/* A Bison parser, made by GNU Bison 3.8.2.  */

/* Bison implementation for Yacc-like parsers in C

   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation,
   Inc.

   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */

/* As a special exception, you may create a larger work that contains
   part or all of the Bison parser skeleton and distribute that work
   under terms of your choice, so long as that work isn't itself a
   parser generator using the skeleton or a modified version thereof
   as a parser skeleton.  Alternatively, if you modify or redistribute
   the parser skeleton itself, you may (at your option) remove this
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.

   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

/* C LALR(1) parser skeleton written by Richard Stallman, by
   simplifying the original so-called "semantic" parser.  */

/* DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual,
   especially those whose name start with YY_ or yy_.  They are
   private implementation details that can be changed or removed.  */

/* All symbols defined below should begin with yy or YY, to avoid
   infringing on user name space.  This should be done even for local
   variables, as they might otherwise be expanded by user macros.
   There are some unavoidable exceptions within include files to
   define necessary library symbols; they are noted "INFRINGES ON
   USER NAME SPACE" below.  */

/* Identify Bison output, and Bison version.  */
#define YYBISON 30802

/* Bison version string.  */
#define YYBISON_VERSION "3.8.2"

/* Skeleton name.  */
#define YYSKELETON_NAME "yacc.c"

/* Pure parsers.  */
#define YYPURE 0

/* Push parsers.  */
#define YYPUSH 0

/* Pull parsers.  */
#define YYPULL 1




/* First part of user prologue.  */
#line 1 "parser_yacc.y"

/*
 *   Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
 *   NOVELL (All rights reserved)
 *   Copyright (c) 2010-2012
 *   Canonical Ltd.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of version 2 of the GNU General Public
 *   License published by the Free Software Foundation.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, contact Canonical, Ltd.
 */

#define YYERROR_VERBOSE 1
#include <limits.h>
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/apparmor.h>

#include <iostream>

/* #define DEBUG */

#include "capability.h"
#include "lib.h"
#include "parser.h"
#include "profile.h"
#include "mount.h"
#include "dbus.h"
#include "af_unix.h"
#include "parser_include.h"
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>

using namespace std;

#define CIDR_32 htonl(0xffffffff)
#define CIDR_24 htonl(0xffffff00)
#define CIDR_16 htonl(0xffff0000)
#define CIDR_8  htonl(0xff000000)

/* undefine linux/capability.h CAP_TO_MASK */
#ifdef CAP_TO_MASK
#undef CAP_TO_MASK
#endif

#define CAP_TO_MASK(x) (1ull << (x))

#define EXEC_MODE_EMPTY		0
#define EXEC_MODE_UNSAFE	1
#define EXEC_MODE_SAFE		2

int parser_token = 0;

struct cod_entry *do_file_rule(char *id, perm32_t perms, char *link_id, char *nt);
mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      perm32_t perms);
mnt_rule *do_pivot_rule(struct cond_entry *old, char *root,
			char *transition);
static void abi_features(char *filename, bool search);


#line 148 "parser_yacc.c"

# ifndef YY_CAST
#  ifdef __cplusplus
#   define YY_CAST(Type, Val) static_cast<Type> (Val)
#   define YY_REINTERPRET_CAST(Type, Val) reinterpret_cast<Type> (Val)
#  else
#   define YY_CAST(Type, Val) ((Type) (Val))
#   define YY_REINTERPRET_CAST(Type, Val) ((Type) (Val))
#  endif
# endif
# ifndef YY_NULLPTR
#  if defined __cplusplus
#   if 201103L <= __cplusplus
#    define YY_NULLPTR nullptr
#   else
#    define YY_NULLPTR 0
#   endif
#  else
#   define YY_NULLPTR ((void*)0)
#  endif
# endif

#include "parser_yacc.h"
/* Symbol kind.  */
enum yysymbol_kind_t
{
  YYSYMBOL_YYEMPTY = -2,
  YYSYMBOL_YYEOF = 0,                      /* "end of file"  */
  YYSYMBOL_YYerror = 1,                    /* error  */
  YYSYMBOL_YYUNDEF = 2,                    /* "invalid token"  */
  YYSYMBOL_TOK_ID = 3,                     /* TOK_ID  */
  YYSYMBOL_TOK_CONDID = 4,                 /* TOK_CONDID  */
  YYSYMBOL_TOK_CONDLISTID = 5,             /* TOK_CONDLISTID  */
  YYSYMBOL_TOK_CARET = 6,                  /* TOK_CARET  */
  YYSYMBOL_TOK_OPEN = 7,                   /* TOK_OPEN  */
  YYSYMBOL_TOK_CLOSE = 8,                  /* TOK_CLOSE  */
  YYSYMBOL_TOK_MODE = 9,                   /* TOK_MODE  */
  YYSYMBOL_TOK_END_OF_RULE = 10,           /* TOK_END_OF_RULE  */
  YYSYMBOL_TOK_EQUALS = 11,                /* TOK_EQUALS  */
  YYSYMBOL_TOK_ARROW = 12,                 /* TOK_ARROW  */
  YYSYMBOL_TOK_ADD_ASSIGN = 13,            /* TOK_ADD_ASSIGN  */
  YYSYMBOL_TOK_COND_ASSIGN = 14,           /* TOK_COND_ASSIGN  */
  YYSYMBOL_TOK_OVERRIDE_ASSIGN = 15,       /* TOK_OVERRIDE_ASSIGN  */
  YYSYMBOL_TOK_LE = 16,                    /* TOK_LE  */
  YYSYMBOL_TOK_SET_VAR = 17,               /* TOK_SET_VAR  */
  YYSYMBOL_TOK_BOOL_VAR = 18,              /* TOK_BOOL_VAR  */
  YYSYMBOL_TOK_VALUE = 19,                 /* TOK_VALUE  */
  YYSYMBOL_TOK_IF = 20,                    /* TOK_IF  */
  YYSYMBOL_TOK_ELSE = 21,                  /* TOK_ELSE  */
  YYSYMBOL_TOK_NOT = 22,                   /* TOK_NOT  */
  YYSYMBOL_TOK_DEFINED = 23,               /* TOK_DEFINED  */
  YYSYMBOL_TOK_CHANGE_PROFILE = 24,        /* TOK_CHANGE_PROFILE  */
  YYSYMBOL_TOK_NETWORK = 25,               /* TOK_NETWORK  */
  YYSYMBOL_TOK_UNIX = 26,                  /* TOK_UNIX  */
  YYSYMBOL_TOK_CREATE = 27,                /* TOK_CREATE  */
  YYSYMBOL_TOK_SHUTDOWN = 28,              /* TOK_SHUTDOWN  */
  YYSYMBOL_TOK_ACCEPT = 29,                /* TOK_ACCEPT  */
  YYSYMBOL_TOK_CONNECT = 30,               /* TOK_CONNECT  */
  YYSYMBOL_TOK_LISTEN = 31,                /* TOK_LISTEN  */
  YYSYMBOL_TOK_SETOPT = 32,                /* TOK_SETOPT  */
  YYSYMBOL_TOK_GETOPT = 33,                /* TOK_GETOPT  */
  YYSYMBOL_TOK_SETATTR = 34,               /* TOK_SETATTR  */
  YYSYMBOL_TOK_GETATTR = 35,               /* TOK_GETATTR  */
  YYSYMBOL_TOK_HAT = 36,                   /* TOK_HAT  */
  YYSYMBOL_TOK_UNSAFE = 37,                /* TOK_UNSAFE  */
  YYSYMBOL_TOK_SAFE = 38,                  /* TOK_SAFE  */
  YYSYMBOL_TOK_COLON = 39,                 /* TOK_COLON  */
  YYSYMBOL_TOK_LINK = 40,                  /* TOK_LINK  */
  YYSYMBOL_TOK_OWNER = 41,                 /* TOK_OWNER  */
  YYSYMBOL_TOK_OTHER = 42,                 /* TOK_OTHER  */
  YYSYMBOL_TOK_SUBSET = 43,                /* TOK_SUBSET  */
  YYSYMBOL_TOK_AUDIT = 44,                 /* TOK_AUDIT  */
  YYSYMBOL_TOK_DENY = 45,                  /* TOK_DENY  */
  YYSYMBOL_TOK_ALLOW = 46,                 /* TOK_ALLOW  */
  YYSYMBOL_TOK_PROMPT = 47,                /* TOK_PROMPT  */
  YYSYMBOL_TOK_PROFILE = 48,               /* TOK_PROFILE  */
  YYSYMBOL_TOK_SET = 49,                   /* TOK_SET  */
  YYSYMBOL_TOK_ALIAS = 50,                 /* TOK_ALIAS  */
  YYSYMBOL_TOK_PTRACE = 51,                /* TOK_PTRACE  */
  YYSYMBOL_TOK_OPENPAREN = 52,             /* TOK_OPENPAREN  */
  YYSYMBOL_TOK_CLOSEPAREN = 53,            /* TOK_CLOSEPAREN  */
  YYSYMBOL_TOK_COMMA = 54,                 /* TOK_COMMA  */
  YYSYMBOL_TOK_FILE = 55,                  /* TOK_FILE  */
  YYSYMBOL_TOK_MOUNT = 56,                 /* TOK_MOUNT  */
  YYSYMBOL_TOK_REMOUNT = 57,               /* TOK_REMOUNT  */
  YYSYMBOL_TOK_UMOUNT = 58,                /* TOK_UMOUNT  */
  YYSYMBOL_TOK_PIVOTROOT = 59,             /* TOK_PIVOTROOT  */
  YYSYMBOL_TOK_IN = 60,                    /* TOK_IN  */
  YYSYMBOL_TOK_DBUS = 61,                  /* TOK_DBUS  */
  YYSYMBOL_TOK_SIGNAL = 62,                /* TOK_SIGNAL  */
  YYSYMBOL_TOK_SEND = 63,                  /* TOK_SEND  */
  YYSYMBOL_TOK_RECEIVE = 64,               /* TOK_RECEIVE  */
  YYSYMBOL_TOK_BIND = 65,                  /* TOK_BIND  */
  YYSYMBOL_TOK_READ = 66,                  /* TOK_READ  */
  YYSYMBOL_TOK_WRITE = 67,                 /* TOK_WRITE  */
  YYSYMBOL_TOK_EAVESDROP = 68,             /* TOK_EAVESDROP  */
  YYSYMBOL_TOK_PEER = 69,                  /* TOK_PEER  */
  YYSYMBOL_TOK_TRACE = 70,                 /* TOK_TRACE  */
  YYSYMBOL_TOK_TRACEDBY = 71,              /* TOK_TRACEDBY  */
  YYSYMBOL_TOK_READBY = 72,                /* TOK_READBY  */
  YYSYMBOL_TOK_ABI = 73,                   /* TOK_ABI  */
  YYSYMBOL_TOK_USERNS = 74,                /* TOK_USERNS  */
  YYSYMBOL_TOK_MQUEUE = 75,                /* TOK_MQUEUE  */
  YYSYMBOL_TOK_DELETE = 76,                /* TOK_DELETE  */
  YYSYMBOL_TOK_IO_URING = 77,              /* TOK_IO_URING  */
  YYSYMBOL_TOK_OVERRIDE_CREDS = 78,        /* TOK_OVERRIDE_CREDS  */
  YYSYMBOL_TOK_SQPOLL = 79,                /* TOK_SQPOLL  */
  YYSYMBOL_TOK_ALL = 80,                   /* TOK_ALL  */
  YYSYMBOL_TOK_PRIORITY = 81,              /* TOK_PRIORITY  */
  YYSYMBOL_TOK_AND = 82,                   /* TOK_AND  */
  YYSYMBOL_TOK_OR = 83,                    /* TOK_OR  */
  YYSYMBOL_TOK_EQ_OP = 84,                 /* TOK_EQ_OP  */
  YYSYMBOL_TOK_NE_OP = 85,                 /* TOK_NE_OP  */
  YYSYMBOL_TOK_IN_OP = 86,                 /* TOK_IN_OP  */
  YYSYMBOL_TOK_GT = 87,                    /* TOK_GT  */
  YYSYMBOL_TOK_GE = 88,                    /* TOK_GE  */
  YYSYMBOL_TOK_LT = 89,                    /* TOK_LT  */
  YYSYMBOL_TOK_RLIMIT = 90,                /* TOK_RLIMIT  */
  YYSYMBOL_TOK_SOFT_RLIMIT = 91,           /* TOK_SOFT_RLIMIT  */
  YYSYMBOL_TOK_RLIMIT_CPU = 92,            /* TOK_RLIMIT_CPU  */
  YYSYMBOL_TOK_RLIMIT_FSIZE = 93,          /* TOK_RLIMIT_FSIZE  */
  YYSYMBOL_TOK_RLIMIT_DATA = 94,           /* TOK_RLIMIT_DATA  */
  YYSYMBOL_TOK_RLIMIT_STACK = 95,          /* TOK_RLIMIT_STACK  */
  YYSYMBOL_TOK_RLIMIT_CORE = 96,           /* TOK_RLIMIT_CORE  */
  YYSYMBOL_TOK_RLIMIT_RSS = 97,            /* TOK_RLIMIT_RSS  */
  YYSYMBOL_TOK_RLIMIT_NOFILE = 98,         /* TOK_RLIMIT_NOFILE  */
  YYSYMBOL_TOK_RLIMIT_OFILE = 99,          /* TOK_RLIMIT_OFILE  */
  YYSYMBOL_TOK_RLIMIT_AS = 100,            /* TOK_RLIMIT_AS  */
  YYSYMBOL_TOK_RLIMIT_NPROC = 101,         /* TOK_RLIMIT_NPROC  */
  YYSYMBOL_TOK_RLIMIT_MEMLOCK = 102,       /* TOK_RLIMIT_MEMLOCK  */
  YYSYMBOL_TOK_RLIMIT_LOCKS = 103,         /* TOK_RLIMIT_LOCKS  */
  YYSYMBOL_TOK_RLIMIT_SIGPENDING = 104,    /* TOK_RLIMIT_SIGPENDING  */
  YYSYMBOL_TOK_RLIMIT_MSGQUEUE = 105,      /* TOK_RLIMIT_MSGQUEUE  */
  YYSYMBOL_TOK_RLIMIT_NICE = 106,          /* TOK_RLIMIT_NICE  */
  YYSYMBOL_TOK_RLIMIT_RTPRIO = 107,        /* TOK_RLIMIT_RTPRIO  */
  YYSYMBOL_TOK_CAPABILITY = 108,           /* TOK_CAPABILITY  */
  YYSYMBOL_TOK_FLAGS = 109,                /* TOK_FLAGS  */
  YYSYMBOL_TOK_IDENTITIES = 110,           /* TOK_IDENTITIES  */
  YYSYMBOL_TOK_PLUS = 111,                 /* TOK_PLUS  */
  YYSYMBOL_YYACCEPT = 112,                 /* $accept  */
  YYSYMBOL_list = 113,                     /* list  */
  YYSYMBOL_114_1 = 114,                    /* $@1  */
  YYSYMBOL_profilelist = 115,              /* profilelist  */
  YYSYMBOL_opt_profile_flag = 116,         /* opt_profile_flag  */
  YYSYMBOL_opt_id = 117,                   /* opt_id  */
  YYSYMBOL_opt_id_or_var = 118,            /* opt_id_or_var  */
  YYSYMBOL_profile_base = 119,             /* profile_base  */
  YYSYMBOL_120_2 = 120,                    /* @2  */
  YYSYMBOL_profile = 121,                  /* profile  */
  YYSYMBOL_local_profile = 122,            /* local_profile  */
  YYSYMBOL_hat = 123,                      /* hat  */
  YYSYMBOL_preamble = 124,                 /* preamble  */
  YYSYMBOL_alias = 125,                    /* alias  */
  YYSYMBOL_assign_op = 126,                /* assign_op  */
  YYSYMBOL_varassign = 127,                /* varassign  */
  YYSYMBOL_valuelist = 128,                /* valuelist  */
  YYSYMBOL_flags = 129,                    /* flags  */
  YYSYMBOL_flagvals = 130,                 /* flagvals  */
  YYSYMBOL_flagval = 131,                  /* flagval  */
  YYSYMBOL_identities = 132,               /* identities  */
  YYSYMBOL_identity_item = 133,            /* identity_item  */
  YYSYMBOL_identitiesvals = 134,           /* identitiesvals  */
  YYSYMBOL_identitiesval = 135,            /* identitiesval  */
  YYSYMBOL_opt_subset_flag = 136,          /* opt_subset_flag  */
  YYSYMBOL_opt_priority = 137,             /* opt_priority  */
  YYSYMBOL_opt_audit_flag = 138,           /* opt_audit_flag  */
  YYSYMBOL_opt_owner_flag = 139,           /* opt_owner_flag  */
  YYSYMBOL_opt_rule_mode = 140,            /* opt_rule_mode  */
  YYSYMBOL_opt_prefix = 141,               /* opt_prefix  */
  YYSYMBOL_rules = 142,                    /* rules  */
  YYSYMBOL_block = 143,                    /* block  */
  YYSYMBOL_prefix_rule = 144,              /* prefix_rule  */
  YYSYMBOL_cond_rule = 145,                /* cond_rule  */
  YYSYMBOL_expr = 146,                     /* expr  */
  YYSYMBOL_term = 147,                     /* term  */
  YYSYMBOL_notfactor = 148,                /* notfactor  */
  YYSYMBOL_factor = 149,                   /* factor  */
  YYSYMBOL_id_or_var = 150,                /* id_or_var  */
  YYSYMBOL_opt_target = 151,               /* opt_target  */
  YYSYMBOL_opt_named_transition = 152,     /* opt_named_transition  */
  YYSYMBOL_rule = 153,                     /* rule  */
  YYSYMBOL_abi_rule = 154,                 /* abi_rule  */
  YYSYMBOL_opt_exec_mode = 155,            /* opt_exec_mode  */
  YYSYMBOL_opt_file = 156,                 /* opt_file  */
  YYSYMBOL_frule = 157,                    /* frule  */
  YYSYMBOL_file_rule = 158,                /* file_rule  */
  YYSYMBOL_file_rule_tail = 159,           /* file_rule_tail  */
  YYSYMBOL_link_rule = 160,                /* link_rule  */
  YYSYMBOL_network_rule = 161,             /* network_rule  */
  YYSYMBOL_cond = 162,                     /* cond  */
  YYSYMBOL_opt_conds = 163,                /* opt_conds  */
  YYSYMBOL_cond_list = 164,                /* cond_list  */
  YYSYMBOL_opt_cond_list = 165,            /* opt_cond_list  */
  YYSYMBOL_mnt_rule = 166,                 /* mnt_rule  */
  YYSYMBOL_dbus_perm = 167,                /* dbus_perm  */
  YYSYMBOL_dbus_perms = 168,               /* dbus_perms  */
  YYSYMBOL_opt_dbus_perm = 169,            /* opt_dbus_perm  */
  YYSYMBOL_dbus_rule = 170,                /* dbus_rule  */
  YYSYMBOL_net_perm = 171,                 /* net_perm  */
  YYSYMBOL_net_perms = 172,                /* net_perms  */
  YYSYMBOL_opt_net_perm = 173,             /* opt_net_perm  */
  YYSYMBOL_unix_rule = 174,                /* unix_rule  */
  YYSYMBOL_signal_perm = 175,              /* signal_perm  */
  YYSYMBOL_signal_perms = 176,             /* signal_perms  */
  YYSYMBOL_opt_signal_perm = 177,          /* opt_signal_perm  */
  YYSYMBOL_signal_rule = 178,              /* signal_rule  */
  YYSYMBOL_ptrace_perm = 179,              /* ptrace_perm  */
  YYSYMBOL_ptrace_perms = 180,             /* ptrace_perms  */
  YYSYMBOL_opt_ptrace_perm = 181,          /* opt_ptrace_perm  */
  YYSYMBOL_ptrace_rule = 182,              /* ptrace_rule  */
  YYSYMBOL_userns_perm = 183,              /* userns_perm  */
  YYSYMBOL_userns_perms = 184,             /* userns_perms  */
  YYSYMBOL_opt_userns_perm = 185,          /* opt_userns_perm  */
  YYSYMBOL_userns_rule = 186,              /* userns_rule  */
  YYSYMBOL_mqueue_perm = 187,              /* mqueue_perm  */
  YYSYMBOL_mqueue_perms = 188,             /* mqueue_perms  */
  YYSYMBOL_opt_mqueue_perm = 189,          /* opt_mqueue_perm  */
  YYSYMBOL_mqueue_rule = 190,              /* mqueue_rule  */
  YYSYMBOL_io_uring_perm = 191,            /* io_uring_perm  */
  YYSYMBOL_io_uring_perms = 192,           /* io_uring_perms  */
  YYSYMBOL_opt_io_uring_perm = 193,        /* opt_io_uring_perm  */
  YYSYMBOL_io_uring_rule = 194,            /* io_uring_rule  */
  YYSYMBOL_all_rule = 195,                 /* all_rule  */
  YYSYMBOL_hat_start = 196,                /* hat_start  */
  YYSYMBOL_file_perms = 197,               /* file_perms  */
  YYSYMBOL_change_profile = 198,           /* change_profile  */
  YYSYMBOL_capability = 199,               /* capability  */
  YYSYMBOL_caps = 200                      /* caps  */
};
typedef enum yysymbol_kind_t yysymbol_kind_t;




#ifdef short
# undef short
#endif

/* On compilers that do not define __PTRDIFF_MAX__ etc., make sure
   <limits.h> and (if available) <stdint.h> are included
   so that the code can choose integer types of a good width.  */

#ifndef __PTRDIFF_MAX__
# include <limits.h> /* INFRINGES ON USER NAME SPACE */
# if defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stdint.h> /* INFRINGES ON USER NAME SPACE */
#  define YY_STDINT_H
# endif
#endif

/* Narrow types that promote to a signed type and that can represent a
   signed or unsigned integer of at least N bits.  In tables they can
   save space and decrease cache pressure.  Promoting to a signed type
   helps avoid bugs in integer arithmetic.  */

#ifdef __INT_LEAST8_MAX__
typedef __INT_LEAST8_TYPE__ yytype_int8;
#elif defined YY_STDINT_H
typedef int_least8_t yytype_int8;
#else
typedef signed char yytype_int8;
#endif

#ifdef __INT_LEAST16_MAX__
typedef __INT_LEAST16_TYPE__ yytype_int16;
#elif defined YY_STDINT_H
typedef int_least16_t yytype_int16;
#else
typedef short yytype_int16;
#endif

/* Work around bug in HP-UX 11.23, which defines these macros
   incorrectly for preprocessor constants.  This workaround can likely
   be removed in 2023, as HPE has promised support for HP-UX 11.23
   (aka HP-UX 11i v2) only through the end of 2022; see Table 2 of
   <https://h20195.www2.hpe.com/V2/getpdf.aspx/4AA4-7673ENW.pdf>.  */
#ifdef __hpux
# undef UINT_LEAST8_MAX
# undef UINT_LEAST16_MAX
# define UINT_LEAST8_MAX 255
# define UINT_LEAST16_MAX 65535
#endif

#if defined __UINT_LEAST8_MAX__ && __UINT_LEAST8_MAX__ <= __INT_MAX__
typedef __UINT_LEAST8_TYPE__ yytype_uint8;
#elif (!defined __UINT_LEAST8_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST8_MAX <= INT_MAX)
typedef uint_least8_t yytype_uint8;
#elif !defined __UINT_LEAST8_MAX__ && UCHAR_MAX <= INT_MAX
typedef unsigned char yytype_uint8;
#else
typedef short yytype_uint8;
#endif

#if defined __UINT_LEAST16_MAX__ && __UINT_LEAST16_MAX__ <= __INT_MAX__
typedef __UINT_LEAST16_TYPE__ yytype_uint16;
#elif (!defined __UINT_LEAST16_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST16_MAX <= INT_MAX)
typedef uint_least16_t yytype_uint16;
#elif !defined __UINT_LEAST16_MAX__ && USHRT_MAX <= INT_MAX
typedef unsigned short yytype_uint16;
#else
typedef int yytype_uint16;
#endif

#ifndef YYPTRDIFF_T
# if defined __PTRDIFF_TYPE__ && defined __PTRDIFF_MAX__
#  define YYPTRDIFF_T __PTRDIFF_TYPE__
#  define YYPTRDIFF_MAXIMUM __PTRDIFF_MAX__
# elif defined PTRDIFF_MAX
#  ifndef ptrdiff_t
#   include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  endif
#  define YYPTRDIFF_T ptrdiff_t
#  define YYPTRDIFF_MAXIMUM PTRDIFF_MAX
# else
#  define YYPTRDIFF_T long
#  define YYPTRDIFF_MAXIMUM LONG_MAX
# endif
#endif

#ifndef YYSIZE_T
# ifdef __SIZE_TYPE__
#  define YYSIZE_T __SIZE_TYPE__
# elif defined size_t
#  define YYSIZE_T size_t
# elif defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  define YYSIZE_T size_t
# else
#  define YYSIZE_T unsigned
# endif
#endif

#define YYSIZE_MAXIMUM                                  \
  YY_CAST (YYPTRDIFF_T,                                 \
           (YYPTRDIFF_MAXIMUM < YY_CAST (YYSIZE_T, -1)  \
            ? YYPTRDIFF_MAXIMUM                         \
            : YY_CAST (YYSIZE_T, -1)))

#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X))


/* Stored state numbers (used for stacks). */
typedef yytype_int16 yy_state_t;

/* State numbers in computations.  */
typedef int yy_state_fast_t;

#ifndef YY_
# if defined YYENABLE_NLS && YYENABLE_NLS
#  if ENABLE_NLS
#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
#   define YY_(Msgid) dgettext ("bison-runtime", Msgid)
#  endif
# endif
# ifndef YY_
#  define YY_(Msgid) Msgid
# endif
#endif


#ifndef YY_ATTRIBUTE_PURE
# if defined __GNUC__ && 2 < __GNUC__ + (96 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_PURE __attribute__ ((__pure__))
# else
#  define YY_ATTRIBUTE_PURE
# endif
#endif

#ifndef YY_ATTRIBUTE_UNUSED
# if defined __GNUC__ && 2 < __GNUC__ + (7 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_UNUSED __attribute__ ((__unused__))
# else
#  define YY_ATTRIBUTE_UNUSED
# endif
#endif

/* Suppress unused-variable warnings by "using" E.  */
#if ! defined lint || defined __GNUC__
# define YY_USE(E) ((void) (E))
#else
# define YY_USE(E) /* empty */
#endif

/* Suppress an incorrect diagnostic about yylval being uninitialized.  */
#if defined __GNUC__ && ! defined __ICC && 406 <= __GNUC__ * 100 + __GNUC_MINOR__
# if __GNUC__ * 100 + __GNUC_MINOR__ < 407
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")
# else
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")              \
    _Pragma ("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
# endif
# define YY_IGNORE_MAYBE_UNINITIALIZED_END      \
    _Pragma ("GCC diagnostic pop")
#else
# define YY_INITIAL_VALUE(Value) Value
#endif
#ifndef YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_END
#endif
#ifndef YY_INITIAL_VALUE
# define YY_INITIAL_VALUE(Value) /* Nothing. */
#endif

#if defined __cplusplus && defined __GNUC__ && ! defined __ICC && 6 <= __GNUC__
# define YY_IGNORE_USELESS_CAST_BEGIN                          \
    _Pragma ("GCC diagnostic push")                            \
    _Pragma ("GCC diagnostic ignored \"-Wuseless-cast\"")
# define YY_IGNORE_USELESS_CAST_END            \
    _Pragma ("GCC diagnostic pop")
#endif
#ifndef YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_END
#endif


#define YY_ASSERT(E) ((void) (0 && (E)))

#if 1

/* The parser invokes alloca or malloc; define the necessary symbols.  */

# ifdef YYSTACK_USE_ALLOCA
#  if YYSTACK_USE_ALLOCA
#   ifdef __GNUC__
#    define YYSTACK_ALLOC __builtin_alloca
#   elif defined __BUILTIN_VA_ARG_INCR
#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
#   elif defined _AIX
#    define YYSTACK_ALLOC __alloca
#   elif defined _MSC_VER
#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
#    define alloca _alloca
#   else
#    define YYSTACK_ALLOC alloca
#    if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS
#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
      /* Use EXIT_SUCCESS as a witness for stdlib.h.  */
#     ifndef EXIT_SUCCESS
#      define EXIT_SUCCESS 0
#     endif
#    endif
#   endif
#  endif
# endif

# ifdef YYSTACK_ALLOC
   /* Pacify GCC's 'empty if-body' warning.  */
#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (0)
#  ifndef YYSTACK_ALLOC_MAXIMUM
    /* The OS might guarantee only one guard page at the bottom of the stack,
       and a page size can be as small as 4096 bytes.  So we cannot safely
       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
       to allow for a few compiler-allocated temporary stack slots.  */
#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
#  endif
# else
#  define YYSTACK_ALLOC YYMALLOC
#  define YYSTACK_FREE YYFREE
#  ifndef YYSTACK_ALLOC_MAXIMUM
#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
#  endif
#  if (defined __cplusplus && ! defined EXIT_SUCCESS \
       && ! ((defined YYMALLOC || defined malloc) \
             && (defined YYFREE || defined free)))
#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
#   ifndef EXIT_SUCCESS
#    define EXIT_SUCCESS 0
#   endif
#  endif
#  ifndef YYMALLOC
#   define YYMALLOC malloc
#   if ! defined malloc && ! defined EXIT_SUCCESS
void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
#  ifndef YYFREE
#   define YYFREE free
#   if ! defined free && ! defined EXIT_SUCCESS
void free (void *); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
# endif
#endif /* 1 */

#if (! defined yyoverflow \
     && (! defined __cplusplus \
         || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))

/* A type that is properly aligned for any stack member.  */
union yyalloc
{
  yy_state_t yyss_alloc;
  YYSTYPE yyvs_alloc;
};

/* The size of the maximum gap between one aligned stack and the next.  */
# define YYSTACK_GAP_MAXIMUM (YYSIZEOF (union yyalloc) - 1)

/* The size of an array large to enough to hold all stacks, each with
   N elements.  */
# define YYSTACK_BYTES(N) \
     ((N) * (YYSIZEOF (yy_state_t) + YYSIZEOF (YYSTYPE)) \
      + YYSTACK_GAP_MAXIMUM)

# define YYCOPY_NEEDED 1

/* Relocate STACK from its old location to the new one.  The
   local variables YYSIZE and YYSTACKSIZE give the old and new number of
   elements in the stack, and YYPTR gives the new location of the
   stack.  Advance YYPTR to a properly aligned location for the next
   stack.  */
# define YYSTACK_RELOCATE(Stack_alloc, Stack)                           \
    do                                                                  \
      {                                                                 \
        YYPTRDIFF_T yynewbytes;                                         \
        YYCOPY (&yyptr->Stack_alloc, Stack, yysize);                    \
        Stack = &yyptr->Stack_alloc;                                    \
        yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \
        yyptr += yynewbytes / YYSIZEOF (*yyptr);                        \
      }                                                                 \
    while (0)

#endif

#if defined YYCOPY_NEEDED && YYCOPY_NEEDED
/* Copy COUNT objects from SRC to DST.  The source and destination do
   not overlap.  */
# ifndef YYCOPY
#  if defined __GNUC__ && 1 < __GNUC__
#   define YYCOPY(Dst, Src, Count) \
      __builtin_memcpy (Dst, Src, YY_CAST (YYSIZE_T, (Count)) * sizeof (*(Src)))
#  else
#   define YYCOPY(Dst, Src, Count)              \
      do                                        \
        {                                       \
          YYPTRDIFF_T yyi;                      \
          for (yyi = 0; yyi < (Count); yyi++)   \
            (Dst)[yyi] = (Src)[yyi];            \
        }                                       \
      while (0)
#  endif
# endif
#endif /* !YYCOPY_NEEDED */

/* YYFINAL -- State number of the termination state.  */
#define YYFINAL  3
/* YYLAST -- Last index in YYTABLE.  */
#define YYLAST   443

/* YYNTOKENS -- Number of terminals.  */
#define YYNTOKENS  112
/* YYNNTS -- Number of nonterminals.  */
#define YYNNTS  89
/* YYNRULES -- Number of rules.  */
#define YYNRULES  250
/* YYNSTATES -- Number of states.  */
#define YYNSTATES  389

/* YYMAXUTOK -- Last valid token kind.  */
#define YYMAXUTOK   366


/* YYTRANSLATE(TOKEN-NUM) -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex, with out-of-bounds checking.  */
#define YYTRANSLATE(YYX)                                \
  (0 <= (YYX) && (YYX) <= YYMAXUTOK                     \
   ? YY_CAST (yysymbol_kind_t, yytranslate[YYX])        \
   : YYSYMBOL_YYUNDEF)

/* YYTRANSLATE[TOKEN-NUM] -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex.  */
static const yytype_int8 yytranslate[] =
{
       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
      35,    36,    37,    38,    39,    40,    41,    42,    43,    44,
      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
      85,    86,    87,    88,    89,    90,    91,    92,    93,    94,
      95,    96,    97,    98,    99,   100,   101,   102,   103,   104,
     105,   106,   107,   108,   109,   110,   111
};

#if YYDEBUG
/* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
static const yytype_int16 yyrline[] =
{
       0,   343,   343,   342,   370,   372,   378,   379,   380,   382,
     383,   385,   386,   389,   388,   457,   477,   487,   503,   504,
     505,   506,   508,   516,   517,   518,   519,   521,   547,   569,
     579,   590,   597,   602,   607,   614,   619,   628,   632,   642,
     647,   653,   658,   669,   670,   671,   674,   675,   690,   691,
     693,   694,   695,   697,   698,   699,   700,   702,   710,   719,
     721,   735,   740,   770,   792,   793,   794,   795,   796,   797,
     798,   799,   800,   802,   811,   831,   850,   859,   868,   874,
     973,   986,  1001,  1017,  1024,  1029,  1036,  1041,  1047,  1052,
    1060,  1068,  1076,  1081,  1090,  1099,  1108,  1117,  1126,  1135,
    1144,  1152,  1153,  1155,  1156,  1158,  1159,  1164,  1165,  1167,
    1173,  1180,  1181,  1182,  1184,  1185,  1187,  1200,  1218,  1229,
    1232,  1247,  1256,  1269,  1282,  1296,  1311,  1320,  1334,  1348,
    1358,  1367,  1376,  1377,  1383,  1389,  1390,  1392,  1397,  1402,
    1407,  1412,  1417,  1435,  1436,  1437,  1438,  1439,  1440,  1441,
    1447,  1448,  1449,  1451,  1452,  1453,  1455,  1471,  1505,  1506,
    1507,  1508,  1509,  1510,  1511,  1512,  1513,  1514,  1515,  1516,
    1517,  1518,  1519,  1525,  1526,  1527,  1529,  1530,  1531,  1533,
    1549,  1563,  1564,  1565,  1566,  1567,  1573,  1574,  1575,  1577,
    1578,  1579,  1581,  1587,  1605,  1606,  1607,  1608,  1609,  1610,
    1616,  1617,  1618,  1620,  1621,  1622,  1624,  1630,  1640,  1642,
    1643,  1644,  1646,  1647,  1648,  1650,  1656,  1680,  1681,  1682,
    1683,  1684,  1685,  1686,  1687,  1693,  1694,  1695,  1697,  1698,
    1699,  1701,  1706,  1712,  1724,  1725,  1727,  1728,  1729,  1731,
    1732,  1733,  1735,  1744,  1752,  1753,  1755,  1763,  1809,  1818,
    1819
};
#endif

/** Accessing symbol of state STATE.  */
#define YY_ACCESSING_SYMBOL(State) YY_CAST (yysymbol_kind_t, yystos[State])

#if 1
/* The user-facing name of the symbol whose (internal) number is
   YYSYMBOL.  No bounds checking.  */
static const char *yysymbol_name (yysymbol_kind_t yysymbol) YY_ATTRIBUTE_UNUSED;

/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
static const char *const yytname[] =
{
  "\"end of file\"", "error", "\"invalid token\"", "TOK_ID", "TOK_CONDID",
  "TOK_CONDLISTID", "TOK_CARET", "TOK_OPEN", "TOK_CLOSE", "TOK_MODE",
  "TOK_END_OF_RULE", "TOK_EQUALS", "TOK_ARROW", "TOK_ADD_ASSIGN",
  "TOK_COND_ASSIGN", "TOK_OVERRIDE_ASSIGN", "TOK_LE", "TOK_SET_VAR",
  "TOK_BOOL_VAR", "TOK_VALUE", "TOK_IF", "TOK_ELSE", "TOK_NOT",
  "TOK_DEFINED", "TOK_CHANGE_PROFILE", "TOK_NETWORK", "TOK_UNIX",
  "TOK_CREATE", "TOK_SHUTDOWN", "TOK_ACCEPT", "TOK_CONNECT", "TOK_LISTEN",
  "TOK_SETOPT", "TOK_GETOPT", "TOK_SETATTR", "TOK_GETATTR", "TOK_HAT",
  "TOK_UNSAFE", "TOK_SAFE", "TOK_COLON", "TOK_LINK", "TOK_OWNER",
  "TOK_OTHER", "TOK_SUBSET", "TOK_AUDIT", "TOK_DENY", "TOK_ALLOW",
  "TOK_PROMPT", "TOK_PROFILE", "TOK_SET", "TOK_ALIAS", "TOK_PTRACE",
  "TOK_OPENPAREN", "TOK_CLOSEPAREN", "TOK_COMMA", "TOK_FILE", "TOK_MOUNT",
  "TOK_REMOUNT", "TOK_UMOUNT", "TOK_PIVOTROOT", "TOK_IN", "TOK_DBUS",
  "TOK_SIGNAL", "TOK_SEND", "TOK_RECEIVE", "TOK_BIND", "TOK_READ",
  "TOK_WRITE", "TOK_EAVESDROP", "TOK_PEER", "TOK_TRACE", "TOK_TRACEDBY",
  "TOK_READBY", "TOK_ABI", "TOK_USERNS", "TOK_MQUEUE", "TOK_DELETE",
  "TOK_IO_URING", "TOK_OVERRIDE_CREDS", "TOK_SQPOLL", "TOK_ALL",
  "TOK_PRIORITY", "TOK_AND", "TOK_OR", "TOK_EQ_OP", "TOK_NE_OP",
  "TOK_IN_OP", "TOK_GT", "TOK_GE", "TOK_LT", "TOK_RLIMIT",
  "TOK_SOFT_RLIMIT", "TOK_RLIMIT_CPU", "TOK_RLIMIT_FSIZE",
  "TOK_RLIMIT_DATA", "TOK_RLIMIT_STACK", "TOK_RLIMIT_CORE",
  "TOK_RLIMIT_RSS", "TOK_RLIMIT_NOFILE", "TOK_RLIMIT_OFILE",
  "TOK_RLIMIT_AS", "TOK_RLIMIT_NPROC", "TOK_RLIMIT_MEMLOCK",
  "TOK_RLIMIT_LOCKS", "TOK_RLIMIT_SIGPENDING", "TOK_RLIMIT_MSGQUEUE",
  "TOK_RLIMIT_NICE", "TOK_RLIMIT_RTPRIO", "TOK_CAPABILITY", "TOK_FLAGS",
  "TOK_IDENTITIES", "TOK_PLUS", "$accept", "list", "$@1", "profilelist",
  "opt_profile_flag", "opt_id", "opt_id_or_var", "profile_base", "@2",
  "profile", "local_profile", "hat", "preamble", "alias", "assign_op",
  "varassign", "valuelist", "flags", "flagvals", "flagval", "identities",
  "identity_item", "identitiesvals", "identitiesval", "opt_subset_flag",
  "opt_priority", "opt_audit_flag", "opt_owner_flag", "opt_rule_mode",
  "opt_prefix", "rules", "block", "prefix_rule", "cond_rule", "expr",
  "term", "notfactor", "factor", "id_or_var", "opt_target",
  "opt_named_transition", "rule", "abi_rule", "opt_exec_mode", "opt_file",
  "frule", "file_rule", "file_rule_tail", "link_rule", "network_rule",
  "cond", "opt_conds", "cond_list", "opt_cond_list", "mnt_rule",
  "dbus_perm", "dbus_perms", "opt_dbus_perm", "dbus_rule", "net_perm",
  "net_perms", "opt_net_perm", "unix_rule", "signal_perm", "signal_perms",
  "opt_signal_perm", "signal_rule", "ptrace_perm", "ptrace_perms",
  "opt_ptrace_perm", "ptrace_rule", "userns_perm", "userns_perms",
  "opt_userns_perm", "userns_rule", "mqueue_perm", "mqueue_perms",
  "opt_mqueue_perm", "mqueue_rule", "io_uring_perm", "io_uring_perms",
  "opt_io_uring_perm", "io_uring_rule", "all_rule", "hat_start",
  "file_perms", "change_profile", "capability", "caps", YY_NULLPTR
};

static const char *
yysymbol_name (yysymbol_kind_t yysymbol)
{
  return yytname[yysymbol];
}
#endif

#define YYPACT_NINF (-331)

#define yypact_value_is_default(Yyn) \
  ((Yyn) == YYPACT_NINF)

#define YYTABLE_NINF (-7)

#define yytable_value_is_error(Yyn) \
  0

/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
   STATE-NUM.  */
static const yytype_int16 yypact[] =
{
    -331,    44,    34,  -331,   262,   262,   106,    36,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,   103,   219,   122,   147,
     165,   176,  -331,   166,  -331,  -331,  -331,   219,   184,   219,
     130,   157,  -331,  -331,     5,   240,  -331,  -331,  -331,  -331,
    -331,   275,  -331,  -331,  -331,  -331,  -331,  -331,    97,   219,
     219,    37,    37,    37,    37,    37,    37,    37,   283,    37,
    -331,  -331,   157,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,   293,  -331,   290,  -331,  -331,   258,    21,  -331,
     326,   301,   238,   357,    16,  -331,     3,  -331,   315,   361,
    -331,  -331,    22,  -331,  -331,  -331,  -331,   326,   330,  -331,
     102,   109,   331,    51,   359,    30,  -331,   103,  -331,   103,
     103,  -331,  -331,    99,  -331,  -331,   219,   275,   294,   368,
    -331,  -331,   348,     6,  -331,  -331,   275,   121,   150,   185,
    -331,  -331,    12,  -331,   392,   377,  -331,   297,  -331,   220,
     295,   295,   189,   144,   387,  -331,  -331,  -331,  -331,   188,
     354,   286,   110,    94,   388,  -331,  -331,  -331,  -331,   220,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,   378,   384,
    -331,  -331,  -331,  -331,   291,    39,  -331,  -331,   398,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,   399,  -331,  -331,
    -331,    37,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,   367,   367,   367,   367,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,   289,    26,  -331,   118,   385,  -331,  -331,  -331,  -331,
    -331,   391,   253,   402,   370,   370,   395,   117,   223,   284,
     400,   401,   396,   181,   370,   327,   285,   281,   305,    89,
     287,   139,   370,  -331,  -331,  -331,   403,  -331,   189,  -331,
    -331,   398,    37,   404,  -331,   322,  -331,  -331,   370,   405,
     406,    37,  -331,   159,  -331,  -331,  -331,  -331,  -331,  -331,
      37,   409,  -331,   200,  -331,   412,  -331,   302,  -331,  -331,
    -331,   201,  -331,  -331,  -331,   132,  -331,   413,  -331,  -331,
     116,  -331,   414,   257,    37,   415,  -331,  -331,  -331,   370,
     416,  -331,  -331,   417,  -331,   373,  -331,  -331,  -331,  -331,
    -331,  -331,  -331,  -331,  -331,  -331,  -331,   418,   391,  -331,
     419,  -331,  -331,   420,  -331,   421,  -331,  -331,  -331
};

/* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
   Performed when YYTABLE does not specify something else to do.  Zero
   means the default is an error.  */
static const yytype_uint8 yydefact[] =
{
      18,     0,     2,     1,     0,     0,     0,     0,     4,    19,
      20,    21,    23,    24,    25,    26,     0,     0,     0,     0,
       0,     3,    29,    27,   101,   102,    89,     0,     0,     0,
      28,    84,    86,    88,   100,     0,   109,   110,   244,   245,
       7,     0,     5,     8,    30,    87,    90,    91,     0,     0,
       0,     0,     0,     0,     0,     0,     0,     0,     0,    11,
      15,    92,    83,    85,    99,    93,    94,    95,    96,    97,
      98,    22,   135,    12,     0,   136,    37,     0,    31,   132,
       0,     0,     0,     0,     0,    36,     0,    35,     0,     0,
      38,    13,   126,   134,   133,    33,    34,     0,     0,    58,
       0,     0,     0,     0,     0,    46,   127,     0,   128,     0,
       0,    32,    42,     0,    41,    14,     0,     0,     0,     0,
      77,    76,    48,   114,    78,    59,     0,     0,     0,     0,
      39,    40,     0,    16,     0,     0,    49,    53,    58,   111,
     176,   176,    43,   203,   115,   132,   132,   132,   132,   153,
     189,   212,   228,   239,     0,   249,    62,    73,    60,   111,
     107,   108,    63,    64,    65,    68,    66,    67,    69,    70,
      71,    72,    74,    75,    17,   129,   131,   130,    80,     0,
      47,    55,    54,    56,    50,    46,   112,   113,     9,   172,
     157,   158,   163,   161,   162,   160,   167,   166,   165,   164,
     173,   168,   169,   159,   170,   171,   177,   132,   132,    45,
      44,     0,   199,   193,   200,   196,   197,   194,   195,   198,
     204,   132,   118,     9,     9,     9,     9,   149,   142,   150,
     144,   145,   143,   146,   147,   148,   154,   132,   185,   180,
     186,   181,   182,   183,   184,   190,   132,   207,   208,   209,
     213,   132,   218,   224,   216,   217,   221,   220,   225,   223,
     222,   219,   229,   132,   233,   236,   234,   235,   240,   132,
     243,     0,     0,   119,     0,     0,    51,    52,    57,    61,
      10,   105,     0,   132,   135,   135,     0,     0,     0,     0,
       0,     0,   103,     0,   135,     0,     0,     0,     0,     0,
       0,     0,   135,   250,   248,   246,     0,   120,    43,    81,
      82,     9,     0,     0,   178,     0,   174,   132,   135,     0,
       0,     0,   205,     0,   201,   206,   137,   132,   139,   140,
       0,     0,   155,     0,   151,     0,   191,     0,   187,   192,
     214,     0,   210,   215,   230,     0,   226,     0,   231,   241,
       0,   237,     0,   105,     0,     0,   106,   247,   175,   135,
       0,   123,   179,     0,   202,     0,   104,   141,   152,   156,
     188,   211,   227,   232,   238,   242,   121,     0,   105,    79,
       0,   124,   122,     0,   116,     0,   125,   138,   117
};

/* YYPGOTO[NTERM-NUM].  */
static const yytype_int16 yypgoto[] =
{
    -331,  -331,  -331,  -331,  -331,  -209,  -331,   133,  -331,  -331,
    -331,  -331,  -331,  -331,   408,  -331,   230,  -331,   312,   120,
    -331,  -331,  -331,   319,   125,  -331,  -331,  -331,  -331,  -331,
     296,  -125,  -331,   161,   -11,   389,    -1,  -331,   -51,  -331,
    -330,  -331,   434,   278,  -331,  -331,  -331,  -331,  -331,  -331,
    -331,  -136,  -331,  -260,  -331,  -233,  -331,  -331,  -331,  -151,
    -331,   298,  -331,  -189,  -331,  -331,  -331,  -246,  -331,  -331,
    -331,  -244,  -331,  -331,  -331,  -271,  -331,  -331,  -331,  -274,
    -331,  -331,  -331,  -331,   422,   134,  -331,  -331,  -331
};

/* YYDEFGOTO[NTERM-NUM].  */
static const yytype_int16 yydefgoto[] =
{
       0,     1,     8,    21,    41,   281,    72,    60,    99,    42,
     120,   121,     2,     9,    16,    10,    23,    83,    86,    87,
      78,    90,   113,   114,   211,   122,   137,   278,   184,   123,
     105,   156,   157,   124,    30,    31,    32,    33,    34,   331,
     313,   158,   125,   188,   159,   307,   160,   273,   161,   162,
      94,    84,    75,    76,   163,   236,   293,   237,   164,   206,
     282,   207,   165,   245,   295,   246,   166,   220,   287,   221,
     167,   250,   297,   251,   168,   262,   299,   263,   169,   268,
     301,   269,   170,   171,   126,   308,   172,   173,   271
};

/* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
   positive, shift that token.  If negative, reduce the rule whose
   number is the opposite.  If YYTABLE_NINF, syntax error.  */
static const yytype_int16 yytable[] =
{
      64,    65,    66,    67,    68,    69,    70,   178,    73,   223,
     224,   225,   226,   138,   289,   290,   291,   292,    48,   138,
      92,    51,    85,   377,   319,   320,    45,   351,   346,    24,
     139,   140,   141,   100,   335,   305,    38,   101,   115,    19,
      24,   324,   352,    25,     3,    38,   142,   279,   385,    63,
     116,     4,     5,   342,    25,    20,    95,   143,   360,   116,
     334,   144,   145,   146,   147,   148,    39,   149,   150,    93,
      85,   284,   285,    80,   372,    39,   374,   364,   117,   118,
     151,   152,   102,   153,     6,   288,   154,   117,   118,    52,
      53,    54,    55,    56,    57,    49,   252,   371,   253,   380,
     368,   294,   355,     7,   111,   132,   338,     7,   254,    18,
     296,   119,     7,   264,   155,   298,   255,   252,   112,   253,
     119,   106,    22,   256,   257,   138,   212,   300,   108,   254,
      81,   316,    82,   302,    35,   264,   213,   255,   116,   252,
      44,   253,   344,   345,   256,   257,   265,   318,   370,   309,
      61,   254,   130,   212,   107,   259,   260,    36,   264,   255,
     286,   109,   258,   213,   358,   261,   256,   257,   212,    44,
     322,   323,   266,   267,   175,    37,   259,   260,   213,    -6,
      49,   359,    38,   215,   216,    44,   261,   217,   218,   219,
     227,   365,   349,   350,   266,   267,   214,   227,   259,   260,
     228,    46,    47,   176,    44,   209,    96,   228,   261,   227,
     215,   216,    39,    49,   217,   218,   219,   266,   267,   228,
     247,   306,    24,    96,    40,   215,   216,    92,   248,   217,
     218,   219,   210,   325,   332,   333,    25,    26,   177,    50,
     229,    27,    28,    58,   230,   231,   232,   233,   234,   235,
     133,   230,   231,   232,   233,   234,   235,   186,   187,   174,
      24,   356,   189,   230,   231,   232,   233,   234,   235,   312,
     363,    29,   190,    12,    25,    13,    14,    15,    59,   366,
     191,   192,   193,   194,   195,   196,   197,   198,   199,    92,
     347,    92,   303,    71,   326,   339,   327,   348,    74,   304,
     247,    77,   376,   378,   189,   247,   314,   315,   248,    92,
      79,   238,    88,   248,   190,   343,   201,   202,   203,   204,
     205,   239,   191,   192,   193,   194,   195,   196,   197,   198,
     199,   189,   276,   277,   340,   341,   238,   127,   249,   128,
     129,   190,   181,   182,   183,    85,   239,   200,    89,   191,
     192,   193,   194,   195,   196,   197,   198,   199,   201,   202,
     203,   204,   205,   238,    91,   241,   242,    97,   243,   244,
     280,    92,    98,   239,    92,    74,   383,    92,   112,   135,
     336,   337,   104,   110,   134,   201,   202,   203,   204,   205,
     241,   242,   136,   243,   244,   179,   180,   222,   270,   274,
     275,   280,   283,   312,   311,   317,   240,   321,   330,   103,
     328,   329,   305,    17,   357,   361,   362,   241,   242,   367,
     243,   244,   369,   373,   375,   379,   381,   382,   384,   386,
     387,   388,   131,   354,   185,   310,    11,   272,    62,   208,
     353,     0,     0,    43
};

static const yytype_int16 yycheck[] =
{
      51,    52,    53,    54,    55,    56,    57,   132,    59,   145,
     146,   147,   148,     7,   223,   224,   225,   226,    29,     7,
       4,    16,    19,   353,   284,   285,    27,   301,   299,     3,
      24,    25,    26,    11,   294,     9,     6,    15,     8,     3,
       3,   287,   302,    17,     0,     6,    40,     8,   378,    50,
      20,    17,    18,   297,    17,    19,    53,    51,   318,    20,
     293,    55,    56,    57,    58,    59,    36,    61,    62,    53,
      19,   207,   208,    52,   345,    36,   350,   323,    48,    49,
      74,    75,    60,    77,    50,   221,    80,    48,    49,    84,
      85,    86,    87,    88,    89,    83,     7,   341,     9,   359,
     333,   237,   311,    73,    53,   116,   295,    73,    19,     3,
     246,    81,    73,    19,   108,   251,    27,     7,    19,     9,
      81,    19,    19,    34,    35,     7,     9,   263,    19,    19,
     109,   282,   111,   269,    12,    19,    19,    27,    20,     7,
      19,     9,    53,    54,    34,    35,    52,   283,   337,   274,
      53,    19,    53,     9,    52,    66,    67,    10,    19,    27,
     211,    52,    52,    19,   315,    76,    34,    35,     9,    19,
      53,    54,    78,    79,    53,    10,    66,    67,    19,     3,
      83,   317,     6,    66,    67,    19,    76,    70,    71,    72,
       9,   327,    53,    54,    78,    79,    52,     9,    66,    67,
      19,    17,    18,    53,    19,    16,    86,    19,    76,     9,
      66,    67,    36,    83,    70,    71,    72,    78,    79,    19,
      19,   272,     3,   103,    48,    66,    67,     4,    27,    70,
      71,    72,    43,    10,    53,    54,    17,    18,    53,    82,
      52,    22,    23,     3,    63,    64,    65,    66,    67,    68,
     117,    63,    64,    65,    66,    67,    68,    37,    38,   126,
       3,   312,     9,    63,    64,    65,    66,    67,    68,    12,
     321,    52,    19,    11,    17,    13,    14,    15,     3,   330,
      27,    28,    29,    30,    31,    32,    33,    34,    35,     4,
       3,     4,     3,    10,    10,    10,    12,    10,     5,    10,
      19,    11,   353,   354,     9,    19,    53,    54,    27,     4,
      52,     9,    11,    27,    19,    10,    63,    64,    65,    66,
      67,    19,    27,    28,    29,    30,    31,    32,    33,    34,
      35,     9,    41,    42,    53,    54,     9,   107,    52,   109,
     110,    19,    45,    46,    47,    19,    19,    52,   110,    27,
      28,    29,    30,    31,    32,    33,    34,    35,    63,    64,
      65,    66,    67,     9,     7,    63,    64,    52,    66,    67,
       3,     4,    11,    19,     4,     5,     3,     4,    19,    11,
      53,    54,    52,    52,    90,    63,    64,    65,    66,    67,
      63,    64,    44,    66,    67,     3,    19,    10,    10,    21,
      16,     3,     3,    12,    19,     3,    52,    12,    12,    97,
      10,    10,     9,     5,    10,    10,    10,    63,    64,    10,
      66,    67,    10,    10,    10,    10,    10,    10,    10,    10,
      10,    10,   113,   308,   138,   274,     2,   159,    49,   141,
     306,    -1,    -1,    21
};

/* YYSTOS[STATE-NUM] -- The symbol kind of the accessing symbol of
   state STATE-NUM.  */
static const yytype_uint8 yystos[] =
{
       0,   113,   124,     0,    17,    18,    50,    73,   114,   125,
     127,   154,    11,    13,    14,    15,   126,   126,     3,     3,
      19,   115,    19,   128,     3,    17,    18,    22,    23,    52,
     146,   147,   148,   149,   150,    12,    10,    10,     6,    36,
      48,   116,   121,   196,    19,   148,    17,    18,   146,    83,
      82,    16,    84,    85,    86,    87,    88,    89,     3,     3,
     119,    53,   147,   148,   150,   150,   150,   150,   150,   150,
     150,    10,   118,   150,     5,   164,   165,    11,   132,    52,
      52,   109,   111,   129,   163,    19,   130,   131,    11,   110,
     133,     7,     4,    53,   162,    53,   131,    52,    11,   120,
      11,    15,    60,   130,    52,   142,    19,    52,    19,    52,
      52,    53,    19,   134,   135,     8,    20,    48,    49,    81,
     122,   123,   137,   141,   145,   154,   196,   128,   128,   128,
      53,   135,   146,   119,    90,    11,    44,   138,     7,    24,
      25,    26,    40,    51,    55,    56,    57,    58,    59,    61,
      62,    74,    75,    77,    80,   108,   143,   144,   153,   156,
     158,   160,   161,   166,   170,   174,   178,   182,   186,   190,
     194,   195,   198,   199,   119,    53,    53,    53,   143,     3,
      19,    45,    46,    47,   140,   142,    37,    38,   155,     9,
      19,    27,    28,    29,    30,    31,    32,    33,    34,    35,
      52,    63,    64,    65,    66,    67,   171,   173,   173,    16,
      43,   136,     9,    19,    52,    66,    67,    70,    71,    72,
     179,   181,    10,   163,   163,   163,   163,     9,    19,    52,
      63,    64,    65,    66,    67,    68,   167,   169,     9,    19,
      52,    63,    64,    66,    67,   175,   177,    19,    27,    52,
     183,   185,     7,     9,    19,    27,    34,    35,    52,    66,
      67,    76,   187,   189,    19,    52,    78,    79,   191,   193,
      10,   200,   155,   159,    21,    16,    41,    42,   139,     8,
       3,   117,   172,     3,   163,   163,   150,   180,   163,   117,
     117,   117,   117,   168,   163,   176,   163,   184,   163,   188,
     163,   192,   163,     3,    10,     9,   150,   157,   197,   143,
     145,    19,    12,   152,    53,    54,   171,     3,   163,   165,
     165,    12,    53,    54,   179,    10,    10,    12,    10,    10,
      12,   151,    53,    54,   167,   165,    53,    54,   175,    10,
      53,    54,   183,    10,    53,    54,   187,     3,    10,    53,
      54,   191,   165,   197,   136,   117,   150,    10,   171,   163,
     165,    10,    10,   150,   179,   163,   150,    10,   167,    10,
     175,   183,   187,    10,   191,    10,   150,   152,   150,    10,
     165,    10,    10,     3,    10,   152,    10,    10,    10
};

/* YYR1[RULE-NUM] -- Symbol kind of the left-hand side of rule RULE-NUM.  */
static const yytype_uint8 yyr1[] =
{
       0,   112,   114,   113,   115,   115,   116,   116,   116,   117,
     117,   118,   118,   120,   119,   121,   122,   123,   124,   124,
     124,   124,   125,   126,   126,   126,   126,   127,   127,   128,
     128,   129,   129,   129,   130,   130,   131,   132,   132,   133,
     134,   134,   135,   136,   136,   136,   137,   137,   138,   138,
     139,   139,   139,   140,   140,   140,   140,   141,   142,   142,
     142,   143,   142,   142,   144,   144,   144,   144,   144,   144,
     144,   144,   144,   142,   142,   142,   142,   142,   142,   142,
     145,   145,   145,   146,   146,   147,   147,   148,   148,   149,
     149,   149,   149,   149,   149,   149,   149,   149,   149,   149,
     149,   150,   150,   151,   151,   152,   152,   153,   153,   154,
     154,   155,   155,   155,   156,   156,   157,   157,   158,   158,
     159,   159,   160,   161,   161,   161,   162,   162,   162,   162,
     162,   162,   163,   163,   164,   165,   165,   166,   166,   166,
     166,   166,   167,   167,   167,   167,   167,   167,   167,   167,
     168,   168,   168,   169,   169,   169,   170,   171,   171,   171,
     171,   171,   171,   171,   171,   171,   171,   171,   171,   171,
     171,   171,   171,   172,   172,   172,   173,   173,   173,   174,
     175,   175,   175,   175,   175,   175,   176,   176,   176,   177,
     177,   177,   178,   179,   179,   179,   179,   179,   179,   179,
     180,   180,   180,   181,   181,   181,   182,   183,   183,   184,
     184,   184,   185,   185,   185,   186,   187,   187,   187,   187,
     187,   187,   187,   187,   187,   188,   188,   188,   189,   189,
     189,   190,   190,   191,   191,   191,   192,   192,   192,   193,
     193,   193,   194,   195,   196,   196,   197,   198,   199,   200,
     200
};

/* YYR2[RULE-NUM] -- Number of symbols on the right-hand side of rule RULE-NUM.  */
static const yytype_int8 yyr2[] =
{
       0,     2,     0,     3,     0,     2,     0,     1,     1,     0,
       1,     0,     1,     0,     9,     2,     2,     2,     0,     2,
       2,     2,     5,     1,     1,     1,     1,     3,     3,     1,
       2,     0,     5,     3,     2,     1,     1,     0,     3,     5,
       2,     1,     1,     0,     1,     1,     0,     3,     0,     1,
       0,     1,     1,     0,     1,     1,     1,     4,     0,     2,
       3,     3,     3,     3,     1,     1,     1,     1,     1,     1,
       1,     1,     1,     3,     3,     3,     2,     2,     2,     8,
       3,     5,     5,     3,     1,     3,     1,     2,     1,     1,
       2,     2,     3,     3,     3,     3,     3,     3,     3,     3,
       1,     1,     1,     0,     2,     0,     2,     1,     1,     3,
       3,     0,     1,     1,     0,     1,     4,     5,     2,     2,
       2,     4,     6,     5,     6,     7,     1,     3,     3,     5,
       5,     5,     0,     2,     5,     0,     1,     4,     7,     4,
       4,     5,     1,     1,     1,     1,     1,     1,     1,     1,
       0,     2,     3,     0,     1,     3,     5,     1,     1,     1,
       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
       1,     1,     1,     0,     2,     3,     0,     1,     3,     5,
       1,     1,     1,     1,     1,     1,     0,     2,     3,     0,
       1,     3,     4,     1,     1,     1,     1,     1,     1,     1,
       0,     2,     3,     0,     1,     3,     4,     1,     1,     0,
       2,     3,     0,     1,     3,     4,     1,     1,     1,     1,
       1,     1,     1,     1,     1,     0,     2,     3,     0,     1,
       3,     4,     5,     1,     1,     1,     0,     2,     3,     0,
       1,     3,     5,     2,     1,     1,     1,     5,     3,     0,
       2
};


enum { YYENOMEM = -2 };

#define yyerrok         (yyerrstatus = 0)
#define yyclearin       (yychar = YYEMPTY)

#define YYACCEPT        goto yyacceptlab
#define YYABORT         goto yyabortlab
#define YYERROR         goto yyerrorlab
#define YYNOMEM         goto yyexhaustedlab


#define YYRECOVERING()  (!!yyerrstatus)

#define YYBACKUP(Token, Value)                                    \
  do                                                              \
    if (yychar == YYEMPTY)                                        \
      {                                                           \
        yychar = (Token);                                         \
        yylval = (Value);                                         \
        YYPOPSTACK (yylen);                                       \
        yystate = *yyssp;                                         \
        goto yybackup;                                            \
      }                                                           \
    else                                                          \
      {                                                           \
        yyerror (YY_("syntax error: cannot back up")); \
        YYERROR;                                                  \
      }                                                           \
  while (0)

/* Backward compatibility with an undocumented macro.
   Use YYerror or YYUNDEF. */
#define YYERRCODE YYUNDEF


/* Enable debugging if requested.  */
#if YYDEBUG

# ifndef YYFPRINTF
#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
#  define YYFPRINTF fprintf
# endif

# define YYDPRINTF(Args)                        \
do {                                            \
  if (yydebug)                                  \
    YYFPRINTF Args;                             \
} while (0)




# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)                    \
do {                                                                      \
  if (yydebug)                                                            \
    {                                                                     \
      YYFPRINTF (stderr, "%s ", Title);                                   \
      yy_symbol_print (stderr,                                            \
                  Kind, Value); \
      YYFPRINTF (stderr, "\n");                                           \
    }                                                                     \
} while (0)


/*-----------------------------------.
| Print this symbol's value on YYO.  |
`-----------------------------------*/

static void
yy_symbol_value_print (FILE *yyo,
                       yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  FILE *yyoutput = yyo;
  YY_USE (yyoutput);
  if (!yyvaluep)
    return;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/*---------------------------.
| Print this symbol on YYO.  |
`---------------------------*/

static void
yy_symbol_print (FILE *yyo,
                 yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  YYFPRINTF (yyo, "%s %s (",
             yykind < YYNTOKENS ? "token" : "nterm", yysymbol_name (yykind));

  yy_symbol_value_print (yyo, yykind, yyvaluep);
  YYFPRINTF (yyo, ")");
}

/*------------------------------------------------------------------.
| yy_stack_print -- Print the state stack from its BOTTOM up to its |
| TOP (included).                                                   |
`------------------------------------------------------------------*/

static void
yy_stack_print (yy_state_t *yybottom, yy_state_t *yytop)
{
  YYFPRINTF (stderr, "Stack now");
  for (; yybottom <= yytop; yybottom++)
    {
      int yybot = *yybottom;
      YYFPRINTF (stderr, " %d", yybot);
    }
  YYFPRINTF (stderr, "\n");
}

# define YY_STACK_PRINT(Bottom, Top)                            \
do {                                                            \
  if (yydebug)                                                  \
    yy_stack_print ((Bottom), (Top));                           \
} while (0)


/*------------------------------------------------.
| Report that the YYRULE is going to be reduced.  |
`------------------------------------------------*/

static void
yy_reduce_print (yy_state_t *yyssp, YYSTYPE *yyvsp,
                 int yyrule)
{
  int yylno = yyrline[yyrule];
  int yynrhs = yyr2[yyrule];
  int yyi;
  YYFPRINTF (stderr, "Reducing stack by rule %d (line %d):\n",
             yyrule - 1, yylno);
  /* The symbols being reduced.  */
  for (yyi = 0; yyi < yynrhs; yyi++)
    {
      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
      yy_symbol_print (stderr,
                       YY_ACCESSING_SYMBOL (+yyssp[yyi + 1 - yynrhs]),
                       &yyvsp[(yyi + 1) - (yynrhs)]);
      YYFPRINTF (stderr, "\n");
    }
}

# define YY_REDUCE_PRINT(Rule)          \
do {                                    \
  if (yydebug)                          \
    yy_reduce_print (yyssp, yyvsp, Rule); \
} while (0)

/* Nonzero means print parse trace.  It is left uninitialized so that
   multiple parsers can coexist.  */
int yydebug;
#else /* !YYDEBUG */
# define YYDPRINTF(Args) ((void) 0)
# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)
# define YY_STACK_PRINT(Bottom, Top)
# define YY_REDUCE_PRINT(Rule)
#endif /* !YYDEBUG */


/* YYINITDEPTH -- initial size of the parser's stacks.  */
#ifndef YYINITDEPTH
# define YYINITDEPTH 200
#endif

/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
   if the built-in stack extension method is used).

   Do not make this value too large; the results are undefined if
   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
   evaluated with infinite-precision integer arithmetic.  */

#ifndef YYMAXDEPTH
# define YYMAXDEPTH 10000
#endif


/* Context of a parse error.  */
typedef struct
{
  yy_state_t *yyssp;
  yysymbol_kind_t yytoken;
} yypcontext_t;

/* Put in YYARG at most YYARGN of the expected tokens given the
   current YYCTX, and return the number of tokens stored in YYARG.  If
   YYARG is null, return the number of expected tokens (guaranteed to
   be less than YYNTOKENS).  Return YYENOMEM on memory exhaustion.
   Return 0 if there are more than YYARGN expected tokens, yet fill
   YYARG up to YYARGN. */
static int
yypcontext_expected_tokens (const yypcontext_t *yyctx,
                            yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  int yyn = yypact[+*yyctx->yyssp];
  if (!yypact_value_is_default (yyn))
    {
      /* Start YYX at -YYN if negative to avoid negative indexes in
         YYCHECK.  In other words, skip the first -YYN actions for
         this state because they are default actions.  */
      int yyxbegin = yyn < 0 ? -yyn : 0;
      /* Stay within bounds of both yycheck and yytname.  */
      int yychecklim = YYLAST - yyn + 1;
      int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
      int yyx;
      for (yyx = yyxbegin; yyx < yyxend; ++yyx)
        if (yycheck[yyx + yyn] == yyx && yyx != YYSYMBOL_YYerror
            && !yytable_value_is_error (yytable[yyx + yyn]))
          {
            if (!yyarg)
              ++yycount;
            else if (yycount == yyargn)
              return 0;
            else
              yyarg[yycount++] = YY_CAST (yysymbol_kind_t, yyx);
          }
    }
  if (yyarg && yycount == 0 && 0 < yyargn)
    yyarg[0] = YYSYMBOL_YYEMPTY;
  return yycount;
}




#ifndef yystrlen
# if defined __GLIBC__ && defined _STRING_H
#  define yystrlen(S) (YY_CAST (YYPTRDIFF_T, strlen (S)))
# else
/* Return the length of YYSTR.  */
static YYPTRDIFF_T
yystrlen (const char *yystr)
{
  YYPTRDIFF_T yylen;
  for (yylen = 0; yystr[yylen]; yylen++)
    continue;
  return yylen;
}
# endif
#endif

#ifndef yystpcpy
# if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
#  define yystpcpy stpcpy
# else
/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
   YYDEST.  */
static char *
yystpcpy (char *yydest, const char *yysrc)
{
  char *yyd = yydest;
  const char *yys = yysrc;

  while ((*yyd++ = *yys++) != '\0')
    continue;

  return yyd - 1;
}
# endif
#endif

#ifndef yytnamerr
/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
   quotes and backslashes, so that it's suitable for yyerror.  The
   heuristic is that double-quoting is unnecessary unless the string
   contains an apostrophe, a comma, or backslash (other than
   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
   null, do not copy; instead, return the length of what the result
   would have been.  */
static YYPTRDIFF_T
yytnamerr (char *yyres, const char *yystr)
{
  if (*yystr == '"')
    {
      YYPTRDIFF_T yyn = 0;
      char const *yyp = yystr;
      for (;;)
        switch (*++yyp)
          {
          case '\'':
          case ',':
            goto do_not_strip_quotes;

          case '\\':
            if (*++yyp != '\\')
              goto do_not_strip_quotes;
            else
              goto append;

          append:
          default:
            if (yyres)
              yyres[yyn] = *yyp;
            yyn++;
            break;

          case '"':
            if (yyres)
              yyres[yyn] = '\0';
            return yyn;
          }
    do_not_strip_quotes: ;
    }

  if (yyres)
    return yystpcpy (yyres, yystr) - yyres;
  else
    return yystrlen (yystr);
}
#endif


static int
yy_syntax_error_arguments (const yypcontext_t *yyctx,
                           yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  /* There are many possibilities here to consider:
     - If this state is a consistent state with a default action, then
       the only way this function was invoked is if the default action
       is an error action.  In that case, don't check for expected
       tokens because there are none.
     - The only way there can be no lookahead present (in yychar) is if
       this state is a consistent state with a default action.  Thus,
       detecting the absence of a lookahead is sufficient to determine
       that there is no unexpected or expected token to report.  In that
       case, just report a simple "syntax error".
     - Don't assume there isn't a lookahead just because this state is a
       consistent state with a default action.  There might have been a
       previous inconsistent state, consistent state with a non-default
       action, or user semantic action that manipulated yychar.
     - Of course, the expected token list depends on states to have
       correct lookahead information, and it depends on the parser not
       to perform extra reductions after fetching a lookahead from the
       scanner and before detecting a syntax error.  Thus, state merging
       (from LALR or IELR) and default reductions corrupt the expected
       token list.  However, the list is correct for canonical LR with
       one exception: it will still contain any token that will not be
       accepted due to an error action in a later state.
  */
  if (yyctx->yytoken != YYSYMBOL_YYEMPTY)
    {
      int yyn;
      if (yyarg)
        yyarg[yycount] = yyctx->yytoken;
      ++yycount;
      yyn = yypcontext_expected_tokens (yyctx,
                                        yyarg ? yyarg + 1 : yyarg, yyargn - 1);
      if (yyn == YYENOMEM)
        return YYENOMEM;
      else
        yycount += yyn;
    }
  return yycount;
}

/* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message
   about the unexpected token YYTOKEN for the state stack whose top is
   YYSSP.

   Return 0 if *YYMSG was successfully written.  Return -1 if *YYMSG is
   not large enough to hold the message.  In that case, also set
   *YYMSG_ALLOC to the required number of bytes.  Return YYENOMEM if the
   required number of bytes is too large to store.  */
static int
yysyntax_error (YYPTRDIFF_T *yymsg_alloc, char **yymsg,
                const yypcontext_t *yyctx)
{
  enum { YYARGS_MAX = 5 };
  /* Internationalized format string. */
  const char *yyformat = YY_NULLPTR;
  /* Arguments of yyformat: reported tokens (one for the "unexpected",
     one per "expected"). */
  yysymbol_kind_t yyarg[YYARGS_MAX];
  /* Cumulated lengths of YYARG.  */
  YYPTRDIFF_T yysize = 0;

  /* Actual size of YYARG. */
  int yycount = yy_syntax_error_arguments (yyctx, yyarg, YYARGS_MAX);
  if (yycount == YYENOMEM)
    return YYENOMEM;

  switch (yycount)
    {
#define YYCASE_(N, S)                       \
      case N:                               \
        yyformat = S;                       \
        break
    default: /* Avoid compiler warnings. */
      YYCASE_(0, YY_("syntax error"));
      YYCASE_(1, YY_("syntax error, unexpected %s"));
      YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
      YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s"));
      YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s"));
      YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s"));
#undef YYCASE_
    }

  /* Compute error message size.  Don't count the "%s"s, but reserve
     room for the terminator.  */
  yysize = yystrlen (yyformat) - 2 * yycount + 1;
  {
    int yyi;
    for (yyi = 0; yyi < yycount; ++yyi)
      {
        YYPTRDIFF_T yysize1
          = yysize + yytnamerr (YY_NULLPTR, yytname[yyarg[yyi]]);
        if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
          yysize = yysize1;
        else
          return YYENOMEM;
      }
  }

  if (*yymsg_alloc < yysize)
    {
      *yymsg_alloc = 2 * yysize;
      if (! (yysize <= *yymsg_alloc
             && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
        *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
      return -1;
    }

  /* Avoid sprintf, as that infringes on the user's name space.
     Don't have undefined behavior even if the translation
     produced a string with the wrong number of "%s"s.  */
  {
    char *yyp = *yymsg;
    int yyi = 0;
    while ((*yyp = *yyformat) != '\0')
      if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount)
        {
          yyp += yytnamerr (yyp, yytname[yyarg[yyi++]]);
          yyformat += 2;
        }
      else
        {
          ++yyp;
          ++yyformat;
        }
  }
  return 0;
}


/*-----------------------------------------------.
| Release the memory associated to this symbol.  |
`-----------------------------------------------*/

static void
yydestruct (const char *yymsg,
            yysymbol_kind_t yykind, YYSTYPE *yyvaluep)
{
  YY_USE (yyvaluep);
  if (!yymsg)
    yymsg = "Deleting";
  YY_SYMBOL_PRINT (yymsg, yykind, yyvaluep, yylocationp);

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/* Lookahead token kind.  */
int yychar;

/* The semantic value of the lookahead symbol.  */
YYSTYPE yylval;
/* Number of syntax errors so far.  */
int yynerrs;




/*----------.
| yyparse.  |
`----------*/

int
yyparse (void)
{
    yy_state_fast_t yystate = 0;
    /* Number of tokens to shift before error messages enabled.  */
    int yyerrstatus = 0;

    /* Refer to the stacks through separate pointers, to allow yyoverflow
       to reallocate them elsewhere.  */

    /* Their size.  */
    YYPTRDIFF_T yystacksize = YYINITDEPTH;

    /* The state stack: array, bottom, top.  */
    yy_state_t yyssa[YYINITDEPTH];
    yy_state_t *yyss = yyssa;
    yy_state_t *yyssp = yyss;

    /* The semantic value stack: array, bottom, top.  */
    YYSTYPE yyvsa[YYINITDEPTH];
    YYSTYPE *yyvs = yyvsa;
    YYSTYPE *yyvsp = yyvs;

  int yyn;
  /* The return value of yyparse.  */
  int yyresult;
  /* Lookahead symbol kind.  */
  yysymbol_kind_t yytoken = YYSYMBOL_YYEMPTY;
  /* The variables used to return semantic value and location from the
     action routines.  */
  YYSTYPE yyval;

  /* Buffer for error messages, and its allocated size.  */
  char yymsgbuf[128];
  char *yymsg = yymsgbuf;
  YYPTRDIFF_T yymsg_alloc = sizeof yymsgbuf;

#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))

  /* The number of symbols on the RHS of the reduced rule.
     Keep to zero when no symbol should be popped.  */
  int yylen = 0;

  YYDPRINTF ((stderr, "Starting parse\n"));

  yychar = YYEMPTY; /* Cause a token to be read.  */

  goto yysetstate;


/*------------------------------------------------------------.
| yynewstate -- push a new state, which is found in yystate.  |
`------------------------------------------------------------*/
yynewstate:
  /* In all cases, when you get here, the value and location stacks
     have just been pushed.  So pushing a state here evens the stacks.  */
  yyssp++;


/*--------------------------------------------------------------------.
| yysetstate -- set current state (the top of the stack) to yystate.  |
`--------------------------------------------------------------------*/
yysetstate:
  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
  YY_ASSERT (0 <= yystate && yystate < YYNSTATES);
  YY_IGNORE_USELESS_CAST_BEGIN
  *yyssp = YY_CAST (yy_state_t, yystate);
  YY_IGNORE_USELESS_CAST_END
  YY_STACK_PRINT (yyss, yyssp);

  if (yyss + yystacksize - 1 <= yyssp)
#if !defined yyoverflow && !defined YYSTACK_RELOCATE
    YYNOMEM;
#else
    {
      /* Get the current used size of the three stacks, in elements.  */
      YYPTRDIFF_T yysize = yyssp - yyss + 1;

# if defined yyoverflow
      {
        /* Give user a chance to reallocate the stack.  Use copies of
           these so that the &'s don't force the real ones into
           memory.  */
        yy_state_t *yyss1 = yyss;
        YYSTYPE *yyvs1 = yyvs;

        /* Each stack pointer address is followed by the size of the
           data in use in that stack, in bytes.  This used to be a
           conditional around just the two extra args, but that might
           be undefined if yyoverflow is a macro.  */
        yyoverflow (YY_("memory exhausted"),
                    &yyss1, yysize * YYSIZEOF (*yyssp),
                    &yyvs1, yysize * YYSIZEOF (*yyvsp),
                    &yystacksize);
        yyss = yyss1;
        yyvs = yyvs1;
      }
# else /* defined YYSTACK_RELOCATE */
      /* Extend the stack our own way.  */
      if (YYMAXDEPTH <= yystacksize)
        YYNOMEM;
      yystacksize *= 2;
      if (YYMAXDEPTH < yystacksize)
        yystacksize = YYMAXDEPTH;

      {
        yy_state_t *yyss1 = yyss;
        union yyalloc *yyptr =
          YY_CAST (union yyalloc *,
                   YYSTACK_ALLOC (YY_CAST (YYSIZE_T, YYSTACK_BYTES (yystacksize))));
        if (! yyptr)
          YYNOMEM;
        YYSTACK_RELOCATE (yyss_alloc, yyss);
        YYSTACK_RELOCATE (yyvs_alloc, yyvs);
#  undef YYSTACK_RELOCATE
        if (yyss1 != yyssa)
          YYSTACK_FREE (yyss1);
      }
# endif

      yyssp = yyss + yysize - 1;
      yyvsp = yyvs + yysize - 1;

      YY_IGNORE_USELESS_CAST_BEGIN
      YYDPRINTF ((stderr, "Stack size increased to %ld\n",
                  YY_CAST (long, yystacksize)));
      YY_IGNORE_USELESS_CAST_END

      if (yyss + yystacksize - 1 <= yyssp)
        YYABORT;
    }
#endif /* !defined yyoverflow && !defined YYSTACK_RELOCATE */


  if (yystate == YYFINAL)
    YYACCEPT;

  goto yybackup;


/*-----------.
| yybackup.  |
`-----------*/
yybackup:
  /* Do appropriate processing given the current state.  Read a
     lookahead token if we need one and don't already have one.  */

  /* First try to decide what to do without reference to lookahead token.  */
  yyn = yypact[yystate];
  if (yypact_value_is_default (yyn))
    goto yydefault;

  /* Not known => get a lookahead token if don't already have one.  */

  /* YYCHAR is either empty, or end-of-input, or a valid lookahead.  */
  if (yychar == YYEMPTY)
    {
      YYDPRINTF ((stderr, "Reading a token\n"));
      yychar = yylex ();
    }

  if (yychar <= YYEOF)
    {
      yychar = YYEOF;
      yytoken = YYSYMBOL_YYEOF;
      YYDPRINTF ((stderr, "Now at end of input.\n"));
    }
  else if (yychar == YYerror)
    {
      /* The scanner already issued an error message, process directly
         to error recovery.  But do not keep the error token as
         lookahead, it is too special and may lead us to an endless
         loop in error recovery. */
      yychar = YYUNDEF;
      yytoken = YYSYMBOL_YYerror;
      goto yyerrlab1;
    }
  else
    {
      yytoken = YYTRANSLATE (yychar);
      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
    }

  /* If the proper action on seeing token YYTOKEN is to reduce or to
     detect an error, take that action.  */
  yyn += yytoken;
  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
    goto yydefault;
  yyn = yytable[yyn];
  if (yyn <= 0)
    {
      if (yytable_value_is_error (yyn))
        goto yyerrlab;
      yyn = -yyn;
      goto yyreduce;
    }

  /* Count tokens shifted since error; after three, turn off error
     status.  */
  if (yyerrstatus)
    yyerrstatus--;

  /* Shift the lookahead token.  */
  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
  yystate = yyn;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END

  /* Discard the shifted token.  */
  yychar = YYEMPTY;
  goto yynewstate;


/*-----------------------------------------------------------.
| yydefault -- do the default action for the current state.  |
`-----------------------------------------------------------*/
yydefault:
  yyn = yydefact[yystate];
  if (yyn == 0)
    goto yyerrlab;
  goto yyreduce;


/*-----------------------------.
| yyreduce -- do a reduction.  |
`-----------------------------*/
yyreduce:
  /* yyn is the number of a rule to reduce with.  */
  yylen = yyr2[yyn];

  /* If YYLEN is nonzero, implement the default value of the action:
     '$$ = $1'.

     Otherwise, the following line sets YYVAL to garbage.
     This behavior is undocumented and Bison
     users should not rely upon it.  Assigning to YYVAL
     unconditionally makes the parser a bit smaller, and it avoids a
     GCC warning that YYVAL may be used uninitialized.  */
  yyval = yyvsp[1-yylen];


  YY_REDUCE_PRINT (yyn);
  switch (yyn)
    {
  case 2: /* $@1: %empty  */
#line 343 "parser_yacc.y"
        {
		/* make sure abi is setup */
		if (override_features) {
			if (policy_features)
				aa_features_unref(policy_features);
			policy_features = aa_features_ref(override_features);
		} else if (policy_features == NULL) {
			if (pinned_features) {
				policy_features = aa_features_ref(pinned_features);
			/* use default feature abi */
			} else {
				if (aa_features_new_from_string(&policy_features,
								default_features_abi,
								strlen(default_features_abi))) {
					yyerror(_("Failed to setup default policy feature abi"));
				}
				pwarn(WARN_ABI, _("%s: File '%s' missing feature abi, falling back to default policy feature abi\n"), progname, current_filename);
			}
		}
		if (!add_cap_feature_mask(policy_features,
					  CAPFLAG_POLICY_FEATURE))
			yyerror(_("Failed to add policy capabilities to known capabilities set"));
		set_supported_features();

	}
#line 1961 "parser_yacc.c"
    break;

  case 4: /* profilelist: %empty  */
#line 370 "parser_yacc.y"
                { /* nothing */ }
#line 1967 "parser_yacc.c"
    break;

  case 5: /* profilelist: profilelist profile  */
#line 373 "parser_yacc.y"
        {
		PDEBUG("Matched: list profile\n");
		add_to_list((yyvsp[0].prof));
	}
#line 1976 "parser_yacc.c"
    break;

  case 6: /* opt_profile_flag: %empty  */
#line 378 "parser_yacc.y"
                  { /* nothing */ (yyval.integer) = 0; }
#line 1982 "parser_yacc.c"
    break;

  case 7: /* opt_profile_flag: TOK_PROFILE  */
#line 379 "parser_yacc.y"
                      { (yyval.integer) = 1; }
#line 1988 "parser_yacc.c"
    break;

  case 8: /* opt_profile_flag: hat_start  */
#line 380 "parser_yacc.y"
                    { (yyval.integer) = 2; }
#line 1994 "parser_yacc.c"
    break;

  case 9: /* opt_id: %empty  */
#line 382 "parser_yacc.y"
        { /* nothing */ (yyval.id) = NULL; }
#line 2000 "parser_yacc.c"
    break;

  case 10: /* opt_id: TOK_ID  */
#line 383 "parser_yacc.y"
                 { (yyval.id) = (yyvsp[0].id); }
#line 2006 "parser_yacc.c"
    break;

  case 11: /* opt_id_or_var: %empty  */
#line 385 "parser_yacc.y"
               { /* nothing */ (yyval.id) = NULL; }
#line 2012 "parser_yacc.c"
    break;

  case 12: /* opt_id_or_var: id_or_var  */
#line 386 "parser_yacc.y"
                    { (yyval.id) = (yyvsp[0].id); }
#line 2018 "parser_yacc.c"
    break;

  case 13: /* @2: %empty  */
#line 389 "parser_yacc.y"
        {
		/* mid rule action
		 * save current cache, restore at end of block
		 */
		(yyval.includecache) = g_includecache;
		g_includecache = new IncludeCache_t();
	}
#line 2030 "parser_yacc.c"
    break;

  case 14: /* profile_base: TOK_ID opt_id_or_var opt_cond_list identities flags TOK_OPEN @2 rules TOK_CLOSE  */
#line 397 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[-1].prof);
		bool self_stack = false;

		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		parse_label(&self_stack, &prof->ns, &prof->name, (yyvsp[-8].id), true);
		free((yyvsp[-8].id));

		if (self_stack) {
			yyerror(_("Profile names must begin with a '/' or a namespace"));
		}

		/* Honor the --namespace-string command line option */
		if (profile_ns) {
			/**
			 * Print warning if the profile specified a namespace
			 * different than the one specified with the
			 * --namespace-string command line option
			 */
			if (prof->ns && strcmp(prof->ns, profile_ns))
				pwarn(WARN_OVERRIDE, "%s: -n %s overriding policy specified namespace :%s:\n",
				      progname, profile_ns, prof->ns);

			free(prof->ns);
			prof->ns = strdup(profile_ns);
			if (!prof->ns)
				yyerror(_("Memory allocation error."));
		}

		prof->attachment = (yyvsp[-7].id);
		if ((yyvsp[-7].id) && !((yyvsp[-7].id)[0] == '/' || strncmp((yyvsp[-7].id), "@{", 2) == 0))
			yyerror(_("Profile attachment must begin with a '/' or variable."));
		if ((yyvsp[-6].cond_entry_list).name) {
			if (strcmp((yyvsp[-6].cond_entry_list).name, "xattrs") != 0)
				yyerror(_("profile id: invalid conditional group %s=()"), (yyvsp[-6].cond_entry_list).name);
			free ((yyvsp[-6].cond_entry_list).name);
			(yyvsp[-6].cond_entry_list).name = NULL;
			prof->xattrs = (yyvsp[-6].cond_entry_list);
		}
		prof->identities = (yyvsp[-5].identities);
		prof->flags = (yyvsp[-4].flags);
		if (force_complain && kernel_abi_version == 5)
			/* newer abis encode force complain as part of the
			 * header
			 */
			prof->flags.mode = MODE_COMPLAIN;

		prof->post_parse_profile();
		prof->flags.debug(cerr);

		/* restore previous blocks include cache */
		delete g_includecache;
		g_includecache = (yyvsp[-2].includecache);
		(yyval.prof) = prof;

	}
#line 2094 "parser_yacc.c"
    break;

  case 15: /* profile: opt_profile_flag profile_base  */
#line 458 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof)->ns)
			PDEBUG("Matched: :%s://%s { ... }\n", (yyvsp[0].prof)->ns, (yyvsp[0].prof)->name);
		else
			PDEBUG("Matched: %s { ... }\n", (yyvsp[0].prof)->name);

		if ((yyvsp[0].prof)->name[0] == '/')
			pwarn(WARN_DEPRECATED, _("The use of file paths as profile names is deprecated. See man apparmor.d for more information\n"));

		if ((yyvsp[0].prof)->name[0] != '/' && !((yyvsp[-1].integer) || (yyvsp[0].prof)->ns))
			yyerror(_("Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."));

		if ((yyvsp[-1].integer) == 2)
			prof->flags.flags |= FLAG_HAT;
		(yyval.prof) = prof;
	}
#line 2117 "parser_yacc.c"
    break;

  case 16: /* local_profile: TOK_PROFILE profile_base  */
#line 478 "parser_yacc.y"
        {

		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof))
			PDEBUG("Matched: local profile %s { ... }\n", prof->name);
		(yyval.prof) = prof;
	}
#line 2130 "parser_yacc.c"
    break;

  case 17: /* hat: hat_start profile_base  */
#line 488 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);
		if ((yyvsp[0].prof))
			PDEBUG("Matched: hat %s { ... }\n", prof->name);
		/*
		 * It isn't clear what a xattrs match on a hat profile
		 * should do, disallow it for now.
		 */
		if ((yyvsp[0].prof)->xattrs.list)
			yyerror("hat profiles can't use xattrs matches");

		prof->flags.flags |= FLAG_HAT;
		(yyval.prof) = prof;
	}
#line 2149 "parser_yacc.c"
    break;

  case 18: /* preamble: %empty  */
#line 503 "parser_yacc.y"
          { /* nothing */ }
#line 2155 "parser_yacc.c"
    break;

  case 19: /* preamble: preamble alias  */
#line 504 "parser_yacc.y"
                         { /* nothing */ }
#line 2161 "parser_yacc.c"
    break;

  case 20: /* preamble: preamble varassign  */
#line 505 "parser_yacc.y"
                             { /* nothing */ }
#line 2167 "parser_yacc.c"
    break;

  case 21: /* preamble: preamble abi_rule  */
#line 506 "parser_yacc.y"
                            { /* nothing */ }
#line 2173 "parser_yacc.c"
    break;

  case 22: /* alias: TOK_ALIAS TOK_ID TOK_ARROW TOK_ID TOK_END_OF_RULE  */
#line 509 "parser_yacc.y"
        {
		if (!new_alias((yyvsp[-3].id), (yyvsp[-1].id)))
			yyerror(_("Failed to create alias %s -> %s\n"), (yyvsp[-3].id), (yyvsp[-1].id));
		free((yyvsp[-3].id));
		free((yyvsp[-1].id));
	}
#line 2184 "parser_yacc.c"
    break;

  case 23: /* assign_op: TOK_EQUALS  */
#line 516 "parser_yacc.y"
                      { (yyval.integer) = TOK_EQUALS; }
#line 2190 "parser_yacc.c"
    break;

  case 24: /* assign_op: TOK_ADD_ASSIGN  */
#line 517 "parser_yacc.y"
                         { (yyval.integer) = TOK_ADD_ASSIGN; }
#line 2196 "parser_yacc.c"
    break;

  case 25: /* assign_op: TOK_COND_ASSIGN  */
#line 518 "parser_yacc.y"
                          { (yyval.integer) = TOK_COND_ASSIGN; }
#line 2202 "parser_yacc.c"
    break;

  case 26: /* assign_op: TOK_OVERRIDE_ASSIGN  */
#line 519 "parser_yacc.y"
                              { (yyval.integer) = TOK_OVERRIDE_ASSIGN; }
#line 2208 "parser_yacc.c"
    break;

  case 27: /* varassign: TOK_SET_VAR assign_op valuelist  */
#line 522 "parser_yacc.y"
        {
		int err;
		if ((yyvsp[-1].integer) == TOK_ADD_ASSIGN) {
			err = symtab::add_set_value((yyvsp[-2].set_var), (yyvsp[0].val_list));
			if (err) {
				yyerror(_("variable %s was not previously declared, but is being assigned additional values"), (yyvsp[-2].set_var));
			}
		} else if ((yyvsp[-1].integer) == TOK_OVERRIDE_ASSIGN) {
			autofree char *var_name = variable::process_var((yyvsp[-2].set_var));
			if (!var_name)
				yyerror(_("invalid variable name '%s'"), (yyvsp[-2].set_var));
			variable *old = symtab::delete_var(var_name);
			delete old;
			err = symtab::add_var((yyvsp[-2].set_var), (yyvsp[0].val_list));
		} else { /* TOK_EQUALS | TOK_COND_ASSIGN */
			err = symtab::add_var((yyvsp[-2].set_var), (yyvsp[0].val_list));
			if ((yyvsp[-1].integer) == TOK_EQUALS && err) {
				yyerror(_("variable %s was previously declared"), (yyvsp[-2].set_var));
				/* FIXME: it'd be handy to report the previous location */
			}
		}
		free_value_list((yyvsp[0].val_list));
		free((yyvsp[-2].set_var));
	}
#line 2237 "parser_yacc.c"
    break;

  case 28: /* varassign: TOK_BOOL_VAR assign_op expr  */
#line 548 "parser_yacc.y"
        {
		int boolean, err;
		if ((yyvsp[-1].integer) == TOK_ADD_ASSIGN)
			yyerror(_("Invalid assignment += not allowed with boolean variables"));
		boolean = (yyvsp[0].cond)->eval();
		if ((yyvsp[-1].integer) == TOK_OVERRIDE_ASSIGN) {
			autofree char *var_name = variable::process_var((yyvsp[-2].bool_var));
			if (!var_name)
				yyerror(_("invalid variable name '%s'"), (yyvsp[-2].bool_var));
			variable *old = symtab::delete_var(var_name);
			delete old;
		}
		err = symtab::add_var((yyvsp[-2].bool_var), boolean);
		if ((yyvsp[-1].integer) == TOK_EQUALS && err) {
			yyerror(_("variable %s was previously declared"), (yyvsp[-2].bool_var));
			/* FIXME: it'd be handy to report the previous location */
		}
		free((yyvsp[-2].bool_var));
		delete((yyvsp[0].cond));
	}
#line 2262 "parser_yacc.c"
    break;

  case 29: /* valuelist: TOK_VALUE  */
#line 570 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value (%s)\n", (yyvsp[0].var_val));

		(yyval.val_list) = val;
	}
#line 2275 "parser_yacc.c"
    break;

  case 30: /* valuelist: valuelist TOK_VALUE  */
#line 580 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value list\n");

		list_append((yyvsp[-1].val_list), val);
		(yyval.val_list) = (yyvsp[-1].val_list);
	}
#line 2289 "parser_yacc.c"
    break;

  case 31: /* flags: %empty  */
#line 590 "parser_yacc.y"
        { /* nothing */
		flagvals fv;

		fv.init();
		(yyval.flags) = fv;
	}
#line 2300 "parser_yacc.c"
    break;

  case 32: /* flags: TOK_FLAGS TOK_EQUALS TOK_OPENPAREN flagvals TOK_CLOSEPAREN  */
#line 598 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2308 "parser_yacc.c"
    break;

  case 33: /* flags: TOK_OPENPAREN flagvals TOK_CLOSEPAREN  */
#line 603 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2316 "parser_yacc.c"
    break;

  case 34: /* flagvals: flagvals flagval  */
#line 608 "parser_yacc.y"
        {
		(yyvsp[-1].flags).merge((yyvsp[0].flags));
		(yyvsp[0].flags).clear();
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2326 "parser_yacc.c"
    break;

  case 35: /* flagvals: flagval  */
#line 615 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[0].flags);
	}
#line 2334 "parser_yacc.c"
    break;

  case 36: /* flagval: TOK_VALUE  */
#line 620 "parser_yacc.y"
        {
		flagvals fv;

		fv.init((yyvsp[0].var_val));
		free((yyvsp[0].var_val));
		(yyval.flags) = fv;
	}
#line 2346 "parser_yacc.c"
    break;

  case 37: /* identities: %empty  */
#line 628 "parser_yacc.y"
                { /* nothing */
		(yyval.identities) = NULL;
	}
#line 2354 "parser_yacc.c"
    break;

  case 38: /* identities: identities TOK_PLUS identity_item  */
#line 633 "parser_yacc.y"
        {
		(yyval.identities) = (yyvsp[-2].identities);
		if (!(yyval.identities)) {
			(yyval.identities) = (yyvsp[0].identities);
		} else {
			list_append((yyval.identities), (yyvsp[0].identities));
		}
	}
#line 2367 "parser_yacc.c"
    break;

  case 39: /* identity_item: TOK_IDENTITIES TOK_EQUALS TOK_OPENPAREN identitiesvals TOK_CLOSEPAREN  */
#line 643 "parser_yacc.y"
        {
		(yyval.identities) = (yyvsp[-1].identities);
	}
#line 2375 "parser_yacc.c"
    break;

  case 40: /* identitiesvals: identitiesvals identitiesval  */
#line 648 "parser_yacc.y"
        {
		list_append((yyvsp[-1].identities), (yyvsp[0].identities));
		(yyval.identities) = (yyvsp[-1].identities);
	}
#line 2384 "parser_yacc.c"
    break;

  case 41: /* identitiesvals: identitiesval  */
#line 654 "parser_yacc.y"
        {
		(yyval.identities) = (yyvsp[0].identities);
	}
#line 2392 "parser_yacc.c"
    break;

  case 42: /* identitiesval: TOK_VALUE  */
#line 659 "parser_yacc.y"
        {
		if ( (yyvsp[0].var_val)[0] != '/' && strchr((yyvsp[0].var_val), ' ')) {
			yyerror(_("Space character not allowed in identities: '%s'"), (yyvsp[0].var_val));
			free((yyvsp[0].var_val));
			(yyval.identities) = NULL;
		} else {
			(yyval.identities) = new_value_list((yyvsp[0].var_val));
		}
	}
#line 2406 "parser_yacc.c"
    break;

  case 43: /* opt_subset_flag: %empty  */
#line 669 "parser_yacc.y"
                 { /* nothing */ (yyval.boolean) = false; }
#line 2412 "parser_yacc.c"
    break;

  case 44: /* opt_subset_flag: TOK_SUBSET  */
#line 670 "parser_yacc.y"
                     { (yyval.boolean) = true; }
#line 2418 "parser_yacc.c"
    break;

  case 45: /* opt_subset_flag: TOK_LE  */
#line 671 "parser_yacc.y"
                 { (yyval.boolean) = true; }
#line 2424 "parser_yacc.c"
    break;

  case 46: /* opt_priority: %empty  */
#line 674 "parser_yacc.y"
              { (yyval.integer) = 0; }
#line 2430 "parser_yacc.c"
    break;

  case 47: /* opt_priority: TOK_PRIORITY TOK_EQUALS TOK_VALUE  */
#line 676 "parser_yacc.y"
        {
		char *end;
		long tmp = strtol((yyvsp[0].var_val), &end, 10);
		if (end == (yyvsp[0].var_val) || *end != '\0')
			yyerror("invalid priority %s", (yyvsp[0].var_val));
		free((yyvsp[0].var_val));
		/* see note on mediates_priority */
		if (tmp > MAX_POLICY_PRIORITY)
			yyerror("invalid priority %ld > %d", tmp, MAX_POLICY_PRIORITY);
		if (tmp < MIN_POLICY_PRIORITY)
			yyerror("invalid priority %ld > %d", tmp, MIN_POLICY_PRIORITY);
		(yyval.integer) = tmp;
	}
#line 2448 "parser_yacc.c"
    break;

  case 48: /* opt_audit_flag: %empty  */
#line 690 "parser_yacc.y"
                { /* nothing */ (yyval.audit) = AUDIT_UNSPECIFIED; }
#line 2454 "parser_yacc.c"
    break;

  case 49: /* opt_audit_flag: TOK_AUDIT  */
#line 691 "parser_yacc.y"
                    { (yyval.audit) = AUDIT_FORCE; }
#line 2460 "parser_yacc.c"
    break;

  case 50: /* opt_owner_flag: %empty  */
#line 693 "parser_yacc.y"
                { /* nothing */ (yyval.owner) = OWNER_UNSPECIFIED; }
#line 2466 "parser_yacc.c"
    break;

  case 51: /* opt_owner_flag: TOK_OWNER  */
#line 694 "parser_yacc.y"
                    { (yyval.owner) = OWNER_SPECIFIED; }
#line 2472 "parser_yacc.c"
    break;

  case 52: /* opt_owner_flag: TOK_OTHER  */
#line 695 "parser_yacc.y"
                    { (yyval.owner) = OWNER_NOT; }
#line 2478 "parser_yacc.c"
    break;

  case 53: /* opt_rule_mode: %empty  */
#line 697 "parser_yacc.y"
               { /* nothing */ (yyval.rule_mode) = RULE_UNSPECIFIED; }
#line 2484 "parser_yacc.c"
    break;

  case 54: /* opt_rule_mode: TOK_ALLOW  */
#line 698 "parser_yacc.y"
                    { (yyval.rule_mode) = RULE_ALLOW; }
#line 2490 "parser_yacc.c"
    break;

  case 55: /* opt_rule_mode: TOK_DENY  */
#line 699 "parser_yacc.y"
                   { (yyval.rule_mode) = RULE_DENY; }
#line 2496 "parser_yacc.c"
    break;

  case 56: /* opt_rule_mode: TOK_PROMPT  */
#line 700 "parser_yacc.y"
                     { (yyval.rule_mode) = RULE_PROMPT; }
#line 2502 "parser_yacc.c"
    break;

  case 57: /* opt_prefix: opt_priority opt_audit_flag opt_rule_mode opt_owner_flag  */
#line 703 "parser_yacc.y"
        {
		(yyval.prefix).priority = (yyvsp[-3].integer);
		(yyval.prefix).audit = (yyvsp[-2].audit);
		(yyval.prefix).rule_mode = (yyvsp[-1].rule_mode);
		(yyval.prefix).owner = (yyvsp[0].owner);
	}
#line 2513 "parser_yacc.c"
    break;

  case 58: /* rules: %empty  */
#line 710 "parser_yacc.y"
        { /* nothing */ 
	Profile *prof = new Profile();
		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		(yyval.prof) = prof;
	}
#line 2526 "parser_yacc.c"
    break;

  case 59: /* rules: rules abi_rule  */
#line 719 "parser_yacc.y"
                      { /* nothing */ }
#line 2532 "parser_yacc.c"
    break;

  case 60: /* rules: rules opt_prefix rule  */
#line 722 "parser_yacc.y"
        {
		const char *error;
		PDEBUG("matched: rules rule\n");
		PDEBUG("rules rule: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `rule' returned NULL."));
		if (!entry_add_prefix((yyvsp[0].user_entry), (yyvsp[-1].prefix), error)) {
			yyerror(_("%s"), error);
		}
		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2549 "parser_yacc.c"
    break;

  case 61: /* block: TOK_OPEN rules TOK_CLOSE  */
#line 736 "parser_yacc.y"
        {
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2557 "parser_yacc.c"
    break;

  case 62: /* rules: rules opt_prefix block  */
#line 741 "parser_yacc.y"
        {
		struct cod_entry *entry, *tmp;

		if (((yyvsp[-1].prefix)).priority != 0) {
			yyerror(_("priority is not allowed on rule blocks"));
		}
		PDEBUG("matched: %s%s%s%sblock\n",
		       (yyvsp[-1].prefix).audit == AUDIT_FORCE ? "audit " : "",
		       (yyvsp[-1].prefix).rule_mode == RULE_DENY ? "deny " : "",
		       (yyvsp[-1].prefix).rule_mode == RULE_PROMPT ? "prompt " : "",
		       (yyvsp[-1].prefix).owner == OWNER_SPECIFIED ? "owner " : "");
		list_for_each_safe((yyvsp[0].prof)->entries, entry, tmp) {
			const char *error;
			entry->next = NULL;
			if (!entry_add_prefix(entry, (yyvsp[-1].prefix), error)) {
				yyerror(_("%s"), error);
			}
			/* transfer rule for now, TODO keep block and just
			 * apply add_prefix to block rule and have it do
			 * the work
			 */
			add_entry_to_policy((yyvsp[-2].prof), entry);
		}
		(yyvsp[0].prof)->entries = NULL;
		// fix me transfer rules and free sub profile
		delete (yyvsp[0].prof);
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2590 "parser_yacc.c"
    break;

  case 63: /* rules: rules opt_prefix network_rule  */
#line 771 "parser_yacc.y"
        {
		const char *error;
		if (!(yyvsp[0].network_entry)->add_prefix((yyvsp[-1].prefix), error))
			yyerror("%s", error);
		/* class members need to be updated after prefix is added */
		(yyvsp[0].network_entry)->update_compat_net();

		auto nm_af_unix = (yyvsp[0].network_entry)->network_map.find(AF_UNIX);
		if (nm_af_unix != (yyvsp[0].network_entry)->network_map.end()) {
			for (auto& entry : nm_af_unix->second) {
				unix_rule *rule = new unix_rule(entry.type,
								(yyvsp[-1].prefix).audit, (yyvsp[-1].prefix).rule_mode);
				if (!rule)
					yyerror(_("Memory allocation error."));
				(yyvsp[-2].prof)->rule_ents.push_back(rule);
			}
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].network_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2615 "parser_yacc.c"
    break;

  case 64: /* prefix_rule: mnt_rule  */
#line 792 "parser_yacc.y"
                       { (yyval.prefix_entry) = (yyvsp[0].mnt_entry); }
#line 2621 "parser_yacc.c"
    break;

  case 65: /* prefix_rule: dbus_rule  */
#line 793 "parser_yacc.y"
                    { (yyval.prefix_entry) = (yyvsp[0].dbus_entry); }
#line 2627 "parser_yacc.c"
    break;

  case 66: /* prefix_rule: signal_rule  */
#line 794 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].signal_entry); }
#line 2633 "parser_yacc.c"
    break;

  case 67: /* prefix_rule: ptrace_rule  */
#line 795 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].ptrace_entry); }
#line 2639 "parser_yacc.c"
    break;

  case 68: /* prefix_rule: unix_rule  */
#line 796 "parser_yacc.y"
                    { (yyval.prefix_entry) = (yyvsp[0].unix_entry); }
#line 2645 "parser_yacc.c"
    break;

  case 69: /* prefix_rule: userns_rule  */
#line 797 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].userns_entry); }
#line 2651 "parser_yacc.c"
    break;

  case 70: /* prefix_rule: mqueue_rule  */
#line 798 "parser_yacc.y"
                      { (yyval.prefix_entry) = (yyvsp[0].mqueue_entry); }
#line 2657 "parser_yacc.c"
    break;

  case 71: /* prefix_rule: io_uring_rule  */
#line 799 "parser_yacc.y"
                        { (yyval.prefix_entry) = (yyvsp[0].io_uring_entry); }
#line 2663 "parser_yacc.c"
    break;

  case 72: /* prefix_rule: all_rule  */
#line 800 "parser_yacc.y"
                   { (yyval.prefix_entry) = (yyvsp[0].all_entry); }
#line 2669 "parser_yacc.c"
    break;

  case 73: /* rules: rules opt_prefix prefix_rule  */
#line 803 "parser_yacc.y"
        {
		const char *error;
		if (!(yyvsp[0].prefix_entry)->add_prefix((yyvsp[-1].prefix), error))
			yyerror("%s", error);
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].prefix_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2681 "parser_yacc.c"
    break;

  case 74: /* rules: rules opt_prefix change_profile  */
#line 812 "parser_yacc.y"
        {
		PDEBUG("matched: rules change_profile\n");
		PDEBUG("rules change_profile: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `change_profile' returned NULL."));
		if ((yyvsp[-1].prefix).owner != OWNER_UNSPECIFIED)
			yyerror(_("owner conditional not allowed on unix rules"));
		if (((yyvsp[-1].prefix).rule_mode == RULE_DENY) && (yyvsp[-1].prefix).audit == AUDIT_FORCE) {
			(yyvsp[0].user_entry)->rule_mode = RULE_DENY;
		} else if ((yyvsp[-1].prefix).rule_mode == RULE_DENY) {
			(yyvsp[0].user_entry)->rule_mode = RULE_DENY;
			(yyvsp[0].user_entry)->audit = AUDIT_FORCE;
		} else if ((yyvsp[-1].prefix).audit != AUDIT_UNSPECIFIED) {
			(yyvsp[0].user_entry)->audit = (yyvsp[-1].prefix).audit;
		}
		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2704 "parser_yacc.c"
    break;

  case 75: /* rules: rules opt_prefix capability  */
#line 832 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner != OWNER_UNSPECIFIED)
			yyerror(_("owner conditional not allowed on capability rules"));

		if ((yyvsp[-1].prefix).rule_mode == RULE_DENY && (yyvsp[-1].prefix).audit == AUDIT_FORCE) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
		} else if ((yyvsp[-1].prefix).rule_mode == RULE_DENY) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
			(yyvsp[-2].prof)->caps.quiet |= (yyvsp[0].cap);
		} else {
			(yyvsp[-2].prof)->caps.allow |= (yyvsp[0].cap);
			if ((yyvsp[-1].prefix).audit != AUDIT_UNSPECIFIED)
				(yyvsp[-2].prof)->caps.audit |= (yyvsp[0].cap);
		}

		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2726 "parser_yacc.c"
    break;

  case 76: /* rules: rules hat  */
#line 851 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'hat rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2738 "parser_yacc.c"
    break;

  case 77: /* rules: rules local_profile  */
#line 860 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'local_profile rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2750 "parser_yacc.c"
    break;

  case 78: /* rules: rules cond_rule  */
#line 869 "parser_yacc.y"
        {
		PDEBUG("Matched: conditional rules\n");
		(yyval.prof) = merge_policy((yyvsp[-1].prof), (yyvsp[0].prof));
	}
#line 2759 "parser_yacc.c"
    break;

  case 79: /* rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE opt_id TOK_END_OF_RULE  */
#line 875 "parser_yacc.y"
        {
		rlim_t value = RLIM_INFINITY;
		long long tmp;
		char *end;

		int limit = get_rlimit((yyvsp[-4].id));
		if (limit == -1)
			yyerror("INVALID RLIMIT '%s'\n", (yyvsp[-4].id));

		if (strcmp((yyvsp[-2].var_val), "infinity") == 0) {
			value = RLIM_INFINITY;
		} else {
			const char *kb = "KB";
			const char *mb = "MB";
			const char *gb = "GB";

			tmp = strtoll((yyvsp[-2].var_val), &end, 0);
			switch (limit) {
			case RLIMIT_CPU:
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				tmp = convert_time_units(tmp, SECONDS_P_MS, (yyvsp[-1].id));
				if (tmp == -1LL)
					yyerror("RLIMIT '%s %s' < minimum value of 1s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				else if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'cpu' no units specified using default units of seconds\n"));
				value = tmp;
				break;
#ifdef RLIMIT_RTTIME
			case RLIMIT_RTTIME:
				/* RTTIME is measured in microseconds */
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				tmp = convert_time_units(tmp, 1LL, (yyvsp[-1].id));
				if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'rttime' no units specified using default units of microseconds\n"));
				value = tmp;
				break;
#endif
			case RLIMIT_NOFILE:
			case RLIMIT_NPROC:
			case RLIMIT_LOCKS:
			case RLIMIT_SIGPENDING:
#ifdef RLIMIT_RTPRIO
			case RLIMIT_RTPRIO:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id) || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				value = tmp;
				break;
#endif
#ifdef RLIMIT_NICE
			case RLIMIT_NICE:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id))
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (tmp < -20 || tmp > 19)
					yyerror("RLIMIT '%s' out of range (-20 .. 19) %lld\n", (yyvsp[-4].id), tmp);
				value = tmp + 20;
				break;
#endif
			case RLIMIT_FSIZE:
			case RLIMIT_DATA:
			case RLIMIT_STACK:
			case RLIMIT_CORE:
			case RLIMIT_RSS:
			case RLIMIT_AS:
			case RLIMIT_MEMLOCK:
			case RLIMIT_MSGQUEUE:
				if ((yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id)) {
					; /* use default of bytes */
				} else if (strstr(kb, (yyvsp[-1].id)) == kb) {
					tmp *= 1024;
				} else if (strstr(mb, (yyvsp[-1].id)) == mb) {
					tmp *= 1024*1024;
				} else if (strstr(gb, (yyvsp[-1].id)) == gb) {
					tmp *= 1024*1024*1024;
				} else {
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id));
				}
				value = tmp;
				break;
			default:
				yyerror("Unknown RLIMIT %s\n", (yyvsp[-4].id));
			}
		}
		(yyvsp[-7].prof)->rlimits.specified |= 1 << limit;
		(yyvsp[-7].prof)->rlimits.limits[limit] = value;
		free((yyvsp[-4].id));
		free((yyvsp[-2].var_val));
		(yyval.prof) = (yyvsp[-7].prof);
	}
#line 2860 "parser_yacc.c"
    break;

  case 80: /* cond_rule: TOK_IF expr block  */
#line 974 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional rules\n");
		if ((yyvsp[-1].cond)->eval()) {
			ret = (yyvsp[0].prof);
		} else {
			delete (yyvsp[0].prof);
		}
		delete (yyvsp[-1].cond);
		(yyval.prof) = ret;
	}
#line 2876 "parser_yacc.c"
    break;

  case 81: /* cond_rule: TOK_IF expr block TOK_ELSE block  */
#line 987 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else rules\n");
		if ((yyvsp[-3].cond)->eval()) {
			ret = (yyvsp[-2].prof);
			delete (yyvsp[0].prof);
		} else {
			ret = (yyvsp[0].prof);
			delete (yyvsp[-2].prof);
		}
		delete (yyvsp[-3].cond);
		(yyval.prof) = ret;
	}
#line 2894 "parser_yacc.c"
    break;

  case 82: /* cond_rule: TOK_IF expr block TOK_ELSE cond_rule  */
#line 1002 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else-if rules\n");
		if ((yyvsp[-3].cond)->eval()) {
			ret = (yyvsp[-2].prof);
			delete (yyvsp[0].prof);
		} else {
			ret = (yyvsp[0].prof);
			delete (yyvsp[-2].prof);
		}
		delete (yyvsp[-3].cond);
		(yyval.prof) = ret;
	}
#line 2912 "parser_yacc.c"
    break;

  case 83: /* expr: expr TOK_OR term  */
#line 1018 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].cond)->eval() || (yyvsp[0].cond)->eval());
		delete (yyvsp[-2].cond);
		delete (yyvsp[0].cond);
		(yyval.cond) = conds;
	}
#line 2923 "parser_yacc.c"
    break;

  case 84: /* expr: term  */
#line 1025 "parser_yacc.y"
        {
		(yyval.cond) = (yyvsp[0].cond);
	}
#line 2931 "parser_yacc.c"
    break;

  case 85: /* term: term TOK_AND notfactor  */
#line 1030 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].cond)->eval() && (yyvsp[0].cond)->eval());
		delete (yyvsp[-2].cond);
		delete (yyvsp[0].cond);
		(yyval.cond) = conds;
	}
#line 2942 "parser_yacc.c"
    break;

  case 86: /* term: notfactor  */
#line 1037 "parser_yacc.y"
        {
		(yyval.cond) = (yyvsp[0].cond);
	}
#line 2950 "parser_yacc.c"
    break;

  case 87: /* notfactor: TOK_NOT notfactor  */
#line 1042 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr(!(yyvsp[0].cond)->eval());
		delete (yyvsp[0].cond);
		(yyval.cond) = conds;
	}
#line 2960 "parser_yacc.c"
    break;

  case 88: /* notfactor: factor  */
#line 1048 "parser_yacc.y"
        {
		(yyval.cond) = (yyvsp[0].cond);
	}
#line 2968 "parser_yacc.c"
    break;

  case 89: /* factor: TOK_BOOL_VAR  */
#line 1053 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].bool_var), BOOLEAN_OP);
		PDEBUG("Matched: boolean expr %s value: %d\n", (yyvsp[0].bool_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].bool_var));
	}
#line 2979 "parser_yacc.c"
    break;

  case 90: /* factor: TOK_DEFINED TOK_SET_VAR  */
#line 1061 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].set_var), DEFINED_OP);
		PDEBUG("Matched: defined set expr %s value %d\n", (yyvsp[0].set_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].set_var));
	}
#line 2990 "parser_yacc.c"
    break;

  case 91: /* factor: TOK_DEFINED TOK_BOOL_VAR  */
#line 1069 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].bool_var), DEFINED_OP);
		PDEBUG("Matched: defined set expr %s value %d\n", (yyvsp[0].bool_var), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].bool_var));
	}
#line 3001 "parser_yacc.c"
    break;

  case 92: /* factor: TOK_OPENPAREN expr TOK_CLOSEPAREN  */
#line 1077 "parser_yacc.y"
        {
		(yyval.cond) = (yyvsp[-1].cond);
	}
#line 3009 "parser_yacc.c"
    break;

  case 93: /* factor: id_or_var TOK_EQ_OP id_or_var  */
#line 1082 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), EQ_OP, (yyvsp[0].id));
		PDEBUG("Matched: equal set expr %s == %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3021 "parser_yacc.c"
    break;

  case 94: /* factor: id_or_var TOK_NE_OP id_or_var  */
#line 1091 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), NE_OP, (yyvsp[0].id));
		PDEBUG("Matched: not equal set expr %s != %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3033 "parser_yacc.c"
    break;

  case 95: /* factor: id_or_var TOK_IN_OP id_or_var  */
#line 1100 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), IN_OP, (yyvsp[0].id));
		PDEBUG("Matched: in set expr %s in %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3045 "parser_yacc.c"
    break;

  case 96: /* factor: id_or_var TOK_GT id_or_var  */
#line 1109 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), GT_OP, (yyvsp[0].id));
		PDEBUG("Matched: greater set expr %s > %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3057 "parser_yacc.c"
    break;

  case 97: /* factor: id_or_var TOK_GE id_or_var  */
#line 1118 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), GE_OP, (yyvsp[0].id));
		PDEBUG("Matched: greater or equal set expr %s >= %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3069 "parser_yacc.c"
    break;

  case 98: /* factor: id_or_var TOK_LT id_or_var  */
#line 1127 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), LT_OP, (yyvsp[0].id));
		PDEBUG("Matched: less set expr %s < %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3081 "parser_yacc.c"
    break;

  case 99: /* factor: id_or_var TOK_LE id_or_var  */
#line 1136 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[-2].id), LE_OP, (yyvsp[0].id));
		PDEBUG("Matched: less or equal set expr %s <= %s value %d\n", (yyvsp[-2].id), (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[-2].id));
		free((yyvsp[0].id));
	}
#line 3093 "parser_yacc.c"
    break;

  case 100: /* factor: id_or_var  */
#line 1145 "parser_yacc.y"
        {
		cond_expr *conds = new cond_expr((yyvsp[0].id), BOOLEAN_VALUE);
		PDEBUG("Matched: boolean expr %s value: %d\n", (yyvsp[0].id), conds->eval());
		(yyval.cond) = conds;
		free((yyvsp[0].id));
	}
#line 3104 "parser_yacc.c"
    break;

  case 101: /* id_or_var: TOK_ID  */
#line 1152 "parser_yacc.y"
                  { (yyval.id) = (yyvsp[0].id); }
#line 3110 "parser_yacc.c"
    break;

  case 102: /* id_or_var: TOK_SET_VAR  */
#line 1153 "parser_yacc.y"
                       { (yyval.id) = (yyvsp[0].set_var); }
#line 3116 "parser_yacc.c"
    break;

  case 103: /* opt_target: %empty  */
#line 1155 "parser_yacc.y"
                          { (yyval.id) = NULL; }
#line 3122 "parser_yacc.c"
    break;

  case 104: /* opt_target: TOK_ARROW id_or_var  */
#line 1156 "parser_yacc.y"
                                { (yyval.id) = (yyvsp[0].id); }
#line 3128 "parser_yacc.c"
    break;

  case 105: /* opt_named_transition: %empty  */
#line 1158 "parser_yacc.y"
                      { /* nothing */ (yyval.id) = NULL; }
#line 3134 "parser_yacc.c"
    break;

  case 106: /* opt_named_transition: TOK_ARROW id_or_var  */
#line 1160 "parser_yacc.y"
        {
		(yyval.id) = (yyvsp[0].id);
	}
#line 3142 "parser_yacc.c"
    break;

  case 107: /* rule: file_rule  */
#line 1164 "parser_yacc.y"
                { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 3148 "parser_yacc.c"
    break;

  case 108: /* rule: link_rule  */
#line 1165 "parser_yacc.y"
                    { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 3154 "parser_yacc.c"
    break;

  case 109: /* abi_rule: TOK_ABI TOK_ID TOK_END_OF_RULE  */
#line 1168 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].id), true);
		free((yyvsp[-1].id));
		/* $$ = nothing, not used */
	}
#line 3164 "parser_yacc.c"
    break;

  case 110: /* abi_rule: TOK_ABI TOK_VALUE TOK_END_OF_RULE  */
#line 1174 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].var_val), false);
		free((yyvsp[-1].var_val));
		/* $$ = nothing, not used */
	}
#line 3174 "parser_yacc.c"
    break;

  case 111: /* opt_exec_mode: %empty  */
#line 1180 "parser_yacc.y"
               { /* nothing */ (yyval.integer) = EXEC_MODE_EMPTY; }
#line 3180 "parser_yacc.c"
    break;

  case 112: /* opt_exec_mode: TOK_UNSAFE  */
#line 1181 "parser_yacc.y"
                     { (yyval.integer) = EXEC_MODE_UNSAFE; }
#line 3186 "parser_yacc.c"
    break;

  case 113: /* opt_exec_mode: TOK_SAFE  */
#line 1182 "parser_yacc.y"
                   { (yyval.integer) = EXEC_MODE_SAFE; }
#line 3192 "parser_yacc.c"
    break;

  case 114: /* opt_file: %empty  */
#line 1184 "parser_yacc.y"
          { /* nothing */ (yyval.boolean) = false; }
#line 3198 "parser_yacc.c"
    break;

  case 115: /* opt_file: TOK_FILE  */
#line 1185 "parser_yacc.y"
                   { (yyval.boolean) = true; }
#line 3204 "parser_yacc.c"
    break;

  case 116: /* frule: id_or_var file_perms opt_named_transition TOK_END_OF_RULE  */
#line 1188 "parser_yacc.y"
        {
		if ((yyvsp[-1].id) && ((yyvsp[-2].fperms) & AA_LINK_BITS) && ((yyvsp[-2].fperms) & AA_EXEC_BITS)) {
			// TODO: option to fail on abi check for next release
			pwarn(WARN_DEPRECATED, _("ambiguous rule specifies both link target and exec transition target. Using as exec transition"));
			(yyval.user_entry) = do_file_rule((yyvsp[-3].id), (yyvsp[-2].fperms), NULL, (yyvsp[-1].id));
		} else if ((yyvsp[-1].id) && ((yyvsp[-2].fperms) & AA_LINK_BITS)) {
			(yyval.user_entry) = do_file_rule((yyvsp[-3].id), (yyvsp[-2].fperms), (yyvsp[-1].id), NULL);
		} else {
			(yyval.user_entry) = do_file_rule((yyvsp[-3].id), (yyvsp[-2].fperms), NULL, (yyvsp[-1].id));
		}
	}
#line 3220 "parser_yacc.c"
    break;

  case 117: /* frule: file_perms opt_subset_flag id_or_var opt_named_transition TOK_END_OF_RULE  */
#line 1201 "parser_yacc.y"
        {
		if ((yyvsp[-3].boolean) && ((yyvsp[-4].fperms) & ~AA_LINK_BITS))
			yyerror(_("subset can only be used with link rules."));
		if ((yyvsp[-1].id) && ((yyvsp[-4].fperms) & AA_LINK_BITS) && ((yyvsp[-4].fperms) & AA_EXEC_BITS))
			yyerror(_("link and exec perms conflict on a file rule using ->"));
		if ((yyvsp[-1].id) && label_contains_ns((yyvsp[-1].id)) && ((yyvsp[-4].fperms) & AA_LINK_BITS))
			yyerror(_("link perms are not allowed on a named profile transition.\n"));

		if (((yyvsp[-4].fperms) & AA_LINK_BITS)) {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fperms), (yyvsp[-1].id), NULL);
			(yyval.user_entry)->subset = (yyvsp[-3].boolean);

		} else {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fperms), NULL, (yyvsp[-1].id));
		}
 	}
#line 3241 "parser_yacc.c"
    break;

  case 118: /* file_rule: TOK_FILE TOK_END_OF_RULE  */
#line 1219 "parser_yacc.y"
        {
		char *path = strdup("/{**,}");
		int perms = ((AA_BASE_PERMS & ~AA_EXEC_TYPE) |
			     (AA_EXEC_INHERIT | AA_MAY_EXEC));
		/* duplicate to other permission set */
		perms |= perms << AA_OTHER_SHIFT;
		if (!path)
			yyerror(_("Memory allocation error."));
		(yyval.user_entry) = do_file_rule(path, perms, NULL, NULL);
	}
#line 3256 "parser_yacc.c"
    break;

  case 119: /* file_rule: opt_file file_rule_tail  */
#line 1229 "parser_yacc.y"
                                  { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 3262 "parser_yacc.c"
    break;

  case 120: /* file_rule_tail: opt_exec_mode frule  */
#line 1233 "parser_yacc.y"
        {
		if ((yyvsp[-1].integer) != EXEC_MODE_EMPTY) {
			if (!((yyvsp[0].user_entry)->perms & AA_EXEC_BITS))
				yyerror(_("unsafe rule missing exec permissions"));
			if ((yyvsp[-1].integer) == EXEC_MODE_UNSAFE) {
				(yyvsp[0].user_entry)->perms |= (((yyvsp[0].user_entry)->perms & AA_EXEC_BITS) << 8) &
					 ALL_AA_EXEC_UNSAFE;
			}
			else if ((yyvsp[-1].integer) == EXEC_MODE_SAFE)
				(yyvsp[0].user_entry)->perms &= ~ALL_AA_EXEC_UNSAFE;
		}
		(yyval.user_entry) = (yyvsp[0].user_entry);
	}
#line 3280 "parser_yacc.c"
    break;

  case 121: /* file_rule_tail: opt_exec_mode id_or_var file_perms id_or_var  */
#line 1248 "parser_yacc.y"
        {
		/* Oopsie, we appear to be missing an EOL marker. If we
		 * were *smart*, we could work around it. Since we're
		 * obviously not smart, we'll just punt with a more
		 * sensible error. */
		yyerror(_("missing an end of line character? (entry: %s)"), (yyvsp[-2].id));
	}
#line 3292 "parser_yacc.c"
    break;

  case 122: /* link_rule: TOK_LINK opt_subset_flag id_or_var TOK_ARROW id_or_var TOK_END_OF_RULE  */
#line 1257 "parser_yacc.y"
        {
		struct cod_entry *entry;
		PDEBUG("Matched: link tok_id (%s) -> (%s)\n", (yyvsp[-3].id), (yyvsp[-1].id));
		entry = new_entry((yyvsp[-3].id), AA_LINK_BITS, (yyvsp[-1].id));
		if (!entry) {
			yyerror(_("Memory allocation error."));
		}
		entry->subset = (yyvsp[-4].boolean);
		PDEBUG("rule.entry: link (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 3308 "parser_yacc.c"
    break;

  case 123: /* network_rule: TOK_NETWORK opt_net_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1270 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		(yyval.network_entry) = entry;
	}
#line 3324 "parser_yacc.c"
    break;

  case 124: /* network_rule: TOK_NETWORK opt_net_perm TOK_ID opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1283 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-4].fperms), (yyvsp[-3].id), NULL, NULL, (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		free((yyvsp[-3].id));
		(yyval.network_entry) = entry;
	}
#line 3341 "parser_yacc.c"
    break;

  case 125: /* network_rule: TOK_NETWORK opt_net_perm TOK_ID TOK_ID opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1297 "parser_yacc.y"
        {
		network_rule *entry;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("network rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		entry = new network_rule((yyvsp[-5].fperms), (yyvsp[-4].id), (yyvsp[-3].id), NULL, (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		free((yyvsp[-4].id));
		free((yyvsp[-3].id));
		(yyval.network_entry) = entry;
	}
#line 3359 "parser_yacc.c"
    break;

  case 126: /* cond: TOK_CONDID  */
#line 1312 "parser_yacc.y"
        {
		struct cond_entry *ent;
		ent = new_cond_entry((yyvsp[0].id), cond_comp::NONE, NULL);
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3371 "parser_yacc.c"
    break;

  case 127: /* cond: TOK_CONDID TOK_EQUALS TOK_VALUE  */
#line 1321 "parser_yacc.y"
        {
		struct cond_entry *ent;
		struct value_list *value = new_value_list((yyvsp[0].var_val));
		if (!value)
			yyerror(_("Memory allocation error."));
		ent = new_cond_entry((yyvsp[-2].id), cond_comp::EQ, value);
		if (!ent) {
			free_value_list(value);
			yyerror(_("Memory allocation error."));
		}
		(yyval.cond_entry) = ent;
	}
#line 3388 "parser_yacc.c"
    break;

  case 128: /* cond: TOK_CONDID TOK_OVERRIDE_ASSIGN TOK_VALUE  */
#line 1335 "parser_yacc.y"
        {
		struct cond_entry *ent;
		struct value_list *value = new_value_list((yyvsp[0].var_val));
		if (!value)
			yyerror(_("Memory allocation error."));
		ent = new_cond_entry((yyvsp[-2].id), cond_comp::SET, value);
		if (!ent) {
			free_value_list(value);
			yyerror(_("Memory allocation error."));
		}
		(yyval.cond_entry) = ent;
	}
#line 3405 "parser_yacc.c"
    break;

  case 129: /* cond: TOK_CONDID TOK_EQUALS TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1349 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), cond_comp::EQ, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3417 "parser_yacc.c"
    break;

  case 130: /* cond: TOK_CONDID TOK_IN TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1359 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), cond_comp::IN, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3429 "parser_yacc.c"
    break;

  case 131: /* cond: TOK_CONDID TOK_OVERRIDE_ASSIGN TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1368 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), cond_comp::SET, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3441 "parser_yacc.c"
    break;

  case 132: /* opt_conds: %empty  */
#line 1376 "parser_yacc.y"
           { /* nothing */ (yyval.cond_entry) = NULL; }
#line 3447 "parser_yacc.c"
    break;

  case 133: /* opt_conds: opt_conds cond  */
#line 1378 "parser_yacc.y"
        {
		(yyvsp[0].cond_entry)->next = (yyvsp[-1].cond_entry);
		(yyval.cond_entry) = (yyvsp[0].cond_entry);
	}
#line 3456 "parser_yacc.c"
    break;

  case 134: /* cond_list: TOK_CONDLISTID TOK_EQUALS TOK_OPENPAREN opt_conds TOK_CLOSEPAREN  */
#line 1384 "parser_yacc.y"
        {
		(yyval.cond_entry_list).name = (yyvsp[-4].id);
		(yyval.cond_entry_list).list = (yyvsp[-1].cond_entry);
	}
#line 3465 "parser_yacc.c"
    break;

  case 135: /* opt_cond_list: %empty  */
#line 1389 "parser_yacc.y"
               { /* nothing */ (yyval.cond_entry_list) = { NULL, NULL }; }
#line 3471 "parser_yacc.c"
    break;

  case 136: /* opt_cond_list: cond_list  */
#line 1390 "parser_yacc.y"
                    { (yyval.cond_entry_list) = (yyvsp[0].cond_entry_list); }
#line 3477 "parser_yacc.c"
    break;

  case 137: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1393 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), (yyvsp[-1].id), NULL, NULL, AA_MAY_MOUNT);
	}
#line 3485 "parser_yacc.c"
    break;

  case 138: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_ARROW opt_conds TOK_ID TOK_END_OF_RULE  */
#line 1398 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-5].cond_entry), (yyvsp[-4].id), (yyvsp[-2].cond_entry), (yyvsp[-1].id), AA_MAY_MOUNT);
	}
#line 3493 "parser_yacc.c"
    break;

  case 139: /* mnt_rule: TOK_REMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1403 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_DUMMY_REMOUNT);
	}
#line 3501 "parser_yacc.c"
    break;

  case 140: /* mnt_rule: TOK_UMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1408 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_MAY_UMOUNT);
	}
#line 3509 "parser_yacc.c"
    break;

  case 141: /* mnt_rule: TOK_PIVOTROOT opt_conds opt_id opt_target TOK_END_OF_RULE  */
#line 1413 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_pivot_rule((yyvsp[-3].cond_entry), (yyvsp[-2].id), (yyvsp[-1].id));
	}
#line 3517 "parser_yacc.c"
    break;

  case 142: /* dbus_perm: TOK_VALUE  */
#line 1418 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fperms) = AA_DBUS_BIND;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_DBUS_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_DBUS_RECEIVE;
		else if (strcmp((yyvsp[0].var_val), "eavesdrop") == 0)
			(yyval.fperms) = AA_DBUS_EAVESDROP;
		else if ((yyvsp[0].var_val)) {
			parse_dbus_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3539 "parser_yacc.c"
    break;

  case 143: /* dbus_perm: TOK_BIND  */
#line 1435 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_BIND; }
#line 3545 "parser_yacc.c"
    break;

  case 144: /* dbus_perm: TOK_SEND  */
#line 1436 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_SEND; }
#line 3551 "parser_yacc.c"
    break;

  case 145: /* dbus_perm: TOK_RECEIVE  */
#line 1437 "parser_yacc.y"
                      { (yyval.fperms) = AA_DBUS_RECEIVE; }
#line 3557 "parser_yacc.c"
    break;

  case 146: /* dbus_perm: TOK_READ  */
#line 1438 "parser_yacc.y"
                   { (yyval.fperms) = AA_DBUS_RECEIVE; }
#line 3563 "parser_yacc.c"
    break;

  case 147: /* dbus_perm: TOK_WRITE  */
#line 1439 "parser_yacc.y"
                    { (yyval.fperms) = AA_DBUS_SEND; }
#line 3569 "parser_yacc.c"
    break;

  case 148: /* dbus_perm: TOK_EAVESDROP  */
#line 1440 "parser_yacc.y"
                        { (yyval.fperms) = AA_DBUS_EAVESDROP; }
#line 3575 "parser_yacc.c"
    break;

  case 149: /* dbus_perm: TOK_MODE  */
#line 1442 "parser_yacc.y"
        {
		parse_dbus_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3584 "parser_yacc.c"
    break;

  case 150: /* dbus_perms: %empty  */
#line 1447 "parser_yacc.y"
            { /* nothing */ (yyval.fperms) = 0; }
#line 3590 "parser_yacc.c"
    break;

  case 151: /* dbus_perms: dbus_perms dbus_perm  */
#line 1448 "parser_yacc.y"
                               { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3596 "parser_yacc.c"
    break;

  case 152: /* dbus_perms: dbus_perms TOK_COMMA dbus_perm  */
#line 1449 "parser_yacc.y"
                                         { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3602 "parser_yacc.c"
    break;

  case 153: /* opt_dbus_perm: %empty  */
#line 1451 "parser_yacc.y"
               { /* nothing */ (yyval.fperms) = 0; }
#line 3608 "parser_yacc.c"
    break;

  case 154: /* opt_dbus_perm: dbus_perm  */
#line 1452 "parser_yacc.y"
                     { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3614 "parser_yacc.c"
    break;

  case 155: /* opt_dbus_perm: TOK_OPENPAREN dbus_perms TOK_CLOSEPAREN  */
#line 1453 "parser_yacc.y"
                                                  { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3620 "parser_yacc.c"
    break;

  case 156: /* dbus_rule: TOK_DBUS opt_dbus_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1456 "parser_yacc.y"
        {
		dbus_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("dbus rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new dbus_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.dbus_entry) = ent;
	}
#line 3639 "parser_yacc.c"
    break;

  case 157: /* net_perm: TOK_VALUE  */
#line 1472 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_NET_CREATE;
		else if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fperms) = AA_NET_BIND;
		else if (strcmp((yyvsp[0].var_val), "listen") == 0)
			(yyval.fperms) = AA_NET_LISTEN;
		else if (strcmp((yyvsp[0].var_val), "accept") == 0)
			(yyval.fperms) = AA_NET_ACCEPT;
		else if (strcmp((yyvsp[0].var_val), "connect") == 0)
			(yyval.fperms) = AA_NET_CONNECT;
		else if (strcmp((yyvsp[0].var_val), "shutdown") == 0)
			(yyval.fperms) = AA_NET_SHUTDOWN;
		else if (strcmp((yyvsp[0].var_val), "getattr") == 0)
			(yyval.fperms) = AA_NET_GETATTR;
		else if (strcmp((yyvsp[0].var_val), "setattr") == 0)
			(yyval.fperms) = AA_NET_SETATTR;
		else if (strcmp((yyvsp[0].var_val), "getopt") == 0)
			(yyval.fperms) = AA_NET_GETOPT;
		else if (strcmp((yyvsp[0].var_val), "setopt") == 0)
			(yyval.fperms) = AA_NET_SETOPT;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_NET_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_NET_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_net_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3677 "parser_yacc.c"
    break;

  case 158: /* net_perm: TOK_CREATE  */
#line 1505 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_CREATE; }
#line 3683 "parser_yacc.c"
    break;

  case 159: /* net_perm: TOK_BIND  */
#line 1506 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_BIND; }
#line 3689 "parser_yacc.c"
    break;

  case 160: /* net_perm: TOK_LISTEN  */
#line 1507 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_LISTEN; }
#line 3695 "parser_yacc.c"
    break;

  case 161: /* net_perm: TOK_ACCEPT  */
#line 1508 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_ACCEPT; }
#line 3701 "parser_yacc.c"
    break;

  case 162: /* net_perm: TOK_CONNECT  */
#line 1509 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_CONNECT; }
#line 3707 "parser_yacc.c"
    break;

  case 163: /* net_perm: TOK_SHUTDOWN  */
#line 1510 "parser_yacc.y"
                       { (yyval.fperms) = AA_NET_SHUTDOWN; }
#line 3713 "parser_yacc.c"
    break;

  case 164: /* net_perm: TOK_GETATTR  */
#line 1511 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_GETATTR; }
#line 3719 "parser_yacc.c"
    break;

  case 165: /* net_perm: TOK_SETATTR  */
#line 1512 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_SETATTR; }
#line 3725 "parser_yacc.c"
    break;

  case 166: /* net_perm: TOK_GETOPT  */
#line 1513 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_GETOPT; }
#line 3731 "parser_yacc.c"
    break;

  case 167: /* net_perm: TOK_SETOPT  */
#line 1514 "parser_yacc.y"
                     { (yyval.fperms) = AA_NET_SETOPT; }
#line 3737 "parser_yacc.c"
    break;

  case 168: /* net_perm: TOK_SEND  */
#line 1515 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_SEND; }
#line 3743 "parser_yacc.c"
    break;

  case 169: /* net_perm: TOK_RECEIVE  */
#line 1516 "parser_yacc.y"
                      { (yyval.fperms) = AA_NET_RECEIVE; }
#line 3749 "parser_yacc.c"
    break;

  case 170: /* net_perm: TOK_READ  */
#line 1517 "parser_yacc.y"
                   { (yyval.fperms) = AA_NET_RECEIVE; }
#line 3755 "parser_yacc.c"
    break;

  case 171: /* net_perm: TOK_WRITE  */
#line 1518 "parser_yacc.y"
                    { (yyval.fperms) = AA_NET_SEND; }
#line 3761 "parser_yacc.c"
    break;

  case 172: /* net_perm: TOK_MODE  */
#line 1520 "parser_yacc.y"
        {
		parse_unix_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3770 "parser_yacc.c"
    break;

  case 173: /* net_perms: %empty  */
#line 1525 "parser_yacc.y"
           { /* nothing */ (yyval.fperms) = 0; }
#line 3776 "parser_yacc.c"
    break;

  case 174: /* net_perms: net_perms net_perm  */
#line 1526 "parser_yacc.y"
                             { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3782 "parser_yacc.c"
    break;

  case 175: /* net_perms: net_perms TOK_COMMA net_perm  */
#line 1527 "parser_yacc.y"
                                       { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3788 "parser_yacc.c"
    break;

  case 176: /* opt_net_perm: %empty  */
#line 1529 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3794 "parser_yacc.c"
    break;

  case 177: /* opt_net_perm: net_perm  */
#line 1530 "parser_yacc.y"
                    { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3800 "parser_yacc.c"
    break;

  case 178: /* opt_net_perm: TOK_OPENPAREN net_perms TOK_CLOSEPAREN  */
#line 1531 "parser_yacc.y"
                                                 { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3806 "parser_yacc.c"
    break;

  case 179: /* unix_rule: TOK_UNIX opt_net_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1534 "parser_yacc.y"
        {
		unix_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("unix rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new unix_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.unix_entry) = ent;
	}
#line 3825 "parser_yacc.c"
    break;

  case 180: /* signal_perm: TOK_VALUE  */
#line 1550 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MAY_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MAY_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_signal_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3843 "parser_yacc.c"
    break;

  case 181: /* signal_perm: TOK_SEND  */
#line 1563 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_SEND; }
#line 3849 "parser_yacc.c"
    break;

  case 182: /* signal_perm: TOK_RECEIVE  */
#line 1564 "parser_yacc.y"
                      { (yyval.fperms) = AA_MAY_RECEIVE; }
#line 3855 "parser_yacc.c"
    break;

  case 183: /* signal_perm: TOK_READ  */
#line 1565 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_RECEIVE; }
#line 3861 "parser_yacc.c"
    break;

  case 184: /* signal_perm: TOK_WRITE  */
#line 1566 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_SEND; }
#line 3867 "parser_yacc.c"
    break;

  case 185: /* signal_perm: TOK_MODE  */
#line 1568 "parser_yacc.y"
        {
		parse_signal_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3876 "parser_yacc.c"
    break;

  case 186: /* signal_perms: %empty  */
#line 1573 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3882 "parser_yacc.c"
    break;

  case 187: /* signal_perms: signal_perms signal_perm  */
#line 1574 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3888 "parser_yacc.c"
    break;

  case 188: /* signal_perms: signal_perms TOK_COMMA signal_perm  */
#line 1575 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 3894 "parser_yacc.c"
    break;

  case 189: /* opt_signal_perm: %empty  */
#line 1577 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 3900 "parser_yacc.c"
    break;

  case 190: /* opt_signal_perm: signal_perm  */
#line 1578 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 3906 "parser_yacc.c"
    break;

  case 191: /* opt_signal_perm: TOK_OPENPAREN signal_perms TOK_CLOSEPAREN  */
#line 1579 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 3912 "parser_yacc.c"
    break;

  case 192: /* signal_rule: TOK_SIGNAL opt_signal_perm opt_conds TOK_END_OF_RULE  */
#line 1582 "parser_yacc.y"
        {
		signal_rule *ent = new signal_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.signal_entry) = ent;
	}
#line 3921 "parser_yacc.c"
    break;

  case 193: /* ptrace_perm: TOK_VALUE  */
#line 1588 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "trace") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MAY_TRACE;
		else if (strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MAY_READ;
		else if (strcmp((yyvsp[0].var_val), "tracedby") == 0)
			(yyval.fperms) = AA_MAY_TRACEDBY;
		else if (strcmp((yyvsp[0].var_val), "readby") == 0)
			(yyval.fperms) = AA_MAY_READBY;
		else if ((yyvsp[0].var_val))
			parse_ptrace_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3943 "parser_yacc.c"
    break;

  case 194: /* ptrace_perm: TOK_TRACE  */
#line 1605 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_TRACE; }
#line 3949 "parser_yacc.c"
    break;

  case 195: /* ptrace_perm: TOK_TRACEDBY  */
#line 1606 "parser_yacc.y"
                       { (yyval.fperms) = AA_MAY_TRACEDBY; }
#line 3955 "parser_yacc.c"
    break;

  case 196: /* ptrace_perm: TOK_READ  */
#line 1607 "parser_yacc.y"
                   { (yyval.fperms) = AA_MAY_READ; }
#line 3961 "parser_yacc.c"
    break;

  case 197: /* ptrace_perm: TOK_WRITE  */
#line 1608 "parser_yacc.y"
                    { (yyval.fperms) = AA_MAY_TRACE; }
#line 3967 "parser_yacc.c"
    break;

  case 198: /* ptrace_perm: TOK_READBY  */
#line 1609 "parser_yacc.y"
                     { (yyval.fperms) = AA_MAY_READBY; }
#line 3973 "parser_yacc.c"
    break;

  case 199: /* ptrace_perm: TOK_MODE  */
#line 1611 "parser_yacc.y"
        {
		parse_ptrace_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 3982 "parser_yacc.c"
    break;

  case 200: /* ptrace_perms: %empty  */
#line 1616 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 3988 "parser_yacc.c"
    break;

  case 201: /* ptrace_perms: ptrace_perms ptrace_perm  */
#line 1617 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 3994 "parser_yacc.c"
    break;

  case 202: /* ptrace_perms: ptrace_perms TOK_COMMA ptrace_perm  */
#line 1618 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 4000 "parser_yacc.c"
    break;

  case 203: /* opt_ptrace_perm: %empty  */
#line 1620 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 4006 "parser_yacc.c"
    break;

  case 204: /* opt_ptrace_perm: ptrace_perm  */
#line 1621 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 4012 "parser_yacc.c"
    break;

  case 205: /* opt_ptrace_perm: TOK_OPENPAREN ptrace_perms TOK_CLOSEPAREN  */
#line 1622 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 4018 "parser_yacc.c"
    break;

  case 206: /* ptrace_rule: TOK_PTRACE opt_ptrace_perm opt_conds TOK_END_OF_RULE  */
#line 1625 "parser_yacc.y"
        {
		ptrace_rule *ent = new ptrace_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.ptrace_entry) = ent;
	}
#line 4027 "parser_yacc.c"
    break;

  case 207: /* userns_perm: TOK_VALUE  */
#line 1631 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_USERNS_CREATE;
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 4041 "parser_yacc.c"
    break;

  case 208: /* userns_perm: TOK_CREATE  */
#line 1640 "parser_yacc.y"
                     { (yyval.fperms) = AA_USERNS_CREATE; }
#line 4047 "parser_yacc.c"
    break;

  case 209: /* userns_perms: %empty  */
#line 1642 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 4053 "parser_yacc.c"
    break;

  case 210: /* userns_perms: userns_perms userns_perm  */
#line 1643 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 4059 "parser_yacc.c"
    break;

  case 211: /* userns_perms: userns_perms TOK_COMMA userns_perm  */
#line 1644 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 4065 "parser_yacc.c"
    break;

  case 212: /* opt_userns_perm: %empty  */
#line 1646 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 4071 "parser_yacc.c"
    break;

  case 213: /* opt_userns_perm: userns_perm  */
#line 1647 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 4077 "parser_yacc.c"
    break;

  case 214: /* opt_userns_perm: TOK_OPENPAREN userns_perms TOK_CLOSEPAREN  */
#line 1648 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 4083 "parser_yacc.c"
    break;

  case 215: /* userns_rule: TOK_USERNS opt_userns_perm opt_conds TOK_END_OF_RULE  */
#line 1651 "parser_yacc.y"
        {
		userns_rule *ent = new userns_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.userns_entry) = ent;
	}
#line 4092 "parser_yacc.c"
    break;

  case 216: /* mqueue_perm: TOK_VALUE  */
#line 1657 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fperms) = AA_MQUEUE_CREATE;
		else if (strcmp((yyvsp[0].var_val), "open") == 0)
			(yyval.fperms) = AA_MQUEUE_OPEN;
		else if (strcmp((yyvsp[0].var_val), "delete") == 0)
			(yyval.fperms) = AA_MQUEUE_DELETE;
		else if (strcmp((yyvsp[0].var_val), "getattr") == 0)
			(yyval.fperms) = AA_MQUEUE_GETATTR;
		else if (strcmp((yyvsp[0].var_val), "setattr") == 0)
			(yyval.fperms) = AA_MQUEUE_SETATTR;
		else if (strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fperms) = AA_MQUEUE_WRITE;
		else if (strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fperms) = AA_MQUEUE_READ;
		else if ((yyvsp[0].var_val)) {
			parse_mqueue_perms((yyvsp[0].var_val), &(yyval.fperms), 1);
		} else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 4120 "parser_yacc.c"
    break;

  case 217: /* mqueue_perm: TOK_CREATE  */
#line 1680 "parser_yacc.y"
                     { (yyval.fperms) = AA_MQUEUE_CREATE; }
#line 4126 "parser_yacc.c"
    break;

  case 218: /* mqueue_perm: TOK_OPEN  */
#line 1681 "parser_yacc.y"
                   { (yyval.fperms) = AA_MQUEUE_OPEN; }
#line 4132 "parser_yacc.c"
    break;

  case 219: /* mqueue_perm: TOK_DELETE  */
#line 1682 "parser_yacc.y"
                     { (yyval.fperms) = AA_MQUEUE_DELETE; }
#line 4138 "parser_yacc.c"
    break;

  case 220: /* mqueue_perm: TOK_GETATTR  */
#line 1683 "parser_yacc.y"
                      { (yyval.fperms) = AA_MQUEUE_GETATTR; }
#line 4144 "parser_yacc.c"
    break;

  case 221: /* mqueue_perm: TOK_SETATTR  */
#line 1684 "parser_yacc.y"
                      { (yyval.fperms) = AA_MQUEUE_SETATTR; }
#line 4150 "parser_yacc.c"
    break;

  case 222: /* mqueue_perm: TOK_WRITE  */
#line 1685 "parser_yacc.y"
                    { (yyval.fperms) = AA_MQUEUE_WRITE; }
#line 4156 "parser_yacc.c"
    break;

  case 223: /* mqueue_perm: TOK_READ  */
#line 1686 "parser_yacc.y"
                   { (yyval.fperms) = AA_MQUEUE_READ; }
#line 4162 "parser_yacc.c"
    break;

  case 224: /* mqueue_perm: TOK_MODE  */
#line 1688 "parser_yacc.y"
        {
		parse_mqueue_perms((yyvsp[0].mode), &(yyval.fperms), 1);
		free((yyvsp[0].mode));
	}
#line 4171 "parser_yacc.c"
    break;

  case 225: /* mqueue_perms: %empty  */
#line 1693 "parser_yacc.y"
              { /* nothing */ (yyval.fperms) = 0; }
#line 4177 "parser_yacc.c"
    break;

  case 226: /* mqueue_perms: mqueue_perms mqueue_perm  */
#line 1694 "parser_yacc.y"
                                   { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 4183 "parser_yacc.c"
    break;

  case 227: /* mqueue_perms: mqueue_perms TOK_COMMA mqueue_perm  */
#line 1695 "parser_yacc.y"
                                             { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 4189 "parser_yacc.c"
    break;

  case 228: /* opt_mqueue_perm: %empty  */
#line 1697 "parser_yacc.y"
                 { /* nothing */ (yyval.fperms) = 0; }
#line 4195 "parser_yacc.c"
    break;

  case 229: /* opt_mqueue_perm: mqueue_perm  */
#line 1698 "parser_yacc.y"
                      { (yyval.fperms) = (yyvsp[0].fperms); }
#line 4201 "parser_yacc.c"
    break;

  case 230: /* opt_mqueue_perm: TOK_OPENPAREN mqueue_perms TOK_CLOSEPAREN  */
#line 1699 "parser_yacc.y"
                                                    { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 4207 "parser_yacc.c"
    break;

  case 231: /* mqueue_rule: TOK_MQUEUE opt_mqueue_perm opt_conds TOK_END_OF_RULE  */
#line 1702 "parser_yacc.y"
        {
		mqueue_rule *ent = new mqueue_rule((yyvsp[-2].fperms), (yyvsp[-1].cond_entry));
		(yyval.mqueue_entry) = ent;
	}
#line 4216 "parser_yacc.c"
    break;

  case 232: /* mqueue_rule: TOK_MQUEUE opt_mqueue_perm opt_conds TOK_ID TOK_END_OF_RULE  */
#line 1707 "parser_yacc.y"
        {
		mqueue_rule *ent = new mqueue_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].id));
		(yyval.mqueue_entry) = ent;
	}
#line 4225 "parser_yacc.c"
    break;

  case 233: /* io_uring_perm: TOK_VALUE  */
#line 1713 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "override_creds") == 0)
			(yyval.fperms) = AA_IO_URING_OVERRIDE_CREDS;
		else if (strcmp((yyvsp[0].var_val), "sqpoll") == 0)
			(yyval.fperms) = AA_IO_URING_SQPOLL;
		else
			(yyval.fperms) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 4241 "parser_yacc.c"
    break;

  case 234: /* io_uring_perm: TOK_OVERRIDE_CREDS  */
#line 1724 "parser_yacc.y"
                             { (yyval.fperms) = AA_IO_URING_OVERRIDE_CREDS; }
#line 4247 "parser_yacc.c"
    break;

  case 235: /* io_uring_perm: TOK_SQPOLL  */
#line 1725 "parser_yacc.y"
                     { (yyval.fperms) = AA_IO_URING_SQPOLL; }
#line 4253 "parser_yacc.c"
    break;

  case 236: /* io_uring_perms: %empty  */
#line 1727 "parser_yacc.y"
                { /* nothing */ (yyval.fperms) = 0; }
#line 4259 "parser_yacc.c"
    break;

  case 237: /* io_uring_perms: io_uring_perms io_uring_perm  */
#line 1728 "parser_yacc.y"
                                       { (yyval.fperms) = (yyvsp[-1].fperms) | (yyvsp[0].fperms); }
#line 4265 "parser_yacc.c"
    break;

  case 238: /* io_uring_perms: io_uring_perms TOK_COMMA io_uring_perm  */
#line 1729 "parser_yacc.y"
                                                 { (yyval.fperms) = (yyvsp[-2].fperms) | (yyvsp[0].fperms); }
#line 4271 "parser_yacc.c"
    break;

  case 239: /* opt_io_uring_perm: %empty  */
#line 1731 "parser_yacc.y"
                   { /* nothing */ (yyval.fperms) = 0; }
#line 4277 "parser_yacc.c"
    break;

  case 240: /* opt_io_uring_perm: io_uring_perm  */
#line 1732 "parser_yacc.y"
                        { (yyval.fperms) = (yyvsp[0].fperms); }
#line 4283 "parser_yacc.c"
    break;

  case 241: /* opt_io_uring_perm: TOK_OPENPAREN io_uring_perms TOK_CLOSEPAREN  */
#line 1733 "parser_yacc.y"
                                                      { (yyval.fperms) = (yyvsp[-1].fperms); }
#line 4289 "parser_yacc.c"
    break;

  case 242: /* io_uring_rule: TOK_IO_URING opt_io_uring_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1736 "parser_yacc.y"
        {
		io_uring_rule *ent;
		ent = new io_uring_rule((yyvsp[-3].fperms), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.io_uring_entry) = ent;
	}
#line 4301 "parser_yacc.c"
    break;

  case 243: /* all_rule: TOK_ALL TOK_END_OF_RULE  */
#line 1745 "parser_yacc.y"
        {
		all_rule *ent = new all_rule();
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.all_entry) = ent;
	}
#line 4312 "parser_yacc.c"
    break;

  case 244: /* hat_start: TOK_CARET  */
#line 1752 "parser_yacc.y"
                     {}
#line 4318 "parser_yacc.c"
    break;

  case 245: /* hat_start: TOK_HAT  */
#line 1753 "parser_yacc.y"
                  {}
#line 4324 "parser_yacc.c"
    break;

  case 246: /* file_perms: TOK_MODE  */
#line 1756 "parser_yacc.y"
        {
		/* A single TOK_MODE maps to the same permission in all
		 * of user::other */
		(yyval.fperms) = parse_perms((yyvsp[0].mode));
		free((yyvsp[0].mode));
	}
#line 4335 "parser_yacc.c"
    break;

  case 247: /* change_profile: TOK_CHANGE_PROFILE opt_exec_mode opt_id opt_named_transition TOK_END_OF_RULE  */
#line 1764 "parser_yacc.y"
        {
		struct cod_entry *entry;
		perm32_t perms = AA_CHANGE_PROFILE;
		int exec_mode = (yyvsp[-3].integer);
		char *exec = (yyvsp[-2].id);
		char *target = (yyvsp[-1].id);

		if (exec) {
			/* exec bits required to trigger rule conflict if
			 * for overlapping safe and unsafe exec rules
			 */
			perms |= AA_EXEC_BITS;
			if (exec_mode == EXEC_MODE_UNSAFE)
				perms |= ALL_AA_EXEC_UNSAFE;
			else if (exec_mode == EXEC_MODE_SAFE &&
				 !features_supports_stacking) {
				pwarn(WARN_RULE_DOWNGRADED, "downgrading change_profile safe rule to unsafe due to lack of necessary kernel support\n");
				/**
				 * No need to do anything because 'unsafe' exec
				 * mode is the only supported mode of
				 * change_profile rules in non-stacking kernels
				 */
			}
		} else if (exec_mode != EXEC_MODE_EMPTY)
			yyerror(_("Exec condition is required when unsafe or safe keywords are present"));
		if (exec && !(exec[0] == '/' || strncmp(exec, "@{", 2) == 0))
			yyerror(_("Exec condition must begin with '/'."));

		if (target) {
			PDEBUG("Matched change_profile: tok_id (%s)\n", target);
		} else {
			PDEBUG("Matched change_profile,\n");
			target = strdup("**");
			if (!target)
				yyerror(_("Memory allocation error."));
		}

		entry = new_entry(target, perms, exec);
		if (!entry)
			yyerror(_("Memory allocation error."));

		PDEBUG("change_profile.entry: (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 4384 "parser_yacc.c"
    break;

  case 248: /* capability: TOK_CAPABILITY caps TOK_END_OF_RULE  */
#line 1810 "parser_yacc.y"
        {
		if ((yyvsp[-1].cap) == 0) {
			/* bare capability keyword - set all caps */
			(yyval.cap) = 0xffffffffffffffff;
		} else
			(yyval.cap) = (yyvsp[-1].cap);
	}
#line 4396 "parser_yacc.c"
    break;

  case 249: /* caps: %empty  */
#line 1818 "parser_yacc.y"
      { /* nothing */ (yyval.cap) = 0; }
#line 4402 "parser_yacc.c"
    break;

  case 250: /* caps: caps TOK_ID  */
#line 1820 "parser_yacc.y"
        {
		int backmap, cap = name_to_capability((yyvsp[0].id));
		if (cap == -1)
			yyerror(_("Invalid capability %s."), (yyvsp[0].id));
		free((yyvsp[0].id));
		backmap = capability_backmap(cap);
		if (backmap != NO_BACKMAP_CAP && !capability_in_kernel(cap)) {
			/* TODO: special backmap warning */
			cap = backmap;
		}
		(yyval.cap) = (yyvsp[-1].cap) | CAP_TO_MASK(cap);
	}
#line 4419 "parser_yacc.c"
    break;


#line 4423 "parser_yacc.c"

      default: break;
    }
  /* User semantic actions sometimes alter yychar, and that requires
     that yytoken be updated with the new translation.  We take the
     approach of translating immediately before every use of yytoken.
     One alternative is translating here after every semantic action,
     but that translation would be missed if the semantic action invokes
     YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or
     if it invokes YYBACKUP.  In the case of YYABORT or YYACCEPT, an
     incorrect destructor might then be invoked immediately.  In the
     case of YYERROR or YYBACKUP, subsequent parser actions might lead
     to an incorrect destructor call or verbose syntax error message
     before the lookahead is translated.  */
  YY_SYMBOL_PRINT ("-> $$ =", YY_CAST (yysymbol_kind_t, yyr1[yyn]), &yyval, &yyloc);

  YYPOPSTACK (yylen);
  yylen = 0;

  *++yyvsp = yyval;

  /* Now 'shift' the result of the reduction.  Determine what state
     that goes to, based on the state we popped back to and the rule
     number reduced by.  */
  {
    const int yylhs = yyr1[yyn] - YYNTOKENS;
    const int yyi = yypgoto[yylhs] + *yyssp;
    yystate = (0 <= yyi && yyi <= YYLAST && yycheck[yyi] == *yyssp
               ? yytable[yyi]
               : yydefgoto[yylhs]);
  }

  goto yynewstate;


/*--------------------------------------.
| yyerrlab -- here on detecting error.  |
`--------------------------------------*/
yyerrlab:
  /* Make sure we have latest lookahead translation.  See comments at
     user semantic actions for why this is necessary.  */
  yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar);
  /* If not already recovering from an error, report this error.  */
  if (!yyerrstatus)
    {
      ++yynerrs;
      {
        yypcontext_t yyctx
          = {yyssp, yytoken};
        char const *yymsgp = YY_("syntax error");
        int yysyntax_error_status;
        yysyntax_error_status = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
        if (yysyntax_error_status == 0)
          yymsgp = yymsg;
        else if (yysyntax_error_status == -1)
          {
            if (yymsg != yymsgbuf)
              YYSTACK_FREE (yymsg);
            yymsg = YY_CAST (char *,
                             YYSTACK_ALLOC (YY_CAST (YYSIZE_T, yymsg_alloc)));
            if (yymsg)
              {
                yysyntax_error_status
                  = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
                yymsgp = yymsg;
              }
            else
              {
                yymsg = yymsgbuf;
                yymsg_alloc = sizeof yymsgbuf;
                yysyntax_error_status = YYENOMEM;
              }
          }
        yyerror("%s", yymsgp);
        if (yysyntax_error_status == YYENOMEM)
          YYNOMEM;
      }
    }

  if (yyerrstatus == 3)
    {
      /* If just tried and failed to reuse lookahead token after an
         error, discard it.  */

      if (yychar <= YYEOF)
        {
          /* Return failure if at end of input.  */
          if (yychar == YYEOF)
            YYABORT;
        }
      else
        {
          yydestruct ("Error: discarding",
                      yytoken, &yylval);
          yychar = YYEMPTY;
        }
    }

  /* Else will try to reuse lookahead token after shifting the error
     token.  */
  goto yyerrlab1;


/*---------------------------------------------------.
| yyerrorlab -- error raised explicitly by YYERROR.  |
`---------------------------------------------------*/
yyerrorlab:
  /* Pacify compilers when the user code never invokes YYERROR and the
     label yyerrorlab therefore never appears in user code.  */
  if (0)
    YYERROR;
  ++yynerrs;

  /* Do not reclaim the symbols of the rule whose action triggered
     this YYERROR.  */
  YYPOPSTACK (yylen);
  yylen = 0;
  YY_STACK_PRINT (yyss, yyssp);
  yystate = *yyssp;
  goto yyerrlab1;


/*-------------------------------------------------------------.
| yyerrlab1 -- common code for both syntax error and YYERROR.  |
`-------------------------------------------------------------*/
yyerrlab1:
  yyerrstatus = 3;      /* Each real token shifted decrements this.  */

  /* Pop stack until we find a state that shifts the error token.  */
  for (;;)
    {
      yyn = yypact[yystate];
      if (!yypact_value_is_default (yyn))
        {
          yyn += YYSYMBOL_YYerror;
          if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYSYMBOL_YYerror)
            {
              yyn = yytable[yyn];
              if (0 < yyn)
                break;
            }
        }

      /* Pop the current state because it cannot handle the error token.  */
      if (yyssp == yyss)
        YYABORT;


      yydestruct ("Error: popping",
                  YY_ACCESSING_SYMBOL (yystate), yyvsp);
      YYPOPSTACK (1);
      yystate = *yyssp;
      YY_STACK_PRINT (yyss, yyssp);
    }

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END


  /* Shift the error token.  */
  YY_SYMBOL_PRINT ("Shifting", YY_ACCESSING_SYMBOL (yyn), yyvsp, yylsp);

  yystate = yyn;
  goto yynewstate;


/*-------------------------------------.
| yyacceptlab -- YYACCEPT comes here.  |
`-------------------------------------*/
yyacceptlab:
  yyresult = 0;
  goto yyreturnlab;


/*-----------------------------------.
| yyabortlab -- YYABORT comes here.  |
`-----------------------------------*/
yyabortlab:
  yyresult = 1;
  goto yyreturnlab;


/*-----------------------------------------------------------.
| yyexhaustedlab -- YYNOMEM (memory exhaustion) comes here.  |
`-----------------------------------------------------------*/
yyexhaustedlab:
  yyerror (YY_("memory exhausted"));
  yyresult = 2;
  goto yyreturnlab;


/*----------------------------------------------------------.
| yyreturnlab -- parsing is finished, clean up and return.  |
`----------------------------------------------------------*/
yyreturnlab:
  if (yychar != YYEMPTY)
    {
      /* Make sure we have latest lookahead translation.  See comments at
         user semantic actions for why this is necessary.  */
      yytoken = YYTRANSLATE (yychar);
      yydestruct ("Cleanup: discarding lookahead",
                  yytoken, &yylval);
    }
  /* Do not reclaim the symbols of the rule whose action triggered
     this YYABORT or YYACCEPT.  */
  YYPOPSTACK (yylen);
  YY_STACK_PRINT (yyss, yyssp);
  while (yyssp != yyss)
    {
      yydestruct ("Cleanup: popping",
                  YY_ACCESSING_SYMBOL (+*yyssp), yyvsp);
      YYPOPSTACK (1);
    }
#ifndef yyoverflow
  if (yyss != yyssa)
    YYSTACK_FREE (yyss);
#endif
  if (yymsg != yymsgbuf)
    YYSTACK_FREE (yymsg);
  return yyresult;
}

#line 1833 "parser_yacc.y"

#define MAXBUFSIZE 4096

void vprintyyerror(const char *msg, va_list argptr)
{
	char buf[MAXBUFSIZE];

	vsnprintf(buf, sizeof(buf), msg, argptr);

	if (profilename) {
		PERROR(_("AppArmor parser error for %s%s%s at line %d: %s\n"),
		       profilename,
		       current_filename ? " in profile " : "",
		       current_filename ? current_filename : "",
		       current_lineno, buf);
	} else {
		PERROR(_("AppArmor parser error at line %d: %s\n"),
		       current_lineno, buf);
	}
}

void printyyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);
}

void yyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);

	exit(1);
}

struct cod_entry *do_file_rule(char *id, perm32_t perms, char *link_id, char *nt)
{
		struct cod_entry *entry;
		PDEBUG("Matched: tok_id (%s) tok_perms (0x%x)\n", id, perms);
		entry = new_entry(id, perms, link_id);
		if (!entry)
			yyerror(_("Memory allocation error."));
		entry->nt_name = nt;
		PDEBUG("rule.entry: (%s)\n", entry->name);
		return entry;
}

static const char *mnt_cond_msg[] = {"",
			 " not allowed as source conditional",
			 " not allowed as target conditional",
			 "",
			 NULL};

int verify_mnt_conds(struct cond_entry *conds, int src)
{
	struct cond_entry *entry;
	int error = 0;

	if (!conds)
		return 0;

	list_for_each(conds, entry) {
		int res = is_valid_mnt_cond(entry->name, src);
		if (res <= 0) {
				printyyerror(_("invalid mount conditional %s%s"),
					     entry->name,
					     res == -1 ? "" : mnt_cond_msg[src]);
				error++;
		}
	}

	return error;
}

mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      perm32_t perms)
{
	if (verify_mnt_conds(src_conds, MNT_SRC_OPT) != 0)
		yyerror(_("bad mount rule"));

	/* FIXME: atm conditions are not supported on dst
	if (verify_conds(dst_conds, DST_OPT) != 0)
		yyerror(_("bad mount rule"));
	*/
	if (dst_conds)
		yyerror(_("mount point conditions not currently supported"));

	mnt_rule *ent = new mnt_rule(src_conds, src, dst_conds, dst, perms);
	if (!ent) {
		yyerror(_("Memory allocation error."));
	}

	return ent;
}

mnt_rule *do_pivot_rule(struct cond_entry *old, char *root, char *transition)
{
	char *device = NULL;
	if (old) {
		if (strcmp(old->name, "oldroot") != 0)
			yyerror(_("invalid pivotroot conditional '%s'"), old->name);
		if (old->vals) {
			device = old->vals->value;
			old->vals->value = NULL;
		}
		free_cond_entry(old);
	}

	mnt_rule *ent = new mnt_rule(NULL, device, NULL, root, AA_MAY_PIVOTROOT);
	ent->trans = transition;

	return ent;
}

static int abi_features_base(struct aa_features **features, char *filename, bool search)
{
	autofclose FILE *f = NULL;
	struct stat my_stat;
	autofree char *fullpath = NULL;
	bool cached;

	if (search) {
		if (strcmp(filename, "kernel") == 0) {
			if (kernel_features) {
				*features = aa_features_ref(kernel_features);
				return 0;
			}
			return aa_features_new_from_kernel(features);
		} else if (strcmp(filename, "default") == 0) {
			return aa_features_new_from_string(features,
								default_features_abi,
								strlen(default_features_abi));
		}
		f = search_path(filename, &fullpath, &cached);
		PDEBUG("abi lookup '%s' -> '%s' f %p cached %d\n", filename, fullpath, f, cached);
		if (!f && cached) {
			*features = NULL;
			return 0;
		}
	} else {
		f = fopen(filename, "r");
		PDEBUG("abi relpath '%s' f %p\n", filename, f);
	}

	if (!f) {
		yyerror(_("Could not open '%s': %m"),
                        fullpath ? fullpath: filename);
	}

	if (fstat(fileno(f), &my_stat))
		yyerror(_("fstat failed for '%s': %m"), fullpath ? fullpath : filename);

        if (S_ISREG(my_stat.st_mode)) {
		return aa_features_new_from_file(features, fileno(f));
	}

	return -1;
}

static void abi_features(char *filename, bool search)
{
	struct aa_features *tmp_features;

	if (abi_features_base(&tmp_features, filename, search) == -1) {
			yyerror(_("failed to find features abi '%s': %m"), filename);
	}
	if (policy_features) {
		if (tmp_features) {
			if (!aa_features_is_equal(tmp_features, policy_features)) {
				pwarn(WARN_ABI, _("%s: %s features abi '%s' differs from policy declared feature abi, using the features abi declared in policy\n"), progname, current_filename, filename);
			}
			aa_features_unref(tmp_features);
		}
	} else if (!tmp_features) {
		/* skipped reinclude, but features not set */
		yyerror(_("failed features abi not set but include cache skipped\n"));
	} else {
		/* first features abi declaration */
		policy_features = tmp_features;
	}

};
