Commit graph

1166 commits

Author SHA1 Message Date
John Johansen
6850b933dc Fix bnc#257286, so that if complain or enfore fail to load the profile,
they will fail and dump the profiles error message.
2008-04-10 07:25:46 +00:00
John Johansen
d870116ae5 fix bnc#304205. This results in the following warning, when a profile already
exits but doesn't have a flags=(X) component.

Use of uninitialized value in substitution (s///) at
       /usr/lib/perl5/vendor_perl/Immunix/SubDomain.pm line 4687 (#1)
   (W uninitialized) An undefined value was used as if it were already
   defined.  It was interpreted as a "" or a 0, but maybe it was a mistake.
   To suppress this warning assign a defined value to your variables.

   To help you figure out what was undefined, perl tells you what operation
   you used the undefined value in.  Note, however, that perl optimizes your
   program and the operation displayed in the warning may not necessarily
   appear literally in your program.  For example, "that $foo" is
   usually optimized into "that " . $foo, and the warning will refer to
   the concatenation (.) operator, even though there is no . in your
   program.
2008-03-13 15:12:30 +00:00
John Johansen
aed6f06800 Fix bug where genprof/logprof would just die on newer mode format.
This does not allow genprof/logprof to enable features using the
new format, just work with the new style logs.
2008-03-13 10:49:44 +00:00
John Johansen
ba6606460d add missing files from previous set of commits 2008-02-26 12:28:42 +00:00
John Johansen
28860a8386 repo-cmd-line-tool.diff - Basic prototype for a command line tool to allow
users to push/pull/search for profiles in remote
                            repositories. It is not fully functional at the
                            moment (the official repository is down) but I'd
                            like to get feedback on the basic usage. The
                            options for
                              push/pull/search/status/getconfig/setconfig
                            are working (usage/help below). I think the next
                            step could be a basic gtk UI to give users a
                            decent UI to manage profiles/repositories.
                            Feedback welcomed about the usage model - 
                            would a graphical tool make sense?

--------------------------------------------------------
aa-repo.pl --command args
    --search [author=XXX] [prog=XXX] [id=XXX]
             Search the repository for profiles matching the search criteria
             and return the results.
             NOTE: One --search switch per option

    --verbose|v
             Verbosity level. Supply either one or two switches. Two switches
             adds full profile text in returned search results.

    --push   [--profile=XXX|all] [--changelog=XXX]
             Push local profiles to repository, uses configured user and upon
             overwrite of an existing profile in the repository then prompt
             user with a diff for confirmation XXX the name of the application
             whose profile should be uploaded or "all"  to upload all
             profiles.  Multiple --profile switches may be passed to supply
             multiple profile names

             e.g.  --push --profile /usr/sbin/mdnsd --profile /usr/sbin/ftp
             e.g.  --push --profile all

    --pull   [--author=XXX] [--profile=XXX] or [--id=XXX] [--mode=complain]
             pull remote profiles and install on local system
             If operation will change local profiles then prompt user with
             diff for confirmation
             NOTE: One --pull switch per option and there are three acceptable
                   combinations

             --pull --author=XXX
               * pull all profiles in the repo for the author

             --pull --author=XXX  --profile=XXXX
               * pull the profile for prog owned by author

             --pull --id=XXXX
               * pull the profile with id

             --pull --mode=complain
               * set the profile(s) to complain mode when installed

             Profiles are checked for conflicts with currently installed
             profiles and presented as a list to the user to confirm and view.

    --sync   [--up] [--down] [--noconfirm]
             Synchronize local profile set with the repository - showing
             changes and allowing prompting the user with the diffs and
             suggest the newest version to be activated. If the --all option
             is passed then treat profiles not marked as remote as new
             profiles that will be uploaded to the repository.

    --status
             Show the current status of the local profile set. This operation
             is similar to sync but does not prompt the user to up|down load
             changes

    --setconfig [url=xxx] [username=xxxx] [password=xxxx] [enabled=(yes|no)]
                [upload=(yes|no)]
              Set the configuration options for the repository.
              NOTE: One --setconfig switch per option

    --getconfig|c
             Print the current configuration for the repsository

    --quiet|q Don't prompt user - assume that all changes should be made.
2008-02-26 12:02:00 +00:00
John Johansen
010fc621ca logparse.diff - Update the tools to use the apparmor loparsing
library to read events from the log files.
2008-02-26 12:01:10 +00:00
John Johansen
0562961d71 repo-refactor.diff - Refactor the basic repository communication
routines into a standalone perl module.
                            Factor out the config file reading/writing into a
                            standalone perl module. The goal here was to
                            start to break out some of the basic routines
                            that the tools use into their own independent
                            modules.
2008-02-26 12:00:37 +00:00
John Johansen
dfe2b6d3db reverse commit 1104 removing optional use of xml-rpc. May reintroduce later 2008-02-26 11:58:40 +00:00
John Johansen
7140ac64a3 Make rpc-xml optional (only needed if repository is used) 2008-02-19 18:50:36 +00:00
John Johansen
1421b0b366 merge over update of .spec %changes from r1083 2008-02-19 18:49:35 +00:00
John Johansen
fb62cb15b2 update apparmor_status to work when apparmor is a kernel builtin 2008-01-05 08:29:39 +00:00
Dominic Reynolds
472a1d333a Added handling to correctly check the result of the profile development
run and reset the profile mode to enforce when the profile development
run exits without an error.
Addresses novell bug: https://bugzilla.novell.com/show_bug.cgi?id=328045
2007-11-06 18:08:24 +00:00
Dominic Reynolds
c074a19f24 Ignore complain flags when up|down loading profiles to|from the
repository. This makes the repository agnostic to profile mode
(complain/enforce) - users must manage this locally via
aa-complain/aa-enforce.
Addresses novell bug: https://bugzilla.novell.com/show_bug.cgi?id=328033
2007-11-06 18:06:18 +00:00
Dominic Reynolds
63a7fa4aed Modified code to check the repository for new profile when:
- processing an unknown hat/execute rejection if its not already in the profile
   - at the start of processing all the remain events for the profile
Addresses novell bug: https://bugzilla.novell.com/show_bug.cgi?id=328707
2007-11-06 16:46:57 +00:00
Dominic Reynolds
57f1e839b7 Updated regex used to detect syslog messages (from bug reported against
Ubuntu gutsy)
2007-11-06 16:37:52 +00:00
David J Drewelow
6eedd28dc2 Fix for bug #329476. The mode validation regexp has been updated to
support additional values.
2007-09-28 16:51:56 +00:00
Dominic Reynolds
de278ffef8 Don't try to read inactive profile directory if it doesn't exist. Fix
based on feedback from mathiaz@ubuntu.com and from bug report:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/141128.
2007-09-28 15:39:42 +00:00
Dominic Reynolds
27c13607be Change the default repository to
http://apparmor.opensuse.org/backend/api - the host for the production
repository.
2007-09-17 02:28:26 +00:00
Dominic Reynolds
4ffd798b57 Update to log parsing to correctly unpack the hex encoded values passed
from the module: name, name2, and profile. (fix from jmichael@suse.de)
2007-09-17 01:58:36 +00:00
Dominic Reynolds
0cd4b39f4c Remove the confirmation prompt for confirm_and_finish - this was a
duplicate prompt after the repository changes to save_profiles.
2007-09-17 01:56:14 +00:00
Dominic Reynolds
61d499c108 Add support for network toggles, append, and locking to the YaST2
EditProfile wizard.
2007-09-17 01:55:11 +00:00
David J Drewelow
935e7eb32f Fixes (#310454) to support new audit log format and new libapparmor1. 2007-09-14 21:23:08 +00:00
Dominic Reynolds
7faf960612 Update the logfile parsing in the tools to support syslog (in addition
to LAF) as a source of AppArmor module messages.
2007-09-10 19:44:07 +00:00
Dominic Reynolds
ddba73d87c Very basic user feedback when connections are made to a remote
repository. For genprof/logprof just report "Connecting to the
repository". For yast display a dialog.
2007-09-10 19:42:18 +00:00
Dominic Reynolds
b451a537c4 Update the eventd schema to support the mode_deny mode_req types
reported by the latest apparmor module in its rejection/permitting
messages.
2007-09-10 19:41:03 +00:00
David J Drewelow
99fc25eb37 Updated requirements for changes to libapparmor. 2007-08-20 15:07:43 +00:00
David J Drewelow
fd1c72183b Updated sqlite db and related functions to support new parser and
libapparmor.
2007-08-20 15:07:13 +00:00
Dominic Reynolds
de7ec1e261 Missing shortcut fixes for german. 2007-08-17 21:41:37 +00:00
Dominic Reynolds
87cde25a44 Minor changes to ensure that removal of the repository section in
logprof.conf disables repository integration.
2007-08-17 21:05:28 +00:00
Dominic Reynolds
5c373ea077 Remove default/required hats for ssh in logprof.conf 2007-08-17 19:54:57 +00:00
Dominic Reynolds
9c0820d5ed Fixes for "mandatory profile not found" profiling bug, empty configs in
logprof.conf generating undefined value errors, repository code
prompting user even if no configuration is present that specifies a
default repository.
2007-08-16 21:51:08 +00:00
Dominic Reynolds
0e60123f22 Updated translations for missing shortcuts in msgstr fields. 2007-08-16 21:38:34 +00:00
Seth Arnold
0c9d1c44ed new audit manpage from Mathias Gug 2007-08-15 21:43:40 +00:00
Dominic Reynolds
ea8ed8f665 utitlity to look for problems in the po files. 2007-08-15 19:24:49 +00:00
Dominic Reynolds
4b7a720d8a Fix problems with missing hotkey for "(S)can for SubDomain Events" in
genprof. Replace occurances of SubDomain in msgstr with AppArmor.
2007-08-15 16:24:26 +00:00
Dominic Reynolds
1c56662fe7 Added support for capablities and network toggles in #includes. 2007-08-15 16:17:50 +00:00
Steve Beattie
4c1effc3a2 Make the location of logger configurable via /etc/apparmor/logprof.conf 2007-08-14 22:07:40 +00:00
Steve Beattie
6123467433 skip files suffixed with .dpkg-old, based on a patch from Mathias Gug
<mathiaz@ubuntu.com> [Message-ID: <20070813201254.GD11381@mathias.mathiaz.net>]
Added comments to both file-skipping locations referencing the other
location that needs to be modified.

(The ideal solution would be for this information to be stored in one
commonly referenced location, configurable by distributors and
administratrors.)
2007-08-14 19:19:59 +00:00
Steve Beattie
7e8fe42967 Fix for #298840, "apparmor-utils misses perl-TermReadKey dep" 2007-08-10 21:51:20 +00:00
Dominic Reynolds
073854651f Added updated translations. 2007-08-06 12:49:47 +00:00
Dominic Reynolds
bc8b8d742a Fix bug in saving of local profiles in the yast UI. Front end wasn't
returning the selected list correctly and the backend wasn't processing
the returned list correctly.
2007-07-30 01:56:21 +00:00
Dominic Reynolds
ecf9f5b5bf Fix bug in changehat handling code where profiles read in from were set
as changed even though they may not be active profiles.
2007-07-30 01:54:25 +00:00
Dominic Reynolds
95769acf38 Patch from jmichael@suse.de to factor out validate_mode into
validate_log_mode() and validate_profile_mode()
2007-07-30 01:53:25 +00:00
Dominic Reynolds
82b86abc58 Fix bug where events from the log were dropped for profiles in the
null-complain-profile.
2007-07-29 02:30:39 +00:00
Dominic Reynolds
371860fb03 Handle "mandatory profile missing" messages and autodep a new profile if
P|px is chosen.
2007-07-29 02:25:25 +00:00
Dominic Reynolds
b210319daa Fixes for regex handling in the tools to match the newer directory
handling syntax.
2007-07-29 02:23:31 +00:00
Dominic Reynolds
1a8ae64cfb Add handling for lock and append in logs and profiles. 2007-07-29 02:20:24 +00:00
Dominic Reynolds
3f2ed86bef Don't process events for profiles that no longer exist. 2007-07-29 02:18:29 +00:00
Dominic Reynolds
6f5bc70ae1 Updated usage of SubDomain::readprofile() (which changed in r620) in
yast apparmor profile agent and syntax checking function in subdomain.pm
2007-07-29 02:17:17 +00:00
Dominic Reynolds
0bd08b78c8 Strip trailing comments from individual rule lines in the profiles when
they are parsed.
2007-07-29 02:06:41 +00:00