John Johansen
7ec531f4e8
try to make some general writer routines
2008-04-18 20:55:11 +00:00
John Johansen
e48fccb6d0
simple patch to map u::g modes into old style
2008-04-18 20:50:18 +00:00
John Johansen
e25c4dad06
fix bug where task was getting dropped
2008-04-18 20:49:48 +00:00
John Johansen
89b9ef516a
don't change locale if yast has already set them
2008-04-18 20:49:00 +00:00
John Johansen
3efb4ea353
allow bare x in named transitions
2008-04-18 00:40:40 +00:00
Steve Beattie
7a751a53f6
Not sure why the close of stdout and redirection of the pipe was here,
...
given that the following write was to the specific file descriptor in
the pipe.
2008-04-17 22:09:05 +00:00
Steve Beattie
c0275d06eb
Fix up some dependencies in parser_misc.c's unit test build.
2008-04-16 16:27:23 +00:00
Steve Beattie
e41a326ef5
Add a flag so that 'make check V=1' will turn on verbose output.
2008-04-16 16:09:36 +00:00
John Johansen
ee03760c1d
disable named transition conversion to cx. Needs to be reworked
2008-04-16 08:48:06 +00:00
John Johansen
11f925abba
fix named transition, enable cx to imply transition to local profile, without having to specify name
2008-04-16 06:54:51 +00:00
John Johansen
015df061e3
Named transition - but disabled due to a bug
2008-04-16 04:45:02 +00:00
John Johansen
db34aac811
Basis for named transitions
2008-04-16 04:44:21 +00:00
John Johansen
051a3f8c01
add missing parser_alias.c + fix parameter bug in parser.h
2008-04-11 17:43:22 +00:00
Steve Beattie
666a8ec51b
Fix up prototype error.
2008-04-10 22:24:35 +00:00
John Johansen
3092aaa821
Various profile updates touching on bnc#255270, bnc#331444, bnc#307365
...
bnc#230700
2008-04-10 08:54:05 +00:00
John Johansen
c6666773d9
update config to point the repo to 11.0
2008-04-10 08:51:29 +00:00
John Johansen
9961c4b895
skip vim swp files in the profile dir. bnc#205105
2008-04-10 08:40:52 +00:00
John Johansen
e59f8bfd29
fix bnc@304205. Stop redefining LC_MESSAGES when it yast has alread
...
defined it.
2008-04-10 08:25:23 +00:00
John Johansen
6850b933dc
Fix bnc#257286, so that if complain or enfore fail to load the profile,
...
they will fail and dump the profiles error message.
2008-04-10 07:25:46 +00:00
John Johansen
16b5a26306
update for ptrace rules
2008-04-09 23:56:31 +00:00
John Johansen
4dd0e8ead8
allow for ptrace rules
2008-04-09 09:04:08 +00:00
John Johansen
78590d1823
allow for simpe alias rules
2008-04-09 09:03:17 +00:00
John Johansen
b742da7751
allow <= to be used instead of subset in link rules
2008-04-09 09:02:51 +00:00
John Johansen
add2b93657
update interface version
2008-04-08 20:30:06 +00:00
John Johansen
4016ae5fb3
bump version to 2.3
2008-04-07 18:37:57 +00:00
John Johansen
26e1f20262
rename-rlimit.diff to apparmor-rlimit.diff
2008-04-07 18:00:34 +00:00
John Johansen
2ed2bc67f0
merge patches down to start cleaning up
2008-04-07 17:55:03 +00:00
John Johansen
1daeaa9308
reorder patches in preparation for patch merging
2008-04-07 17:48:20 +00:00
John Johansen
d3eb6500f5
oops, reenable setting the rlimits
2008-04-07 14:51:26 +00:00
John Johansen
aef0eb93dd
Fix rlimits so that it doesn't try to do nproc checks when moving
...
to an unconfined state; which would result in dereferencing a null
profile pointer.
2008-04-07 04:47:08 +00:00
John Johansen
aba82ff427
reject rlimit cpu in the parser
2008-04-07 04:26:02 +00:00
John Johansen
831f2e252c
add missing tests
2008-04-06 18:57:05 +00:00
John Johansen
ecf6b55baf
let a profile control a tasks rlimits
2008-04-06 18:55:46 +00:00
John Johansen
34f2c96700
let a profile set a tasks caps, similar to fscaps
2008-04-06 18:55:27 +00:00
John Johansen
13e04a9f02
update of unattached profile to require profile keyword
2008-04-06 18:54:52 +00:00
John Johansen
d4c9f0ad0c
recommit namespace update to use :namespace:
2008-04-06 18:53:59 +00:00
John Johansen
c460dcc52f
update change_hats rules to generate rules for all hats
2008-04-06 18:52:47 +00:00
John Johansen
6f65e6e8f5
A fix-dfa.diff
...
- rework how null transitions are done.
M fix-profile-namespaces.diff
- fix namespaces to use the :namespace: syntax
A cap-set.diff
- allow a profile to set a tasks capabilities similar to fscap
A rlimits.diff
- allow control of a tasks rlimits
2008-04-06 18:50:37 +00:00
John Johansen
5f5aeee472
Allow for profiles without attachment, ie. they don't begin with /
...
currently profile names can not collide with file modes nor with
keywords
2008-04-05 05:47:49 +00:00
John Johansen
bbd31c70a1
change namespaces to use the :namespace: format
2008-04-05 05:46:06 +00:00
John Johansen
74152bbd9d
Add the implicit change_hat rules for hats in the profile.
...
Allow external hats by declaring them in the profile via
^hatname,
eg.
/foo {
^local_hat {
}
^external_hat,
}
/foo//external_hat {
}
2008-04-05 05:44:44 +00:00
John Johansen
81d40bd281
Fix profile namespace to use :namespace: format, and allow for profiles
...
that don't begin with /
2008-04-05 05:40:15 +00:00
John Johansen
ec08477129
fix type on typename in cast bug
2008-04-05 04:57:51 +00:00
John Johansen
3bbca91391
fix fatal errors so that they don't exit with an exit code of 0 when no
...
previsous tests failed. Instead have fatal errors always exit with
a exit code of 127
2008-03-28 07:17:14 +00:00
John Johansen
6b6c045fbf
Update ptrace test
...
- fix some races that could lead to tests randomly failing
- extend tests to test more combinations
2008-03-27 17:27:39 +00:00
John Johansen
e103873eb2
merge over r1151 - update to exec.sh test which allows it to run on
...
64 bit platforms using /lib64
2008-03-27 01:16:40 +00:00
John Johansen
a3c0753b89
Add Audit control to AppArmor through, the use of audit and deny
...
key words. Deny is also used to subtract permissions from the
profiles permission set.
the audit key word can be prepended to any file, network, or capability
rule, to force a selective audit when that rule is matched. Audit
permissions accumulate just like standard permissions.
eg.
audit /bin/foo rw,
will force an audit message when the file /bin/foo is opened for
read or write.
audit /etc/shadow w,
/etc/shadow r,
will force an audit message when /etc/shadow is opened for writing.
The audit message is per permission bit so only opening the file
for read access will not, force an audit message.
audit can also be used in block form instead of prepending audit
to every rule.
audit {
/bin/foo rw,
/etc/shadow w,
}
/etc/shadow r, # don't audit r access to /etc/shadow
the deny key word can be prepended to file, network and capability
rules, to result in a denial of permissions when matching that rule.
The deny rule specifically does 3 things
- it gives AppArmor the ability to remember what has been denied
so that the tools don't prompt for what has been denied in
previous profiling sessions.
- it subtracts globally from the allowed permissions. Deny permissions
accumulate in the the deny set just as allow permissions accumulate
then, the deny set is subtracted from the allow set.
- it quiets known rejects. The default audit behavior of deny rules
is to quiet known rejects so that audit logs are not flooded
with already known rejects. To have known rejects logged prepend
the audit keyword to the deny rule. Deny rules do not have a
block form.
eg.
deny /foo/bar rw,
audit deny /etc/shadow w,
audit {
deny owner /blah w,
deny other /foo w,
deny /etc/shadow w,
}
2008-03-13 17:39:03 +00:00
John Johansen
36ad7de2c5
Add the ability to specify link subset test on a link pair, and
...
fix a bug where link pairs could get improperly merged.
2008-03-13 16:49:10 +00:00
John Johansen
d2eeef8291
extend the flags in preparation for audit control
2008-03-13 16:46:53 +00:00
John Johansen
814773b2e1
Update the parse to emit a 0 to seperate pairs in the dfa.
...
This was always the intended behavior and fixes a bug where
the dfa will match change profile rules using // seperator.
2008-03-13 16:46:19 +00:00
