Commit graph

5 commits

Author SHA1 Message Date
Seth Arnold
b432cf45c9 Add aa-easyprof and easyprof.py and related pieces from the Ubuntu
apparmor packaging.

These were originally 0030-easyprof-sdk.patch and
0037-easyprof-sdk-pt2.patch. Jamie posted an updated
0030-easyprof-sdk_v2.patch and I squashed both patches into one commit.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-02-13 17:53:40 -08:00
Jamie Strandboge
72995c5bcb utils/easyprof/templates/sandbox-x: add explicit deny rule to deny
@{HOME}/.Xauthority
utils/apparmor/sandbox.py: verify the above rule is any any dynamic templates
 that use -X
utils/aa-sandbox.pod: update man page to warn about /.Xauthority access
2012-08-27 16:43:20 -05:00
Jamie Strandboge
af26d11dd2 fix up option parsing
implement profile loading and transition (sudo for now)
2012-05-10 01:17:56 -07:00
Jamie Strandboge
89933a4cb0 add preliminary aa-sandbox which starts an X application in Xephyr. Currently
does not add policy
2012-05-09 11:33:36 -07:00
Jamie Strandboge
1db463f4de This patchset is broken into 4 parts:
* the application, library, documentation and installation script
* the initial templates and policy groups. This will undoubtedly need
  refinement as we get feedback from users. Initial policy is based on Ubuntu's
  Application Review Board (ARB) requirements[2].
* tests for the library
* Makefile integration

Templates are stored in /usr/share/apparmor/easyprof/templates and policy
groups in /usr/share/apparmor/easyprof/policygroups. This can be adjusted via
/etc/apparmor/easyprof.conf.

The aa-easyprof.pod has complete documentation on usage with some
additional information in utils/easyprof/README (mostly duplicated
here).

Testing can be performed in a number of ways:
$ cd utils ; make check # runs unit tests and pyflakes

Unit tests manually:
$ ./test/test-aa-easyprof.py

In source manual testing:
$ ./aa-easyprof --templates-dir=./easyprof/templates \
                --policy-groups-dir=./easyprof/policygroups \
                ... \
                /opt/foo/bin/foo

Post-install manual testing:
$ make DESTDIR=/tmp/test PERLDIR=/tmp/test/usr/share/perl5/Immunix install
$ cd /tmp/test
$ PYTHONPATH=/tmp/test/usr/local/.../dist-packages ./usr/bin/aa-easyprof \
    --templates-dir=/tmp/test/usr/share/apparmor/easyprof/templates \
    --policy-groups-dir=/tmp/test/usr/share/apparmor/easyprof/policygroups \
    /opt/bin/foo

(you may also adjust /tmp/test/etc/apparmor/easyprof.conf to avoid
specifying --templates-dir and --policy-groups-dir).

Committing this now based on conversation with John and Steve.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-05-07 22:37:48 -07:00