Christian Boltz 3d3667f38b move path log event handling to hashlog ... In logparser.py parse_event_for_tree, convert path handling to hashlog. While on it, include 'owner' as part of hashlog so that aa.py doesn't need to guess. Also switch to a simple for loop instead of using log_str_to_mode() from aamode.py to convert denied_mask to hasher keys (which would have been needed to allow merging of several log events for the same path anyway). Note that the check for 'mrawlk' (intentionally without 'x') is more strict than the validate_log_mode(), but it should still cover all file permissions. (validate_log_mode() also allows things like 'Px', which we'll never hit in a logfile.) In aa.py collapse_log() update the handling of path events to match the additional [owner] key in hashlog/prelog. This makes the owner detection in collapse_log() superfluous. In aa.py handle_children(), remove 'path' handling from the 'path' or 'exec' section, and add an 'if True:' to avoid lots of whitespace changes. In aamode.py, drop the now unused split_mode() function, and AA_OTHER_REMOVE() that was only used by split_mode(). Finally, remove sample log events with null-* hats from the list of known failures in test-libapparmor-test_multi.py (we no longer filter out null-* hats), and fix whitespace in two expected profiles.		2019-05-02 01:10:18 +02:00
..
libapparmor	move path log event handling to hashlog	2019-05-02 01:10:18 +02:00