mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge [2.13..3.1] Ignore ´//null-` peers in signal and ptrace events

Browse source 
Ideally we'd update them to the chosen exec target - but until this is
implemented, it doesn't make sense to ask about adding a //null-* peer
to a profile.

This commit is a manual backport of 41df2ca366 /
https://gitlab.com/apparmor/apparmor/-/merge_requests/1090
(with indentation changed to match the 3.1 branch)

I propose this patch for 2.13..3.1

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1107
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>


(cherry picked from commit 719251cac2)

7301aae2 Ignore ´//null-` peers in signal and ptrace events
This commit is contained in:
John Johansen 2023-09-14 21:01:45 +00:00 • committed by Christian Boltz
parent ed6bc062fc
commit 1b300f5896
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
utils/apparmor/aa.py
View file

@ -2025,6 +2025,9 @@ def collapse_log():
ptrace = prelog[aamode][profile][hat]['ptrace']
for peer in ptrace.keys():
if '//null-' in peer:
continue # ignore null-* peers
for access in ptrace[peer].keys():
ptrace_event = PtraceRule(access, peer, log_event=True)
if not hat_exists or not is_known_rule(aa[profile][hat], 'ptrace', ptrace_event):
@ -2032,6 +2035,9 @@ def collapse_log():
sig = prelog[aamode][profile][hat]['signal']
for peer in sig.keys():
if '//null-' in peer:
continue # ignore null-* peers
for access in sig[peer].keys():
for signal in sig[peer][access].keys():
signal_event = SignalRule(access, signal, peer, log_event=True)