mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-25 06:27:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix(aa-log): ensure we also split quote in log value

Browse source 
fix #229
This commit is contained in:
Alexandre Pujol 2024-10-02 21:06:45 +01:00
parent 3f98e86e24
commit 14a5d8deae
Failed to generate hash of commit
3 changed files with 28 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
pkg/logs/logs.go
View file

@ -138,7 +138,12 @@ func New(file io.Reader, profile string) AppArmorLogs {
aa := make(AppArmorLog)
for _, item := range tmp {
kv := strings.Split(item, "=")
kv := strings.FieldsFunc(item, func(r rune) bool {
if r == '"' {
quoted = !quoted
}
return !quoted && r == '='
})
if len(kv) >= 2 {
key, value := kv[0], kv[1]
if slices.Contains(toClean, key) {

21
pkg/logs/logs_test.go
View file

@ -267,6 +267,27 @@ func TestNew(t *testing.T) {
},
},
},
{
name: "startplasma",
path: filepath.Join(testdata, "audit.log"),
want: AppArmorLogs{
{
"apparmor": "ALLOWED",
"operation": "link",
"class": "file",
"profile": "startplasma",
"name": "@{user_cache_dirs}/ksycoca5_de_LQ6f0J2qZg4vOKgw2NbXuW7iuVU=.isNSBz",
"target": "@{user_cache_dirs}/#@{int}",
"comm": "startplasma-way",
"denied_mask": "k",
"requested_mask": "k",
"fsuid": "1000",
"ouid": "1000",
"FSUID": "user",
"OUID": "user",
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {

1
tests/testdata/logs/audit.log vendored
View file

@ -54,4 +54,5 @@ type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace"
apparmor="ALLOWED" operation="open" class="file" profile="signal-desktop" name="/sys/devices/pci0000:00/0000:00:02.0/boot_vga" comm="signal-desktop" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="user" OUID="root"
apparmor="ALLOWED" operation="link" class="file" profile="startplasma" name="@{user_cache_dirs}/ksycoca5_de_LQ6f0J2qZg4vOKgw2NbXuW7iuVU=.isNSBz" comm="startplasma-way" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="@{user_cache_dirs}/#@{int}" FSUID="user" OUID="user"