Georgia Garcia 8e74855531 Merge Handle mount events/log entries without class ... audit.log entries for mount events don't always include `class=mount`, but can still be the base for mount rules. Change logparser.py to also consider `operation=mount` as a mount event. Actually we already had such a log and profile in our collection (testcase_mount_01), but since it existed years before MountRule was implemented, it was excluded in test-libapparmor-test_multi.py. Therefore we didn't notice that it failed to produce a profile rule when MountRule was introduced. Remove testcase_mount_01 from the list of known failures so that it gets tested - and fix the syntax error in the hand-written testcase_mount_01.profile. Also add testcase_mount_02 which is a mount event without fstype, srcname and class. I propose this fix for 4.0 and master. MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1229 Approved-by: Georgia Garcia <georgia.garcia@canonical.com> Merged-by: Georgia Garcia <georgia.garcia@canonical.com> (cherry picked from commit 48a936e985) b475ed0d Handle mount events/log entries without class Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>		2024-05-10 12:31:41 +00:00
..
config	move libapparmor into the libraries directory	2008-05-19 22:48:31 +00:00
lib	move libapparmor into the libraries directory	2008-05-19 22:48:31 +00:00
libaalogparse.test	treewide: spelling/typo fixes in comments and docs	2020-12-01 12:47:11 -08:00
test_multi	Merge Handle mount events/log entries without class	2024-05-10 12:31:41 +00:00
Makefile.am	build: add and use global EXTRA_WARNINGS from common/Make.rules	2020-05-28 16:55:50 -07:00
test_multi.c	libapparmor: add support for class in logparsing	2022-10-27 18:16:53 +00:00