/* A Bison parser, made by GNU Bison 3.8.2.  */

/* Bison implementation for Yacc-like parsers in C

   Copyright (C) 1984, 1989-1990, 2000-2015, 2018-2021 Free Software Foundation,
   Inc.

   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation, either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */

/* As a special exception, you may create a larger work that contains
   part or all of the Bison parser skeleton and distribute that work
   under terms of your choice, so long as that work isn't itself a
   parser generator using the skeleton or a modified version thereof
   as a parser skeleton.  Alternatively, if you modify or redistribute
   the parser skeleton itself, you may (at your option) remove this
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.

   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

/* C LALR(1) parser skeleton written by Richard Stallman, by
   simplifying the original so-called "semantic" parser.  */

/* DO NOT RELY ON FEATURES THAT ARE NOT DOCUMENTED in the manual,
   especially those whose name start with YY_ or yy_.  They are
   private implementation details that can be changed or removed.  */

/* All symbols defined below should begin with yy or YY, to avoid
   infringing on user name space.  This should be done even for local
   variables, as they might otherwise be expanded by user macros.
   There are some unavoidable exceptions within include files to
   define necessary library symbols; they are noted "INFRINGES ON
   USER NAME SPACE" below.  */

/* Identify Bison output, and Bison version.  */
#define YYBISON 30802

/* Bison version string.  */
#define YYBISON_VERSION "3.8.2"

/* Skeleton name.  */
#define YYSKELETON_NAME "yacc.c"

/* Pure parsers.  */
#define YYPURE 0

/* Push parsers.  */
#define YYPUSH 0

/* Pull parsers.  */
#define YYPULL 1




/* First part of user prologue.  */
#line 1 "parser_yacc.y"

/*
 *   Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
 *   NOVELL (All rights reserved)
 *   Copyright (c) 2010-2012
 *   Canonical Ltd.
 *
 *   This program is free software; you can redistribute it and/or
 *   modify it under the terms of version 2 of the GNU General Public
 *   License published by the Free Software Foundation.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, contact Canonical, Ltd.
 */

#define YYERROR_VERBOSE 1
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/apparmor.h>

#include <iostream>

/* #define DEBUG */

#include "capability.h"
#include "lib.h"
#include "parser.h"
#include "profile.h"
#include "mount.h"
#include "dbus.h"
#include "af_unix.h"
#include "parser_include.h"
#include <unistd.h>
#include <netinet/in.h>
#include <arpa/inet.h>


#define CIDR_32 htonl(0xffffffff)
#define CIDR_24 htonl(0xffffff00)
#define CIDR_16 htonl(0xffff0000)
#define CIDR_8  htonl(0xff000000)

/* undefine linux/capability.h CAP_TO_MASK */
#ifdef CAP_TO_MASK
#undef CAP_TO_MASK
#endif

#define CAP_TO_MASK(x) (1ull << (x))

#define EXEC_MODE_EMPTY		0
#define EXEC_MODE_UNSAFE	1
#define EXEC_MODE_SAFE		2

int parser_token = 0;

struct cod_entry *do_file_rule(char *id, int mode, char *link_id, char *nt);
mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      int mode);
mnt_rule *do_pivot_rule(struct cond_entry *old, char *root,
			char *transition);
static void abi_features(char *filename, bool search);
void add_local_entry(Profile *prof);


#line 147 "parser_yacc.c"

# ifndef YY_CAST
#  ifdef __cplusplus
#   define YY_CAST(Type, Val) static_cast<Type> (Val)
#   define YY_REINTERPRET_CAST(Type, Val) reinterpret_cast<Type> (Val)
#  else
#   define YY_CAST(Type, Val) ((Type) (Val))
#   define YY_REINTERPRET_CAST(Type, Val) ((Type) (Val))
#  endif
# endif
# ifndef YY_NULLPTR
#  if defined __cplusplus
#   if 201103L <= __cplusplus
#    define YY_NULLPTR nullptr
#   else
#    define YY_NULLPTR 0
#   endif
#  else
#   define YY_NULLPTR ((void*)0)
#  endif
# endif

#include "parser_yacc.h"
/* Symbol kind.  */
enum yysymbol_kind_t
{
  YYSYMBOL_YYEMPTY = -2,
  YYSYMBOL_YYEOF = 0,                      /* "end of file"  */
  YYSYMBOL_YYerror = 1,                    /* error  */
  YYSYMBOL_YYUNDEF = 2,                    /* "invalid token"  */
  YYSYMBOL_TOK_ID = 3,                     /* TOK_ID  */
  YYSYMBOL_TOK_CONDID = 4,                 /* TOK_CONDID  */
  YYSYMBOL_TOK_CONDLISTID = 5,             /* TOK_CONDLISTID  */
  YYSYMBOL_TOK_CARET = 6,                  /* TOK_CARET  */
  YYSYMBOL_TOK_OPEN = 7,                   /* TOK_OPEN  */
  YYSYMBOL_TOK_CLOSE = 8,                  /* TOK_CLOSE  */
  YYSYMBOL_TOK_MODE = 9,                   /* TOK_MODE  */
  YYSYMBOL_TOK_END_OF_RULE = 10,           /* TOK_END_OF_RULE  */
  YYSYMBOL_TOK_EQUALS = 11,                /* TOK_EQUALS  */
  YYSYMBOL_TOK_ARROW = 12,                 /* TOK_ARROW  */
  YYSYMBOL_TOK_ADD_ASSIGN = 13,            /* TOK_ADD_ASSIGN  */
  YYSYMBOL_TOK_LE = 14,                    /* TOK_LE  */
  YYSYMBOL_TOK_SET_VAR = 15,               /* TOK_SET_VAR  */
  YYSYMBOL_TOK_BOOL_VAR = 16,              /* TOK_BOOL_VAR  */
  YYSYMBOL_TOK_VALUE = 17,                 /* TOK_VALUE  */
  YYSYMBOL_TOK_IF = 18,                    /* TOK_IF  */
  YYSYMBOL_TOK_ELSE = 19,                  /* TOK_ELSE  */
  YYSYMBOL_TOK_NOT = 20,                   /* TOK_NOT  */
  YYSYMBOL_TOK_DEFINED = 21,               /* TOK_DEFINED  */
  YYSYMBOL_TOK_CHANGE_PROFILE = 22,        /* TOK_CHANGE_PROFILE  */
  YYSYMBOL_TOK_NETWORK = 23,               /* TOK_NETWORK  */
  YYSYMBOL_TOK_UNIX = 24,                  /* TOK_UNIX  */
  YYSYMBOL_TOK_CREATE = 25,                /* TOK_CREATE  */
  YYSYMBOL_TOK_SHUTDOWN = 26,              /* TOK_SHUTDOWN  */
  YYSYMBOL_TOK_ACCEPT = 27,                /* TOK_ACCEPT  */
  YYSYMBOL_TOK_CONNECT = 28,               /* TOK_CONNECT  */
  YYSYMBOL_TOK_LISTEN = 29,                /* TOK_LISTEN  */
  YYSYMBOL_TOK_SETOPT = 30,                /* TOK_SETOPT  */
  YYSYMBOL_TOK_GETOPT = 31,                /* TOK_GETOPT  */
  YYSYMBOL_TOK_SETATTR = 32,               /* TOK_SETATTR  */
  YYSYMBOL_TOK_GETATTR = 33,               /* TOK_GETATTR  */
  YYSYMBOL_TOK_HAT = 34,                   /* TOK_HAT  */
  YYSYMBOL_TOK_UNSAFE = 35,                /* TOK_UNSAFE  */
  YYSYMBOL_TOK_SAFE = 36,                  /* TOK_SAFE  */
  YYSYMBOL_TOK_COLON = 37,                 /* TOK_COLON  */
  YYSYMBOL_TOK_LINK = 38,                  /* TOK_LINK  */
  YYSYMBOL_TOK_OWNER = 39,                 /* TOK_OWNER  */
  YYSYMBOL_TOK_OTHER = 40,                 /* TOK_OTHER  */
  YYSYMBOL_TOK_SUBSET = 41,                /* TOK_SUBSET  */
  YYSYMBOL_TOK_AUDIT = 42,                 /* TOK_AUDIT  */
  YYSYMBOL_TOK_DENY = 43,                  /* TOK_DENY  */
  YYSYMBOL_TOK_ALLOW = 44,                 /* TOK_ALLOW  */
  YYSYMBOL_TOK_PROFILE = 45,               /* TOK_PROFILE  */
  YYSYMBOL_TOK_SET = 46,                   /* TOK_SET  */
  YYSYMBOL_TOK_ALIAS = 47,                 /* TOK_ALIAS  */
  YYSYMBOL_TOK_PTRACE = 48,                /* TOK_PTRACE  */
  YYSYMBOL_TOK_OPENPAREN = 49,             /* TOK_OPENPAREN  */
  YYSYMBOL_TOK_CLOSEPAREN = 50,            /* TOK_CLOSEPAREN  */
  YYSYMBOL_TOK_COMMA = 51,                 /* TOK_COMMA  */
  YYSYMBOL_TOK_FILE = 52,                  /* TOK_FILE  */
  YYSYMBOL_TOK_MOUNT = 53,                 /* TOK_MOUNT  */
  YYSYMBOL_TOK_REMOUNT = 54,               /* TOK_REMOUNT  */
  YYSYMBOL_TOK_UMOUNT = 55,                /* TOK_UMOUNT  */
  YYSYMBOL_TOK_PIVOTROOT = 56,             /* TOK_PIVOTROOT  */
  YYSYMBOL_TOK_IN = 57,                    /* TOK_IN  */
  YYSYMBOL_TOK_DBUS = 58,                  /* TOK_DBUS  */
  YYSYMBOL_TOK_SIGNAL = 59,                /* TOK_SIGNAL  */
  YYSYMBOL_TOK_SEND = 60,                  /* TOK_SEND  */
  YYSYMBOL_TOK_RECEIVE = 61,               /* TOK_RECEIVE  */
  YYSYMBOL_TOK_BIND = 62,                  /* TOK_BIND  */
  YYSYMBOL_TOK_READ = 63,                  /* TOK_READ  */
  YYSYMBOL_TOK_WRITE = 64,                 /* TOK_WRITE  */
  YYSYMBOL_TOK_EAVESDROP = 65,             /* TOK_EAVESDROP  */
  YYSYMBOL_TOK_PEER = 66,                  /* TOK_PEER  */
  YYSYMBOL_TOK_TRACE = 67,                 /* TOK_TRACE  */
  YYSYMBOL_TOK_TRACEDBY = 68,              /* TOK_TRACEDBY  */
  YYSYMBOL_TOK_READBY = 69,                /* TOK_READBY  */
  YYSYMBOL_TOK_ABI = 70,                   /* TOK_ABI  */
  YYSYMBOL_TOK_RLIMIT = 71,                /* TOK_RLIMIT  */
  YYSYMBOL_TOK_SOFT_RLIMIT = 72,           /* TOK_SOFT_RLIMIT  */
  YYSYMBOL_TOK_RLIMIT_CPU = 73,            /* TOK_RLIMIT_CPU  */
  YYSYMBOL_TOK_RLIMIT_FSIZE = 74,          /* TOK_RLIMIT_FSIZE  */
  YYSYMBOL_TOK_RLIMIT_DATA = 75,           /* TOK_RLIMIT_DATA  */
  YYSYMBOL_TOK_RLIMIT_STACK = 76,          /* TOK_RLIMIT_STACK  */
  YYSYMBOL_TOK_RLIMIT_CORE = 77,           /* TOK_RLIMIT_CORE  */
  YYSYMBOL_TOK_RLIMIT_RSS = 78,            /* TOK_RLIMIT_RSS  */
  YYSYMBOL_TOK_RLIMIT_NOFILE = 79,         /* TOK_RLIMIT_NOFILE  */
  YYSYMBOL_TOK_RLIMIT_OFILE = 80,          /* TOK_RLIMIT_OFILE  */
  YYSYMBOL_TOK_RLIMIT_AS = 81,             /* TOK_RLIMIT_AS  */
  YYSYMBOL_TOK_RLIMIT_NPROC = 82,          /* TOK_RLIMIT_NPROC  */
  YYSYMBOL_TOK_RLIMIT_MEMLOCK = 83,        /* TOK_RLIMIT_MEMLOCK  */
  YYSYMBOL_TOK_RLIMIT_LOCKS = 84,          /* TOK_RLIMIT_LOCKS  */
  YYSYMBOL_TOK_RLIMIT_SIGPENDING = 85,     /* TOK_RLIMIT_SIGPENDING  */
  YYSYMBOL_TOK_RLIMIT_MSGQUEUE = 86,       /* TOK_RLIMIT_MSGQUEUE  */
  YYSYMBOL_TOK_RLIMIT_NICE = 87,           /* TOK_RLIMIT_NICE  */
  YYSYMBOL_TOK_RLIMIT_RTPRIO = 88,         /* TOK_RLIMIT_RTPRIO  */
  YYSYMBOL_TOK_CAPABILITY = 89,            /* TOK_CAPABILITY  */
  YYSYMBOL_TOK_FLAGS = 90,                 /* TOK_FLAGS  */
  YYSYMBOL_YYACCEPT = 91,                  /* $accept  */
  YYSYMBOL_list = 92,                      /* list  */
  YYSYMBOL_93_1 = 93,                      /* $@1  */
  YYSYMBOL_profilelist = 94,               /* profilelist  */
  YYSYMBOL_opt_profile_flag = 95,          /* opt_profile_flag  */
  YYSYMBOL_opt_id = 96,                    /* opt_id  */
  YYSYMBOL_opt_id_or_var = 97,             /* opt_id_or_var  */
  YYSYMBOL_profile_base = 98,              /* profile_base  */
  YYSYMBOL_99_2 = 99,                      /* @2  */
  YYSYMBOL_profile = 100,                  /* profile  */
  YYSYMBOL_local_profile = 101,            /* local_profile  */
  YYSYMBOL_hat = 102,                      /* hat  */
  YYSYMBOL_preamble = 103,                 /* preamble  */
  YYSYMBOL_alias = 104,                    /* alias  */
  YYSYMBOL_varassign = 105,                /* varassign  */
  YYSYMBOL_valuelist = 106,                /* valuelist  */
  YYSYMBOL_flags = 107,                    /* flags  */
  YYSYMBOL_opt_flags = 108,                /* opt_flags  */
  YYSYMBOL_flagvals = 109,                 /* flagvals  */
  YYSYMBOL_flagval = 110,                  /* flagval  */
  YYSYMBOL_opt_subset_flag = 111,          /* opt_subset_flag  */
  YYSYMBOL_opt_audit_flag = 112,           /* opt_audit_flag  */
  YYSYMBOL_opt_owner_flag = 113,           /* opt_owner_flag  */
  YYSYMBOL_opt_perm_mode = 114,            /* opt_perm_mode  */
  YYSYMBOL_opt_prefix = 115,               /* opt_prefix  */
  YYSYMBOL_rules = 116,                    /* rules  */
  YYSYMBOL_cond_rule = 117,                /* cond_rule  */
  YYSYMBOL_expr = 118,                     /* expr  */
  YYSYMBOL_id_or_var = 119,                /* id_or_var  */
  YYSYMBOL_opt_target = 120,               /* opt_target  */
  YYSYMBOL_opt_named_transition = 121,     /* opt_named_transition  */
  YYSYMBOL_rule = 122,                     /* rule  */
  YYSYMBOL_abi_rule = 123,                 /* abi_rule  */
  YYSYMBOL_opt_exec_mode = 124,            /* opt_exec_mode  */
  YYSYMBOL_opt_file = 125,                 /* opt_file  */
  YYSYMBOL_frule = 126,                    /* frule  */
  YYSYMBOL_file_rule = 127,                /* file_rule  */
  YYSYMBOL_file_rule_tail = 128,           /* file_rule_tail  */
  YYSYMBOL_link_rule = 129,                /* link_rule  */
  YYSYMBOL_network_rule = 130,             /* network_rule  */
  YYSYMBOL_cond = 131,                     /* cond  */
  YYSYMBOL_opt_conds = 132,                /* opt_conds  */
  YYSYMBOL_cond_list = 133,                /* cond_list  */
  YYSYMBOL_opt_cond_list = 134,            /* opt_cond_list  */
  YYSYMBOL_mnt_rule = 135,                 /* mnt_rule  */
  YYSYMBOL_dbus_perm = 136,                /* dbus_perm  */
  YYSYMBOL_dbus_perms = 137,               /* dbus_perms  */
  YYSYMBOL_opt_dbus_perm = 138,            /* opt_dbus_perm  */
  YYSYMBOL_dbus_rule = 139,                /* dbus_rule  */
  YYSYMBOL_net_perm = 140,                 /* net_perm  */
  YYSYMBOL_net_perms = 141,                /* net_perms  */
  YYSYMBOL_opt_net_perm = 142,             /* opt_net_perm  */
  YYSYMBOL_unix_rule = 143,                /* unix_rule  */
  YYSYMBOL_signal_perm = 144,              /* signal_perm  */
  YYSYMBOL_signal_perms = 145,             /* signal_perms  */
  YYSYMBOL_opt_signal_perm = 146,          /* opt_signal_perm  */
  YYSYMBOL_signal_rule = 147,              /* signal_rule  */
  YYSYMBOL_ptrace_perm = 148,              /* ptrace_perm  */
  YYSYMBOL_ptrace_perms = 149,             /* ptrace_perms  */
  YYSYMBOL_opt_ptrace_perm = 150,          /* opt_ptrace_perm  */
  YYSYMBOL_ptrace_rule = 151,              /* ptrace_rule  */
  YYSYMBOL_hat_start = 152,                /* hat_start  */
  YYSYMBOL_file_mode = 153,                /* file_mode  */
  YYSYMBOL_change_profile = 154,           /* change_profile  */
  YYSYMBOL_capability = 155,               /* capability  */
  YYSYMBOL_caps = 156                      /* caps  */
};
typedef enum yysymbol_kind_t yysymbol_kind_t;




#ifdef short
# undef short
#endif

/* On compilers that do not define __PTRDIFF_MAX__ etc., make sure
   <limits.h> and (if available) <stdint.h> are included
   so that the code can choose integer types of a good width.  */

#ifndef __PTRDIFF_MAX__
# include <limits.h> /* INFRINGES ON USER NAME SPACE */
# if defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stdint.h> /* INFRINGES ON USER NAME SPACE */
#  define YY_STDINT_H
# endif
#endif

/* Narrow types that promote to a signed type and that can represent a
   signed or unsigned integer of at least N bits.  In tables they can
   save space and decrease cache pressure.  Promoting to a signed type
   helps avoid bugs in integer arithmetic.  */

#ifdef __INT_LEAST8_MAX__
typedef __INT_LEAST8_TYPE__ yytype_int8;
#elif defined YY_STDINT_H
typedef int_least8_t yytype_int8;
#else
typedef signed char yytype_int8;
#endif

#ifdef __INT_LEAST16_MAX__
typedef __INT_LEAST16_TYPE__ yytype_int16;
#elif defined YY_STDINT_H
typedef int_least16_t yytype_int16;
#else
typedef short yytype_int16;
#endif

/* Work around bug in HP-UX 11.23, which defines these macros
   incorrectly for preprocessor constants.  This workaround can likely
   be removed in 2023, as HPE has promised support for HP-UX 11.23
   (aka HP-UX 11i v2) only through the end of 2022; see Table 2 of
   <https://h20195.www2.hpe.com/V2/getpdf.aspx/4AA4-7673ENW.pdf>.  */
#ifdef __hpux
# undef UINT_LEAST8_MAX
# undef UINT_LEAST16_MAX
# define UINT_LEAST8_MAX 255
# define UINT_LEAST16_MAX 65535
#endif

#if defined __UINT_LEAST8_MAX__ && __UINT_LEAST8_MAX__ <= __INT_MAX__
typedef __UINT_LEAST8_TYPE__ yytype_uint8;
#elif (!defined __UINT_LEAST8_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST8_MAX <= INT_MAX)
typedef uint_least8_t yytype_uint8;
#elif !defined __UINT_LEAST8_MAX__ && UCHAR_MAX <= INT_MAX
typedef unsigned char yytype_uint8;
#else
typedef short yytype_uint8;
#endif

#if defined __UINT_LEAST16_MAX__ && __UINT_LEAST16_MAX__ <= __INT_MAX__
typedef __UINT_LEAST16_TYPE__ yytype_uint16;
#elif (!defined __UINT_LEAST16_MAX__ && defined YY_STDINT_H \
       && UINT_LEAST16_MAX <= INT_MAX)
typedef uint_least16_t yytype_uint16;
#elif !defined __UINT_LEAST16_MAX__ && USHRT_MAX <= INT_MAX
typedef unsigned short yytype_uint16;
#else
typedef int yytype_uint16;
#endif

#ifndef YYPTRDIFF_T
# if defined __PTRDIFF_TYPE__ && defined __PTRDIFF_MAX__
#  define YYPTRDIFF_T __PTRDIFF_TYPE__
#  define YYPTRDIFF_MAXIMUM __PTRDIFF_MAX__
# elif defined PTRDIFF_MAX
#  ifndef ptrdiff_t
#   include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  endif
#  define YYPTRDIFF_T ptrdiff_t
#  define YYPTRDIFF_MAXIMUM PTRDIFF_MAX
# else
#  define YYPTRDIFF_T long
#  define YYPTRDIFF_MAXIMUM LONG_MAX
# endif
#endif

#ifndef YYSIZE_T
# ifdef __SIZE_TYPE__
#  define YYSIZE_T __SIZE_TYPE__
# elif defined size_t
#  define YYSIZE_T size_t
# elif defined __STDC_VERSION__ && 199901 <= __STDC_VERSION__
#  include <stddef.h> /* INFRINGES ON USER NAME SPACE */
#  define YYSIZE_T size_t
# else
#  define YYSIZE_T unsigned
# endif
#endif

#define YYSIZE_MAXIMUM                                  \
  YY_CAST (YYPTRDIFF_T,                                 \
           (YYPTRDIFF_MAXIMUM < YY_CAST (YYSIZE_T, -1)  \
            ? YYPTRDIFF_MAXIMUM                         \
            : YY_CAST (YYSIZE_T, -1)))

#define YYSIZEOF(X) YY_CAST (YYPTRDIFF_T, sizeof (X))


/* Stored state numbers (used for stacks). */
typedef yytype_int16 yy_state_t;

/* State numbers in computations.  */
typedef int yy_state_fast_t;

#ifndef YY_
# if defined YYENABLE_NLS && YYENABLE_NLS
#  if ENABLE_NLS
#   include <libintl.h> /* INFRINGES ON USER NAME SPACE */
#   define YY_(Msgid) dgettext ("bison-runtime", Msgid)
#  endif
# endif
# ifndef YY_
#  define YY_(Msgid) Msgid
# endif
#endif


#ifndef YY_ATTRIBUTE_PURE
# if defined __GNUC__ && 2 < __GNUC__ + (96 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_PURE __attribute__ ((__pure__))
# else
#  define YY_ATTRIBUTE_PURE
# endif
#endif

#ifndef YY_ATTRIBUTE_UNUSED
# if defined __GNUC__ && 2 < __GNUC__ + (7 <= __GNUC_MINOR__)
#  define YY_ATTRIBUTE_UNUSED __attribute__ ((__unused__))
# else
#  define YY_ATTRIBUTE_UNUSED
# endif
#endif

/* Suppress unused-variable warnings by "using" E.  */
#if ! defined lint || defined __GNUC__
# define YY_USE(E) ((void) (E))
#else
# define YY_USE(E) /* empty */
#endif

/* Suppress an incorrect diagnostic about yylval being uninitialized.  */
#if defined __GNUC__ && ! defined __ICC && 406 <= __GNUC__ * 100 + __GNUC_MINOR__
# if __GNUC__ * 100 + __GNUC_MINOR__ < 407
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")
# else
#  define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN                           \
    _Pragma ("GCC diagnostic push")                                     \
    _Pragma ("GCC diagnostic ignored \"-Wuninitialized\"")              \
    _Pragma ("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
# endif
# define YY_IGNORE_MAYBE_UNINITIALIZED_END      \
    _Pragma ("GCC diagnostic pop")
#else
# define YY_INITIAL_VALUE(Value) Value
#endif
#ifndef YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
# define YY_IGNORE_MAYBE_UNINITIALIZED_END
#endif
#ifndef YY_INITIAL_VALUE
# define YY_INITIAL_VALUE(Value) /* Nothing. */
#endif

#if defined __cplusplus && defined __GNUC__ && ! defined __ICC && 6 <= __GNUC__
# define YY_IGNORE_USELESS_CAST_BEGIN                          \
    _Pragma ("GCC diagnostic push")                            \
    _Pragma ("GCC diagnostic ignored \"-Wuseless-cast\"")
# define YY_IGNORE_USELESS_CAST_END            \
    _Pragma ("GCC diagnostic pop")
#endif
#ifndef YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_BEGIN
# define YY_IGNORE_USELESS_CAST_END
#endif


#define YY_ASSERT(E) ((void) (0 && (E)))

#if 1

/* The parser invokes alloca or malloc; define the necessary symbols.  */

# ifdef YYSTACK_USE_ALLOCA
#  if YYSTACK_USE_ALLOCA
#   ifdef __GNUC__
#    define YYSTACK_ALLOC __builtin_alloca
#   elif defined __BUILTIN_VA_ARG_INCR
#    include <alloca.h> /* INFRINGES ON USER NAME SPACE */
#   elif defined _AIX
#    define YYSTACK_ALLOC __alloca
#   elif defined _MSC_VER
#    include <malloc.h> /* INFRINGES ON USER NAME SPACE */
#    define alloca _alloca
#   else
#    define YYSTACK_ALLOC alloca
#    if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS
#     include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
      /* Use EXIT_SUCCESS as a witness for stdlib.h.  */
#     ifndef EXIT_SUCCESS
#      define EXIT_SUCCESS 0
#     endif
#    endif
#   endif
#  endif
# endif

# ifdef YYSTACK_ALLOC
   /* Pacify GCC's 'empty if-body' warning.  */
#  define YYSTACK_FREE(Ptr) do { /* empty */; } while (0)
#  ifndef YYSTACK_ALLOC_MAXIMUM
    /* The OS might guarantee only one guard page at the bottom of the stack,
       and a page size can be as small as 4096 bytes.  So we cannot safely
       invoke alloca (N) if N exceeds 4096.  Use a slightly smaller number
       to allow for a few compiler-allocated temporary stack slots.  */
#   define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */
#  endif
# else
#  define YYSTACK_ALLOC YYMALLOC
#  define YYSTACK_FREE YYFREE
#  ifndef YYSTACK_ALLOC_MAXIMUM
#   define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM
#  endif
#  if (defined __cplusplus && ! defined EXIT_SUCCESS \
       && ! ((defined YYMALLOC || defined malloc) \
             && (defined YYFREE || defined free)))
#   include <stdlib.h> /* INFRINGES ON USER NAME SPACE */
#   ifndef EXIT_SUCCESS
#    define EXIT_SUCCESS 0
#   endif
#  endif
#  ifndef YYMALLOC
#   define YYMALLOC malloc
#   if ! defined malloc && ! defined EXIT_SUCCESS
void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
#  ifndef YYFREE
#   define YYFREE free
#   if ! defined free && ! defined EXIT_SUCCESS
void free (void *); /* INFRINGES ON USER NAME SPACE */
#   endif
#  endif
# endif
#endif /* 1 */

#if (! defined yyoverflow \
     && (! defined __cplusplus \
         || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL)))

/* A type that is properly aligned for any stack member.  */
union yyalloc
{
  yy_state_t yyss_alloc;
  YYSTYPE yyvs_alloc;
};

/* The size of the maximum gap between one aligned stack and the next.  */
# define YYSTACK_GAP_MAXIMUM (YYSIZEOF (union yyalloc) - 1)

/* The size of an array large to enough to hold all stacks, each with
   N elements.  */
# define YYSTACK_BYTES(N) \
     ((N) * (YYSIZEOF (yy_state_t) + YYSIZEOF (YYSTYPE)) \
      + YYSTACK_GAP_MAXIMUM)

# define YYCOPY_NEEDED 1

/* Relocate STACK from its old location to the new one.  The
   local variables YYSIZE and YYSTACKSIZE give the old and new number of
   elements in the stack, and YYPTR gives the new location of the
   stack.  Advance YYPTR to a properly aligned location for the next
   stack.  */
# define YYSTACK_RELOCATE(Stack_alloc, Stack)                           \
    do                                                                  \
      {                                                                 \
        YYPTRDIFF_T yynewbytes;                                         \
        YYCOPY (&yyptr->Stack_alloc, Stack, yysize);                    \
        Stack = &yyptr->Stack_alloc;                                    \
        yynewbytes = yystacksize * YYSIZEOF (*Stack) + YYSTACK_GAP_MAXIMUM; \
        yyptr += yynewbytes / YYSIZEOF (*yyptr);                        \
      }                                                                 \
    while (0)

#endif

#if defined YYCOPY_NEEDED && YYCOPY_NEEDED
/* Copy COUNT objects from SRC to DST.  The source and destination do
   not overlap.  */
# ifndef YYCOPY
#  if defined __GNUC__ && 1 < __GNUC__
#   define YYCOPY(Dst, Src, Count) \
      __builtin_memcpy (Dst, Src, YY_CAST (YYSIZE_T, (Count)) * sizeof (*(Src)))
#  else
#   define YYCOPY(Dst, Src, Count)              \
      do                                        \
        {                                       \
          YYPTRDIFF_T yyi;                      \
          for (yyi = 0; yyi < (Count); yyi++)   \
            (Dst)[yyi] = (Src)[yyi];            \
        }                                       \
      while (0)
#  endif
# endif
#endif /* !YYCOPY_NEEDED */

/* YYFINAL -- State number of the termination state.  */
#define YYFINAL  3
/* YYLAST -- Last index in YYTABLE.  */
#define YYLAST   345

/* YYNTOKENS -- Number of terminals.  */
#define YYNTOKENS  91
/* YYNNTS -- Number of nonterminals.  */
#define YYNNTS  66
/* YYNRULES -- Number of rules.  */
#define YYNRULES  180
/* YYNSTATES -- Number of states.  */
#define YYNSTATES  278

/* YYMAXUTOK -- Last valid token kind.  */
#define YYMAXUTOK   345


/* YYTRANSLATE(TOKEN-NUM) -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex, with out-of-bounds checking.  */
#define YYTRANSLATE(YYX)                                \
  (0 <= (YYX) && (YYX) <= YYMAXUTOK                     \
   ? YY_CAST (yysymbol_kind_t, yytranslate[YYX])        \
   : YYSYMBOL_YYUNDEF)

/* YYTRANSLATE[TOKEN-NUM] -- Symbol number corresponding to TOKEN-NUM
   as returned by yylex.  */
static const yytype_int8 yytranslate[] =
{
       0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
       2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
       5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
      25,    26,    27,    28,    29,    30,    31,    32,    33,    34,
      35,    36,    37,    38,    39,    40,    41,    42,    43,    44,
      45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
      65,    66,    67,    68,    69,    70,    71,    72,    73,    74,
      75,    76,    77,    78,    79,    80,    81,    82,    83,    84,
      85,    86,    87,    88,    89,    90
};

#if YYDEBUG
/* YYRLINE[YYN] -- Source line where rule number YYN was defined.  */
static const yytype_int16 yyrline[] =
{
       0,   279,   279,   278,   306,   308,   314,   315,   316,   318,
     319,   321,   322,   325,   324,   393,   413,   424,   440,   441,
     442,   443,   445,   453,   480,   508,   528,   538,   549,   555,
     556,   564,   569,   595,   600,   634,   635,   636,   638,   639,
     641,   642,   643,   645,   646,   647,   649,   656,   665,   667,
     695,   730,   780,   797,   813,   829,   845,   861,   881,   900,
     909,   919,   925,  1024,  1036,  1050,  1064,  1069,  1084,  1094,
    1104,  1105,  1107,  1108,  1110,  1111,  1116,  1117,  1119,  1125,
    1132,  1133,  1134,  1136,  1137,  1139,  1144,  1162,  1173,  1176,
    1191,  1200,  1210,  1225,  1238,  1249,  1258,  1272,  1282,  1291,
    1292,  1298,  1304,  1305,  1307,  1312,  1317,  1322,  1327,  1332,
    1350,  1351,  1352,  1353,  1354,  1355,  1356,  1362,  1363,  1364,
    1366,  1367,  1368,  1370,  1386,  1420,  1421,  1422,  1423,  1424,
    1425,  1426,  1427,  1428,  1429,  1430,  1431,  1432,  1433,  1434,
    1440,  1441,  1442,  1444,  1445,  1446,  1448,  1464,  1478,  1479,
    1480,  1481,  1482,  1488,  1489,  1490,  1492,  1493,  1494,  1496,
    1502,  1520,  1521,  1522,  1523,  1524,  1525,  1531,  1532,  1533,
    1535,  1536,  1537,  1539,  1545,  1546,  1548,  1556,  1602,  1611,
    1612
};
#endif

/** Accessing symbol of state STATE.  */
#define YY_ACCESSING_SYMBOL(State) YY_CAST (yysymbol_kind_t, yystos[State])

#if 1
/* The user-facing name of the symbol whose (internal) number is
   YYSYMBOL.  No bounds checking.  */
static const char *yysymbol_name (yysymbol_kind_t yysymbol) YY_ATTRIBUTE_UNUSED;

/* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM.
   First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
static const char *const yytname[] =
{
  "\"end of file\"", "error", "\"invalid token\"", "TOK_ID", "TOK_CONDID",
  "TOK_CONDLISTID", "TOK_CARET", "TOK_OPEN", "TOK_CLOSE", "TOK_MODE",
  "TOK_END_OF_RULE", "TOK_EQUALS", "TOK_ARROW", "TOK_ADD_ASSIGN", "TOK_LE",
  "TOK_SET_VAR", "TOK_BOOL_VAR", "TOK_VALUE", "TOK_IF", "TOK_ELSE",
  "TOK_NOT", "TOK_DEFINED", "TOK_CHANGE_PROFILE", "TOK_NETWORK",
  "TOK_UNIX", "TOK_CREATE", "TOK_SHUTDOWN", "TOK_ACCEPT", "TOK_CONNECT",
  "TOK_LISTEN", "TOK_SETOPT", "TOK_GETOPT", "TOK_SETATTR", "TOK_GETATTR",
  "TOK_HAT", "TOK_UNSAFE", "TOK_SAFE", "TOK_COLON", "TOK_LINK",
  "TOK_OWNER", "TOK_OTHER", "TOK_SUBSET", "TOK_AUDIT", "TOK_DENY",
  "TOK_ALLOW", "TOK_PROFILE", "TOK_SET", "TOK_ALIAS", "TOK_PTRACE",
  "TOK_OPENPAREN", "TOK_CLOSEPAREN", "TOK_COMMA", "TOK_FILE", "TOK_MOUNT",
  "TOK_REMOUNT", "TOK_UMOUNT", "TOK_PIVOTROOT", "TOK_IN", "TOK_DBUS",
  "TOK_SIGNAL", "TOK_SEND", "TOK_RECEIVE", "TOK_BIND", "TOK_READ",
  "TOK_WRITE", "TOK_EAVESDROP", "TOK_PEER", "TOK_TRACE", "TOK_TRACEDBY",
  "TOK_READBY", "TOK_ABI", "TOK_RLIMIT", "TOK_SOFT_RLIMIT",
  "TOK_RLIMIT_CPU", "TOK_RLIMIT_FSIZE", "TOK_RLIMIT_DATA",
  "TOK_RLIMIT_STACK", "TOK_RLIMIT_CORE", "TOK_RLIMIT_RSS",
  "TOK_RLIMIT_NOFILE", "TOK_RLIMIT_OFILE", "TOK_RLIMIT_AS",
  "TOK_RLIMIT_NPROC", "TOK_RLIMIT_MEMLOCK", "TOK_RLIMIT_LOCKS",
  "TOK_RLIMIT_SIGPENDING", "TOK_RLIMIT_MSGQUEUE", "TOK_RLIMIT_NICE",
  "TOK_RLIMIT_RTPRIO", "TOK_CAPABILITY", "TOK_FLAGS", "$accept", "list",
  "$@1", "profilelist", "opt_profile_flag", "opt_id", "opt_id_or_var",
  "profile_base", "@2", "profile", "local_profile", "hat", "preamble",
  "alias", "varassign", "valuelist", "flags", "opt_flags", "flagvals",
  "flagval", "opt_subset_flag", "opt_audit_flag", "opt_owner_flag",
  "opt_perm_mode", "opt_prefix", "rules", "cond_rule", "expr", "id_or_var",
  "opt_target", "opt_named_transition", "rule", "abi_rule",
  "opt_exec_mode", "opt_file", "frule", "file_rule", "file_rule_tail",
  "link_rule", "network_rule", "cond", "opt_conds", "cond_list",
  "opt_cond_list", "mnt_rule", "dbus_perm", "dbus_perms", "opt_dbus_perm",
  "dbus_rule", "net_perm", "net_perms", "opt_net_perm", "unix_rule",
  "signal_perm", "signal_perms", "opt_signal_perm", "signal_rule",
  "ptrace_perm", "ptrace_perms", "opt_ptrace_perm", "ptrace_rule",
  "hat_start", "file_mode", "change_profile", "capability", "caps", YY_NULLPTR
};

static const char *
yysymbol_name (yysymbol_kind_t yysymbol)
{
  return yytname[yysymbol];
}
#endif

#define YYPACT_NINF (-231)

#define yypact_value_is_default(Yyn) \
  ((Yyn) == YYPACT_NINF)

#define YYTABLE_NINF (-30)

#define yytable_value_is_error(Yyn) \
  0

/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
   STATE-NUM.  */
static const yytype_int16 yypact[] =
{
    -231,    25,     7,  -231,   118,    20,    49,    27,  -231,  -231,
    -231,  -231,   109,   109,   117,   135,    81,   148,    96,  -231,
     145,   145,  -231,   182,  -231,  -231,  -231,  -231,  -231,   200,
    -231,  -231,  -231,   217,    31,  -231,  -231,  -231,  -231,   223,
    -231,   220,  -231,    13,   180,   221,   226,   181,  -231,  -231,
    -231,   224,     6,  -231,  -231,   -10,  -231,     8,  -231,  -231,
       3,  -231,  -231,    21,   188,  -231,   151,  -231,   200,   167,
    -231,  -231,   162,     5,  -231,  -231,   200,  -231,   109,   109,
    -231,   151,   177,   232,  -231,   237,  -231,  -231,   169,  -231,
     184,    85,   225,    -6,    97,   233,  -231,  -231,  -231,  -231,
     119,   275,  -231,  -231,   184,  -231,  -231,  -231,  -231,  -231,
    -231,  -231,  -231,  -231,  -231,  -231,    16,    59,  -231,  -231,
    -231,  -231,   230,  -231,  -231,  -231,    33,  -231,  -231,   257,
     102,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,
    -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,
    -231,  -231,  -231,    31,  -231,  -231,  -231,  -231,  -231,  -231,
    -231,  -231,  -231,  -231,  -231,   218,   218,   218,   218,  -231,
    -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,
    -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,  -231,   149,
     124,  -231,  -231,  -231,    74,   244,  -231,  -231,   251,   252,
    -231,   185,   219,   253,    87,   138,    14,   256,   258,   259,
     126,   219,   255,   153,  -231,  -231,  -231,   260,  -231,    -6,
     254,   257,    31,   283,  -231,  -231,   250,  -231,   284,    31,
    -231,   106,  -231,  -231,  -231,  -231,  -231,  -231,    31,   285,
    -231,   136,  -231,   286,  -231,   281,  -231,  -231,   192,    31,
     104,   287,  -231,  -231,  -231,  -231,   289,  -231,   222,  -231,
    -231,  -231,  -231,  -231,  -231,   290,   251,  -231,  -231,  -231,
    -231,   291,  -231,   292,    79,  -231,  -231,  -231
};

/* YYDEFACT[STATE-NUM] -- Default reduction number in state STATE-NUM.
   Performed when YYTABLE does not specify something else to do.  Zero
   means the default is an error.  */
static const yytype_uint8 yydefact[] =
{
      18,     0,     2,     1,     0,     0,     0,     0,     4,    19,
      20,    21,     0,     0,     0,     0,     0,     0,     3,    26,
      23,    24,    25,     0,    78,    79,   174,   175,     7,     0,
       5,     8,    27,     0,    11,    15,    22,    70,    71,   102,
      12,     0,   103,    28,     0,     0,     0,     0,    99,    30,
      13,     0,     0,    47,    34,     0,    33,    95,   101,   100,
      38,    31,    32,     0,     0,    14,     0,    39,     0,     0,
      60,    59,    43,    83,    61,    48,     0,    96,     0,     0,
      67,     0,     0,     0,    16,     0,    45,    44,    40,    47,
      80,     0,   143,    35,   170,    84,    99,    99,    99,    99,
     120,   156,   179,    49,    80,    76,    77,    51,    52,    53,
      56,    54,    55,    57,    58,    17,     0,     0,    66,    68,
      69,    47,     0,    41,    42,    46,    38,    81,    82,     9,
       0,    92,   139,   124,   125,   130,   128,   129,   127,   134,
     133,   132,   131,   140,   135,   136,   126,   137,   138,   144,
      99,    37,    36,     0,   166,   160,   167,   163,   164,   161,
     162,   165,   171,    99,    87,     9,     9,     9,     9,   116,
     109,   117,   111,   112,   110,   113,   114,   115,   121,    99,
     152,   147,   153,   148,   149,   150,   151,   157,    99,     0,
       0,    88,    97,    98,    38,     0,    50,    10,    74,     0,
      93,     0,   102,     0,     0,     0,     0,     0,     0,    72,
       0,   102,     0,     0,   180,   178,   176,     0,    89,    35,
      63,     9,     0,     0,    94,   145,     0,   141,     0,     0,
     172,     0,   168,   173,   104,    99,   106,   107,     0,     0,
     122,     0,   118,     0,   158,     0,   154,   159,    74,     0,
       0,     0,    75,   177,   142,   146,     0,   169,     0,    73,
     108,   119,   123,   155,    90,     0,    74,    47,    65,    62,
      91,     0,    85,     0,    38,   105,    86,    64
};

/* YYPGOTO[NTERM-NUM].  */
static const yytype_int16 yypgoto[] =
{
    -231,  -231,  -231,  -231,  -231,  -152,  -231,    42,  -231,  -231,
    -231,  -231,  -231,  -231,  -231,    -7,  -231,  -231,  -231,   215,
      72,  -231,  -231,  -231,  -231,   -89,    53,   227,  -148,  -231,
    -230,  -231,   302,   203,  -231,  -231,  -231,  -231,  -231,  -231,
    -231,   -95,  -231,  -113,  -231,  -124,  -231,  -231,  -231,   -94,
    -231,  -231,  -231,  -162,  -231,  -231,  -231,  -184,  -231,  -231,
    -231,   299,    92,  -231,  -231,  -231
};

/* YYDEFGOTO[NTERM-NUM].  */
static const yytype_uint8 yydefgoto[] =
{
       0,     1,     8,    18,    29,   198,    39,    35,    53,    30,
      70,    71,     2,     9,    10,    20,    46,    47,    55,    56,
     153,    72,   125,    88,    73,    60,    74,    83,    40,   239,
     223,   103,    75,   129,   104,   218,   105,   191,   106,   107,
      59,    52,    42,    43,   108,   178,   210,   179,   109,   149,
     201,   150,   110,   187,   212,   188,   111,   162,   204,   163,
     112,    76,   219,   113,   114,   189
};

/* YYTABLE[YYPACT[STATE-NUM]] -- What to do in state STATE-NUM.  If
   positive, shift that token.  If negative, reduce the rule whose
   number is the opposite.  If YYTABLE_NINF, syntax error.  */
static const yytype_int16 yytable[] =
{
     126,   165,   166,   167,   168,   203,    21,    54,   151,    26,
      57,    65,    89,   206,   207,   208,   209,    45,   265,    63,
     232,    66,     4,     5,   234,     3,   235,    90,    91,    92,
      16,    14,   194,    32,    37,   152,   273,    27,    77,    26,
      61,   196,   217,    93,    17,    67,    38,   257,    68,    69,
     246,    66,    15,    94,     6,   202,    58,    95,    96,    97,
      98,    99,   -29,   100,   101,    64,   192,    27,   205,   251,
      78,   116,   117,     7,   252,    67,    32,     7,    68,    69,
      26,   256,   220,   263,   211,    26,   242,   277,   130,   228,
     259,    24,    66,   213,   102,   131,   154,    66,   243,    -6,
     264,   266,    26,     7,   155,   199,   154,   227,    27,   193,
      84,   267,   200,    27,   155,   154,    67,   261,   115,    68,
      69,    67,    66,   155,    68,    69,    19,    37,   169,    12,
      27,    13,   254,   216,    22,   169,   170,   230,   231,    38,
     258,    28,    57,   170,     7,   169,   156,    23,   233,     7,
     157,   158,   214,   170,   159,   160,   161,    57,    25,   215,
     157,   158,    32,   247,   159,   160,   161,    80,   171,   157,
     158,    81,    82,   159,   160,   161,   240,   241,   274,   172,
     173,   174,   175,   176,   177,    33,   172,   173,   174,   175,
     176,   177,   119,   120,   132,    37,   172,   173,   174,   175,
     176,   177,   133,    34,   222,    86,    87,    38,   123,   124,
     134,   135,   136,   137,   138,   139,   140,   141,   142,   127,
     128,   197,    57,    57,    41,   271,    57,    36,    41,    48,
      51,    44,    49,    50,   132,   225,   226,    79,    85,   121,
     122,    54,   133,   164,   195,   144,   145,   146,   147,   148,
     134,   135,   136,   137,   138,   139,   140,   141,   142,   132,
     197,   221,   224,   222,   180,   229,   236,   133,   237,   216,
      62,   238,   181,   250,   143,   134,   135,   136,   137,   138,
     139,   140,   141,   142,   180,   144,   145,   146,   147,   148,
     180,   249,   181,   253,   255,   260,   262,   269,   181,   270,
     272,   275,   276,   268,    11,   244,   245,   190,   118,   248,
     144,   145,   146,   147,   148,   183,   184,    31,   185,   186,
       0,     0,     0,     0,   182,     0,     0,     0,     0,     0,
       0,     0,     0,     0,     0,   183,   184,     0,   185,   186,
       0,   183,   184,     0,   185,   186
};

static const yytype_int16 yycheck[] =
{
      89,    96,    97,    98,    99,   153,    13,    17,    14,     6,
       4,     8,     7,   165,   166,   167,   168,     4,   248,    11,
     204,    18,    15,    16,    10,     0,    12,    22,    23,    24,
       3,    11,   121,    17,     3,    41,   266,    34,    17,     6,
      50,     8,   190,    38,    17,    42,    15,   231,    45,    46,
     212,    18,     3,    48,    47,   150,    50,    52,    53,    54,
      55,    56,    49,    58,    59,    57,    50,    34,   163,   221,
      49,    78,    79,    70,   222,    42,    17,    70,    45,    46,
       6,   229,     8,   245,   179,     6,   210,     8,     3,   202,
     238,    10,    18,   188,    89,    10,     9,    18,   211,     3,
     248,   249,     6,    70,    17,     3,     9,   201,    34,    50,
      68,     7,    10,    34,    17,     9,    42,   241,    76,    45,
      46,    42,    18,    17,    45,    46,    17,     3,     9,    11,
      34,    13,   226,     9,    17,     9,    17,    50,    51,    15,
     235,    45,     4,    17,    70,     9,    49,    12,    10,    70,
      63,    64,     3,    17,    67,    68,    69,     4,    10,    10,
      63,    64,    17,    10,    67,    68,    69,    16,    49,    63,
      64,    20,    21,    67,    68,    69,    50,    51,   267,    60,
      61,    62,    63,    64,    65,     3,    60,    61,    62,    63,
      64,    65,    15,    16,     9,     3,    60,    61,    62,    63,
      64,    65,    17,     3,    12,    43,    44,    15,    39,    40,
      25,    26,    27,    28,    29,    30,    31,    32,    33,    35,
      36,     3,     4,     4,     5,     3,     4,    10,     5,    49,
      49,    11,    11,     7,     9,    50,    51,    49,    71,     7,
       3,    17,    17,    10,    14,    60,    61,    62,    63,    64,
      25,    26,    27,    28,    29,    30,    31,    32,    33,     9,
       3,    17,    10,    12,     9,    12,    10,    17,    10,     9,
      55,    12,    17,    19,    49,    25,    26,    27,    28,    29,
      30,    31,    32,    33,     9,    60,    61,    62,    63,    64,
       9,   219,    17,    10,    10,    10,    10,    10,    17,    10,
      10,    10,    10,   250,     2,    50,    51,   104,    81,   217,
      60,    61,    62,    63,    64,    60,    61,    18,    63,    64,
      -1,    -1,    -1,    -1,    49,    -1,    -1,    -1,    -1,    -1,
      -1,    -1,    -1,    -1,    -1,    60,    61,    -1,    63,    64,
      -1,    60,    61,    -1,    63,    64
};

/* YYSTOS[STATE-NUM] -- The symbol kind of the accessing symbol of
   state STATE-NUM.  */
static const yytype_uint8 yystos[] =
{
       0,    92,   103,     0,    15,    16,    47,    70,    93,   104,
     105,   123,    11,    13,    11,     3,     3,    17,    94,    17,
     106,   106,    17,    12,    10,    10,     6,    34,    45,    95,
     100,   152,    17,     3,     3,    98,    10,     3,    15,    97,
     119,     5,   133,   134,    11,     4,   107,   108,    49,    11,
       7,    49,   132,    99,    17,   109,   110,     4,    50,   131,
     116,    50,   110,    11,    57,     8,    18,    42,    45,    46,
     101,   102,   112,   115,   117,   123,   152,    17,    49,    49,
      16,    20,    21,   118,    98,    71,    43,    44,   114,     7,
      22,    23,    24,    38,    48,    52,    53,    54,    55,    56,
      58,    59,    89,   122,   125,   127,   129,   130,   135,   139,
     143,   147,   151,   154,   155,    98,   106,   106,   118,    15,
      16,     7,     3,    39,    40,   113,   116,    35,    36,   124,
       3,    10,     9,    17,    25,    26,    27,    28,    29,    30,
      31,    32,    33,    49,    60,    61,    62,    63,    64,   140,
     142,    14,    41,   111,     9,    17,    49,    63,    64,    67,
      68,    69,   148,   150,    10,   132,   132,   132,   132,     9,
      17,    49,    60,    61,    62,    63,    64,    65,   136,   138,
       9,    17,    49,    60,    61,    63,    64,   144,   146,   156,
     124,   128,    50,    50,   116,    14,     8,     3,    96,     3,
      10,   141,   132,   119,   149,   132,    96,    96,    96,    96,
     137,   132,   145,   132,     3,    10,     9,   119,   126,   153,
       8,    17,    12,   121,    10,    50,    51,   140,   134,    12,
      50,    51,   148,    10,    10,    12,    10,    10,    12,   120,
      50,    51,   136,   134,    50,    51,   144,    10,   153,   111,
      19,    96,   119,    10,   140,    10,   119,   148,   132,   119,
      10,   136,    10,   144,   119,   121,   119,     7,   117,    10,
      10,     3,    10,   121,   116,    10,    10,     8
};

/* YYR1[RULE-NUM] -- Symbol kind of the left-hand side of rule RULE-NUM.  */
static const yytype_uint8 yyr1[] =
{
       0,    91,    93,    92,    94,    94,    95,    95,    95,    96,
      96,    97,    97,    99,    98,   100,   101,   102,   103,   103,
     103,   103,   104,   105,   105,   105,   106,   106,   107,   108,
     108,   107,   109,   109,   110,   111,   111,   111,   112,   112,
     113,   113,   113,   114,   114,   114,   115,   116,   116,   116,
     116,   116,   116,   116,   116,   116,   116,   116,   116,   116,
     116,   116,   116,   117,   117,   117,   118,   118,   118,   118,
     119,   119,   120,   120,   121,   121,   122,   122,   123,   123,
     124,   124,   124,   125,   125,   126,   126,   127,   127,   128,
     128,   129,   130,   130,   130,   131,   131,   131,   131,   132,
     132,   133,   134,   134,   135,   135,   135,   135,   135,   136,
     136,   136,   136,   136,   136,   136,   136,   137,   137,   137,
     138,   138,   138,   139,   140,   140,   140,   140,   140,   140,
     140,   140,   140,   140,   140,   140,   140,   140,   140,   140,
     141,   141,   141,   142,   142,   142,   143,   144,   144,   144,
     144,   144,   144,   145,   145,   145,   146,   146,   146,   147,
     148,   148,   148,   148,   148,   148,   148,   149,   149,   149,
     150,   150,   150,   151,   152,   152,   153,   154,   155,   156,
     156
};

/* YYR2[RULE-NUM] -- Number of symbols on the right-hand side of rule RULE-NUM.  */
static const yytype_int8 yyr2[] =
{
       0,     2,     0,     3,     0,     2,     0,     1,     1,     0,
       1,     0,     1,     0,     8,     2,     2,     2,     0,     2,
       2,     2,     5,     3,     3,     3,     1,     2,     0,     0,
       2,     4,     2,     1,     1,     0,     1,     1,     0,     1,
       0,     1,     1,     0,     1,     1,     3,     0,     2,     3,
       5,     3,     3,     3,     3,     3,     3,     3,     3,     2,
       2,     2,     8,     5,     9,     7,     2,     1,     2,     2,
       1,     1,     0,     2,     0,     2,     1,     1,     3,     3,
       0,     1,     1,     0,     1,     4,     5,     2,     2,     2,
       4,     6,     2,     3,     4,     1,     3,     5,     5,     0,
       2,     5,     0,     1,     4,     7,     4,     4,     5,     1,
       1,     1,     1,     1,     1,     1,     1,     0,     2,     3,
       0,     1,     3,     5,     1,     1,     1,     1,     1,     1,
       1,     1,     1,     1,     1,     1,     1,     1,     1,     1,
       0,     2,     3,     0,     1,     3,     5,     1,     1,     1,
       1,     1,     1,     0,     2,     3,     0,     1,     3,     4,
       1,     1,     1,     1,     1,     1,     1,     0,     2,     3,
       0,     1,     3,     4,     1,     1,     1,     5,     3,     0,
       2
};


enum { YYENOMEM = -2 };

#define yyerrok         (yyerrstatus = 0)
#define yyclearin       (yychar = YYEMPTY)

#define YYACCEPT        goto yyacceptlab
#define YYABORT         goto yyabortlab
#define YYERROR         goto yyerrorlab
#define YYNOMEM         goto yyexhaustedlab


#define YYRECOVERING()  (!!yyerrstatus)

#define YYBACKUP(Token, Value)                                    \
  do                                                              \
    if (yychar == YYEMPTY)                                        \
      {                                                           \
        yychar = (Token);                                         \
        yylval = (Value);                                         \
        YYPOPSTACK (yylen);                                       \
        yystate = *yyssp;                                         \
        goto yybackup;                                            \
      }                                                           \
    else                                                          \
      {                                                           \
        yyerror (YY_("syntax error: cannot back up")); \
        YYERROR;                                                  \
      }                                                           \
  while (0)

/* Backward compatibility with an undocumented macro.
   Use YYerror or YYUNDEF. */
#define YYERRCODE YYUNDEF


/* Enable debugging if requested.  */
#if YYDEBUG

# ifndef YYFPRINTF
#  include <stdio.h> /* INFRINGES ON USER NAME SPACE */
#  define YYFPRINTF fprintf
# endif

# define YYDPRINTF(Args)                        \
do {                                            \
  if (yydebug)                                  \
    YYFPRINTF Args;                             \
} while (0)




# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)                    \
do {                                                                      \
  if (yydebug)                                                            \
    {                                                                     \
      YYFPRINTF (stderr, "%s ", Title);                                   \
      yy_symbol_print (stderr,                                            \
                  Kind, Value); \
      YYFPRINTF (stderr, "\n");                                           \
    }                                                                     \
} while (0)


/*-----------------------------------.
| Print this symbol's value on YYO.  |
`-----------------------------------*/

static void
yy_symbol_value_print (FILE *yyo,
                       yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  FILE *yyoutput = yyo;
  YY_USE (yyoutput);
  if (!yyvaluep)
    return;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/*---------------------------.
| Print this symbol on YYO.  |
`---------------------------*/

static void
yy_symbol_print (FILE *yyo,
                 yysymbol_kind_t yykind, YYSTYPE const * const yyvaluep)
{
  YYFPRINTF (yyo, "%s %s (",
             yykind < YYNTOKENS ? "token" : "nterm", yysymbol_name (yykind));

  yy_symbol_value_print (yyo, yykind, yyvaluep);
  YYFPRINTF (yyo, ")");
}

/*------------------------------------------------------------------.
| yy_stack_print -- Print the state stack from its BOTTOM up to its |
| TOP (included).                                                   |
`------------------------------------------------------------------*/

static void
yy_stack_print (yy_state_t *yybottom, yy_state_t *yytop)
{
  YYFPRINTF (stderr, "Stack now");
  for (; yybottom <= yytop; yybottom++)
    {
      int yybot = *yybottom;
      YYFPRINTF (stderr, " %d", yybot);
    }
  YYFPRINTF (stderr, "\n");
}

# define YY_STACK_PRINT(Bottom, Top)                            \
do {                                                            \
  if (yydebug)                                                  \
    yy_stack_print ((Bottom), (Top));                           \
} while (0)


/*------------------------------------------------.
| Report that the YYRULE is going to be reduced.  |
`------------------------------------------------*/

static void
yy_reduce_print (yy_state_t *yyssp, YYSTYPE *yyvsp,
                 int yyrule)
{
  int yylno = yyrline[yyrule];
  int yynrhs = yyr2[yyrule];
  int yyi;
  YYFPRINTF (stderr, "Reducing stack by rule %d (line %d):\n",
             yyrule - 1, yylno);
  /* The symbols being reduced.  */
  for (yyi = 0; yyi < yynrhs; yyi++)
    {
      YYFPRINTF (stderr, "   $%d = ", yyi + 1);
      yy_symbol_print (stderr,
                       YY_ACCESSING_SYMBOL (+yyssp[yyi + 1 - yynrhs]),
                       &yyvsp[(yyi + 1) - (yynrhs)]);
      YYFPRINTF (stderr, "\n");
    }
}

# define YY_REDUCE_PRINT(Rule)          \
do {                                    \
  if (yydebug)                          \
    yy_reduce_print (yyssp, yyvsp, Rule); \
} while (0)

/* Nonzero means print parse trace.  It is left uninitialized so that
   multiple parsers can coexist.  */
int yydebug;
#else /* !YYDEBUG */
# define YYDPRINTF(Args) ((void) 0)
# define YY_SYMBOL_PRINT(Title, Kind, Value, Location)
# define YY_STACK_PRINT(Bottom, Top)
# define YY_REDUCE_PRINT(Rule)
#endif /* !YYDEBUG */


/* YYINITDEPTH -- initial size of the parser's stacks.  */
#ifndef YYINITDEPTH
# define YYINITDEPTH 200
#endif

/* YYMAXDEPTH -- maximum size the stacks can grow to (effective only
   if the built-in stack extension method is used).

   Do not make this value too large; the results are undefined if
   YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH)
   evaluated with infinite-precision integer arithmetic.  */

#ifndef YYMAXDEPTH
# define YYMAXDEPTH 10000
#endif


/* Context of a parse error.  */
typedef struct
{
  yy_state_t *yyssp;
  yysymbol_kind_t yytoken;
} yypcontext_t;

/* Put in YYARG at most YYARGN of the expected tokens given the
   current YYCTX, and return the number of tokens stored in YYARG.  If
   YYARG is null, return the number of expected tokens (guaranteed to
   be less than YYNTOKENS).  Return YYENOMEM on memory exhaustion.
   Return 0 if there are more than YYARGN expected tokens, yet fill
   YYARG up to YYARGN. */
static int
yypcontext_expected_tokens (const yypcontext_t *yyctx,
                            yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  int yyn = yypact[+*yyctx->yyssp];
  if (!yypact_value_is_default (yyn))
    {
      /* Start YYX at -YYN if negative to avoid negative indexes in
         YYCHECK.  In other words, skip the first -YYN actions for
         this state because they are default actions.  */
      int yyxbegin = yyn < 0 ? -yyn : 0;
      /* Stay within bounds of both yycheck and yytname.  */
      int yychecklim = YYLAST - yyn + 1;
      int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS;
      int yyx;
      for (yyx = yyxbegin; yyx < yyxend; ++yyx)
        if (yycheck[yyx + yyn] == yyx && yyx != YYSYMBOL_YYerror
            && !yytable_value_is_error (yytable[yyx + yyn]))
          {
            if (!yyarg)
              ++yycount;
            else if (yycount == yyargn)
              return 0;
            else
              yyarg[yycount++] = YY_CAST (yysymbol_kind_t, yyx);
          }
    }
  if (yyarg && yycount == 0 && 0 < yyargn)
    yyarg[0] = YYSYMBOL_YYEMPTY;
  return yycount;
}




#ifndef yystrlen
# if defined __GLIBC__ && defined _STRING_H
#  define yystrlen(S) (YY_CAST (YYPTRDIFF_T, strlen (S)))
# else
/* Return the length of YYSTR.  */
static YYPTRDIFF_T
yystrlen (const char *yystr)
{
  YYPTRDIFF_T yylen;
  for (yylen = 0; yystr[yylen]; yylen++)
    continue;
  return yylen;
}
# endif
#endif

#ifndef yystpcpy
# if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE
#  define yystpcpy stpcpy
# else
/* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in
   YYDEST.  */
static char *
yystpcpy (char *yydest, const char *yysrc)
{
  char *yyd = yydest;
  const char *yys = yysrc;

  while ((*yyd++ = *yys++) != '\0')
    continue;

  return yyd - 1;
}
# endif
#endif

#ifndef yytnamerr
/* Copy to YYRES the contents of YYSTR after stripping away unnecessary
   quotes and backslashes, so that it's suitable for yyerror.  The
   heuristic is that double-quoting is unnecessary unless the string
   contains an apostrophe, a comma, or backslash (other than
   backslash-backslash).  YYSTR is taken from yytname.  If YYRES is
   null, do not copy; instead, return the length of what the result
   would have been.  */
static YYPTRDIFF_T
yytnamerr (char *yyres, const char *yystr)
{
  if (*yystr == '"')
    {
      YYPTRDIFF_T yyn = 0;
      char const *yyp = yystr;
      for (;;)
        switch (*++yyp)
          {
          case '\'':
          case ',':
            goto do_not_strip_quotes;

          case '\\':
            if (*++yyp != '\\')
              goto do_not_strip_quotes;
            else
              goto append;

          append:
          default:
            if (yyres)
              yyres[yyn] = *yyp;
            yyn++;
            break;

          case '"':
            if (yyres)
              yyres[yyn] = '\0';
            return yyn;
          }
    do_not_strip_quotes: ;
    }

  if (yyres)
    return yystpcpy (yyres, yystr) - yyres;
  else
    return yystrlen (yystr);
}
#endif


static int
yy_syntax_error_arguments (const yypcontext_t *yyctx,
                           yysymbol_kind_t yyarg[], int yyargn)
{
  /* Actual size of YYARG. */
  int yycount = 0;
  /* There are many possibilities here to consider:
     - If this state is a consistent state with a default action, then
       the only way this function was invoked is if the default action
       is an error action.  In that case, don't check for expected
       tokens because there are none.
     - The only way there can be no lookahead present (in yychar) is if
       this state is a consistent state with a default action.  Thus,
       detecting the absence of a lookahead is sufficient to determine
       that there is no unexpected or expected token to report.  In that
       case, just report a simple "syntax error".
     - Don't assume there isn't a lookahead just because this state is a
       consistent state with a default action.  There might have been a
       previous inconsistent state, consistent state with a non-default
       action, or user semantic action that manipulated yychar.
     - Of course, the expected token list depends on states to have
       correct lookahead information, and it depends on the parser not
       to perform extra reductions after fetching a lookahead from the
       scanner and before detecting a syntax error.  Thus, state merging
       (from LALR or IELR) and default reductions corrupt the expected
       token list.  However, the list is correct for canonical LR with
       one exception: it will still contain any token that will not be
       accepted due to an error action in a later state.
  */
  if (yyctx->yytoken != YYSYMBOL_YYEMPTY)
    {
      int yyn;
      if (yyarg)
        yyarg[yycount] = yyctx->yytoken;
      ++yycount;
      yyn = yypcontext_expected_tokens (yyctx,
                                        yyarg ? yyarg + 1 : yyarg, yyargn - 1);
      if (yyn == YYENOMEM)
        return YYENOMEM;
      else
        yycount += yyn;
    }
  return yycount;
}

/* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message
   about the unexpected token YYTOKEN for the state stack whose top is
   YYSSP.

   Return 0 if *YYMSG was successfully written.  Return -1 if *YYMSG is
   not large enough to hold the message.  In that case, also set
   *YYMSG_ALLOC to the required number of bytes.  Return YYENOMEM if the
   required number of bytes is too large to store.  */
static int
yysyntax_error (YYPTRDIFF_T *yymsg_alloc, char **yymsg,
                const yypcontext_t *yyctx)
{
  enum { YYARGS_MAX = 5 };
  /* Internationalized format string. */
  const char *yyformat = YY_NULLPTR;
  /* Arguments of yyformat: reported tokens (one for the "unexpected",
     one per "expected"). */
  yysymbol_kind_t yyarg[YYARGS_MAX];
  /* Cumulated lengths of YYARG.  */
  YYPTRDIFF_T yysize = 0;

  /* Actual size of YYARG. */
  int yycount = yy_syntax_error_arguments (yyctx, yyarg, YYARGS_MAX);
  if (yycount == YYENOMEM)
    return YYENOMEM;

  switch (yycount)
    {
#define YYCASE_(N, S)                       \
      case N:                               \
        yyformat = S;                       \
        break
    default: /* Avoid compiler warnings. */
      YYCASE_(0, YY_("syntax error"));
      YYCASE_(1, YY_("syntax error, unexpected %s"));
      YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s"));
      YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s"));
      YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s"));
      YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s"));
#undef YYCASE_
    }

  /* Compute error message size.  Don't count the "%s"s, but reserve
     room for the terminator.  */
  yysize = yystrlen (yyformat) - 2 * yycount + 1;
  {
    int yyi;
    for (yyi = 0; yyi < yycount; ++yyi)
      {
        YYPTRDIFF_T yysize1
          = yysize + yytnamerr (YY_NULLPTR, yytname[yyarg[yyi]]);
        if (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)
          yysize = yysize1;
        else
          return YYENOMEM;
      }
  }

  if (*yymsg_alloc < yysize)
    {
      *yymsg_alloc = 2 * yysize;
      if (! (yysize <= *yymsg_alloc
             && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM))
        *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM;
      return -1;
    }

  /* Avoid sprintf, as that infringes on the user's name space.
     Don't have undefined behavior even if the translation
     produced a string with the wrong number of "%s"s.  */
  {
    char *yyp = *yymsg;
    int yyi = 0;
    while ((*yyp = *yyformat) != '\0')
      if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount)
        {
          yyp += yytnamerr (yyp, yytname[yyarg[yyi++]]);
          yyformat += 2;
        }
      else
        {
          ++yyp;
          ++yyformat;
        }
  }
  return 0;
}


/*-----------------------------------------------.
| Release the memory associated to this symbol.  |
`-----------------------------------------------*/

static void
yydestruct (const char *yymsg,
            yysymbol_kind_t yykind, YYSTYPE *yyvaluep)
{
  YY_USE (yyvaluep);
  if (!yymsg)
    yymsg = "Deleting";
  YY_SYMBOL_PRINT (yymsg, yykind, yyvaluep, yylocationp);

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  YY_USE (yykind);
  YY_IGNORE_MAYBE_UNINITIALIZED_END
}


/* Lookahead token kind.  */
int yychar;

/* The semantic value of the lookahead symbol.  */
YYSTYPE yylval;
/* Number of syntax errors so far.  */
int yynerrs;




/*----------.
| yyparse.  |
`----------*/

int
yyparse (void)
{
    yy_state_fast_t yystate = 0;
    /* Number of tokens to shift before error messages enabled.  */
    int yyerrstatus = 0;

    /* Refer to the stacks through separate pointers, to allow yyoverflow
       to reallocate them elsewhere.  */

    /* Their size.  */
    YYPTRDIFF_T yystacksize = YYINITDEPTH;

    /* The state stack: array, bottom, top.  */
    yy_state_t yyssa[YYINITDEPTH];
    yy_state_t *yyss = yyssa;
    yy_state_t *yyssp = yyss;

    /* The semantic value stack: array, bottom, top.  */
    YYSTYPE yyvsa[YYINITDEPTH];
    YYSTYPE *yyvs = yyvsa;
    YYSTYPE *yyvsp = yyvs;

  int yyn;
  /* The return value of yyparse.  */
  int yyresult;
  /* Lookahead symbol kind.  */
  yysymbol_kind_t yytoken = YYSYMBOL_YYEMPTY;
  /* The variables used to return semantic value and location from the
     action routines.  */
  YYSTYPE yyval;

  /* Buffer for error messages, and its allocated size.  */
  char yymsgbuf[128];
  char *yymsg = yymsgbuf;
  YYPTRDIFF_T yymsg_alloc = sizeof yymsgbuf;

#define YYPOPSTACK(N)   (yyvsp -= (N), yyssp -= (N))

  /* The number of symbols on the RHS of the reduced rule.
     Keep to zero when no symbol should be popped.  */
  int yylen = 0;

  YYDPRINTF ((stderr, "Starting parse\n"));

  yychar = YYEMPTY; /* Cause a token to be read.  */

  goto yysetstate;


/*------------------------------------------------------------.
| yynewstate -- push a new state, which is found in yystate.  |
`------------------------------------------------------------*/
yynewstate:
  /* In all cases, when you get here, the value and location stacks
     have just been pushed.  So pushing a state here evens the stacks.  */
  yyssp++;


/*--------------------------------------------------------------------.
| yysetstate -- set current state (the top of the stack) to yystate.  |
`--------------------------------------------------------------------*/
yysetstate:
  YYDPRINTF ((stderr, "Entering state %d\n", yystate));
  YY_ASSERT (0 <= yystate && yystate < YYNSTATES);
  YY_IGNORE_USELESS_CAST_BEGIN
  *yyssp = YY_CAST (yy_state_t, yystate);
  YY_IGNORE_USELESS_CAST_END
  YY_STACK_PRINT (yyss, yyssp);

  if (yyss + yystacksize - 1 <= yyssp)
#if !defined yyoverflow && !defined YYSTACK_RELOCATE
    YYNOMEM;
#else
    {
      /* Get the current used size of the three stacks, in elements.  */
      YYPTRDIFF_T yysize = yyssp - yyss + 1;

# if defined yyoverflow
      {
        /* Give user a chance to reallocate the stack.  Use copies of
           these so that the &'s don't force the real ones into
           memory.  */
        yy_state_t *yyss1 = yyss;
        YYSTYPE *yyvs1 = yyvs;

        /* Each stack pointer address is followed by the size of the
           data in use in that stack, in bytes.  This used to be a
           conditional around just the two extra args, but that might
           be undefined if yyoverflow is a macro.  */
        yyoverflow (YY_("memory exhausted"),
                    &yyss1, yysize * YYSIZEOF (*yyssp),
                    &yyvs1, yysize * YYSIZEOF (*yyvsp),
                    &yystacksize);
        yyss = yyss1;
        yyvs = yyvs1;
      }
# else /* defined YYSTACK_RELOCATE */
      /* Extend the stack our own way.  */
      if (YYMAXDEPTH <= yystacksize)
        YYNOMEM;
      yystacksize *= 2;
      if (YYMAXDEPTH < yystacksize)
        yystacksize = YYMAXDEPTH;

      {
        yy_state_t *yyss1 = yyss;
        union yyalloc *yyptr =
          YY_CAST (union yyalloc *,
                   YYSTACK_ALLOC (YY_CAST (YYSIZE_T, YYSTACK_BYTES (yystacksize))));
        if (! yyptr)
          YYNOMEM;
        YYSTACK_RELOCATE (yyss_alloc, yyss);
        YYSTACK_RELOCATE (yyvs_alloc, yyvs);
#  undef YYSTACK_RELOCATE
        if (yyss1 != yyssa)
          YYSTACK_FREE (yyss1);
      }
# endif

      yyssp = yyss + yysize - 1;
      yyvsp = yyvs + yysize - 1;

      YY_IGNORE_USELESS_CAST_BEGIN
      YYDPRINTF ((stderr, "Stack size increased to %ld\n",
                  YY_CAST (long, yystacksize)));
      YY_IGNORE_USELESS_CAST_END

      if (yyss + yystacksize - 1 <= yyssp)
        YYABORT;
    }
#endif /* !defined yyoverflow && !defined YYSTACK_RELOCATE */


  if (yystate == YYFINAL)
    YYACCEPT;

  goto yybackup;


/*-----------.
| yybackup.  |
`-----------*/
yybackup:
  /* Do appropriate processing given the current state.  Read a
     lookahead token if we need one and don't already have one.  */

  /* First try to decide what to do without reference to lookahead token.  */
  yyn = yypact[yystate];
  if (yypact_value_is_default (yyn))
    goto yydefault;

  /* Not known => get a lookahead token if don't already have one.  */

  /* YYCHAR is either empty, or end-of-input, or a valid lookahead.  */
  if (yychar == YYEMPTY)
    {
      YYDPRINTF ((stderr, "Reading a token\n"));
      yychar = yylex ();
    }

  if (yychar <= YYEOF)
    {
      yychar = YYEOF;
      yytoken = YYSYMBOL_YYEOF;
      YYDPRINTF ((stderr, "Now at end of input.\n"));
    }
  else if (yychar == YYerror)
    {
      /* The scanner already issued an error message, process directly
         to error recovery.  But do not keep the error token as
         lookahead, it is too special and may lead us to an endless
         loop in error recovery. */
      yychar = YYUNDEF;
      yytoken = YYSYMBOL_YYerror;
      goto yyerrlab1;
    }
  else
    {
      yytoken = YYTRANSLATE (yychar);
      YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc);
    }

  /* If the proper action on seeing token YYTOKEN is to reduce or to
     detect an error, take that action.  */
  yyn += yytoken;
  if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken)
    goto yydefault;
  yyn = yytable[yyn];
  if (yyn <= 0)
    {
      if (yytable_value_is_error (yyn))
        goto yyerrlab;
      yyn = -yyn;
      goto yyreduce;
    }

  /* Count tokens shifted since error; after three, turn off error
     status.  */
  if (yyerrstatus)
    yyerrstatus--;

  /* Shift the lookahead token.  */
  YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc);
  yystate = yyn;
  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END

  /* Discard the shifted token.  */
  yychar = YYEMPTY;
  goto yynewstate;


/*-----------------------------------------------------------.
| yydefault -- do the default action for the current state.  |
`-----------------------------------------------------------*/
yydefault:
  yyn = yydefact[yystate];
  if (yyn == 0)
    goto yyerrlab;
  goto yyreduce;


/*-----------------------------.
| yyreduce -- do a reduction.  |
`-----------------------------*/
yyreduce:
  /* yyn is the number of a rule to reduce with.  */
  yylen = yyr2[yyn];

  /* If YYLEN is nonzero, implement the default value of the action:
     '$$ = $1'.

     Otherwise, the following line sets YYVAL to garbage.
     This behavior is undocumented and Bison
     users should not rely upon it.  Assigning to YYVAL
     unconditionally makes the parser a bit smaller, and it avoids a
     GCC warning that YYVAL may be used uninitialized.  */
  yyval = yyvsp[1-yylen];


  YY_REDUCE_PRINT (yyn);
  switch (yyn)
    {
  case 2: /* $@1: %empty  */
#line 279 "parser_yacc.y"
        {
		/* make sure abi is setup */
		if (override_features) {
			if (policy_features)
				aa_features_unref(policy_features);
			policy_features = aa_features_ref(override_features);
		} else if (policy_features == NULL) {
			if (pinned_features) {
				policy_features = aa_features_ref(pinned_features);
			/* use default feature abi */
			} else {
				if (aa_features_new_from_string(&policy_features,
								default_features_abi,
								strlen(default_features_abi))) {
					yyerror(_("Failed to setup default policy feature abi"));
				}
				pwarn(WARN_ABI, _("%s: File '%s' missing feature abi, falling back to default policy feature abi\n"), progname, current_filename);
			}
		}
		if (!add_cap_feature_mask(policy_features,
					  CAPFLAG_POLICY_FEATURE))
			yyerror(_("Failed to add policy capabilities to known capabilities set"));
		set_supported_features();

	}
#line 1826 "parser_yacc.c"
    break;

  case 4: /* profilelist: %empty  */
#line 306 "parser_yacc.y"
                { /* nothing */ }
#line 1832 "parser_yacc.c"
    break;

  case 5: /* profilelist: profilelist profile  */
#line 309 "parser_yacc.y"
        {
		PDEBUG("Matched: list profile\n");
		add_to_list((yyvsp[0].prof));
	}
#line 1841 "parser_yacc.c"
    break;

  case 6: /* opt_profile_flag: %empty  */
#line 314 "parser_yacc.y"
                  { /* nothing */ (yyval.boolean) = 0; }
#line 1847 "parser_yacc.c"
    break;

  case 7: /* opt_profile_flag: TOK_PROFILE  */
#line 315 "parser_yacc.y"
                      { (yyval.boolean) = 1; }
#line 1853 "parser_yacc.c"
    break;

  case 8: /* opt_profile_flag: hat_start  */
#line 316 "parser_yacc.y"
                    { (yyval.boolean) = 2; }
#line 1859 "parser_yacc.c"
    break;

  case 9: /* opt_id: %empty  */
#line 318 "parser_yacc.y"
        { /* nothing */ (yyval.id) = NULL; }
#line 1865 "parser_yacc.c"
    break;

  case 10: /* opt_id: TOK_ID  */
#line 319 "parser_yacc.y"
                 { (yyval.id) = (yyvsp[0].id); }
#line 1871 "parser_yacc.c"
    break;

  case 11: /* opt_id_or_var: %empty  */
#line 321 "parser_yacc.y"
               { /* nothing */ (yyval.id) = NULL; }
#line 1877 "parser_yacc.c"
    break;

  case 12: /* opt_id_or_var: id_or_var  */
#line 322 "parser_yacc.y"
                    { (yyval.id) = (yyvsp[0].id); }
#line 1883 "parser_yacc.c"
    break;

  case 13: /* @2: %empty  */
#line 325 "parser_yacc.y"
        {
		/* mid rule action
		 * save current cache, restore at end of block
		 */
		(yyval.includecache) = g_includecache;
		g_includecache = new IncludeCache_t();
	}
#line 1895 "parser_yacc.c"
    break;

  case 14: /* profile_base: TOK_ID opt_id_or_var opt_cond_list flags TOK_OPEN @2 rules TOK_CLOSE  */
#line 333 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[-1].prof);
		bool self_stack = false;

		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		parse_label(&self_stack, &prof->ns, &prof->name, (yyvsp[-7].id), true);
		free((yyvsp[-7].id));

		if (self_stack) {
			yyerror(_("Profile names must begin with a '/' or a namespace"));
		}

		/* Honor the --namespace-string command line option */
		if (profile_ns) {
			/**
			 * Print warning if the profile specified a namespace
			 * different than the one specified with the
			 * --namespace-string command line option
			 */
			if (prof->ns && strcmp(prof->ns, profile_ns))
				pwarn(WARN_OVERRIDE, "%s: -n %s overriding policy specified namespace :%s:\n",
				      progname, profile_ns, prof->ns);

			free(prof->ns);
			prof->ns = strdup(profile_ns);
			if (!prof->ns)
				yyerror(_("Memory allocation error."));
		}

		prof->attachment = (yyvsp[-6].id);
		if ((yyvsp[-6].id) && !((yyvsp[-6].id)[0] == '/' || strncmp((yyvsp[-6].id), "@{", 2) == 0))
			yyerror(_("Profile attachment must begin with a '/' or variable."));
		if ((yyvsp[-5].cond_entry_list).name) {
			if (strcmp((yyvsp[-5].cond_entry_list).name, "xattrs") != 0)
				yyerror(_("profile id: invalid conditional group %s=()"), (yyvsp[-5].cond_entry_list).name);
			free ((yyvsp[-5].cond_entry_list).name);
			(yyvsp[-5].cond_entry_list).name = NULL;
			prof->xattrs = (yyvsp[-5].cond_entry_list);
		}
		prof->flags = (yyvsp[-4].flags);
		if (force_complain && kernel_abi_version == 5)
			/* newer abis encode force complain as part of the
			 * header
			 */
			prof->flags.mode = MODE_COMPLAIN;

		post_process_file_entries(prof);
		post_process_rule_entries(prof);
		prof->flags.debug(cerr);

		/* restore previous blocks include cache */
		delete g_includecache;
		g_includecache = (yyvsp[-2].includecache);
		(yyval.prof) = prof;

	}
#line 1959 "parser_yacc.c"
    break;

  case 15: /* profile: opt_profile_flag profile_base  */
#line 394 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof)->ns)
			PDEBUG("Matched: :%s://%s { ... }\n", (yyvsp[0].prof)->ns, (yyvsp[0].prof)->name);
		else
			PDEBUG("Matched: %s { ... }\n", (yyvsp[0].prof)->name);

		if ((yyvsp[0].prof)->name[0] == '/')
			pwarn(WARN_DEPRECATED, _("The use of file paths as profile names is deprecated. See man apparmor.d for more information\n"));

		if ((yyvsp[0].prof)->name[0] != '/' && !((yyvsp[-1].boolean) || (yyvsp[0].prof)->ns))
			yyerror(_("Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."));

		if ((yyvsp[-1].boolean) == 2)
			prof->flags.hat = 1;
		(yyval.prof) = prof;
	}
#line 1982 "parser_yacc.c"
    break;

  case 16: /* local_profile: TOK_PROFILE profile_base  */
#line 414 "parser_yacc.y"
        {

		Profile *prof = (yyvsp[0].prof);

		if ((yyvsp[0].prof))
			PDEBUG("Matched: local profile %s { ... }\n", prof->name);
		prof->local = 1;
		(yyval.prof) = prof;
	}
#line 1996 "parser_yacc.c"
    break;

  case 17: /* hat: hat_start profile_base  */
#line 425 "parser_yacc.y"
        {
		Profile *prof = (yyvsp[0].prof);
		if ((yyvsp[0].prof))
			PDEBUG("Matched: hat %s { ... }\n", prof->name);
		/*
		 * It isn't clear what a xattrs match on a hat profile
		 * should do, disallow it for now.
		 */
		if ((yyvsp[0].prof)->xattrs.list)
			yyerror("hat profiles can't use xattrs matches");

		prof->flags.hat = 1;
		(yyval.prof) = prof;
	}
#line 2015 "parser_yacc.c"
    break;

  case 18: /* preamble: %empty  */
#line 440 "parser_yacc.y"
          { /* nothing */ }
#line 2021 "parser_yacc.c"
    break;

  case 19: /* preamble: preamble alias  */
#line 441 "parser_yacc.y"
                         { /* nothing */ }
#line 2027 "parser_yacc.c"
    break;

  case 20: /* preamble: preamble varassign  */
#line 442 "parser_yacc.y"
                             { /* nothing */ }
#line 2033 "parser_yacc.c"
    break;

  case 21: /* preamble: preamble abi_rule  */
#line 443 "parser_yacc.y"
                            { /* nothing */ }
#line 2039 "parser_yacc.c"
    break;

  case 22: /* alias: TOK_ALIAS TOK_ID TOK_ARROW TOK_ID TOK_END_OF_RULE  */
#line 446 "parser_yacc.y"
        {
		if (!new_alias((yyvsp[-3].id), (yyvsp[-1].id)))
			yyerror(_("Failed to create alias %s -> %s\n"), (yyvsp[-3].id), (yyvsp[-1].id));
		free((yyvsp[-3].id));
		free((yyvsp[-1].id));
	}
#line 2050 "parser_yacc.c"
    break;

  case 23: /* varassign: TOK_SET_VAR TOK_EQUALS valuelist  */
#line 454 "parser_yacc.y"
        {
		struct value_list *list = (yyvsp[0].val_list);
		char *var_name = process_var((yyvsp[-2].set_var));
		int err;
		if (!list || !list->value)
			yyerror("Assert: valuelist returned NULL");
		PDEBUG("Matched: set assignment for (%s)\n", (yyvsp[-2].set_var));
		err = new_set_var(var_name, list->value);
		if (err) {
			free(var_name);
			yyerror("variable %s was previously declared", (yyvsp[-2].set_var));
			/* FIXME: it'd be handy to report the previous location */
		}
		for (list = list->next; list; list = list->next) {
			err = add_set_value(var_name, list->value);
			if (err) {
				free(var_name);
				yyerror("Error adding %s to set var %s",
					list->value, (yyvsp[-2].set_var));
			}
		}
		free_value_list((yyvsp[0].val_list));
		free(var_name);
		free((yyvsp[-2].set_var));
	}
#line 2080 "parser_yacc.c"
    break;

  case 24: /* varassign: TOK_SET_VAR TOK_ADD_ASSIGN valuelist  */
#line 481 "parser_yacc.y"
        {
		struct value_list *list = (yyvsp[0].val_list);
		char *var_name = process_var((yyvsp[-2].set_var));
		int err;
		if (!list || !list->value)
			yyerror("Assert: valuelist returned NULL");
		PDEBUG("Matched: additive assignment for (%s)\n", (yyvsp[-2].set_var));
		/* do the first one outside the loop, subsequent
		 * failures are indicative of symtab failures */
		err = add_set_value(var_name, list->value);
		if (err) {
			free(var_name);
			yyerror("variable %s was not previously declared, but is being assigned additional values", (yyvsp[-2].set_var));
		}
		for (list = list->next; list; list = list->next) {
			err = add_set_value(var_name, list->value);
			if (err) {
				free(var_name);
				yyerror("Error adding %s to set var %s",
					list->value, (yyvsp[-2].set_var));
			}
		}
		free_value_list((yyvsp[0].val_list));
		free(var_name);
		free((yyvsp[-2].set_var));
	}
#line 2111 "parser_yacc.c"
    break;

  case 25: /* varassign: TOK_BOOL_VAR TOK_EQUALS TOK_VALUE  */
#line 509 "parser_yacc.y"
        {
		int boolean, err;
		char *var_name = process_var((yyvsp[-2].bool_var));
		PDEBUG("Matched: boolean assignment (%s) to %s\n", (yyvsp[-2].bool_var), (yyvsp[0].var_val));
		boolean = str_to_boolean((yyvsp[0].var_val));
		if (boolean == -1) {
			yyerror("Invalid boolean assignment for (%s): %s is not true or false",
				(yyvsp[-2].bool_var), (yyvsp[0].var_val));
		}
		err = add_boolean_var(var_name, boolean);
		free(var_name);
		if (err) {
			yyerror("variable %s was previously declared", (yyvsp[-2].bool_var));
			/* FIXME: it'd be handy to report the previous location */
		}
		free((yyvsp[-2].bool_var));
		free((yyvsp[0].var_val));
	}
#line 2134 "parser_yacc.c"
    break;

  case 26: /* valuelist: TOK_VALUE  */
#line 529 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value (%s)\n", (yyvsp[0].var_val));

		(yyval.val_list) = val;
	}
#line 2147 "parser_yacc.c"
    break;

  case 27: /* valuelist: valuelist TOK_VALUE  */
#line 539 "parser_yacc.y"
        {
		struct value_list *val = new_value_list((yyvsp[0].var_val));
		if (!val)
			yyerror(_("Memory allocation error."));
		PDEBUG("Matched: value list\n");

		list_append((yyvsp[-1].val_list), val);
		(yyval.val_list) = (yyvsp[-1].val_list);
	}
#line 2161 "parser_yacc.c"
    break;

  case 28: /* flags: %empty  */
#line 549 "parser_yacc.y"
        { /* nothing */
	flagvals fv = { 0, MODE_UNSPECIFIED, 0, 0 };

		(yyval.flags) = fv;
	}
#line 2171 "parser_yacc.c"
    break;

  case 29: /* opt_flags: %empty  */
#line 555 "parser_yacc.y"
           { /* nothing */ (yyval.boolean) = 0; }
#line 2177 "parser_yacc.c"
    break;

  case 30: /* opt_flags: TOK_CONDID TOK_EQUALS  */
#line 557 "parser_yacc.y"
        {
		if (strcmp((yyvsp[-1].id), "flags") != 0)
			yyerror("expected flags= got %s=", (yyvsp[-1].id));
		free((yyvsp[-1].id));
		(yyval.boolean) = 1;
	}
#line 2188 "parser_yacc.c"
    break;

  case 31: /* flags: opt_flags TOK_OPENPAREN flagvals TOK_CLOSEPAREN  */
#line 565 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2196 "parser_yacc.c"
    break;

  case 32: /* flagvals: flagvals flagval  */
#line 570 "parser_yacc.y"
        {
		if (merge_profile_mode((yyvsp[-1].flags).mode, (yyvsp[0].flags).mode) == MODE_CONFLICT)
			yyerror(_("Profile flag '%s' conflicts with '%s'"),
				profile_mode_table[(yyvsp[-1].flags).mode],
				profile_mode_table[(yyvsp[0].flags).mode]);
		(yyvsp[-1].flags).mode = merge_profile_mode((yyvsp[-1].flags).mode, (yyvsp[0].flags).mode);
		(yyvsp[-1].flags).audit = (yyvsp[-1].flags).audit || (yyvsp[0].flags).audit;
		(yyvsp[-1].flags).path = (yyvsp[-1].flags).path | (yyvsp[0].flags).path;
		if (((yyvsp[-1].flags).path & (PATH_CHROOT_REL | PATH_NS_REL)) ==
		    (PATH_CHROOT_REL | PATH_NS_REL))
			yyerror(_("Profile flag chroot_relative conflicts with namespace_relative"));

		if (((yyvsp[-1].flags).path & (PATH_MEDIATE_DELETED | PATH_DELEGATE_DELETED)) ==
		    (PATH_MEDIATE_DELETED | PATH_DELEGATE_DELETED))
			yyerror(_("Profile flag mediate_deleted conflicts with delegate_deleted"));
		if (((yyvsp[-1].flags).path & (PATH_ATTACH | PATH_NO_ATTACH)) ==
		    (PATH_ATTACH | PATH_NO_ATTACH))
			yyerror(_("Profile flag attach_disconnected conflicts with no_attach_disconnected"));
		if (((yyvsp[-1].flags).path & (PATH_CHROOT_NSATTACH | PATH_CHROOT_NO_ATTACH)) ==
		    (PATH_CHROOT_NSATTACH | PATH_CHROOT_NO_ATTACH))
			yyerror(_("Profile flag chroot_attach conflicts with chroot_no_attach"));

		(yyval.flags) = (yyvsp[-1].flags);
	}
#line 2225 "parser_yacc.c"
    break;

  case 33: /* flagvals: flagval  */
#line 596 "parser_yacc.y"
        {
		(yyval.flags) = (yyvsp[0].flags);
	}
#line 2233 "parser_yacc.c"
    break;

  case 34: /* flagval: TOK_VALUE  */
#line 601 "parser_yacc.y"
        {
		flagvals fv = { 0, MODE_UNSPECIFIED, 0, 0 };
		enum profile_mode mode;

		if (strcmp((yyvsp[0].var_val), "debug") == 0) {
			yyerror(_("Profile flag 'debug' is no longer valid."));
		} if ((mode = str_to_mode((yyvsp[0].var_val)))) {
			fv.mode = mode;
		} else if (strcmp((yyvsp[0].var_val), "audit") == 0) {
			fv.audit = 1;
		} else if (strcmp((yyvsp[0].var_val), "chroot_relative") == 0) {
			fv.path |= PATH_CHROOT_REL;
		} else if (strcmp((yyvsp[0].var_val), "namespace_relative") == 0) {
			fv.path |= PATH_NS_REL;
		} else if (strcmp((yyvsp[0].var_val), "mediate_deleted") == 0) {
			fv.path |= PATH_MEDIATE_DELETED;
		} else if (strcmp((yyvsp[0].var_val), "delegate_deleted") == 0) {
			fv.path |= PATH_DELEGATE_DELETED;
		} else if (strcmp((yyvsp[0].var_val), "attach_disconnected") == 0) {
			fv.path |= PATH_ATTACH;
		} else if (strcmp((yyvsp[0].var_val), "no_attach_disconnected") == 0) {
			fv.path |= PATH_NO_ATTACH;
		} else if (strcmp((yyvsp[0].var_val), "chroot_attach") == 0) {
			fv.path |= PATH_CHROOT_NSATTACH;
		} else if (strcmp((yyvsp[0].var_val), "chroot_no_attach") == 0) {
			fv.path |= PATH_CHROOT_NO_ATTACH;
		} else {
			yyerror(_("Invalid profile flag: %s."), (yyvsp[0].var_val));
		}
		free((yyvsp[0].var_val));
		(yyval.flags) = fv;
	}
#line 2270 "parser_yacc.c"
    break;

  case 35: /* opt_subset_flag: %empty  */
#line 634 "parser_yacc.y"
                 { /* nothing */ (yyval.boolean) = 0; }
#line 2276 "parser_yacc.c"
    break;

  case 36: /* opt_subset_flag: TOK_SUBSET  */
#line 635 "parser_yacc.y"
                     { (yyval.boolean) = 1; }
#line 2282 "parser_yacc.c"
    break;

  case 37: /* opt_subset_flag: TOK_LE  */
#line 636 "parser_yacc.y"
                 { (yyval.boolean) = 1; }
#line 2288 "parser_yacc.c"
    break;

  case 38: /* opt_audit_flag: %empty  */
#line 638 "parser_yacc.y"
                { /* nothing */ (yyval.boolean) = 0; }
#line 2294 "parser_yacc.c"
    break;

  case 39: /* opt_audit_flag: TOK_AUDIT  */
#line 639 "parser_yacc.y"
                    { (yyval.boolean) = 1; }
#line 2300 "parser_yacc.c"
    break;

  case 40: /* opt_owner_flag: %empty  */
#line 641 "parser_yacc.y"
                { /* nothing */ (yyval.boolean) = 0; }
#line 2306 "parser_yacc.c"
    break;

  case 41: /* opt_owner_flag: TOK_OWNER  */
#line 642 "parser_yacc.y"
                    { (yyval.boolean) = 1; }
#line 2312 "parser_yacc.c"
    break;

  case 42: /* opt_owner_flag: TOK_OTHER  */
#line 643 "parser_yacc.y"
                    { (yyval.boolean) = 2; }
#line 2318 "parser_yacc.c"
    break;

  case 43: /* opt_perm_mode: %empty  */
#line 645 "parser_yacc.y"
               { /* nothing */ (yyval.boolean) = 0; }
#line 2324 "parser_yacc.c"
    break;

  case 44: /* opt_perm_mode: TOK_ALLOW  */
#line 646 "parser_yacc.y"
                    { (yyval.boolean) = 0; }
#line 2330 "parser_yacc.c"
    break;

  case 45: /* opt_perm_mode: TOK_DENY  */
#line 647 "parser_yacc.y"
                   { (yyval.boolean) = 1; }
#line 2336 "parser_yacc.c"
    break;

  case 46: /* opt_prefix: opt_audit_flag opt_perm_mode opt_owner_flag  */
#line 650 "parser_yacc.y"
        {
		(yyval.prefix).audit = (yyvsp[-2].boolean);
		(yyval.prefix).deny = (yyvsp[-1].boolean);
		(yyval.prefix).owner = (yyvsp[0].boolean);
	}
#line 2346 "parser_yacc.c"
    break;

  case 47: /* rules: %empty  */
#line 656 "parser_yacc.y"
        { /* nothing */ 
	Profile *prof = new Profile();
		if (!prof) {
			yyerror(_("Memory allocation error."));
		}

		(yyval.prof) = prof;
	}
#line 2359 "parser_yacc.c"
    break;

  case 48: /* rules: rules abi_rule  */
#line 665 "parser_yacc.y"
                      { /* nothing */ }
#line 2365 "parser_yacc.c"
    break;

  case 49: /* rules: rules opt_prefix rule  */
#line 668 "parser_yacc.y"
        {
		PDEBUG("matched: rules rule\n");
		PDEBUG("rules rule: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `rule' returned NULL."));
		(yyvsp[0].user_entry)->deny = (yyvsp[-1].prefix).deny;
		if (((yyvsp[-1].prefix).deny && ((yyvsp[0].user_entry)->mode & AA_EXEC_BITS) &&
		     ((yyvsp[0].user_entry)->mode & ALL_AA_EXEC_TYPE)))
			yyerror(_("Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', 'p', or 'u'"));
		else if (!(yyvsp[-1].prefix).deny && ((yyvsp[0].user_entry)->mode & AA_EXEC_BITS) &&
			 !((yyvsp[0].user_entry)->mode & ALL_AA_EXEC_TYPE) &&
			 !((yyvsp[0].user_entry)->nt_name))
			yyerror(_("Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"));

		if ((yyvsp[-1].prefix).owner == 1)
			(yyvsp[0].user_entry)->mode &= (AA_USER_PERMS | AA_SHARED_PERMS);
		else if ((yyvsp[-1].prefix).owner == 2)
			(yyvsp[0].user_entry)->mode &= (AA_OTHER_PERMS | AA_SHARED_PERMS);
		/* only set audit ctl quieting if the rule is not audited */
		if (((yyvsp[-1].prefix).deny && !(yyvsp[-1].prefix).audit) || (!(yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit))
			(yyvsp[0].user_entry)->audit = (yyvsp[0].user_entry)->mode & ~ALL_AA_EXEC_TYPE;

		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2395 "parser_yacc.c"
    break;

  case 50: /* rules: rules opt_prefix TOK_OPEN rules TOK_CLOSE  */
#line 696 "parser_yacc.y"
        {
		struct cod_entry *entry, *tmp;
		if ((yyvsp[-3].prefix).deny)
			yyerror(_("deny prefix not allowed"));

		PDEBUG("matched: %s%s%sblock\n", (yyvsp[-3].prefix).audit ? "audit " : "",
		       (yyvsp[-3].prefix).deny ? "deny " : "", (yyvsp[-3].prefix).owner ? "owner " : "");
		list_for_each_safe((yyvsp[-1].prof)->entries, entry, tmp) {
			entry->next = NULL;
			if (entry->mode & AA_EXEC_BITS) {
				if (entry->deny &&
				    (entry->mode & ALL_AA_EXEC_TYPE))
					yyerror(_("Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', 'p', or 'u'"));
				else if (!entry->deny &&
					 !(entry->mode & ALL_AA_EXEC_TYPE))
					yyerror(_("Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"));
			}
			if ((yyvsp[-3].prefix).owner == 1)
 				entry->mode &= (AA_USER_PERMS | AA_SHARED_PERMS);
			else if ((yyvsp[-3].prefix).owner == 2)
				entry->mode &= (AA_OTHER_PERMS | AA_SHARED_PERMS);

			if ((yyvsp[-3].prefix).audit && !entry->deny)
				entry->audit = entry->mode & ~ALL_AA_EXEC_TYPE;
			else if (!(yyvsp[-3].prefix).audit && entry->deny)
				 entry->audit = entry->mode & ~ALL_AA_EXEC_TYPE;
			add_entry_to_policy((yyvsp[-4].prof), entry);
		}
		(yyvsp[-1].prof)->entries = NULL;
		// fix me transfer rules and free sub profile
		delete (yyvsp[-1].prof);
		(yyval.prof) = (yyvsp[-4].prof);
	}
#line 2433 "parser_yacc.c"
    break;

  case 51: /* rules: rules opt_prefix network_rule  */
#line 731 "parser_yacc.y"
        {
		struct aa_network_entry *entry, *tmp;

		PDEBUG("Matched: network rule\n");
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed"));
		if (!(yyvsp[0].network_entry))
			yyerror(_("Assert: `network_rule' return invalid protocol."));
		if (!(yyvsp[-2].prof)->alloc_net_table())
			yyerror(_("Memory allocation error."));
		list_for_each_safe((yyvsp[0].network_entry), entry, tmp) {

			/* map to extended mediation, let rule backend do
			 * downgrade if needed
			 */
			if (entry->family == AF_UNIX) {
				unix_rule *rule = new unix_rule(entry->type, (yyvsp[-1].prefix).audit, (yyvsp[-1].prefix).deny);
				if (!rule)
					yyerror(_("Memory allocation error."));
				(yyvsp[-2].prof)->rule_ents.push_back(rule);
			}
			if (entry->type > SOCK_PACKET) {
				/* setting mask instead of a bit */
				if ((yyvsp[-1].prefix).deny) {
					(yyvsp[-2].prof)->net.deny[entry->family] |= entry->type;
					if (!(yyvsp[-1].prefix).audit)
						(yyvsp[-2].prof)->net.quiet[entry->family] |= entry->type;
				} else {
					(yyvsp[-2].prof)->net.allow[entry->family] |= entry->type;
					if ((yyvsp[-1].prefix).audit)
						(yyvsp[-2].prof)->net.audit[entry->family] |= entry->type;
				}
			} else {
				if ((yyvsp[-1].prefix).deny) {
					(yyvsp[-2].prof)->net.deny[entry->family] |= 1 << entry->type;
					if (!(yyvsp[-1].prefix).audit)
						(yyvsp[-2].prof)->net.quiet[entry->family] |= 1 << entry->type;
				} else {
					(yyvsp[-2].prof)->net.allow[entry->family] |= 1 << entry->type;
					if ((yyvsp[-1].prefix).audit)
						(yyvsp[-2].prof)->net.audit[entry->family] |= 1 << entry->type;
				}
			}
			free(entry);
		}

		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2486 "parser_yacc.c"
    break;

  case 52: /* rules: rules opt_prefix mnt_rule  */
#line 781 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on mount rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].mnt_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].mnt_entry)->deny = 1;
			(yyvsp[0].mnt_entry)->audit = (yyvsp[0].mnt_entry)->allow;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].mnt_entry)->audit = (yyvsp[0].mnt_entry)->allow;
		}

		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].mnt_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2506 "parser_yacc.c"
    break;

  case 53: /* rules: rules opt_prefix dbus_rule  */
#line 798 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on dbus rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].dbus_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].dbus_entry)->deny = 1;
			(yyvsp[0].dbus_entry)->audit = (yyvsp[0].dbus_entry)->mode;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].dbus_entry)->audit = (yyvsp[0].dbus_entry)->mode;
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].dbus_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2525 "parser_yacc.c"
    break;

  case 54: /* rules: rules opt_prefix signal_rule  */
#line 814 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on signal rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].signal_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].signal_entry)->deny = 1;
			(yyvsp[0].signal_entry)->audit = (yyvsp[0].signal_entry)->mode;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].signal_entry)->audit = (yyvsp[0].signal_entry)->mode;
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].signal_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2544 "parser_yacc.c"
    break;

  case 55: /* rules: rules opt_prefix ptrace_rule  */
#line 830 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on ptrace rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].ptrace_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].ptrace_entry)->deny = 1;
			(yyvsp[0].ptrace_entry)->audit = (yyvsp[0].ptrace_entry)->mode;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].ptrace_entry)->audit = (yyvsp[0].ptrace_entry)->mode;
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].ptrace_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2563 "parser_yacc.c"
    break;

  case 56: /* rules: rules opt_prefix unix_rule  */
#line 846 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on unix rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].unix_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].unix_entry)->deny = 1;
			(yyvsp[0].unix_entry)->audit = (yyvsp[0].unix_entry)->mode;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].unix_entry)->audit = (yyvsp[0].unix_entry)->mode;
		}
		(yyvsp[-2].prof)->rule_ents.push_back((yyvsp[0].unix_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2582 "parser_yacc.c"
    break;

  case 57: /* rules: rules opt_prefix change_profile  */
#line 862 "parser_yacc.y"
        {
		PDEBUG("matched: rules change_profile\n");
		PDEBUG("rules change_profile: (%s)\n", (yyvsp[0].user_entry)->name);
		if (!(yyvsp[0].user_entry))
			yyerror(_("Assert: `change_profile' returned NULL."));
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on unix rules"));
		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[0].user_entry)->deny = 1;
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[0].user_entry)->deny = 1;
			(yyvsp[0].user_entry)->audit = (yyvsp[0].user_entry)->mode;
		} else if ((yyvsp[-1].prefix).audit) {
			(yyvsp[0].user_entry)->audit = (yyvsp[0].user_entry)->mode;
		}
		add_entry_to_policy((yyvsp[-2].prof), (yyvsp[0].user_entry));
		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2605 "parser_yacc.c"
    break;

  case 58: /* rules: rules opt_prefix capability  */
#line 882 "parser_yacc.y"
        {
		if ((yyvsp[-1].prefix).owner)
			yyerror(_("owner prefix not allowed on capability rules"));

		if ((yyvsp[-1].prefix).deny && (yyvsp[-1].prefix).audit) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
		} else if ((yyvsp[-1].prefix).deny) {
			(yyvsp[-2].prof)->caps.deny |= (yyvsp[0].cap);
			(yyvsp[-2].prof)->caps.quiet |= (yyvsp[0].cap);
		} else {
			(yyvsp[-2].prof)->caps.allow |= (yyvsp[0].cap);
			if ((yyvsp[-1].prefix).audit)
				(yyvsp[-2].prof)->caps.audit |= (yyvsp[0].cap);
		}

		(yyval.prof) = (yyvsp[-2].prof);
	}
#line 2627 "parser_yacc.c"
    break;

  case 59: /* rules: rules hat  */
#line 901 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'hat rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2639 "parser_yacc.c"
    break;

  case 60: /* rules: rules local_profile  */
#line 910 "parser_yacc.y"
        {
		PDEBUG("Matched: hat rule\n");
		if (!(yyvsp[0].prof))
			yyerror(_("Assert: 'local_profile rule' returned NULL."));
		add_hat_to_policy((yyvsp[-1].prof), (yyvsp[0].prof));
		add_local_entry((yyvsp[0].prof));
		(yyval.prof) = (yyvsp[-1].prof);
	}
#line 2652 "parser_yacc.c"
    break;

  case 61: /* rules: rules cond_rule  */
#line 920 "parser_yacc.y"
        {
		PDEBUG("Matched: conditional rules\n");
		(yyval.prof) = merge_policy((yyvsp[-1].prof), (yyvsp[0].prof));
	}
#line 2661 "parser_yacc.c"
    break;

  case 62: /* rules: rules TOK_SET TOK_RLIMIT TOK_ID TOK_LE TOK_VALUE opt_id TOK_END_OF_RULE  */
#line 926 "parser_yacc.y"
        {
		rlim_t value = RLIM_INFINITY;
		long long tmp;
		char *end;

		int limit = get_rlimit((yyvsp[-4].id));
		if (limit == -1)
			yyerror("INVALID RLIMIT '%s'\n", (yyvsp[-4].id));

		if (strcmp((yyvsp[-2].var_val), "infinity") == 0) {
			value = RLIM_INFINITY;
		} else {
			const char *kb = "KB";
			const char *mb = "MB";
			const char *gb = "GB";

			tmp = strtoll((yyvsp[-2].var_val), &end, 0);
			switch (limit) {
			case RLIMIT_CPU:
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				tmp = convert_time_units(tmp, SECONDS_P_MS, (yyvsp[-1].id));
				if (tmp == -1LL)
					yyerror("RLIMIT '%s %s' < minimum value of 1s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				else if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val));
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'cpu' no units specified using default units of seconds\n"));
				value = tmp;
				break;
#ifdef RLIMIT_RTTIME
			case RLIMIT_RTTIME:
				/* RTTIME is measured in microseconds */
				if (!end || (yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				tmp = convert_time_units(tmp, 1LL, (yyvsp[-1].id));
				if (tmp < 0LL)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id))
					pwarn(WARN_MISSING, _("RLIMIT 'rttime' no units specified using default units of microseconds\n"));
				value = tmp;
				break;
#endif
			case RLIMIT_NOFILE:
			case RLIMIT_NPROC:
			case RLIMIT_LOCKS:
			case RLIMIT_SIGPENDING:
#ifdef RLIMIT_RTPRIO
			case RLIMIT_RTPRIO:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id) || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				value = tmp;
				break;
#endif
#ifdef RLIMIT_NICE
			case RLIMIT_NICE:
				if (!end || (yyvsp[-2].var_val) == end || (yyvsp[-1].id))
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (tmp < -20 || tmp > 19)
					yyerror("RLIMIT '%s' out of range (-20 .. 19) %d\n", (yyvsp[-4].id), tmp);
				value = tmp + 20;
				break;
#endif
			case RLIMIT_FSIZE:
			case RLIMIT_DATA:
			case RLIMIT_STACK:
			case RLIMIT_CORE:
			case RLIMIT_RSS:
			case RLIMIT_AS:
			case RLIMIT_MEMLOCK:
			case RLIMIT_MSGQUEUE:
				if ((yyvsp[-2].var_val) == end || tmp < 0)
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id) ? (yyvsp[-1].id) : "");
				if (!(yyvsp[-1].id)) {
					; /* use default of bytes */
				} else if (strstr(kb, (yyvsp[-1].id)) == kb) {
					tmp *= 1024;
				} else if (strstr(mb, (yyvsp[-1].id)) == mb) {
					tmp *= 1024*1024;
				} else if (strstr(gb, (yyvsp[-1].id)) == gb) {
					tmp *= 1024*1024*1024;
				} else {
					yyerror("RLIMIT '%s' invalid value %s %s\n", (yyvsp[-4].id), (yyvsp[-2].var_val), (yyvsp[-1].id));
				}
				value = tmp;
				break;
			default:
				yyerror("Unknown RLIMIT %d\n", (yyvsp[-4].id));
			}
		}
		(yyvsp[-7].prof)->rlimits.specified |= 1 << limit;
		(yyvsp[-7].prof)->rlimits.limits[limit] = value;
		free((yyvsp[-4].id));
		free((yyvsp[-2].var_val));
		(yyval.prof) = (yyvsp[-7].prof);
	}
#line 2762 "parser_yacc.c"
    break;

  case 63: /* cond_rule: TOK_IF expr TOK_OPEN rules TOK_CLOSE  */
#line 1025 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional rules\n");
		if ((yyvsp[-3].boolean)) {
			ret = (yyvsp[-1].prof);
		} else {
			delete (yyvsp[-1].prof);
		}
		(yyval.prof) = ret;
	}
#line 2777 "parser_yacc.c"
    break;

  case 64: /* cond_rule: TOK_IF expr TOK_OPEN rules TOK_CLOSE TOK_ELSE TOK_OPEN rules TOK_CLOSE  */
#line 1037 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else rules\n");
		if ((yyvsp[-7].boolean)) {
			ret = (yyvsp[-5].prof);
			delete (yyvsp[-1].prof);
		} else {
			ret = (yyvsp[-1].prof);
			delete (yyvsp[-5].prof);
		}
		(yyval.prof) = ret;
	}
#line 2794 "parser_yacc.c"
    break;

  case 65: /* cond_rule: TOK_IF expr TOK_OPEN rules TOK_CLOSE TOK_ELSE cond_rule  */
#line 1051 "parser_yacc.y"
        {
		Profile *ret = NULL;
		PDEBUG("Matched: found conditional else-if rules\n");
		if ((yyvsp[-5].boolean)) {
			ret = (yyvsp[-3].prof);
			delete (yyvsp[0].prof);
		} else {
			ret = (yyvsp[0].prof);
			delete (yyvsp[-3].prof);
		}
		(yyval.prof) = ret;
	}
#line 2811 "parser_yacc.c"
    break;

  case 66: /* expr: TOK_NOT expr  */
#line 1065 "parser_yacc.y"
        {
		(yyval.boolean) = !(yyvsp[0].boolean);
	}
#line 2819 "parser_yacc.c"
    break;

  case 67: /* expr: TOK_BOOL_VAR  */
#line 1070 "parser_yacc.y"
        {
		char *var_name = process_var((yyvsp[0].bool_var));
		int boolean  = get_boolean_var(var_name);
		PDEBUG("Matched: boolean expr %s value: %d\n", (yyvsp[0].bool_var), boolean);
		if (boolean < 0) {
			/* FIXME check for set var */
			yyerror(_("Unset boolean variable %s used in if-expression"),
				(yyvsp[0].bool_var));
		}
		(yyval.boolean) = boolean;
		free(var_name);
		free((yyvsp[0].bool_var));
	}
#line 2837 "parser_yacc.c"
    break;

  case 68: /* expr: TOK_DEFINED TOK_SET_VAR  */
#line 1085 "parser_yacc.y"
        {
		char *var_name = process_var((yyvsp[0].set_var));
		void *set_value = get_set_var(var_name);
		PDEBUG("Matched: defined set expr %s value %lx\n", (yyvsp[0].set_var), (long) set_value);
		(yyval.boolean) = !! (long) set_value;
		free(var_name);
		free((yyvsp[0].set_var));
	}
#line 2850 "parser_yacc.c"
    break;

  case 69: /* expr: TOK_DEFINED TOK_BOOL_VAR  */
#line 1095 "parser_yacc.y"
        {
		char *var_name = process_var((yyvsp[0].bool_var));
		int boolean = get_boolean_var(var_name);
		PDEBUG("Matched: defined set expr %s value %d\n", (yyvsp[0].bool_var), boolean);
		(yyval.boolean) = (boolean != -1);
		free(var_name);
		free((yyvsp[0].bool_var));
	}
#line 2863 "parser_yacc.c"
    break;

  case 70: /* id_or_var: TOK_ID  */
#line 1104 "parser_yacc.y"
                  { (yyval.id) = (yyvsp[0].id); }
#line 2869 "parser_yacc.c"
    break;

  case 71: /* id_or_var: TOK_SET_VAR  */
#line 1105 "parser_yacc.y"
                       { (yyval.id) = (yyvsp[0].set_var); }
#line 2875 "parser_yacc.c"
    break;

  case 72: /* opt_target: %empty  */
#line 1107 "parser_yacc.y"
                          { (yyval.id) = NULL; }
#line 2881 "parser_yacc.c"
    break;

  case 73: /* opt_target: TOK_ARROW id_or_var  */
#line 1108 "parser_yacc.y"
                                { (yyval.id) = (yyvsp[0].id); }
#line 2887 "parser_yacc.c"
    break;

  case 74: /* opt_named_transition: %empty  */
#line 1110 "parser_yacc.y"
                      { /* nothing */ (yyval.id) = NULL; }
#line 2893 "parser_yacc.c"
    break;

  case 75: /* opt_named_transition: TOK_ARROW id_or_var  */
#line 1112 "parser_yacc.y"
        {
		(yyval.id) = (yyvsp[0].id);
	}
#line 2901 "parser_yacc.c"
    break;

  case 76: /* rule: file_rule  */
#line 1116 "parser_yacc.y"
                { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 2907 "parser_yacc.c"
    break;

  case 77: /* rule: link_rule  */
#line 1117 "parser_yacc.y"
                    { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 2913 "parser_yacc.c"
    break;

  case 78: /* abi_rule: TOK_ABI TOK_ID TOK_END_OF_RULE  */
#line 1120 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].id), true);
		free((yyvsp[-1].id));
		/* $$ = nothing, not used */
	}
#line 2923 "parser_yacc.c"
    break;

  case 79: /* abi_rule: TOK_ABI TOK_VALUE TOK_END_OF_RULE  */
#line 1126 "parser_yacc.y"
        {
		abi_features((yyvsp[-1].var_val), false);
		free((yyvsp[-1].var_val));
		/* $$ = nothing, not used */
	}
#line 2933 "parser_yacc.c"
    break;

  case 80: /* opt_exec_mode: %empty  */
#line 1132 "parser_yacc.y"
               { /* nothing */ (yyval.boolean) = EXEC_MODE_EMPTY; }
#line 2939 "parser_yacc.c"
    break;

  case 81: /* opt_exec_mode: TOK_UNSAFE  */
#line 1133 "parser_yacc.y"
                     { (yyval.boolean) = EXEC_MODE_UNSAFE; }
#line 2945 "parser_yacc.c"
    break;

  case 82: /* opt_exec_mode: TOK_SAFE  */
#line 1134 "parser_yacc.y"
                   { (yyval.boolean) = EXEC_MODE_SAFE; }
#line 2951 "parser_yacc.c"
    break;

  case 83: /* opt_file: %empty  */
#line 1136 "parser_yacc.y"
          { /* nothing */ (yyval.boolean) = 0; }
#line 2957 "parser_yacc.c"
    break;

  case 84: /* opt_file: TOK_FILE  */
#line 1137 "parser_yacc.y"
                   { (yyval.boolean) = 1; }
#line 2963 "parser_yacc.c"
    break;

  case 85: /* frule: id_or_var file_mode opt_named_transition TOK_END_OF_RULE  */
#line 1140 "parser_yacc.y"
        {
		(yyval.user_entry) = do_file_rule((yyvsp[-3].id), (yyvsp[-2].fmode), NULL, (yyvsp[-1].id));
	}
#line 2971 "parser_yacc.c"
    break;

  case 86: /* frule: file_mode opt_subset_flag id_or_var opt_named_transition TOK_END_OF_RULE  */
#line 1145 "parser_yacc.y"
        {
		if ((yyvsp[-3].boolean) && ((yyvsp[-4].fmode) & ~AA_LINK_BITS))
			yyerror(_("subset can only be used with link rules."));
		if ((yyvsp[-1].id) && ((yyvsp[-4].fmode) & AA_LINK_BITS) && ((yyvsp[-4].fmode) & AA_EXEC_BITS))
			yyerror(_("link and exec perms conflict on a file rule using ->"));
		if ((yyvsp[-1].id) && label_contains_ns((yyvsp[-1].id)) && ((yyvsp[-4].fmode) & AA_LINK_BITS))
			yyerror(_("link perms are not allowed on a named profile transition.\n"));

		if (((yyvsp[-4].fmode) & AA_LINK_BITS)) {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fmode), (yyvsp[-1].id), NULL);
			(yyval.user_entry)->subset = (yyvsp[-3].boolean);

		} else {
			(yyval.user_entry) = do_file_rule((yyvsp[-2].id), (yyvsp[-4].fmode), NULL, (yyvsp[-1].id));
		}
 	}
#line 2992 "parser_yacc.c"
    break;

  case 87: /* file_rule: TOK_FILE TOK_END_OF_RULE  */
#line 1163 "parser_yacc.y"
        {
		char *path = strdup("/{**,}");
		int perms = ((AA_BASE_PERMS & ~AA_EXEC_TYPE) |
			     (AA_EXEC_INHERIT | AA_MAY_EXEC));
		/* duplicate to other permission set */
		perms |= perms << AA_OTHER_SHIFT;
		if (!path)
			yyerror(_("Memory allocation error."));
		(yyval.user_entry) = do_file_rule(path, perms, NULL, NULL);
	}
#line 3007 "parser_yacc.c"
    break;

  case 88: /* file_rule: opt_file file_rule_tail  */
#line 1173 "parser_yacc.y"
                                  { (yyval.user_entry) = (yyvsp[0].user_entry); }
#line 3013 "parser_yacc.c"
    break;

  case 89: /* file_rule_tail: opt_exec_mode frule  */
#line 1177 "parser_yacc.y"
        {
		if ((yyvsp[-1].boolean) != EXEC_MODE_EMPTY) {
			if (!((yyvsp[0].user_entry)->mode & AA_EXEC_BITS))
				yyerror(_("unsafe rule missing exec permissions"));
			if ((yyvsp[-1].boolean) == EXEC_MODE_UNSAFE) {
				(yyvsp[0].user_entry)->mode |= (((yyvsp[0].user_entry)->mode & AA_EXEC_BITS) << 8) &
					 ALL_AA_EXEC_UNSAFE;
			}
			else if ((yyvsp[-1].boolean) == EXEC_MODE_SAFE)
				(yyvsp[0].user_entry)->mode &= ~ALL_AA_EXEC_UNSAFE;
		}
		(yyval.user_entry) = (yyvsp[0].user_entry);
	}
#line 3031 "parser_yacc.c"
    break;

  case 90: /* file_rule_tail: opt_exec_mode id_or_var file_mode id_or_var  */
#line 1192 "parser_yacc.y"
        {
		/* Oopsie, we appear to be missing an EOL marker. If we
		 * were *smart*, we could work around it. Since we're
		 * obviously not smart, we'll just punt with a more
		 * sensible error. */
		yyerror(_("missing an end of line character? (entry: %s)"), (yyvsp[-2].id));
	}
#line 3043 "parser_yacc.c"
    break;

  case 91: /* link_rule: TOK_LINK opt_subset_flag id_or_var TOK_ARROW id_or_var TOK_END_OF_RULE  */
#line 1201 "parser_yacc.y"
        {
		struct cod_entry *entry;
		PDEBUG("Matched: link tok_id (%s) -> (%s)\n", (yyvsp[-3].id), (yyvsp[-1].id));
		entry = new_entry((yyvsp[-3].id), AA_LINK_BITS, (yyvsp[-1].id));
		entry->subset = (yyvsp[-4].boolean);
		PDEBUG("rule.entry: link (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 3056 "parser_yacc.c"
    break;

  case 92: /* network_rule: TOK_NETWORK TOK_END_OF_RULE  */
#line 1211 "parser_yacc.y"
        {
		size_t family;
		struct aa_network_entry *new_entry, *entry = NULL;
		for (family = AF_UNSPEC; family < get_af_max(); family++) {
			new_entry = new_network_ent(family, 0xffffffff,
						    0xffffffff);
			if (!new_entry)
				yyerror(_("Memory allocation error."));
			new_entry->next = entry;
			entry = new_entry;
		}
		(yyval.network_entry) = entry;
	}
#line 3074 "parser_yacc.c"
    break;

  case 93: /* network_rule: TOK_NETWORK TOK_ID TOK_END_OF_RULE  */
#line 1226 "parser_yacc.y"
        {
		struct aa_network_entry *entry;
		entry = network_entry((yyvsp[-1].id), NULL, NULL);
		if (!entry)
			/* test for short circuiting of family */
			entry = network_entry(NULL, (yyvsp[-1].id), NULL);
		if (!entry)
			yyerror(_("Invalid network entry."));
		free((yyvsp[-1].id));
		(yyval.network_entry) = entry;
	}
#line 3090 "parser_yacc.c"
    break;

  case 94: /* network_rule: TOK_NETWORK TOK_ID TOK_ID TOK_END_OF_RULE  */
#line 1239 "parser_yacc.y"
        {
		struct aa_network_entry *entry;
		entry = network_entry((yyvsp[-2].id), (yyvsp[-1].id), NULL);
		if (!entry)
			yyerror(_("Invalid network entry."));
		free((yyvsp[-2].id));
		free((yyvsp[-1].id));
		(yyval.network_entry) = entry;
	}
#line 3104 "parser_yacc.c"
    break;

  case 95: /* cond: TOK_CONDID  */
#line 1250 "parser_yacc.y"
        {
		struct cond_entry *ent;
		ent = new_cond_entry((yyvsp[0].id), 0, NULL);
		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3116 "parser_yacc.c"
    break;

  case 96: /* cond: TOK_CONDID TOK_EQUALS TOK_VALUE  */
#line 1259 "parser_yacc.y"
        {
		struct cond_entry *ent;
		struct value_list *value = new_value_list((yyvsp[0].var_val));
		if (!value)
			yyerror(_("Memory allocation error."));
		ent = new_cond_entry((yyvsp[-2].id), 1, value);
		if (!ent) {
			free_value_list(value);
			yyerror(_("Memory allocation error."));
		}
		(yyval.cond_entry) = ent;
	}
#line 3133 "parser_yacc.c"
    break;

  case 97: /* cond: TOK_CONDID TOK_EQUALS TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1273 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), 1, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3145 "parser_yacc.c"
    break;

  case 98: /* cond: TOK_CONDID TOK_IN TOK_OPENPAREN valuelist TOK_CLOSEPAREN  */
#line 1283 "parser_yacc.y"
        {
		struct cond_entry *ent = new_cond_entry((yyvsp[-4].id), 0, (yyvsp[-1].val_list));

		if (!ent)
			yyerror(_("Memory allocation error."));
		(yyval.cond_entry) = ent;
	}
#line 3157 "parser_yacc.c"
    break;

  case 99: /* opt_conds: %empty  */
#line 1291 "parser_yacc.y"
           { /* nothing */ (yyval.cond_entry) = NULL; }
#line 3163 "parser_yacc.c"
    break;

  case 100: /* opt_conds: opt_conds cond  */
#line 1293 "parser_yacc.y"
        {
		(yyvsp[0].cond_entry)->next = (yyvsp[-1].cond_entry);
		(yyval.cond_entry) = (yyvsp[0].cond_entry);
	}
#line 3172 "parser_yacc.c"
    break;

  case 101: /* cond_list: TOK_CONDLISTID TOK_EQUALS TOK_OPENPAREN opt_conds TOK_CLOSEPAREN  */
#line 1299 "parser_yacc.y"
        {
		(yyval.cond_entry_list).name = (yyvsp[-4].id);
		(yyval.cond_entry_list).list = (yyvsp[-1].cond_entry);
	}
#line 3181 "parser_yacc.c"
    break;

  case 102: /* opt_cond_list: %empty  */
#line 1304 "parser_yacc.y"
               { /* nothing */ (yyval.cond_entry_list) = { NULL, NULL }; }
#line 3187 "parser_yacc.c"
    break;

  case 103: /* opt_cond_list: cond_list  */
#line 1305 "parser_yacc.y"
                    { (yyval.cond_entry_list) = (yyvsp[0].cond_entry_list); }
#line 3193 "parser_yacc.c"
    break;

  case 104: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1308 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), (yyvsp[-1].id), NULL, NULL, AA_MAY_MOUNT);
	}
#line 3201 "parser_yacc.c"
    break;

  case 105: /* mnt_rule: TOK_MOUNT opt_conds opt_id TOK_ARROW opt_conds TOK_ID TOK_END_OF_RULE  */
#line 1313 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-5].cond_entry), (yyvsp[-4].id), (yyvsp[-2].cond_entry), (yyvsp[-1].id), AA_MAY_MOUNT);
	}
#line 3209 "parser_yacc.c"
    break;

  case 106: /* mnt_rule: TOK_REMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1318 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_DUMMY_REMOUNT);
	}
#line 3217 "parser_yacc.c"
    break;

  case 107: /* mnt_rule: TOK_UMOUNT opt_conds opt_id TOK_END_OF_RULE  */
#line 1323 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_mnt_rule((yyvsp[-2].cond_entry), NULL, NULL, (yyvsp[-1].id), AA_MAY_UMOUNT);
	}
#line 3225 "parser_yacc.c"
    break;

  case 108: /* mnt_rule: TOK_PIVOTROOT opt_conds opt_id opt_target TOK_END_OF_RULE  */
#line 1328 "parser_yacc.y"
        {
		(yyval.mnt_entry) = do_pivot_rule((yyvsp[-3].cond_entry), (yyvsp[-2].id), (yyvsp[-1].id));
	}
#line 3233 "parser_yacc.c"
    break;

  case 109: /* dbus_perm: TOK_VALUE  */
#line 1333 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fmode) = AA_DBUS_BIND;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fmode) = AA_DBUS_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fmode) = AA_DBUS_RECEIVE;
		else if (strcmp((yyvsp[0].var_val), "eavesdrop") == 0)
			(yyval.fmode) = AA_DBUS_EAVESDROP;
		else if ((yyvsp[0].var_val)) {
			parse_dbus_mode((yyvsp[0].var_val), &(yyval.fmode), 1);
		} else
			(yyval.fmode) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3255 "parser_yacc.c"
    break;

  case 110: /* dbus_perm: TOK_BIND  */
#line 1350 "parser_yacc.y"
                   { (yyval.fmode) = AA_DBUS_BIND; }
#line 3261 "parser_yacc.c"
    break;

  case 111: /* dbus_perm: TOK_SEND  */
#line 1351 "parser_yacc.y"
                   { (yyval.fmode) = AA_DBUS_SEND; }
#line 3267 "parser_yacc.c"
    break;

  case 112: /* dbus_perm: TOK_RECEIVE  */
#line 1352 "parser_yacc.y"
                      { (yyval.fmode) = AA_DBUS_RECEIVE; }
#line 3273 "parser_yacc.c"
    break;

  case 113: /* dbus_perm: TOK_READ  */
#line 1353 "parser_yacc.y"
                   { (yyval.fmode) = AA_DBUS_RECEIVE; }
#line 3279 "parser_yacc.c"
    break;

  case 114: /* dbus_perm: TOK_WRITE  */
#line 1354 "parser_yacc.y"
                    { (yyval.fmode) = AA_DBUS_SEND; }
#line 3285 "parser_yacc.c"
    break;

  case 115: /* dbus_perm: TOK_EAVESDROP  */
#line 1355 "parser_yacc.y"
                        { (yyval.fmode) = AA_DBUS_EAVESDROP; }
#line 3291 "parser_yacc.c"
    break;

  case 116: /* dbus_perm: TOK_MODE  */
#line 1357 "parser_yacc.y"
        {
		parse_dbus_mode((yyvsp[0].mode), &(yyval.fmode), 1);
		free((yyvsp[0].mode));
	}
#line 3300 "parser_yacc.c"
    break;

  case 117: /* dbus_perms: %empty  */
#line 1362 "parser_yacc.y"
            { /* nothing */ (yyval.fmode) = 0; }
#line 3306 "parser_yacc.c"
    break;

  case 118: /* dbus_perms: dbus_perms dbus_perm  */
#line 1363 "parser_yacc.y"
                               { (yyval.fmode) = (yyvsp[-1].fmode) | (yyvsp[0].fmode); }
#line 3312 "parser_yacc.c"
    break;

  case 119: /* dbus_perms: dbus_perms TOK_COMMA dbus_perm  */
#line 1364 "parser_yacc.y"
                                         { (yyval.fmode) = (yyvsp[-2].fmode) | (yyvsp[0].fmode); }
#line 3318 "parser_yacc.c"
    break;

  case 120: /* opt_dbus_perm: %empty  */
#line 1366 "parser_yacc.y"
               { /* nothing */ (yyval.fmode) = 0; }
#line 3324 "parser_yacc.c"
    break;

  case 121: /* opt_dbus_perm: dbus_perm  */
#line 1367 "parser_yacc.y"
                     { (yyval.fmode) = (yyvsp[0].fmode); }
#line 3330 "parser_yacc.c"
    break;

  case 122: /* opt_dbus_perm: TOK_OPENPAREN dbus_perms TOK_CLOSEPAREN  */
#line 1368 "parser_yacc.y"
                                                  { (yyval.fmode) = (yyvsp[-1].fmode); }
#line 3336 "parser_yacc.c"
    break;

  case 123: /* dbus_rule: TOK_DBUS opt_dbus_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1371 "parser_yacc.y"
        {
		dbus_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("dbus rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new dbus_rule((yyvsp[-3].fmode), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.dbus_entry) = ent;
	}
#line 3355 "parser_yacc.c"
    break;

  case 124: /* net_perm: TOK_VALUE  */
#line 1387 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "create") == 0)
			(yyval.fmode) = AA_NET_CREATE;
		else if (strcmp((yyvsp[0].var_val), "bind") == 0)
			(yyval.fmode) = AA_NET_BIND;
		else if (strcmp((yyvsp[0].var_val), "listen") == 0)
			(yyval.fmode) = AA_NET_LISTEN;
		else if (strcmp((yyvsp[0].var_val), "accept") == 0)
			(yyval.fmode) = AA_NET_ACCEPT;
		else if (strcmp((yyvsp[0].var_val), "connect") == 0)
			(yyval.fmode) = AA_NET_CONNECT;
		else if (strcmp((yyvsp[0].var_val), "shutdown") == 0)
			(yyval.fmode) = AA_NET_SHUTDOWN;
		else if (strcmp((yyvsp[0].var_val), "getattr") == 0)
			(yyval.fmode) = AA_NET_GETATTR;
		else if (strcmp((yyvsp[0].var_val), "setattr") == 0)
			(yyval.fmode) = AA_NET_SETATTR;
		else if (strcmp((yyvsp[0].var_val), "getopt") == 0)
			(yyval.fmode) = AA_NET_GETOPT;
		else if (strcmp((yyvsp[0].var_val), "setopt") == 0)
			(yyval.fmode) = AA_NET_SETOPT;
		else if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fmode) = AA_NET_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fmode) = AA_NET_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_net_mode((yyvsp[0].var_val), &(yyval.fmode), 1);
		} else
			(yyval.fmode) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3393 "parser_yacc.c"
    break;

  case 125: /* net_perm: TOK_CREATE  */
#line 1420 "parser_yacc.y"
                     { (yyval.fmode) = AA_NET_CREATE; }
#line 3399 "parser_yacc.c"
    break;

  case 126: /* net_perm: TOK_BIND  */
#line 1421 "parser_yacc.y"
                   { (yyval.fmode) = AA_NET_BIND; }
#line 3405 "parser_yacc.c"
    break;

  case 127: /* net_perm: TOK_LISTEN  */
#line 1422 "parser_yacc.y"
                     { (yyval.fmode) = AA_NET_LISTEN; }
#line 3411 "parser_yacc.c"
    break;

  case 128: /* net_perm: TOK_ACCEPT  */
#line 1423 "parser_yacc.y"
                     { (yyval.fmode) = AA_NET_ACCEPT; }
#line 3417 "parser_yacc.c"
    break;

  case 129: /* net_perm: TOK_CONNECT  */
#line 1424 "parser_yacc.y"
                      { (yyval.fmode) = AA_NET_CONNECT; }
#line 3423 "parser_yacc.c"
    break;

  case 130: /* net_perm: TOK_SHUTDOWN  */
#line 1425 "parser_yacc.y"
                       { (yyval.fmode) = AA_NET_SHUTDOWN; }
#line 3429 "parser_yacc.c"
    break;

  case 131: /* net_perm: TOK_GETATTR  */
#line 1426 "parser_yacc.y"
                      { (yyval.fmode) = AA_NET_GETATTR; }
#line 3435 "parser_yacc.c"
    break;

  case 132: /* net_perm: TOK_SETATTR  */
#line 1427 "parser_yacc.y"
                      { (yyval.fmode) = AA_NET_SETATTR; }
#line 3441 "parser_yacc.c"
    break;

  case 133: /* net_perm: TOK_GETOPT  */
#line 1428 "parser_yacc.y"
                     { (yyval.fmode) = AA_NET_GETOPT; }
#line 3447 "parser_yacc.c"
    break;

  case 134: /* net_perm: TOK_SETOPT  */
#line 1429 "parser_yacc.y"
                     { (yyval.fmode) = AA_NET_SETOPT; }
#line 3453 "parser_yacc.c"
    break;

  case 135: /* net_perm: TOK_SEND  */
#line 1430 "parser_yacc.y"
                   { (yyval.fmode) = AA_NET_SEND; }
#line 3459 "parser_yacc.c"
    break;

  case 136: /* net_perm: TOK_RECEIVE  */
#line 1431 "parser_yacc.y"
                      { (yyval.fmode) = AA_NET_RECEIVE; }
#line 3465 "parser_yacc.c"
    break;

  case 137: /* net_perm: TOK_READ  */
#line 1432 "parser_yacc.y"
                   { (yyval.fmode) = AA_NET_RECEIVE; }
#line 3471 "parser_yacc.c"
    break;

  case 138: /* net_perm: TOK_WRITE  */
#line 1433 "parser_yacc.y"
                    { (yyval.fmode) = AA_NET_SEND; }
#line 3477 "parser_yacc.c"
    break;

  case 139: /* net_perm: TOK_MODE  */
#line 1435 "parser_yacc.y"
        {
		parse_unix_mode((yyvsp[0].mode), &(yyval.fmode), 1);
		free((yyvsp[0].mode));
	}
#line 3486 "parser_yacc.c"
    break;

  case 140: /* net_perms: %empty  */
#line 1440 "parser_yacc.y"
           { /* nothing */ (yyval.fmode) = 0; }
#line 3492 "parser_yacc.c"
    break;

  case 141: /* net_perms: net_perms net_perm  */
#line 1441 "parser_yacc.y"
                             { (yyval.fmode) = (yyvsp[-1].fmode) | (yyvsp[0].fmode); }
#line 3498 "parser_yacc.c"
    break;

  case 142: /* net_perms: net_perms TOK_COMMA net_perm  */
#line 1442 "parser_yacc.y"
                                       { (yyval.fmode) = (yyvsp[-2].fmode) | (yyvsp[0].fmode); }
#line 3504 "parser_yacc.c"
    break;

  case 143: /* opt_net_perm: %empty  */
#line 1444 "parser_yacc.y"
              { /* nothing */ (yyval.fmode) = 0; }
#line 3510 "parser_yacc.c"
    break;

  case 144: /* opt_net_perm: net_perm  */
#line 1445 "parser_yacc.y"
                    { (yyval.fmode) = (yyvsp[0].fmode); }
#line 3516 "parser_yacc.c"
    break;

  case 145: /* opt_net_perm: TOK_OPENPAREN net_perms TOK_CLOSEPAREN  */
#line 1446 "parser_yacc.y"
                                                 { (yyval.fmode) = (yyvsp[-1].fmode); }
#line 3522 "parser_yacc.c"
    break;

  case 146: /* unix_rule: TOK_UNIX opt_net_perm opt_conds opt_cond_list TOK_END_OF_RULE  */
#line 1449 "parser_yacc.y"
        {
		unix_rule *ent;

		if ((yyvsp[-1].cond_entry_list).name) {
			if (strcmp((yyvsp[-1].cond_entry_list).name, "peer") != 0)
				yyerror(_("unix rule: invalid conditional group %s=()"), (yyvsp[-1].cond_entry_list).name);
			free((yyvsp[-1].cond_entry_list).name);
		}
		ent = new unix_rule((yyvsp[-3].fmode), (yyvsp[-2].cond_entry), (yyvsp[-1].cond_entry_list).list);
		if (!ent) {
			yyerror(_("Memory allocation error."));
		}
		(yyval.unix_entry) = ent;
	}
#line 3541 "parser_yacc.c"
    break;

  case 147: /* signal_perm: TOK_VALUE  */
#line 1465 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "send") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fmode) = AA_MAY_SEND;
		else if (strcmp((yyvsp[0].var_val), "receive") == 0 || strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fmode) = AA_MAY_RECEIVE;
		else if ((yyvsp[0].var_val)) {
			parse_signal_mode((yyvsp[0].var_val), &(yyval.fmode), 1);
		} else
			(yyval.fmode) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3559 "parser_yacc.c"
    break;

  case 148: /* signal_perm: TOK_SEND  */
#line 1478 "parser_yacc.y"
                   { (yyval.fmode) = AA_MAY_SEND; }
#line 3565 "parser_yacc.c"
    break;

  case 149: /* signal_perm: TOK_RECEIVE  */
#line 1479 "parser_yacc.y"
                      { (yyval.fmode) = AA_MAY_RECEIVE; }
#line 3571 "parser_yacc.c"
    break;

  case 150: /* signal_perm: TOK_READ  */
#line 1480 "parser_yacc.y"
                   { (yyval.fmode) = AA_MAY_RECEIVE; }
#line 3577 "parser_yacc.c"
    break;

  case 151: /* signal_perm: TOK_WRITE  */
#line 1481 "parser_yacc.y"
                    { (yyval.fmode) = AA_MAY_SEND; }
#line 3583 "parser_yacc.c"
    break;

  case 152: /* signal_perm: TOK_MODE  */
#line 1483 "parser_yacc.y"
        {
		parse_signal_mode((yyvsp[0].mode), &(yyval.fmode), 1);
		free((yyvsp[0].mode));
	}
#line 3592 "parser_yacc.c"
    break;

  case 153: /* signal_perms: %empty  */
#line 1488 "parser_yacc.y"
              { /* nothing */ (yyval.fmode) = 0; }
#line 3598 "parser_yacc.c"
    break;

  case 154: /* signal_perms: signal_perms signal_perm  */
#line 1489 "parser_yacc.y"
                                   { (yyval.fmode) = (yyvsp[-1].fmode) | (yyvsp[0].fmode); }
#line 3604 "parser_yacc.c"
    break;

  case 155: /* signal_perms: signal_perms TOK_COMMA signal_perm  */
#line 1490 "parser_yacc.y"
                                             { (yyval.fmode) = (yyvsp[-2].fmode) | (yyvsp[0].fmode); }
#line 3610 "parser_yacc.c"
    break;

  case 156: /* opt_signal_perm: %empty  */
#line 1492 "parser_yacc.y"
                 { /* nothing */ (yyval.fmode) = 0; }
#line 3616 "parser_yacc.c"
    break;

  case 157: /* opt_signal_perm: signal_perm  */
#line 1493 "parser_yacc.y"
                      { (yyval.fmode) = (yyvsp[0].fmode); }
#line 3622 "parser_yacc.c"
    break;

  case 158: /* opt_signal_perm: TOK_OPENPAREN signal_perms TOK_CLOSEPAREN  */
#line 1494 "parser_yacc.y"
                                                    { (yyval.fmode) = (yyvsp[-1].fmode); }
#line 3628 "parser_yacc.c"
    break;

  case 159: /* signal_rule: TOK_SIGNAL opt_signal_perm opt_conds TOK_END_OF_RULE  */
#line 1497 "parser_yacc.y"
        {
		signal_rule *ent = new signal_rule((yyvsp[-2].fmode), (yyvsp[-1].cond_entry));
		(yyval.signal_entry) = ent;
	}
#line 3637 "parser_yacc.c"
    break;

  case 160: /* ptrace_perm: TOK_VALUE  */
#line 1503 "parser_yacc.y"
        {
		if (strcmp((yyvsp[0].var_val), "trace") == 0 || strcmp((yyvsp[0].var_val), "write") == 0)
			(yyval.fmode) = AA_MAY_TRACE;
		else if (strcmp((yyvsp[0].var_val), "read") == 0)
			(yyval.fmode) = AA_MAY_READ;
		else if (strcmp((yyvsp[0].var_val), "tracedby") == 0)
			(yyval.fmode) = AA_MAY_TRACEDBY;
		else if (strcmp((yyvsp[0].var_val), "readby") == 0)
			(yyval.fmode) = AA_MAY_READBY;
		else if ((yyvsp[0].var_val))
			parse_ptrace_mode((yyvsp[0].var_val), &(yyval.fmode), 1);
		else
			(yyval.fmode) = 0;

		if ((yyvsp[0].var_val))
			free((yyvsp[0].var_val));
	}
#line 3659 "parser_yacc.c"
    break;

  case 161: /* ptrace_perm: TOK_TRACE  */
#line 1520 "parser_yacc.y"
                    { (yyval.fmode) = AA_MAY_TRACE; }
#line 3665 "parser_yacc.c"
    break;

  case 162: /* ptrace_perm: TOK_TRACEDBY  */
#line 1521 "parser_yacc.y"
                       { (yyval.fmode) = AA_MAY_TRACEDBY; }
#line 3671 "parser_yacc.c"
    break;

  case 163: /* ptrace_perm: TOK_READ  */
#line 1522 "parser_yacc.y"
                   { (yyval.fmode) = AA_MAY_READ; }
#line 3677 "parser_yacc.c"
    break;

  case 164: /* ptrace_perm: TOK_WRITE  */
#line 1523 "parser_yacc.y"
                    { (yyval.fmode) = AA_MAY_TRACE; }
#line 3683 "parser_yacc.c"
    break;

  case 165: /* ptrace_perm: TOK_READBY  */
#line 1524 "parser_yacc.y"
                     { (yyval.fmode) = AA_MAY_READBY; }
#line 3689 "parser_yacc.c"
    break;

  case 166: /* ptrace_perm: TOK_MODE  */
#line 1526 "parser_yacc.y"
        {
		parse_ptrace_mode((yyvsp[0].mode), &(yyval.fmode), 1);
		free((yyvsp[0].mode));
	}
#line 3698 "parser_yacc.c"
    break;

  case 167: /* ptrace_perms: %empty  */
#line 1531 "parser_yacc.y"
              { /* nothing */ (yyval.fmode) = 0; }
#line 3704 "parser_yacc.c"
    break;

  case 168: /* ptrace_perms: ptrace_perms ptrace_perm  */
#line 1532 "parser_yacc.y"
                                   { (yyval.fmode) = (yyvsp[-1].fmode) | (yyvsp[0].fmode); }
#line 3710 "parser_yacc.c"
    break;

  case 169: /* ptrace_perms: ptrace_perms TOK_COMMA ptrace_perm  */
#line 1533 "parser_yacc.y"
                                             { (yyval.fmode) = (yyvsp[-2].fmode) | (yyvsp[0].fmode); }
#line 3716 "parser_yacc.c"
    break;

  case 170: /* opt_ptrace_perm: %empty  */
#line 1535 "parser_yacc.y"
                 { /* nothing */ (yyval.fmode) = 0; }
#line 3722 "parser_yacc.c"
    break;

  case 171: /* opt_ptrace_perm: ptrace_perm  */
#line 1536 "parser_yacc.y"
                      { (yyval.fmode) = (yyvsp[0].fmode); }
#line 3728 "parser_yacc.c"
    break;

  case 172: /* opt_ptrace_perm: TOK_OPENPAREN ptrace_perms TOK_CLOSEPAREN  */
#line 1537 "parser_yacc.y"
                                                    { (yyval.fmode) = (yyvsp[-1].fmode); }
#line 3734 "parser_yacc.c"
    break;

  case 173: /* ptrace_rule: TOK_PTRACE opt_ptrace_perm opt_conds TOK_END_OF_RULE  */
#line 1540 "parser_yacc.y"
        {
		ptrace_rule *ent = new ptrace_rule((yyvsp[-2].fmode), (yyvsp[-1].cond_entry));
		(yyval.ptrace_entry) = ent;
	}
#line 3743 "parser_yacc.c"
    break;

  case 174: /* hat_start: TOK_CARET  */
#line 1545 "parser_yacc.y"
                     {}
#line 3749 "parser_yacc.c"
    break;

  case 175: /* hat_start: TOK_HAT  */
#line 1546 "parser_yacc.y"
                  {}
#line 3755 "parser_yacc.c"
    break;

  case 176: /* file_mode: TOK_MODE  */
#line 1549 "parser_yacc.y"
        {
		/* A single TOK_MODE maps to the same permission in all
		 * of user::other */
		(yyval.fmode) = parse_mode((yyvsp[0].mode));
		free((yyvsp[0].mode));
	}
#line 3766 "parser_yacc.c"
    break;

  case 177: /* change_profile: TOK_CHANGE_PROFILE opt_exec_mode opt_id opt_named_transition TOK_END_OF_RULE  */
#line 1557 "parser_yacc.y"
        {
		struct cod_entry *entry;
		int mode = AA_CHANGE_PROFILE;
		int exec_mode = (yyvsp[-3].boolean);
		char *exec = (yyvsp[-2].id);
		char *target = (yyvsp[-1].id);

		if (exec) {
			/* exec bits required to trigger rule conflict if
			 * for overlapping safe and unsafe exec rules
			 */
			mode |= AA_EXEC_BITS;
			if (exec_mode == EXEC_MODE_UNSAFE)
				mode |= ALL_AA_EXEC_UNSAFE;
			else if (exec_mode == EXEC_MODE_SAFE &&
				 !features_supports_stacking) {
				pwarn(WARN_RULE_DOWNGRADED, "downgrading change_profile safe rule to unsafe due to lack of necessary kernel support\n");
				/**
				 * No need to do anything because 'unsafe' exec
				 * mode is the only supported mode of
				 * change_profile rules in non-stacking kernels
				 */
			}
		} else if (exec_mode != EXEC_MODE_EMPTY)
			yyerror(_("Exec condition is required when unsafe or safe keywords are present"));
		if (exec && !(exec[0] == '/' || strncmp(exec, "@{", 2) == 0))
			yyerror(_("Exec condition must begin with '/'."));

		if (target) {
			PDEBUG("Matched change_profile: tok_id (%s)\n", target);
		} else {
			PDEBUG("Matched change_profile,\n");
			target = strdup("**");
			if (!target)
				yyerror(_("Memory allocation error."));
		}

		entry = new_entry(target, mode, exec);
		if (!entry)
			yyerror(_("Memory allocation error."));

		PDEBUG("change_profile.entry: (%s)\n", entry->name);
		(yyval.user_entry) = entry;
	}
#line 3815 "parser_yacc.c"
    break;

  case 178: /* capability: TOK_CAPABILITY caps TOK_END_OF_RULE  */
#line 1603 "parser_yacc.y"
        {
		if ((yyvsp[-1].cap) == 0) {
			/* bare capability keyword - set all caps */
			(yyval.cap) = 0xffffffffffffffff;
		} else
			(yyval.cap) = (yyvsp[-1].cap);
	}
#line 3827 "parser_yacc.c"
    break;

  case 179: /* caps: %empty  */
#line 1611 "parser_yacc.y"
      { /* nothing */ (yyval.cap) = 0; }
#line 3833 "parser_yacc.c"
    break;

  case 180: /* caps: caps TOK_ID  */
#line 1613 "parser_yacc.y"
        {
		int backmap, cap = name_to_capability((yyvsp[0].id));
		if (cap == -1)
			yyerror(_("Invalid capability %s."), (yyvsp[0].id));
		free((yyvsp[0].id));
		backmap = capability_backmap(cap);
		if (backmap != NO_BACKMAP_CAP && !capability_in_kernel(cap)) {
			/* TODO: special backmap warning */
			cap = backmap;
		}
		(yyval.cap) = (yyvsp[-1].cap) | CAP_TO_MASK(cap);
	}
#line 3850 "parser_yacc.c"
    break;


#line 3854 "parser_yacc.c"

      default: break;
    }
  /* User semantic actions sometimes alter yychar, and that requires
     that yytoken be updated with the new translation.  We take the
     approach of translating immediately before every use of yytoken.
     One alternative is translating here after every semantic action,
     but that translation would be missed if the semantic action invokes
     YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or
     if it invokes YYBACKUP.  In the case of YYABORT or YYACCEPT, an
     incorrect destructor might then be invoked immediately.  In the
     case of YYERROR or YYBACKUP, subsequent parser actions might lead
     to an incorrect destructor call or verbose syntax error message
     before the lookahead is translated.  */
  YY_SYMBOL_PRINT ("-> $$ =", YY_CAST (yysymbol_kind_t, yyr1[yyn]), &yyval, &yyloc);

  YYPOPSTACK (yylen);
  yylen = 0;

  *++yyvsp = yyval;

  /* Now 'shift' the result of the reduction.  Determine what state
     that goes to, based on the state we popped back to and the rule
     number reduced by.  */
  {
    const int yylhs = yyr1[yyn] - YYNTOKENS;
    const int yyi = yypgoto[yylhs] + *yyssp;
    yystate = (0 <= yyi && yyi <= YYLAST && yycheck[yyi] == *yyssp
               ? yytable[yyi]
               : yydefgoto[yylhs]);
  }

  goto yynewstate;


/*--------------------------------------.
| yyerrlab -- here on detecting error.  |
`--------------------------------------*/
yyerrlab:
  /* Make sure we have latest lookahead translation.  See comments at
     user semantic actions for why this is necessary.  */
  yytoken = yychar == YYEMPTY ? YYSYMBOL_YYEMPTY : YYTRANSLATE (yychar);
  /* If not already recovering from an error, report this error.  */
  if (!yyerrstatus)
    {
      ++yynerrs;
      {
        yypcontext_t yyctx
          = {yyssp, yytoken};
        char const *yymsgp = YY_("syntax error");
        int yysyntax_error_status;
        yysyntax_error_status = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
        if (yysyntax_error_status == 0)
          yymsgp = yymsg;
        else if (yysyntax_error_status == -1)
          {
            if (yymsg != yymsgbuf)
              YYSTACK_FREE (yymsg);
            yymsg = YY_CAST (char *,
                             YYSTACK_ALLOC (YY_CAST (YYSIZE_T, yymsg_alloc)));
            if (yymsg)
              {
                yysyntax_error_status
                  = yysyntax_error (&yymsg_alloc, &yymsg, &yyctx);
                yymsgp = yymsg;
              }
            else
              {
                yymsg = yymsgbuf;
                yymsg_alloc = sizeof yymsgbuf;
                yysyntax_error_status = YYENOMEM;
              }
          }
        yyerror (yymsgp);
        if (yysyntax_error_status == YYENOMEM)
          YYNOMEM;
      }
    }

  if (yyerrstatus == 3)
    {
      /* If just tried and failed to reuse lookahead token after an
         error, discard it.  */

      if (yychar <= YYEOF)
        {
          /* Return failure if at end of input.  */
          if (yychar == YYEOF)
            YYABORT;
        }
      else
        {
          yydestruct ("Error: discarding",
                      yytoken, &yylval);
          yychar = YYEMPTY;
        }
    }

  /* Else will try to reuse lookahead token after shifting the error
     token.  */
  goto yyerrlab1;


/*---------------------------------------------------.
| yyerrorlab -- error raised explicitly by YYERROR.  |
`---------------------------------------------------*/
yyerrorlab:
  /* Pacify compilers when the user code never invokes YYERROR and the
     label yyerrorlab therefore never appears in user code.  */
  if (0)
    YYERROR;
  ++yynerrs;

  /* Do not reclaim the symbols of the rule whose action triggered
     this YYERROR.  */
  YYPOPSTACK (yylen);
  yylen = 0;
  YY_STACK_PRINT (yyss, yyssp);
  yystate = *yyssp;
  goto yyerrlab1;


/*-------------------------------------------------------------.
| yyerrlab1 -- common code for both syntax error and YYERROR.  |
`-------------------------------------------------------------*/
yyerrlab1:
  yyerrstatus = 3;      /* Each real token shifted decrements this.  */

  /* Pop stack until we find a state that shifts the error token.  */
  for (;;)
    {
      yyn = yypact[yystate];
      if (!yypact_value_is_default (yyn))
        {
          yyn += YYSYMBOL_YYerror;
          if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYSYMBOL_YYerror)
            {
              yyn = yytable[yyn];
              if (0 < yyn)
                break;
            }
        }

      /* Pop the current state because it cannot handle the error token.  */
      if (yyssp == yyss)
        YYABORT;


      yydestruct ("Error: popping",
                  YY_ACCESSING_SYMBOL (yystate), yyvsp);
      YYPOPSTACK (1);
      yystate = *yyssp;
      YY_STACK_PRINT (yyss, yyssp);
    }

  YY_IGNORE_MAYBE_UNINITIALIZED_BEGIN
  *++yyvsp = yylval;
  YY_IGNORE_MAYBE_UNINITIALIZED_END


  /* Shift the error token.  */
  YY_SYMBOL_PRINT ("Shifting", YY_ACCESSING_SYMBOL (yyn), yyvsp, yylsp);

  yystate = yyn;
  goto yynewstate;


/*-------------------------------------.
| yyacceptlab -- YYACCEPT comes here.  |
`-------------------------------------*/
yyacceptlab:
  yyresult = 0;
  goto yyreturnlab;


/*-----------------------------------.
| yyabortlab -- YYABORT comes here.  |
`-----------------------------------*/
yyabortlab:
  yyresult = 1;
  goto yyreturnlab;


/*-----------------------------------------------------------.
| yyexhaustedlab -- YYNOMEM (memory exhaustion) comes here.  |
`-----------------------------------------------------------*/
yyexhaustedlab:
  yyerror (YY_("memory exhausted"));
  yyresult = 2;
  goto yyreturnlab;


/*----------------------------------------------------------.
| yyreturnlab -- parsing is finished, clean up and return.  |
`----------------------------------------------------------*/
yyreturnlab:
  if (yychar != YYEMPTY)
    {
      /* Make sure we have latest lookahead translation.  See comments at
         user semantic actions for why this is necessary.  */
      yytoken = YYTRANSLATE (yychar);
      yydestruct ("Cleanup: discarding lookahead",
                  yytoken, &yylval);
    }
  /* Do not reclaim the symbols of the rule whose action triggered
     this YYABORT or YYACCEPT.  */
  YYPOPSTACK (yylen);
  YY_STACK_PRINT (yyss, yyssp);
  while (yyssp != yyss)
    {
      yydestruct ("Cleanup: popping",
                  YY_ACCESSING_SYMBOL (+*yyssp), yyvsp);
      YYPOPSTACK (1);
    }
#ifndef yyoverflow
  if (yyss != yyssa)
    YYSTACK_FREE (yyss);
#endif
  if (yymsg != yymsgbuf)
    YYSTACK_FREE (yymsg);
  return yyresult;
}

#line 1626 "parser_yacc.y"

#define MAXBUFSIZE 4096

void vprintyyerror(const char *msg, va_list argptr)
{
	char buf[MAXBUFSIZE];

	vsnprintf(buf, sizeof(buf), msg, argptr);

	if (profilename) {
		PERROR(_("AppArmor parser error for %s%s%s at line %d: %s\n"),
		       profilename,
		       current_filename ? " in profile " : "",
		       current_filename ? current_filename : "",
		       current_lineno, buf);
	} else {
		PERROR(_("AppArmor parser error at line %d: %s\n"),
		       current_lineno, buf);
	}
}

void printyyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);
}

void yyerror(const char *msg, ...)
{
	va_list arg;

	va_start(arg, msg);
	vprintyyerror(msg, arg);
	va_end(arg);

	exit(1);
}

struct cod_entry *do_file_rule(char *id, int mode, char *link_id, char *nt)
{
		struct cod_entry *entry;
		PDEBUG("Matched: tok_id (%s) tok_mode (0x%x)\n", id, mode);
		entry = new_entry(id, mode, link_id);
		if (!entry)
			yyerror(_("Memory allocation error."));
		entry->nt_name = nt;
		PDEBUG("rule.entry: (%s)\n", entry->name);
		return entry;
}

/* Note: NOT currently in use, used for 
 * /foo x -> { /bah, }   style transitions
 */
void add_local_entry(Profile *prof)
{
	/* ugh this has to be called after the hat is attached to its parent */
	if (prof->local_mode) {
		struct cod_entry *entry;
		char *trans = (char *) malloc(strlen(prof->parent->name) +
				    strlen(prof->name) + 3);
		char *name = strdup(prof->name);
		if (!trans)
			yyerror(_("Memory allocation error."));
		sprintf(name, "%s//%s", prof->parent->name, prof->name);

		entry = new_entry(name, prof->local_mode, NULL);
		entry->audit = prof->local_audit;
		entry->nt_name = trans;
		if (!entry)
			yyerror(_("Memory allocation error."));

		add_entry_to_policy(prof, entry);
	}
}

static const char *mnt_cond_msg[] = {"",
			 " not allowed as source conditional",
			 " not allowed as target conditional",
			 "",
			 NULL};

int verify_mnt_conds(struct cond_entry *conds, int src)
{
	struct cond_entry *entry;
	int error = 0;

	if (!conds)
		return 0;

	list_for_each(conds, entry) {
		int res = is_valid_mnt_cond(entry->name, src);
		if (res <= 0) {
				printyyerror(_("invalid mount conditional %s%s"),
					     entry->name,
					     res == -1 ? "" : mnt_cond_msg[src]);
				error++;
		}
	}

	return error;
}

mnt_rule *do_mnt_rule(struct cond_entry *src_conds, char *src,
		      struct cond_entry *dst_conds, char *dst,
		      int mode)
{
	if (verify_mnt_conds(src_conds, MNT_SRC_OPT) != 0)
		yyerror(_("bad mount rule"));

	/* FIXME: atm conditions are not supported on dst
	if (verify_conds(dst_conds, DST_OPT) != 0)
		yyerror(_("bad mount rule"));
	*/
	if (dst_conds)
		yyerror(_("mount point conditions not currently supported"));

	mnt_rule *ent = new mnt_rule(src_conds, src, dst_conds, dst, mode);
	if (!ent) {
		yyerror(_("Memory allocation error."));
	}

	return ent;
}

mnt_rule *do_pivot_rule(struct cond_entry *old, char *root, char *transition)
{
	char *device = NULL;
	if (old) {
		if (strcmp(old->name, "oldroot") != 0)
			yyerror(_("invalid pivotroot conditional '%s'"), old->name);
		if (old->vals) {
			device = old->vals->value;
			old->vals->value = NULL;
		}
		free_cond_entry(old);
	}

	mnt_rule *ent = new mnt_rule(NULL, device, NULL, root, AA_MAY_PIVOTROOT);
	ent->trans = transition;

	return ent;
}

static int abi_features_base(struct aa_features **features, char *filename, bool search)
{
	autofclose FILE *f = NULL;
	struct stat my_stat;
	char *fullpath = NULL;
	bool cached;

	if (search) {
		if (strcmp(filename, "kernel") == 0)
			return aa_features_new_from_kernel(features);
		f = search_path(filename, &fullpath, &cached);
		PDEBUG("abi lookup '%s' -> '%s' f %p cached %d\n", filename, fullpath, f, cached);
		if (!f && cached) {
			*features = NULL;
			return 0;
		}
	} else {
		f = fopen(filename, "r");
		PDEBUG("abi relpath '%s' f %p\n", filename, f);
	}

	if (!f) {
		yyerror(_("Could not open '%s': %m"),
                        fullpath ? fullpath: filename);
	}

	if (fstat(fileno(f), &my_stat))
		yyerror(_("fstat failed for '%s': %m"), fullpath ? fullpath : filename);

        if (S_ISREG(my_stat.st_mode)) {
		return aa_features_new_from_file(features, fileno(f));
	}

	return -1;
}

static void abi_features(char *filename, bool search)
{
	struct aa_features *tmp_features;

	if (abi_features_base(&tmp_features, filename, search) == -1) {
			yyerror(_("failed to find features abi '%s': %m"), filename);
	}
	if (policy_features) {
		if (tmp_features) {
			if (!aa_features_is_equal(tmp_features, policy_features)) {
				pwarn(WARN_ABI, _("%s: %s features abi '%s' differs from policy declared feature abi, using the features abi declared in policy\n"), progname, current_filename, filename);
			}
			aa_features_unref(tmp_features);
		}
	} else if (!tmp_features) {
		/* skipped reinclude, but features not set */
		yyerror(_("failed features abi not set but include cache skipped\n"));
	} else {
		/* first features abi declaration */
		policy_features = tmp_features;
	}

};
