Commit graph

310 commits

Author SHA1 Message Date
John Johansen
e663e7c0b0 Zbyniu Krzystolik <zbyniu@pld-linux.org>
Added missing capabilities names.
Simple rlimits support.  It doesn't care about range of individual limit, 
you can add ie -100G stack size or 100M nice. But maybe sufficient?
2008-06-09 23:30:35 +00:00
John Johansen
aa0b2030c7 add missing for 2008-06-04 11:36:13 +00:00
John Johansen
9e8c5e9914 Fix two bugs
- rpc was failing when passing arrays because the perl is_utf8 string flag
  was set even though its only sending numbers but newer HTTP::Message
  checks for this is_utf8 and if it finds it aborts.
- fix local profiles
  local profiles were failing because
  1.) the parameters to serialize_profile were bad
  2.) the file location was not getting updated so they would get written
      back to the inactive profiles directory
2008-06-03 21:54:55 +00:00
John Johansen
cb9f84a61e fix repository profile saving, where the name for profiles from the repository got lost on saving 2008-06-03 10:38:19 +00:00
John Johansen
838d22220a bleah finally get the config setting for default owner right 2008-06-02 09:02:09 +00:00
John Johansen
9a1f1a5689 fix not defined owner_toggle to default_owner_prompt as it should be 2008-06-01 04:59:08 +00:00
John Johansen
8d3ff10db1 Update the utils profile restrictions so that cx and named transitions can be
used on utility programs
2008-05-30 07:21:15 +00:00
John Johansen
516fb55d1d update translation files 2008-05-26 09:52:11 +00:00
John Johansen
ddf2704a42 default owner_toggle to off it is not in the config file 2008-05-19 22:43:24 +00:00
John Johansen
51558b0b19 add missing ; to complain and enforce. copy fix over to audit 2008-04-24 18:24:02 +00:00
John Johansen
cbdea9c7c2 Add new exec modes and many bug fixes 2008-04-24 16:05:33 +00:00
John Johansen
d85344df63 add support for user rules 2008-04-18 21:16:15 +00:00
John Johansen
3db6bd6c54 more audit support. file rules this time 2008-04-18 21:10:25 +00:00
John Johansen
fe5a2b35ee remap includes to do {}{} link the profiles use {profile}{profile} 2008-04-18 21:09:53 +00:00
John Johansen
e06d1bf84b add support for audit keyword 2008-04-18 21:09:05 +00:00
John Johansen
ad996cec9c add support for set capability 2008-04-18 21:08:34 +00:00
John Johansen
94c795aa52 Hrmm. Actually add support for deny rules 2008-04-18 21:08:05 +00:00
John Johansen
ac273b33f8 Add support for deny rules 2008-04-18 21:07:37 +00:00
John Johansen
9b7912c39f add an extra hash level to distiguish between allow and deny - only use allow 2008-04-18 21:07:16 +00:00
John Johansen
36e0d38fc4 rename global vartable to the filetable 2008-04-18 21:06:24 +00:00
John Johansen
8d715ce9d6 make it so just reading an embedded hat doesn't cause the profile to be rewritten 2008-04-18 21:04:54 +00:00
John Johansen
6e87b3f004 add enough support for cx modes that parsing can succeed 2008-04-18 21:04:16 +00:00
John Johansen
bc652326a7 refactor to pass the profile down, as a step to making routines more generic and independant 2008-04-18 21:03:28 +00:00
John Johansen
1c8b9a51e4 make modes be stored as a bit set and use bit operations 2008-04-18 21:02:47 +00:00
John Johansen
83a35b57c2 give paths a sub hash to store mode into 2008-04-18 21:02:07 +00:00
John Johansen
e43a4769be retain the filename the profile was loaded from and use that when writting it back out 2008-04-18 21:01:10 +00:00
John Johansen
f213706f17 support retaining variables in the head of the file 2008-04-18 21:00:35 +00:00
John Johansen
5a088a1a47 change order that rules are output in 2008-04-18 20:59:42 +00:00
John Johansen
0cbaee9902 support parsing retaining of subset on link rules 2008-04-18 20:59:00 +00:00
John Johansen
a67cfbbb30 keep variables 2008-04-18 20:58:07 +00:00
John Johansen
2a0dc5aae9 keep change_hat rules 2008-04-18 20:57:51 +00:00
John Johansen
d07689e2a7 support and keep profiles using the profile keyword 2008-04-18 20:57:33 +00:00
John Johansen
5d1d6d31c3 keep set capability rules 2008-04-18 20:57:01 +00:00
John Johansen
03728a0155 keep rlimit rules 2008-04-18 20:56:41 +00:00
John Johansen
715952ce0d keep alias rules 2008-04-18 20:56:26 +00:00
John Johansen
de95e8b6ef keep change_profile rules 2008-04-18 20:56:08 +00:00
John Johansen
cda1e94f8a basic patch to link rules 2008-04-18 20:55:43 +00:00
John Johansen
7ec531f4e8 try to make some general writer routines 2008-04-18 20:55:11 +00:00
John Johansen
e48fccb6d0 simple patch to map u::g modes into old style 2008-04-18 20:50:18 +00:00
John Johansen
e25c4dad06 fix bug where task was getting dropped 2008-04-18 20:49:48 +00:00
John Johansen
89b9ef516a don't change locale if yast has already set them 2008-04-18 20:49:00 +00:00
John Johansen
c6666773d9 update config to point the repo to 11.0 2008-04-10 08:51:29 +00:00
John Johansen
9961c4b895 skip vim swp files in the profile dir. bnc#205105 2008-04-10 08:40:52 +00:00
John Johansen
e59f8bfd29 fix bnc@304205. Stop redefining LC_MESSAGES when it yast has alread
defined it.
2008-04-10 08:25:23 +00:00
John Johansen
6850b933dc Fix bnc#257286, so that if complain or enfore fail to load the profile,
they will fail and dump the profiles error message.
2008-04-10 07:25:46 +00:00
John Johansen
d870116ae5 fix bnc#304205. This results in the following warning, when a profile already
exits but doesn't have a flags=(X) component.

Use of uninitialized value in substitution (s///) at
       /usr/lib/perl5/vendor_perl/Immunix/SubDomain.pm line 4687 (#1)
   (W uninitialized) An undefined value was used as if it were already
   defined.  It was interpreted as a "" or a 0, but maybe it was a mistake.
   To suppress this warning assign a defined value to your variables.

   To help you figure out what was undefined, perl tells you what operation
   you used the undefined value in.  Note, however, that perl optimizes your
   program and the operation displayed in the warning may not necessarily
   appear literally in your program.  For example, "that $foo" is
   usually optimized into "that " . $foo, and the warning will refer to
   the concatenation (.) operator, even though there is no . in your
   program.
2008-03-13 15:12:30 +00:00
John Johansen
aed6f06800 Fix bug where genprof/logprof would just die on newer mode format.
This does not allow genprof/logprof to enable features using the
new format, just work with the new style logs.
2008-03-13 10:49:44 +00:00
John Johansen
ba6606460d add missing files from previous set of commits 2008-02-26 12:28:42 +00:00
John Johansen
28860a8386 repo-cmd-line-tool.diff - Basic prototype for a command line tool to allow
users to push/pull/search for profiles in remote
                            repositories. It is not fully functional at the
                            moment (the official repository is down) but I'd
                            like to get feedback on the basic usage. The
                            options for
                              push/pull/search/status/getconfig/setconfig
                            are working (usage/help below). I think the next
                            step could be a basic gtk UI to give users a
                            decent UI to manage profiles/repositories.
                            Feedback welcomed about the usage model - 
                            would a graphical tool make sense?

--------------------------------------------------------
aa-repo.pl --command args
    --search [author=XXX] [prog=XXX] [id=XXX]
             Search the repository for profiles matching the search criteria
             and return the results.
             NOTE: One --search switch per option

    --verbose|v
             Verbosity level. Supply either one or two switches. Two switches
             adds full profile text in returned search results.

    --push   [--profile=XXX|all] [--changelog=XXX]
             Push local profiles to repository, uses configured user and upon
             overwrite of an existing profile in the repository then prompt
             user with a diff for confirmation XXX the name of the application
             whose profile should be uploaded or "all"  to upload all
             profiles.  Multiple --profile switches may be passed to supply
             multiple profile names

             e.g.  --push --profile /usr/sbin/mdnsd --profile /usr/sbin/ftp
             e.g.  --push --profile all

    --pull   [--author=XXX] [--profile=XXX] or [--id=XXX] [--mode=complain]
             pull remote profiles and install on local system
             If operation will change local profiles then prompt user with
             diff for confirmation
             NOTE: One --pull switch per option and there are three acceptable
                   combinations

             --pull --author=XXX
               * pull all profiles in the repo for the author

             --pull --author=XXX  --profile=XXXX
               * pull the profile for prog owned by author

             --pull --id=XXXX
               * pull the profile with id

             --pull --mode=complain
               * set the profile(s) to complain mode when installed

             Profiles are checked for conflicts with currently installed
             profiles and presented as a list to the user to confirm and view.

    --sync   [--up] [--down] [--noconfirm]
             Synchronize local profile set with the repository - showing
             changes and allowing prompting the user with the diffs and
             suggest the newest version to be activated. If the --all option
             is passed then treat profiles not marked as remote as new
             profiles that will be uploaded to the repository.

    --status
             Show the current status of the local profile set. This operation
             is similar to sync but does not prompt the user to up|down load
             changes

    --setconfig [url=xxx] [username=xxxx] [password=xxxx] [enabled=(yes|no)]
                [upload=(yes|no)]
              Set the configuration options for the repository.
              NOTE: One --setconfig switch per option

    --getconfig|c
             Print the current configuration for the repsository

    --quiet|q Don't prompt user - assume that all changes should be made.
2008-02-26 12:02:00 +00:00
John Johansen
010fc621ca logparse.diff - Update the tools to use the apparmor loparsing
library to read events from the log files.
2008-02-26 12:01:10 +00:00