Hello,
Tomáš, I noticed you updated the documentation, but nevertheless I found
several things that still need to be fixed - and also some new texts
that come with new errors ;-)
The attached file contains an updated version of my comments as diff
against r12028.
Regards,
Christian Boltz
--
Please do not think so much about licenses, it will just make
your head explode if not carefully studied over the years ;)
[Marcus Meissner in opensuse-packaging]
Index: xml/apparmor_changehat.xml
===================================================================
--- xml/apparmor_changehat.xml (Revision 12028)
+++ xml/apparmor_changehat.xml (Arbeitskopie)
@@ -276,6 +276,7 @@
Test Adminer in your Web browser by entering
<literal>http://localhost/adminer/adminer.php</literal> in its URI
address field. Note that if you installed Adminer to remote a server,
+<!-- ^^^^^^^^^^^^ "If" is enough -->
replace <literal>localhost</literal> with the real hostname of the
server.
</para>
@@ -300,6 +301,7 @@
already under &aa; control and its &aa; profile is too tight to permit
viewing Adminer. Check it with <command>aa-status</command>, and if
needed, set Apache temporarily in a complain mode with
+ <!-- "in complain mode" -->
</para>
<screen>aa-complain usr.sbin.httpd2-prefork</screen>
</tip>
@@ -335,6 +337,7 @@
<para>
It tells Apache to let &aa; know about a change_hat event when the Web
user accesses the directory <filename>/adminer</filename> (and and any
+ <!-- doubled "and" -->
file/directory inside) in Apache's document root. Remember - we placed
the <filename>adminer.php</filename> application there.
</para>
@@ -402,6 +405,9 @@
Note the <literal>(complain)</literal> addition after the hat name - it
tells &aa; to leave the adminer hat in complain mode. That is because
we need to learn the hat profile by accessing Adminer later on.
+<!-- did you test this yourself? I remember a bug on older versions that caused some problems
+ when the main profile was enforced and only a hat in complain mode, but maybe this was
+ accidently ;-) fixed in the meantime -->
</para>
</step>
<step>
@@ -413,6 +419,7 @@
<step>
<para>
Check if the adminer hat really is in a complain mode.
+ <!-- "in complain" -->
</para>
<screen># aa-status
apparmor module is loaded.
@@ -431,6 +438,7 @@
<para>
As we can see, the <literal>httpd2-prefork//adminer</literal> is loaded
in a complain mode. Good.
+ <!-- "in complain" (and I start to wonder if you have more than one complain mode, if you always prefix it with "a" ;-) -->
</para>
</step>
</procedure>
@@ -525,6 +533,7 @@
<step>
<para>
Set the profile to the enforce mode with <command>aa-enforce</command>
+ <!-- "to enforce mode" -->
</para>
<screen>aa-enforce usr.sbin.httpd2-prefork</screen>
<para>
@@ -542,6 +551,7 @@
[...]</screen>
<para>
As you can see, the <literal>//adminer</literal> hat jumped from the
+ <!-- drop two "the" in this paragraph - guess which ones... ;-) -->
<emphasis>complain</emphasis> to the <emphasis>enforce</emphasis> mode.
</para>
</step>
@@ -560,6 +570,7 @@
<title>Hat and Parent Profile Relationship</title>
<para>
The profile <filename>^adminer</filename> is only valid in the context
+<!-- maybe you should explain what "valid" means. Maybe "available" would be a better word. -->
of a process running under the parent profile
<filename>usr.sbin.httpd2-prefork</filename>.
</para>
Index: xml/apparmor_glossary.xml
===================================================================
--- xml/apparmor_glossary.xml (Revision 12028)
+++ xml/apparmor_glossary.xml (Arbeitskopie)
@@ -75,6 +75,7 @@
you can use helper characters '*' (substitutes any number of
characters) and '?' (substitutes exactly one character) to address
multiple file/directories at once.
+<!-- should also mention "**" in the explanation -->
</para>
</listitem>
</varlistentry>
Index: xml/apparmor_intro.xml
===================================================================
--- xml/apparmor_intro.xml (Revision 12028)
+++ xml/apparmor_intro.xml (Arbeitskopie)
@@ -30,6 +30,12 @@
Also see bnc #722915
-->
+
+
+<!-- general note for all chapters:
+ - Line breaks often contain "Ap-pArmor" - should be "App-Armor"
+-->
+
<chapter id="cha.apparmor.intro">
<title>Introducing &aa;</title>
<para>
Index: xml/apparmor_managing.xml
===================================================================
--- xml/apparmor_managing.xml (Revision 12028)
+++ xml/apparmor_managing.xml (Arbeitskopie)
@@ -1846,6 +1846,7 @@
If you intend to deploy a patch or upgrade in a test environment, the
best method for updating your profiles is to run
<command>aa-genprof</command> in a terminal as &rootuser;. For detailed
+<!-- the section talks about profile update, so aa-logprof is the tool to choose -->
instructions, refer to
<xref xrefstyle="HeadingOnPage" linkend="sec.apparmor.commandline.profiling.summary.genprof"/>.
</para>
Index: xml/apparmor_profiles.xml
===================================================================
--- xml/apparmor_profiles.xml (Revision 12028)
+++ xml/apparmor_profiles.xml (Arbeitskopie)
@@ -928,6 +928,7 @@
<filename>/usr/bin</filename> or <filename>/bin</filename>.
</para>
<screen>/{usr/bin,bin}/foo { ... }</screen>
+<!-- you are wasting some bytes here ;-) - just use /{usr/,}bin/foo -->
<para>
In the following example, when matching against the executable
<filename>/bin/foo</filename>, the <literal>/bin/foo</literal> profile
@@ -1037,6 +1038,12 @@
parser_misc.c: {"alias", TOK_ALIAS},
parser_misc.c: {"rewrite", TOK_ALIAS},
+
+See John't reply on the ML:
+ theoretically yes, but it hasn't been implemented yet and maps to the wider
+ alias rule atm.
+
+ Atm I would just drop rewrite from the documentation
-->
</tip>
<para>
@@ -1252,7 +1259,16 @@
The following rule grants access to all files:
</para>
<screen>file,</screen>
-<!-- please add a note "file, is equal to /** rwkl," (IIRC - John, is this correct?) -->
+<!-- please add a note "file, is equal to /** rwkl," (IIRC - John, is this correct?)
+
+Reply from John:
+ currently I think /** rwmlk, I will have to double check.
+ But that could change to a wider set of perms in the future.
+
+ It is supposed to be the widest set of file permissions not
+ including domain transitions.
+
+ -->
<para>
File rules can use leading or trailing permissions. The permissions do
not need to be specified as a trailing permission, but rather used at
@@ -1463,6 +1479,7 @@
program needs to be able to perform a privileged operation, such as
rebooting the machine. By placing the privileged section in another
executable and granting unconstrained execution rights, it is possible
+<!-- unconfined -->
to bypass the mandatory constraints imposed on all confined processes.
<!-- I'm not sure if such constraints still exist (at least some were removed) - John? -->
For more information about what is constrained, see the
@@ -1641,18 +1658,26 @@
or
</para>
<screen>Cix /path -> profile_name,</screen>
+<!-- the examples looks like Cix always requires "-> profile_name", but that's optional -->
<para>
The same applies if you add the unconstrained <literal>ux</literal>
mode, where the resulting modes are <literal>cux</literal>,
<literal>Cux</literal>, <literal>pux</literal> and
+<!-- CUx
+ don't mix uppercase and lowercase - it will probably result in a parser failure
+ (the obvious exception is "i", which is only available in lowercase)
+ PUx -->
<literal>Pux</literal>. These modes allow falling back to
<quote>unconfined</quote> when the specified profile is not found.
</para>
<screen>/path Pux -> profile_name,</screen>
+<!-- PUx -->
+<!-- the example looks like PUx always requires "-> profile_name", but that's optional -->
<para>
or
</para>
<screen>Pux /path -> profile_name,</screen>
+<!-- PUx again -->
<para>
The fallback modes can be used with named profile transitions, too.
</para>
@@ -1838,7 +1863,18 @@
<listitem>
<para>
currently not supported
-<!-- still valid? (John?) -->
+<!--
+[John]
+ cpu is actually supported now.
+
+ however nproc's behavior has changed from 2.3, this is due to changes in the
+ kernel.
+
+ In 2.3 nproc would keep a count per profile so there it would limit the
+ number of processes in a given profile. However it now just provides a
+ standard rlimit/ulimit nproc now. That is it controls the number of
+ processes/threads that a given user can create
+ -->
</para>
</listitem>
</varlistentry>
Index: xml/apparmor_profiles_man.xml
===================================================================
--- xml/apparmor_profiles_man.xml (Revision 12028)
+++ xml/apparmor_profiles_man.xml (Arbeitskopie)
@@ -28,6 +28,7 @@
<para>
The &aa; can be in any one of three states:
+<!-- "The" looks superfluous -->
</para>
<variablelist>
@@ -444,6 +445,7 @@
<screen>aa-complain /etc/apparmor.d/*</screen>
<para>
in a
+<!-- this gets a funny linebreak, see the PDF -->
terminal window while logged in as &rootuser;. This functionality is
also available through the &yast; Profile Mode module, described in
<xref
@@ -826,6 +828,7 @@
profile name of the current confinement will be used. If neither a
profile nor namespace is specified, the command will be run using the
standard profile attachment ‐ without the
+<!-- ^^^^^^^^^^^ as if you didn't use the -->
<command>aa-exec</command> command.
</para>
<para>
@@ -871,6 +874,7 @@
os="slert">&slert;</phrase>,
the default full path is
<phrase><filename>/usr/sbin/httpd2-prefork</filename></phrase>.
+<!-- results in funny linebreak again -->
</para>
</listitem>
<listitem>
Index: xml/apparmor_profiles_yast.xml
===================================================================
--- xml/apparmor_profiles_yast.xml (Revision 12028)
+++ xml/apparmor_profiles_yast.xml (Arbeitskopie)
@@ -41,6 +41,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Manually Add Profile</guimenu> in the main window.
</para>
</step>
@@ -89,6 +90,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Manage Existing Profiles</guimenu> in the main window.
</para>
<informalfigure>
@@ -352,6 +354,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Manage Existing Profiles</guimenu> in the main window.
</para>
</step>
@@ -419,6 +422,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Settings</guimenu> in the main window.
</para>
</step>
@@ -469,6 +473,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Settings</guimenu> in the main window.
</para>
</step>
Index: xml/apparmor_start.xml
===================================================================
--- xml/apparmor_start.xml (Revision 12028)
+++ xml/apparmor_start.xml (Arbeitskopie)
@@ -201,6 +201,7 @@
<step>
<para>
Start &yast; select <guimenu>&aa; Configuration</guimenu>, and click
+ <!-- , -->
<guimenu>Settings</guimenu> in the main window.
</para>
</step>
Index: xml/apparmor_support.xml
===================================================================
--- xml/apparmor_support.xml (Revision 12028)
+++ xml/apparmor_support.xml (Arbeitskopie)
@@ -501,10 +501,19 @@
Put the application's profile into complain mode:
</para>
<screen><command>aa-complain <option><replaceable>/path/to/application</replaceable></option></command></screen>
+<!-- [c&p from deleted YaST part]
+ Log entries are made for any actions violating the
+ current profile, but the profile is not enforced and the application's
+ behavior not restricted.
+-->
</step>
<step>
<para>
Run the application.
+<!-- [c&p again]
+ Run the application covering all the tasks you need this application
+ to be able to perform.
+-->
</para>
</step>
<step>
Index: xml/apparmor_whatimmunize.xml
===================================================================
--- xml/apparmor_whatimmunize.xml (Revision 12028)
+++ xml/apparmor_whatimmunize.xml (Arbeitskopie)
@@ -358,6 +358,7 @@
instance, a shell script might invoke the <command>cp</command> program
to copy a file. Because <command>cp</command> does not have its own
profile, it inherits the profile of the parent shell script, so can copy
+ <!-- well, in theory cp could have an own profile or subprofile -->
any files that the parent shell script's profile can read and write.
</para>
</sect1>
@@ -533,6 +534,7 @@
<!-- 2013-12-05, toba: invalid xref
Refer to
<xref xrefstyle="SectTitleOnPage" linkend="sec.apparmor.yast.wizard"/>.
+-> change to use aa-genprof/aa-logprof?
-->
</para>
<para>
Index: xml/security_docupdates.xml
===================================================================
--- xml/security_docupdates.xml (Revision 12028)
+++ xml/security_docupdates.xml (Arbeitskopie)
@@ -115,7 +115,8 @@
<itemizedlist>
<listitem>
<para>
- New <literal>Pux/pux</literal> and <literal>Cux/cux</literal>
+ New <literal>PUx/pux</literal> and <literal>CUx/cux</literal>
+<!-- Pux / Cux (mixed upper-/lowercase) will fail parsing -->
profile transitions added in
<xref linkend="sec.apparmor.profiles.exec.fallback"/>.
</para>
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
