Hello, Am Mittwoch, 19. März 2014 schrieb Tyler Hicks: > Bug: https://bugs.launchpad.net/bugs/1294819 > > This patch as minimal support for bare capability rules > ("capability,"). It prevents aa.py from emitting a traceback when > encountering such a rule. > > It only adds the ability to parse and write the bare rule. It doesn't > attempt to be clever when deleting duplicate rules, such as realizing > that "capability audit_control," can be deleted if "capability," is > also present.
Can you please add a TODO note for this to avoid it gets lost? > Signed-off-by: Tyler Hicks <[email protected]> > --- > utils/apparmor/aa.py | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/utils/apparmor/aa.py b/utils/apparmor/aa.py > index a81b495..19a140c 100644 > --- a/utils/apparmor/aa.py > +++ b/utils/apparmor/aa.py > @@ -2599,7 +2602,7 @@ def attach_profile_data(profiles, profile_data): >+RE_PROFILE_CAP = re.compile('^\s*(audit\s+)?(allow\s+| >deny\s+)?capability\s*(\S+)?\s*,\s*(#.*)?$') capability \s* means the regex will also allow "capabilitysetuid". I'd propose something like (untested) ... capability(\s+\S+)?\s*,\s*(#.*)?$') or ... capability(\s+(\S+))?\s*,\s*(#.*)?$') (not sure how the nested parenthesis change the matches[] numbering) ... > - capability = matches[2] > + capability = ALL > + if matches[2]: > + capability = matches[2] If you choose the first regex I propose, you'll probably need to use matches[2].trim here. With the regex changed and a TODO note for duplicate removal, Acked-by: Christian Boltz <[email protected]> Regards, Christian Boltz -- >That release went far too smooth after we had everything together ;-) That on it's own should have set off the alarm bells :-) [> Andreas Jaeger and David Bolt in opensuse-factory] -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
