mirror of
https://gitlab.com/apparmor/apparmor.git
synced 2025-03-04 08:24:42 +01:00
d8e86fee75
So far, change_profile_flags() in aa.py is the only user of ProfileStorage's 'name'. Rewrite minitools test_cleanprof() so that most of its code can be reused, and add a test that runs 'aa-complain /usr/bin/a/simple/cleanprof/test/profile' on cleanprof.in to ensure aa-complain still works as expected on subprofiles and hats. Note: aa-complain $profilename will change the flags of hats, but not child profiles. This is a known issue, and doesn't change with this MR.
98 lines
2.3 KiB
Text
98 lines
2.3 KiB
Text
# A simple test comment which will persist
|
|
#include <tunables/global>
|
|
|
|
#include if exists <tunables/nothing>
|
|
|
|
#include if exists <tunables/global>
|
|
include if exists <tunables/global>
|
|
|
|
alias /foo -> /bar ,
|
|
|
|
@{xy} = y x
|
|
|
|
abi <abi/4.19> ,
|
|
|
|
@{asdf} = foo ""
|
|
|
|
$foo = false
|
|
|
|
$bar = true
|
|
|
|
/usr/bin/a/simple/cleanprof/test/profile flags=(complain) {
|
|
# Just for the heck of it, this comment won't see the day of light
|
|
#include <abstractions/base>
|
|
|
|
#include if exists <foo>
|
|
#include if exists <abstractions/base>
|
|
include <abstractions/base>
|
|
|
|
capability sys_admin,
|
|
audit capability,
|
|
|
|
change_profile -> /bin/foo,
|
|
change_profile,
|
|
|
|
network inet stream,
|
|
abi "abi/4.20" ,
|
|
network stream,
|
|
|
|
#Below rule comes from abstractions/base
|
|
allow /usr/share/X11/locale/** r,
|
|
allow /home/*/** r,
|
|
|
|
ptrace tracedby peer=/bin/strace,
|
|
ptrace tracedby,
|
|
unix (receive) type=dgram,
|
|
|
|
dbus send bus=session,
|
|
dbus send bus=session peer=(label=foo),
|
|
|
|
profile test_child /foobar {
|
|
/etc/child rw,
|
|
}
|
|
|
|
set rlimit nofile <= 256,
|
|
set rlimit nofile <= 64,
|
|
|
|
signal set=(hup int quit ill trap abrt)
|
|
set=(bus,fpe,,,kill,usr1)
|
|
set=segv set=usr2 set=pipe set=alrm set=term set=stkflt set=chld,
|
|
signal set=(hup int quit),
|
|
|
|
^foo flags=(complain) {
|
|
/etc/fstab r,
|
|
capability dac_override,
|
|
}
|
|
|
|
^foo, # hat declarations are obsolete and will be removed when aa-cleanprof or aa-logprof writes the profile
|
|
|
|
mount options=(rw,suid) /c -> /3,
|
|
|
|
hat bar flags=(complain) {
|
|
/etc/passwd r,
|
|
capability sys_admin,
|
|
}
|
|
|
|
pivot_root oldroot=/mnt/root/old/,
|
|
|
|
deny owner link /some/thing -> /foo/bar ,
|
|
unix shutdown addr=@HypotheticalServiceDaemon, # covered in abstractions/base, will be removed
|
|
|
|
link subset /alpha/beta -> /tmp/**,
|
|
|
|
allow /home/foo/bar r,
|
|
allow /home/foo/** w,
|
|
}
|
|
|
|
/usr/bin/other/cleanprof/test/profile {
|
|
# This one shouldn't be affected by the processing
|
|
# However this comment will be wiped, need to change that
|
|
allow /home/*/** rw,
|
|
allow /home/foo/bar r,
|
|
}
|
|
|
|
/what/ever/xattr xattrs=( foo=bar )
|
|
flags=( complain
|
|
) {
|
|
/what/ever r,
|
|
}
|