aa-genprof was incorrectly trying to refer to UI_xxx functions in
apparmor.aa rather than the correct apparmor.ui. This patch fixes the
issue.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
The relative directory tests in test-aa-easyprof.py were failing when
TMPDIR pointed to a directory that was a symlink, because the generated
tmpdir path was not the same as the realpath that easyprof resolved to.
This patch sets the tmpdir to the realpath of the result of the
tempfile.mkdtemp() to avoid the issue.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
This patch removes the '--remove' option on aa-enforce as well as from
the man page. It also removes the test entry that contains it, but I
don't think this is entirely correct because I think the second half
of the test is dependent on the (now deleted) first half of the test.
(It also removes a missed reference to --revert in the aa-disable man
page.)
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
This patch removes the non-funcional -r option for aa-disable, as
well as the test and manpage documentation for it.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
The test-aa-easyprof.py script has '/bin/ls' hardcoded as a path;
however, on systems that have undergone UsrMove, this is a symlink to
/usr/bin/ls. This patch fixes the issue by getting the realpath of
/bin/ls and storing it as an instance field.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
apparmor/tools.py:act() method into a separate cmd_disable()
method. The intent is to unwind the logic in act() into smaller, more
digestible chunks, while sharing commonality via helper functions
(e.g. the added get_next_to_profile() function).
A secondary driver of this change is that the tools fail when used
against the trunk profiles, due to act() forcing all the profiles to
be read and the tools not understanding the recently added dbus rules
(they were intentionally ignored as part of scoping the rewrite).
Unfortunately, this is not a solution for aa-enforce, aa-complain, etc.
as they are expected to know enough about profiles to understand and
update profile flags.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
It prints a data structure in an easily readable output and is quite
useful for debugging. However, I don't recommend to call it in
production code ;-)
Acked-by: Kshitij Gupta <kgupta8592 at gmail.com>
Update path to tools in minitools_test.py
Fix assert values in config_test.py
Signed-off: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
packaging systems that do a make clean while trying to represent
changes.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
AttributeError: 'module' object has no attribute 'UI_Info'
AttributeError: 'module' object has no attribute 'open_file_read'
AttributeError: 'module' object has no attribute 'check_for_apparmor'
Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
profile files with only tunables/global, but no profile. This patch
makes sure that the profile itsself is also written to the profile file.
Without the added line, filelist[prof_filename]['profiles'].keys()) in
serialize_profile was empty, which means the loop that writes the
profile was never executed.
Acked-by: Steve Beattie <steve@nxnw.org>
This patch fixes up the parser command invocation via
apparmor/common.py:cmd(), as it handles stdout/stderr redirection,
and the redirection that was being attempted were being handed as
arguments to the parser.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Let "(F)inish" ask the user if he wants to save the changed profiles
before exiting, instead of aborting without saving (we already have
Abo(r)t for that ;-)
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
- add some debug logging in valid_path()
- fix a py2 incompability in DebugLogger.__init__ (OSError vs. IOError)
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
- use the (new) "parts" variable for the line.split result to make the
code less confusing
- change the line.startswith to check for "REPOSITORY:" (note the
added ":") like it was in the code before my previous patch.
- make the check for "NEVERSUBMIT" more exact
- print a warning on invalid REPOSITORY: lines and make sure to keep
them as unmodified line (it might just be a "normal" comment someone
added manually)
Acked-by: Kshitij Gupta <kgupta8592@gmail.com> (on IRC)
This patch
- preserves the complete initial comment
- makes sure whitespace inside the comment is kept (except leading
whitespace - line.trim() is still applied).
- no longer removes the "# vim:syntax" line
Note: I didn't test if handling the "REPOSITORY" line still works (in
theory it should), but without a working repo, I don't care too much ;-)
Acked-by: Steve Beattie <steve@nxnw.org>
apparmor packaging.
These were originally 0030-easyprof-sdk.patch and
0037-easyprof-sdk-pt2.patch. Jamie posted an updated
0030-easyprof-sdk_v2.patch and I squashed both patches into one commit.
Acked-By: Jamie Strandboge <jamie@canonical.com>
logprof/genprof and related utilities in python. Because the branch that
was worked on was not based on the apparmor tree, not all of the history
can be maintained for files that are not newly created or entirely
rewritten in the branch.
(This merge also includes a subsequent commit to the branch
I was merging from which includes my missed bzr add of
utils/apparmor/translations.py)
perl utilities to the deprecated to directory; a couple of perl
utilities remain, but they are still useful and do not depend on the
Immunix module (just the LibAppArmor perl module).
logprof.conf contains a list of binaries in the [qualifiers] section
that should for example never have their own profile.
Since some distributions moved lots of files from /bin/ to /usr/bin/
("UsrMove"), this list is outdated.
The patch adds copies of all /bin/ (and /sbin/) lines with /usr
prepended.
Acked-by: John Johansen <john.johansen@canonical.com>
This patch adds support for the rttime rlimit (aka RLIMIT_RTTIME),
available since the 2.6.25 kernel, according to the getrlimit(2)
man page; see that man page for more details on this rlimit.
An acceptance test is also added, as well as an update to the
apparmor.vim input template.
While reviewing to see what made sense in apparmor.vim for the rttime
rlimit, I discovered that RLIMIT_RTTIME's units are microseconds, not
seconds like RLIMIT_CPU (according to the setrlimit(2) manpage). This
necessitated not sharing the case switch with RLIMIT_CPU. I didn't add
a keyword for microseconds, but I did for milliseconds. I also don't
accept any unit larger than minutes, as it didn't seem appropriate
(and even minutes felt... gratuitous). I would appreciate feedback
on what keywords would be useful here.
Patch History:
v1: initial submission
v2: - add apparmor.vim support for rttime keyword
- adjust RLIMIT_TIME value assignment due to its units being
microseconds, not seconds, and add milliseconds keyword.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
