mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 16:35:02 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/parser
History
John Johansen c2b8a72317 disable downgrade and not enforced rule messages by default 
Currently the apparmor parser warns about rules that are not enforced or
downgraded. This is a problem for distros that are not carrying the out of
tree kernel patches, as most profile loads result in warnings.

Change the behavior to not output a message unless a warn flag is passed.
This patch adds 2 different warn flags
  --warn rule-downgraded    	 # warn if a rule is downgraded
  --warn rule-not-enforced	   # warn if a rule is not enforced at all

If the warnings are desired by default the flags can be set in the
parser.conf file.

v2 of patch
- update man page
- add --warn to usage statement
- make --quiet clear warn flags

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-08 13:20:20 -07:00
..
libapparmor_re bison grammers: use pure.api directive instead of pure-parser variants 2014-09-04 11:37:33 -07:00
po Launchpad automatic translations update. 2014-09-22 05:56:12 +00:00
tst Parser: fix error when using regex profile names in IPC rules 2014-10-01 15:54:30 -07:00
af_rule.cc parser: fix logic error and incorrect reference from previous commit 2014-09-03 13:34:10 -07:00
af_rule.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
af_unix.cc disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
af_unix.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
apparmor-parser.spec.in Add an example parser.conf file 2011-10-07 14:43:54 -07:00
apparmor.d.pod parser: Sync parser and man page regarding local and peer perms 2014-09-22 11:34:32 -05:00
apparmor.pod can ?not fix apparmor.pod 2013-12-12 03:07:37 +01:00
apparmor_parser.pod disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
common_optarg.c Split dfa optimization and dump flag handling into a separate file so that it can be shared with DFA test programs 2014-04-23 11:10:41 -07:00
common_optarg.h Split dfa optimization and dump flag handling into a separate file so that it can be shared with DFA test programs 2014-04-23 11:10:41 -07:00
COPYING.GPL rpmlint complains about an outdated FSF address in parser/COPYING.GPL. 2011-11-27 13:52:06 +01:00
dbus.cc disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
dbus.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
frob_slack_rc as ACKed on IRC, drop the unused $Id$ tags everywhere 2010-12-20 12:29:10 -08:00
immunix.h Remove the old unused ptrace code that snuck in years ago. 2014-03-12 05:02:32 -07:00
lib.c put the gettext define in one place 2014-08-23 23:50:43 -07:00
lib.h parser: fix i386 breakage on min() argument mismatches 2014-04-17 09:20:40 -07:00
Makefile parser: fix partial compilation of C++ files 2014-09-23 07:54:04 -07:00
mount.cc disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
mount.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
network.c parser: first step implementing fine grained mediation for unix domain sockets 2014-09-03 13:22:26 -07:00
network.h Remove unnecessary include of libintl.h 2014-09-07 12:42:47 -07:00
parser.conf Commit the example parser.conf file that was supposed to be part of 2011-10-09 20:15:03 -07:00
parser.h disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
parser_alias.c C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
parser_common.c disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
parser_include.c put the gettext define in one place 2014-08-23 23:50:43 -07:00
parser_include.h allow directories to be passed to the parser 2013-10-26 00:15:13 -07:00
parser_interface.c disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
parser_lex.l C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
parser_main.c disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
parser_merge.c put the gettext define in one place 2014-08-23 23:50:43 -07:00
parser_misc.c C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
parser_policy.c put the gettext define in one place 2014-08-23 23:50:43 -07:00
parser_regex.c parser: Fix AF_UNIX stub rule creation 2014-09-03 13:45:44 -07:00
parser_symtab.c C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
parser_variable.c put the gettext define in one place 2014-08-23 23:50:43 -07:00
parser_yacc.y fix: auditing of capabilities 2014-10-07 12:50:23 -07:00
policydb.h Add the ability to mediate signals. 2014-04-23 11:35:29 -07:00
profile.cc parser: first step implementing fine grained mediation for unix domain sockets 2014-09-03 13:22:26 -07:00
profile.h parser: make flags defintion consistent 2014-09-12 23:53:39 -07:00
ptrace.cc disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
ptrace.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
rc.apparmor.debian as ACKed on IRC, drop the unused $Id$ tags everywhere 2010-12-20 12:29:10 -08:00
rc.apparmor.functions Update the copyright dates for the apparmor_parser 2012-02-24 04:21:59 -08:00
rc.apparmor.redhat as ACKed on IRC, drop the unused $Id$ tags everywhere 2010-12-20 12:29:10 -08:00
rc.apparmor.slackware as ACKed on IRC, drop the unused $Id$ tags everywhere 2010-12-20 12:29:10 -08:00
rc.apparmor.suse It looks like rc.apparmor.functions renamed "aa_log_action_begin()" to 2011-09-15 20:20:23 +02:00
README parser - update README information 2013-10-11 22:14:28 -07:00
README.devel parser: add some developer documentation 2013-12-10 14:15:02 -08:00
rule.cc Move C++ files from .c suffix to .cc suffix 2014-05-09 15:34:34 -07:00
rule.h Add missing rule.[hc] files that should have been part of commit 2449 2014-04-07 11:41:25 -07:00
signal.cc disable downgrade and not enforced rule messages by default 2014-10-08 13:20:20 -07:00
signal.h C tools: rename __unused macro to unused 2014-10-02 12:58:54 -07:00
subdomain.conf Here's an update to rename another chunk of things that still used 2011-01-13 13:58:26 -08:00
subdomain.conf.pod fix broken URLs in various utils/*.pod files. 2013-09-19 21:17:39 +02:00
techdoc.tex various changes in building techdoc.tex: 2012-05-09 00:41:06 +02:00
unit_test.h Convert codomain to a class 2013-09-27 16:16:37 -07:00

README 

The apparmor_parser allows you to add, replace, and remove AppArmor
policy through the use of command line options. The default is to add.
`apparmor_parser --help` shows what the command line options are.

You can also find more information at http://wiki.apparmor.net

Please send all complaints, feature requests, rants about the software,
and questions to the apparmor@lists.ubuntu.com mailing list. Bug
reports can be filed against the AppArmor project on launchpad.net at
https://launchpad.net/apparmor or reported to the mailing list directly
for those who wish not to register for an account on launchpad.

Security issues can be filed as security bugs on launchpad
or directed to security@ubuntu.com. We will attempt to
conform to the RFP vulnerability disclosure protocol:
http://www.wiretrip.net/rfp/policy.html

Thanks.

-- The AppArmor development team