On Thu, Nov 13, 2014 at 09:00:35PM +0100, Christian Boltz wrote:
> Hello,
>
> when aa-logprof asks for a capability, you'll see something like
>
> WARN: unknown capability: CAP_block_suspend
>
> Profile: /bin/foo
> Capability: block_suspend
> Severity: unknown
>
> The reason for the warning and "Severity: unknown" is that severity.db
> contains the capability names in uppercase, but ask_the_question() calls
> sev_db.rank with the capability in lowercase.
>
> This patch converts the "CAP_$capability" string to uppercase before
> doing the lookup.
>
>
> === modified file 'utils/apparmor/severity.py'
> --- utils/apparmor/severity.py 2014-11-06 20:37:02 +0000
> +++ utils/apparmor/severity.py 2014-11-13 19:55:45 +0000
> @@ -77,8 +77,9 @@
>
> def handle_capability(self, resource):
> """Returns the severity of for the capability resource, default
> value if no match"""
> - if resource in self.severity['CAPABILITIES'].keys():
> - return self.severity['CAPABILITIES'][resource]
> + cap = resource.upper()
> + if cap in self.severity['CAPABILITIES'].keys():
> + return self.severity['CAPABILITIES'][cap]
> # raise ValueError("unexpected capability rank input: %s"%resource)
> warn("unknown capability: %s" % resource)
> return self.severity['DEFAULT_RANK']Acked-by: Steve Beattie <[email protected]>, so long as the following patch is committed at the same time: --- utils/test/test-severity.py | 3 +++ 1 file changed, 3 insertions(+) Index: b/utils/test/test-severity.py =================================================================== --- a/utils/test/test-severity.py +++ b/utils/test/test-severity.py @@ -68,6 +68,9 @@ class SeverityTest(SeverityBaseTest): def test_cap_setpcap(self): self._simple_severity_test('CAP_SETPCAP', 9) + def test_cap_setpcap_lowercase(self): + self._simple_severity_test('CAP_setpcap', 9) + def test_cap_unknown_1(self): self._simple_severity_test('CAP_UNKNOWN', 10) -- Steve Beattie <[email protected]> http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
