mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 16:35:02 +01:00
ee7560d6ef
This patch changes handle_children() (which asks about exec events) and
ask_the_questions() (which asks everything else) to FileRule. This
solves the "brain split" introduced by the previous patch.
This means aa-logprof and aa-genprof ask useful questions again, and
store the answers at the right place.
In detail, this means (with '-' line number from the diff)
- (391) handle_binfmt(): use FileRule. Also avoid breakage if glob_common()
returns an empty result.
- (484) profile_storage(): drop profile['allow']['path'] and
profile['deny']['path']
- (510) create_new_profile(): switch to FileRule
- (1190..1432) lots of changes in handle_children():
- drop escaping (done in FileRule)
- don't add events with 'x' perms to prelog
- use is_known_rule() instead of profile_known_exec()
- replace several regexes for the selected CMD_* with more readable
'in' clauses. While on it, drop unused parts of the regex.
- use plain 'ix', 'px' (as str) instead of str_to_mode() format
- call handle_binfmt() for the interpreter in ix, Pix and Cix rules
- (1652) ask_the_questions(): disable the old file-specific code
(not dropped because some features aren't ported to FileRule yet)
- (2336) collapse_log():
- convert file log events to FileRule (and add some workarounds and
TODOs for logparser.py behaviour that needs to change)
- disable the old file-specific code (not dropped because merging of
existing permissions isn't ported to FileRule yet)
- (2403) drop now unused validate_profile_mode() and the regexes it used
- (3374) drop now unused profile_known_exec()
Test changes:
- adjust fake_ldd to handle /bin/bash
- change test-aa.py AaTest_create_new_profile to expect FileRule instead
of a path hasher. Also copy the profiles to the tempdir and load the
abstractions that are needed by the test.
(These tests get skipped on py2 because changing
apparmor.aa.cfg['settings']['ldd'] doesn't work for some unknown reason)
Important: Some nice-to-have features are not yet implemented for
FileRule:
- globbing
- (N)ew (allowing the user to enter a custom path)
- displaying and merging of permissions already existing in the profile
This means: aa-logprof works, but it's not as user-friendly as before.
The next patches will fix that ;-)
Also note that pyflakes will fail for ask_the_questions_OLD_FILE_CODE()
because of undefined symbols (aamode, profile, hat). This will be fixed
when the old code gets dropped in one of the later patches.
Acked-by: Steve Beattie <steve@nxnw.org>
Bug: https://launchpad.net/bugs/1569316
56 lines
2.3 KiB
Python
Executable file
56 lines
2.3 KiB
Python
Executable file
#!/usr/bin/python3
|
|
|
|
import sys
|
|
|
|
if len(sys.argv) != 2:
|
|
raise Exception('wrong number of arguments in fake_ldd')
|
|
|
|
if sys.argv[1] == '/AATest/bin/bash' or sys.argv[1] == '/bin/bash':
|
|
print(' linux-vdso.so.1 (0x00007ffcf97f4000)')
|
|
print(' libreadline.so.6 => /AATest/lib64/libreadline.so.6 (0x00007f2c41324000)')
|
|
print(' libtinfo.so.6 => /AATest/lib64/libtinfo.so.6 (0x00007f2c410f9000)')
|
|
print(' libdl.so.2 => /AATest/lib64/libdl.so.2 (0x00007f2c40ef5000)')
|
|
print(' libc.so.6 => /AATest/lib64/libc.so.6 (0x00007f2c40b50000)')
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x000055782c473000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/ld-2.22.so':
|
|
print(' linux-vdso.so.1 (0x00007ffcf97f4000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/libc-2.22.so':
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x0000556858473000)')
|
|
print(' linux-vdso.so.1 (0x00007ffe98912000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/libdl.so.2':
|
|
print(' linux-vdso.so.1 (0x00007ffec2538000)')
|
|
print(' libc.so.6 => /AATest/lib64/libc.so.6 (0x00007f8865346000)')
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x0000560c3bcee000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/libtinfo.so.6':
|
|
print(' linux-vdso.so.1 (0x00007fff30518000)')
|
|
print(' libc.so.6 => /AATest/lib64/libc.so.6 (0x00007fb6f2ea3000)')
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x00005631fe8d3000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/libreadline.so.6':
|
|
print(' linux-vdso.so.1 (0x00007ffcb5b62000)')
|
|
print(' libtinfo.so.6 => /AATest/lib64/libtinfo.so.6 (0x00007f2a4ed07000)')
|
|
print(' libc.so.6 => /AATest/lib64/libc.so.6 (0x00007f2a4e961000)')
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x000055f749c89000)')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/ld-linux-x86-64.so.2':
|
|
print(' statically linked')
|
|
|
|
elif sys.argv[1] == '/AATest/lib64/libc.so.6':
|
|
print(' /AATest/lib64/ld-linux-x86-64.so.2 (0x000055b65f7a9000)')
|
|
print(' linux-vdso.so.1 (0x00007ffde132b000)')
|
|
|
|
|
|
elif sys.argv[1].startswith('/tmp/aa-test-'): # test file generated by test-aa.py
|
|
print(' not a dynamic executable')
|
|
|
|
elif sys.argv[1] == 'TEMPLATE':
|
|
print('')
|
|
print('')
|
|
print('')
|
|
|
|
else:
|
|
raise Exception('unknown parameter in fake_ldd: %s' % sys.argv[1])
|