mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge Avoid aa-notify crash on log events without operation=

Browse source 
Some STATUS log events trigger a crash in aa-notify because the log
line doesn't have operation=. Examples are:

    type=AVC msg=audit(1630913351.586:4): apparmor="STATUS" info="AppArmor Filesystem Enabled" pid=1 comm="swapper/0"

    type=AVC msg=audit(1630913352.610:6): apparmor="STATUS" info="AppArmor sha1 policy hashing enabled" pid=1 comm="swapper/0"

Fix this by not looking at log events without operation=

Also add one of the example events as libapparmor testcase.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/194
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/797
Acked-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen 2021-09-13 23:02:15 +00:00
commit c37586cd11
4 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

0
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.err Normal file
View file

1
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.in Normal file
View file

@ -0,0 +1 @@
audit.log:type=AVC msg=audit(1630913351.586:4): apparmor="STATUS" info="AppArmor Filesystem Enabled" pid=1 comm="swapper/0"

3
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.out Normal file
View file

@ -0,0 +1,3 @@
START
File: status-filesystem-enabled.in
Event type: AA_RECORD_INVALID

2
utils/aa-notify
View file

@ -324,7 +324,7 @@ def parse_logdata(logsource):
event = LibAppArmor.parse_record(entry) event = LibAppArmor.parse_record(entry)
# Only show actual events of contained programs and ignore among # Only show actual events of contained programs and ignore among
# others AppArmor profile reloads # others AppArmor profile reloads
if event.operation[0:8] != 'profile_': if event.operation and event.operation[0:8] != 'profile_':
yield event yield event