mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-05 17:01:00 +01:00
16de4ee43d
is_known_rule() in aa.py checked only direct includes, but not includes in the included files. As a result, aa-logprof asked about things that are already covered by an indirect include. For example, the dovecot/auth profile includes abstractions/nameservice, and abstractions/nameservice includes abstractions/nis, which contains "capability net_bind_service,". Nevertheless, aa-logprof asked to add capability net_bind_service. Reproducer: (asks for net_bind_service without this patch, should not ask for anything after applying the patch): python3 aa-logprof -d ../profiles/apparmor.d/ -f <(echo 'type=AVC msg=audit(1415403814.628:662): apparmor="ALLOWED" operation="capable" profile="/usr/lib/dovecot/auth" pid=15454 comm="auth" capability=13 capname="net_bind_service"') The patch adds code to check include files included by other include files. Note that python doesn't allow to change a list while looping over it, therefore we have to use "while includelist" as workaround. This fixes a regression for network rules (this patch is based on the old match_net_include() code). Funnily it "only" fixes capability rule handling (without the "regression" part) because the old match_cap_include() didn't do the recursive include handling. Acked-by: Steve Beattie <steve@nxnw.org> |
||
|---|---|---|
| .. | ||
| apparmor | ||
| easyprof | ||
| po | ||
| test | ||
| vim | ||
| aa-audit | ||
| aa-audit.pod | ||
| aa-autodep | ||
| aa-autodep.pod | ||
| aa-cleanprof | ||
| aa-cleanprof.pod | ||
| aa-complain | ||
| aa-complain.pod | ||
| aa-decode | ||
| aa-decode.pod | ||
| aa-disable | ||
| aa-disable.pod | ||
| aa-easyprof | ||
| aa-easyprof.pod | ||
| aa-enforce | ||
| aa-enforce.pod | ||
| aa-exec | ||
| aa-exec.pod | ||
| aa-genprof | ||
| aa-genprof.pod | ||
| aa-logprof | ||
| aa-logprof.pod | ||
| aa-mergeprof | ||
| aa-mergeprof.pod | ||
| aa-notify | ||
| aa-notify.pod | ||
| aa-sandbox | ||
| aa-sandbox.pod | ||
| aa-status | ||
| aa-status.pod | ||
| aa-unconfined | ||
| aa-unconfined.pod | ||
| check_po.pl | ||
| logprof.conf | ||
| logprof.conf.pod | ||
| Makefile | ||
| notify.conf | ||
| python-tools-setup.py | ||
| README.md | ||
| severity.db | ||
Known Bugs: Will allow multiple letters in the () due to translation/unicode issues with regexing the key. User input will probably bug out in a different locale.