mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

From: Jeff Mahoney <jeffm@suse.com>

Browse source 
Subject: perl-apparmor: Handle bare 'capability' keyword
References: bnc#889651

Specifying 'capability' implies all capabilities, but the perl code didn't
recognize it.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-by: Steve Beattie <steve@nxnw.org>
This commit is contained in:
Christian Boltz 2014-08-02 12:48:30 +02:00
parent ff267dc1fc
commit 08fcbcc8ec
1 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
utils/Immunix/AppArmor.pm
View file

@ -5151,7 +5151,7 @@ sub parse_profile_data($$$) {
$initial_comment = "";
} elsif (m/^\s*(audit\s+)?(deny\s+)?capability\s+(\S+)\s*,\s*(#.*)?$/) { # capability entry
} elsif (m/^\s*(audit\s+)?(deny\s+)?capability(\s+(\S+))?\s*,\s*(#.*)?$/) { # capability entry
if (not $profile) {
die sprintf(gettext('%s contains syntax errors.'), $file) . "\n";
}
@ -5159,7 +5159,7 @@ sub parse_profile_data($$$) {
my $audit = $1 ? 1 : 0;
my $allow = $2 ? 'deny' : 'allow';
$allow = 'deny' if ($2);
my $capability = $3;
my $capability = $3 ? $3 : 'all';
$profile_data->{$profile}{$hat}{$allow}{capability}{$capability}{set} = 1;
$profile_data->{$profile}{$hat}{$allow}{capability}{$capability}{audit} = $audit;
} elsif (m/^\s*set capability\s+(\S+)\s*,\s*(#.*)?$/) { # capability entry
@ -5675,7 +5675,13 @@ sub writecap_rules ($$$) {
my @data;
if (exists $profile_data->{$allow}{capability}) {
for my $cap (sort keys %{$profile_data->{$allow}{capability}}) {
my $audit;
if (exists $profile_data->{$allow}{capability}{all}) {
$audit = ($profile_data->{$allow}{capability}{all}{audit}) ? 'audit ' : '';
push @data, "${pre}${audit}${allowstr}capability,";
}
for my $cap (sort keys %{$profile_data->{$allow}{capability}}) {
next if ($cap eq "all");
my $audit = ($profile_data->{$allow}{capability}{$cap}{audit}) ? 'audit ' : '';
if ($profile_data->{$allow}{capability}{$cap}{set}) {
push @data, "${pre}${audit}${allowstr}capability ${cap},";