Use '-QTK' instead of '-p' in verify_policy(). '-p' only runs the preprocessor and is not as thorough as '-QTK' (--skip-kernel-load, --skip-read-cache, --skip-cache) since '-QTK' does a full compile. Like with '-p', '-QTK' can be run without privilege but it will catch things like conflicting 'x' modifiers that '-p' won't. The '-QTK' arguments are available at least as far back as apparmor 2.5.1 (eg, Ubuntu 10.04 LTS) with easyprof itself added much later, in 2012 (r2040). Note, since using -QTK does a full compile it is significantly slower than '-p', but that is because it is doing much more. This won't affect easyprof's primary consumer, click-apparmor, since aa-clickhook skips the easyprof verification tests (it loads (and therefore verifies) policy in a separate step).
Unit tests pass with the change. Acked-By: Jamie Strandboge <[email protected]> -- Jamie Strandboge http://www.ubuntu.com/
Author: Jamie Strandboge <[email protected]> Description: use -QTK instead of -p in verify_policy(). '-p' only runs the preprocessor and is not as thorough as -QTK (--skip-kernel-load, --skip-read-cache, --skip-cache). Like with '-p', '-QTK' can be run without privilege but it will catch things like conflictings 'x' modifiers. Acked-By: Jamie Strandboge <[email protected]> === modified file 'utils/apparmor/easyprof.py' --- utils/apparmor/easyprof.py 2014-03-20 05:02:53 +0000 +++ utils/apparmor/easyprof.py 2014-06-09 18:08:34 +0000 @@ -279,7 +279,7 @@ os.write(f, policy) os.close(f) - rc, out = cmd([exe, '-p', fn]) + rc, out = cmd([exe, '-QTK', fn]) os.unlink(fn) if rc == 0: return True
signature.asc
Description: OpenPGP digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
