) {
				printyyerror(_("invalid mount conditional %s%s"),
					     entry->name,
					     res == -1 ? "" : mnt_cond_msg[src]);
				error++;
		}
	}

	return error;
}

mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      perm32_t perms)
{
	if (verify_mnt_conds(src_conds, MNT_SRC_OPT) != 0)
		yyerror(_("bad mount rule"));

	/* FIXME: atm conditions are not supported on dst
	if (verify_conds(dst_conds, DST_OPT) != 0)
		yyerror(_("bad mount rule"));
	*/
	if (dst_conds)
		yyerror(_("mount point conditions not currently supported"));

	mnt_rule *ent = new mnt_rule(src_conds, src, dst_conds, dst, perms);
	if (!ent) {
		yyerror(_("Memory allocation error."));
	}

	return ent;
}

mnt_rule *do_pivot_rule(struct cond_entry *old, char *root, char *transition)
{
	char *device = NULL;
	if (old) {
		if (strcmp(old->name, "oldroot") != 0)
			yyerror(_("invalid pivotroot conditional '%s'"), old->name);
		if (old->vals) {
			device = old->vals->value;
			old->vals->value = NULL;
		}
		free_cond_entry(old);
	}

	mnt_rule *ent = new mnt_rule(NULL, device, NULL, root, AA_MAY_PIVOTROOT);
	ent->trans = transition;

	return ent;
}

static int abi_features_base(struct aa_features **features, char *filename, bool search)
{
	autofclose FILE *f = NULL;
	struct stat my_stat;
	autofree char *fullpath = NULL;
	bool cached;

	if (search) {
		if (strcmp(filename, "kernel") == 0)
			return aa_features_new_from_kernel(features);
		f = search_path(filename, &fullpath, &cached);
		PDEBUG("abi lookup '%s' -> '%s' f %p cached %d\n", filename, fullpath, f, cached);
		if (!f && cached) {
			*features = NULL;
			return 0;
		}
	} else {
		f = fopen(filename, "r");
		PDEBUG("abi relpath '%s' f %p\n", filename, f);
	}

	if (!f) {
		yyerror(_("Could not open '%s': %m"),
                        fullpath ? fullpath: filename);
	}

	if (fstat(fileno(f), &my_stat))
		yyerror(_("fstat failed for '%s': %m"), fullpath ? fullpath : filename);

        if (S_ISREG(my_stat.st_mode)) {
		return aa_features_new_from_file(features, fileno(f));
	}

	return -1;
}

static void abi_features(char *filename, bool search)
{
	struct aa_features *tmp_features;

	if (abi_features_base(&tmp_features, filename, search) == -1) {
			yyerror(_("failed to find features abi '%s': %m"), filename);
	}
	if (policy_features) {
		if (tmp_features) {
			if (!aa_features_is_equal(tmp_features, policy_features)) {
				pwarn(WARN_ABI, _("%s: %s features abi '%s' differs from policy declared feature abi, using the features abi declared in policy\n"), progname, current_filename, filename);
			}
			aa_features_unref(tmp_features);
		}
	} else if (!tmp_features) {
		/* skipped reinclude, but features not set */
		yyerror(_("failed features abi not set but include cache skipped\n"));
	} else {
		/* first features abi declaration */
		policy_features = tmp_features;
	}

};
