mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge aa-unconfined: Fix race when reading proc/*/attr/current

Browse source 
aa-unconfined can fault if it looses the race between checkking if
proc/*/attr/{apparmor/,}current exists, and actually opening the file.
Catch open/file errors and ignore them like the file doesn't exist.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/355
Signed-off-by: John Johansen <john.johansen@canonical.com>

Closes #355
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1157
Acked-by: seth.arnold@gmail.com
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 4b1bc85022)
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2024-02-25 07:36:16 +00:00 • committed by John Johansen
parent d8bb0435c2
commit 7e45341ccd
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
utils/aa-unconfined
View file

@ -102,13 +102,18 @@ def get_pids_netstat(netstat='netstat'):
def read_proc_current(filename):
attr = None
if os.path.exists(filename):
try:
# don't bother with if os.path.exists(filename): there is always a race
with apparmor.common.open_file_read(filename) as current:
for line in current:
line = line.strip()
if line.endswith(' (complain)', 1) or line.endswith(' (enforce)', 1) or line.endswith(' (kill)', 1): # enforce at least one char as profile name
# intentionally not checking for '(unconfined)', because $binary confined by $profile (unconfined) would look very confusing
attr = line
except OSError:
# just ignore errors atm
# print("Error trying to open {filename}")
return None
return attr