On Mon, Jun 09, 2014 at 01:30:01PM -0500, Jamie Strandboge wrote: > > Use '-QTK' instead of '-p' in verify_policy(). '-p' only runs the preprocessor > and is not as thorough as '-QTK' (--skip-kernel-load, --skip-read-cache, > --skip-cache) since '-QTK' does a full compile. Like with '-p', '-QTK' can be > run without privilege but it will catch things like conflicting 'x' modifiers > that '-p' won't. The '-QTK' arguments are available at least as far back as > apparmor 2.5.1 (eg, Ubuntu 10.04 LTS) with easyprof itself added much later, > in > 2012 (r2040). Note, since using -QTK does a full compile it is significantly > slower than '-p', but that is because it is doing much more. This won't affect > easyprof's primary consumer, click-apparmor, since aa-clickhook skips the > easyprof verification tests (it loads (and therefore verifies) policy in a > separate step). > > Unit tests pass with the change. > > Acked-By: Jamie Strandboge <[email protected]>
Acked-by: Seth Arnold <[email protected]> Thanks > > -- > Jamie Strandboge http://www.ubuntu.com/ > Author: Jamie Strandboge <[email protected]> > Description: use -QTK instead of -p in verify_policy(). '-p' only runs the > preprocessor and is not as thorough as -QTK (--skip-kernel-load, > --skip-read-cache, --skip-cache). Like with '-p', '-QTK' can be run without > privilege but it will catch things like conflictings 'x' modifiers. > > Acked-By: Jamie Strandboge <[email protected]> > === modified file 'utils/apparmor/easyprof.py' > --- utils/apparmor/easyprof.py 2014-03-20 05:02:53 +0000 > +++ utils/apparmor/easyprof.py 2014-06-09 18:08:34 +0000 > @@ -279,7 +279,7 @@ > os.write(f, policy) > os.close(f) > > - rc, out = cmd([exe, '-p', fn]) > + rc, out = cmd([exe, '-QTK', fn]) > os.unlink(fn) > if rc == 0: > return True >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
