mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
5c04b791d2
If a user specifies a non-existing file to merge into the profiles (`aa-mergeprof /file/not/found`), this results in a backtrace showing an AppArmorBug because that file unsurprisingly doesn't end up in the active_profiles filelist. Handle this more gracefully by adding a read_error_fatal parameter to read_profile() that, if set, forwards the exception. With that, aa-mergeprof doesn't try to list the profiles in this non-existing file. Note that all other callers of read_profile() continue to ignore read errors, because aborting just because a single file in /etc/apparmor.d/ (for example a broken symlink) isn't readable would be a bad idea. This bug was introduced in4e09f315c3, therefore I propose this patch for 3.0..master MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1403 Approved-by: John Johansen <john@jjmx.net> Merged-by: John Johansen <john@jjmx.net> (cherry picked from commit5ebbe788ea) Signed-off-by: John Johansen <john.johansen@canonical.com>
136 lines
4.8 KiB
Python
Executable file
136 lines
4.8 KiB
Python
Executable file
#! /usr/bin/python3
|
|
# ----------------------------------------------------------------------
|
|
# Copyright (C) 2013 Kshitij Gupta <kgupta8592@gmail.com>
|
|
# Copyright (C) 2014-2018 Christian Boltz <apparmor@cboltz.de>
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# ----------------------------------------------------------------------
|
|
import argparse
|
|
|
|
import apparmor.aa
|
|
import apparmor.cleanprofile as cleanprofile
|
|
import apparmor.severity
|
|
import apparmor.ui as aaui
|
|
from apparmor.fail import enable_aa_exception_handler
|
|
from apparmor.translations import init_translation
|
|
|
|
enable_aa_exception_handler() # setup exception handling
|
|
_ = init_translation() # setup module translations
|
|
|
|
parser = argparse.ArgumentParser(description=_('Merge the given profiles into /etc/apparmor.d/ (or the directory specified with -d)'))
|
|
parser.add_argument('files', nargs='+', type=str, help=_('Profile(s) to merge'))
|
|
parser.add_argument('-d', '--dir', type=str, help=_('path to profiles'))
|
|
# parser.add_argument('-a', '--auto', action='store_true', help=_('Automatically merge profiles, exits incase of *x conflicts'))
|
|
parser.add_argument('--configdir', type=str, help=argparse.SUPPRESS)
|
|
args = parser.parse_args()
|
|
|
|
args.other = None
|
|
|
|
apparmor.aa.init_aa(confdir=args.configdir, profiledir=args.dir)
|
|
|
|
profiles = args.files
|
|
|
|
|
|
def find_profiles_from_files(files):
|
|
profile_to_filename = dict()
|
|
for file_name in files:
|
|
try:
|
|
apparmor.aa.read_profile(file_name, True, read_error_fatal=True)
|
|
for profile_name in apparmor.aa.active_profiles.profiles_in_file(file_name):
|
|
profile_to_filename[profile_name] = file_name
|
|
except IOError:
|
|
pass
|
|
apparmor.aa.reset_aa()
|
|
|
|
return profile_to_filename
|
|
|
|
|
|
def find_files_from_profiles(profiles):
|
|
profile_to_filename = dict()
|
|
apparmor.aa.read_profiles()
|
|
|
|
for profile_name in profiles:
|
|
profile_to_filename[profile_name] = apparmor.aa.get_profile_filename_from_profile_name(profile_name, True)
|
|
|
|
apparmor.aa.reset_aa()
|
|
|
|
return profile_to_filename
|
|
|
|
|
|
def main():
|
|
base_profile_to_file = find_profiles_from_files(profiles)
|
|
|
|
profiles_to_merge = set(base_profile_to_file.keys())
|
|
|
|
user_profile_to_file = find_files_from_profiles(profiles_to_merge)
|
|
|
|
for profile_name in profiles_to_merge:
|
|
aaui.UI_Info("\n\n" + _("Merging profile for %s" % profile_name))
|
|
user_file = user_profile_to_file[profile_name]
|
|
base_file = base_profile_to_file.get(profile_name, None)
|
|
|
|
act(user_file, base_file, profile_name)
|
|
|
|
apparmor.aa.reset_aa()
|
|
|
|
|
|
def act(user_file, base_file, merging_profile):
|
|
mergeprofiles = Merge(user_file, base_file)
|
|
# Get rid of common/superfluous stuff
|
|
mergeprofiles.clear_common()
|
|
|
|
mergeprofiles.ask_merge_questions()
|
|
|
|
apparmor.aa.changed[merging_profile] = True # force asking to save the profile
|
|
apparmor.aa.save_profiles(True)
|
|
|
|
|
|
class Merge(object):
|
|
def __init__(self, user, base):
|
|
# Read and parse base profile and save profile data, include data from it and reset them
|
|
apparmor.aa.read_profile(base, True)
|
|
self.base = cleanprofile.Prof(base)
|
|
|
|
apparmor.aa.reset_aa()
|
|
|
|
# Read and parse user profile
|
|
apparmor.aa.read_profile(user, True)
|
|
self.user = cleanprofile.Prof(user)
|
|
|
|
def clear_common(self):
|
|
deleted = 0
|
|
|
|
# Remove off the parts in base profile which are common/superfluous from user profile
|
|
user_base = cleanprofile.CleanProf(False, self.user, self.base)
|
|
deleted += user_base.compare_profiles()
|
|
|
|
def ask_merge_questions(self):
|
|
other = self.base
|
|
log_dict = {'merge': apparmor.aa.split_to_merged(other.aa)}
|
|
|
|
apparmor.aa.loadincludes()
|
|
|
|
if not apparmor.aa.sev_db:
|
|
apparmor.aa.sev_db = apparmor.severity.Severity(apparmor.aa.CONFDIR + '/severity.db', _('unknown'))
|
|
|
|
# ask about preamble rules
|
|
apparmor.aa.ask_rule_questions(
|
|
other.active_profiles.files[other.filename], # prof_events aka log_dict
|
|
'[preamble]', # displayed profile name
|
|
self.user.active_profiles.files[self.user.filename], # profile to update
|
|
['abi', 'inc_ie'] # rule types - TODO: don't hardcode
|
|
)
|
|
|
|
apparmor.aa.ask_the_questions(log_dict)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|