Hello,
Am Dienstag, 9. Oktober 2012 schrieb Steve Beattie:
> On Wed, Oct 03, 2012 at 02:00:34AM +0200, Christian Boltz wrote:
> > the attached patch fixes aa-decode stdin handling.
> Realistically, this ought to be converted to one of the P* languages,
> given the difficulties around quoting and embedding sed statements.
Come on - it's much more funny in bash code ;-)
> That said, one thing aa-decode is lacking, even with your patch, is
> support for encoded profile names (yes, they too can have embedded
> spaces etc. in them). Attached is an updated version of your patch
> to fix that; it uses sed in the echo line, but still needs bash
> variable replacement to do the escaping of any embedded '^'s in the
> encoded string to not conflict with the sed separators.
Supporting encoded profile names is a good idea, using sed isn't ;-)
A'm attaching the next version of the patch.
Changes compared to my first patch:
- replace tr calls by perl's uc() (also for non-stdin mode)
- also handle encoded profile names (introduced by Steve)
- don't fail if a file or profile name contains a '
BTW: I intentionally added the "name=" part in the replacement
line="${line/name=$ne/name=\"$nd\"}"
It might look superfluous, but it ensures that the correct part is
replaced.
> Also attached is a second patch that adds a testscript (written in
> Python) that tests a few variant cases (including embedded '^'s).
> It gets run autmatically under the check target, though can be run
> directly. (A nice feature to add to it would be to premit overriding
> the location of the aa-decode binary to be tested on the command
> line.)
I didn't test the testscript yet, but having one is a good idea ;-)
Regards,
Christian Boltz
--
Wenn es jemand gibt, der Facebook derzeit noch stoppen kann, dann wohl
Google. Regentraufen- und Pestcholera-Vergleich bitte hier einfügen.
[http://praegnanz.de/weblog/ein-tag-vier-interessante-news]
Handling stdin was totally broken (= no output) with the current log
format because aa-decode expected name= to be the last entry in the
log line.
This patch for stdin handling
- fixes the pattern to match the current log format (name= is NOT the
last part in the log entry)
- uses bash replacement to avoid some sed calls (which also means the
script now needs an explicit "#!/bin/bash")
- prints decoded filenames in double instead of single quotes to be
consistent with filenames that were not encoded
- also prints lines that do not contain an encoded filename (instead of
grepping them away)
- replace tr calls by perl's uc() (also for non-stdin mode)
- also handle encoded profile names (introduced by Steve)
- don't fail if a file or profile name contains a '
In other words: you can pipe your audit.log through aa-decode, and the
only difference to the raw audit.log is that filenames are decoded.
=== modified file 'utils/aa-decode'
--- utils/aa-decode 2012-09-17 21:55:28 +0000
+++ utils/aa-decode 2012-10-09 23:53:12 +0000
@@ -1,6 +1,7 @@
-#!/bin/sh
+#!/bin/bash
#
-# Copyright (C) 2009-2010 Canonical Ltd.
+# Copyright (C) 2009-2010, 2012 Canonical Ltd.
+# Copyright (C) 2012 Christian Boltz
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
@@ -36,7 +37,7 @@
}
decode() {
- decoded=`perl -le "\\$s = '$1' ; print pack 'H*', \\$s"`
+ decoded=`perl -le "\\$s = uc('$1') ; if (\\$s =~ /^[0-9A-F]*$/) { print pack 'H*', \\$s; }"`
echo "$decoded"
}
@@ -47,8 +48,8 @@
# if have an argument, then use it, otherwise process stdin
if [ -n "$1" ]; then
- e=`echo "$1" | tr -s '[:lower:]' '[:upper:]'`
- if ! echo "$e" | egrep -q "^[0-9A-F]+$" ; then
+ e="$1"
+ if ! echo "$e" | egrep -q "^[0-9A-Fa-f]+$" ; then
echo "String should only contain hex characters (0-9, a-f, A-F)"
exit 1
fi
@@ -63,13 +64,28 @@
exit 0
fi
-# For now just look at 'name=...' which is usually the last in the log entry,
+# For now just look at 'name=...' and 'profile=...',
# so validate input against this and output based on it.
# TODO: better handle other cases too
-egrep ' name=2[fF][0-9a-fA-F]*$' | while read line ; do
- e=`echo "$line" | sed 's/.* name=\(.*\)/\\1/g' | tr -s '[:lower:]' '[:upper:]'`
- d=`decode $e`
- echo -n "$line" | sed "s/\(.*\) name=.*/\1 name=/g"
- echo "'$d'"
+while read line ; do
+
+ # check if line contains encoded name= or profile=
+ if echo "$line" | egrep ' (name|profile)=[0-9a-fA-F]' >/dev/null ; then
+
+ # cut the encoded filename/profile name out of the line and decode it
+ ne=`echo "$line" | sed 's/.* name=\([^ ]*\).*$/\\1/g'`
+ nd="$(decode ${ne/\'/\\\'})"
+
+ pe=`echo "$line" | sed 's/.* profile=\([^ ]*\).*$/\\1/g'`
+ pd="$(decode ${pe/\'/\\\'})"
+
+ # replace encoded name and profile with its decoded counterparts (only if it was encoded)
+ test -n "$nd" && line="${line/name=$ne/name=\"$nd\"}"
+ test -n "$pd" && line="${line/profile=$pe/profile=\"$pd\"}"
+
+ fi
+
+ echo "$line"
+
done
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
