Skip Menu |

Date: Fri, 12 Apr 2024 16:57:12 -0400
Subject: profile final flag limitations
The profile library supports setting the final flag on a node by placing a "*" character after the tag part of an assignment or after a close bracket (for a section) or a brace (for a subsection).  The general idea is to ignore further assignments to the section, subsection, or relation.  There are two important limitations of the final flag implementation which render it minimally useful:

1. It is only checked when deciding whether to proceed from one file data object to the next during node iteration.  It does not suppress further assignments within the same profile file, or within files included via "include" or "includedir" directives.

2. Although there is support for setting the flag on relations, it has no effect there; it only works on sections and subsections.

Additionally, there is no way to set the final flag via the profile write APIs (profile_add_relation() etc.), only via parsing.  This may not matter in some ideal interpretations of the profile model, as write operations could  be taken to apply strictly post-parsing.  It does matter if profile writes continue to affect only the first file in a multi-file profile, or if we add the ability to compose profiles.
Another note: whlie the syntax and data model can naturally accommodate an empty section or subsection with the final flag set, neither can naturally represent a final-flagged relation with no values.  (In the memory representation, a node with the deleted and final flags set could possibly do in a pinch, but it isn't a natural representation.  A node with a null value is semantically a section, not a relation.)

So, even with the two numbered limitations above addressed, there is no way to use the final flag to force the use of the default value for a variable, or to force an empty list for a relation that can have multiple values.
Subject: git commit
Download (untitled) / with headers
text/plain 1.3KiB

Improve profile final flag support

When parsing a file, ignore sections appearing after a final-flagged
section of the same name. Adjust the meaning of group_level in the
parser state so that it is 1 inside of top-level sections instead of
0, and simplify the addition of top-level sections to the tree by
relying on profile_add_node()'s section merging.

Make the final flag work for relations as well as sections. Check it
while parsing via a new check_final parameter in profile_add_node(),
and during iteration.

Output final flags for relations in dump_profile(). Make the final
flag available to it via a new output parameter in
Author: Greg Hudson <>
Commit: f951625e6bd3ff44f1056958b56e35a1a043e362
Branch: master
doc/admin/conf_files/krb5_conf.rst | 16 +++++---
src/util/profile/ | 8 ++++
src/util/profile/final.expected | 18 ++++++++-
src/util/profile/final2.ini | 4 +-
src/util/profile/final6.ini | 45 ++++++++++++++++++++++
src/util/profile/prof_int.h | 4 +-
src/util/profile/prof_parse.c | 78 ++++++++++++++++++++------------------
src/util/profile/prof_set.c | 4 +-
src/util/profile/prof_tree.c | 19 ++++++++--
9 files changed, 143 insertions(+), 53 deletions(-)