Hi, While trying to help Christian diagnose some problems I was having with his capabilities classes patches, I wrote the following patches.
The first was discovered while writing the second: the assignment for setting segments['include'] = True is wrong, it occurs inside the 'if not segments['include'] and True in segments.values():' block, whereas it needs to always get set outside of that if test. The second pulls out all the common processing for writing out each of the prior segments that need to be written before writing the current segment into a function called 'write_prior_segments', reducing a bunch of ugly duplication. Both patches Signed-off-by: Steve Beattie <[email protected]> -- Steve Beattie <[email protected]> http://NxNW.org/~steve/
---
utils/apparmor/aa.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: b/utils/apparmor/aa.py
===================================================================
--- a/utils/apparmor/aa.py
+++ b/utils/apparmor/aa.py
@@ -4241,7 +4241,7 @@ def serialize_profile_from_old_profile(p
write_prof_data[name]['allow'].pop(segs)
if write_prof_data[name]['deny'].get(segs, False):
write_prof_data[name]['deny'].pop(segs)
- segments['include'] = True
+ segments['include'] = True
write_prof_data[hat]['include'].pop(include_name)
data.append(line)
else:
---
utils/apparmor/aa.py | 112 ++++++++++-----------------------------------------
1 file changed, 24 insertions(+), 88 deletions(-)
Index: b/utils/apparmor/aa.py
===================================================================
--- a/utils/apparmor/aa.py
+++ b/utils/apparmor/aa.py
@@ -3818,6 +3818,19 @@ def serialize_profile_from_old_profile(p
'change_profile': False,
'include_local_started': False, # unused
}
+
+ def write_prior_segments(prof_data, segments, line):
+ data = []
+ for segs in list(filter(lambda x: segments[x], segments.keys())):
+ depth = len(line) - len(line.lstrip())
+ data += write_methods[segs](prof_data, int(depth / 2))
+ segments[segs] = False
+ if prof_data['allow'].get(segs, False):
+ prof_data['allow'].pop(segs)
+ if prof_data['deny'].get(segs, False):
+ prof_data['deny'].pop(segs)
+ return data
+
#data.append('reading prof')
for line in f_in:
correct = True
@@ -3947,14 +3960,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['capability'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['capability'] = True
write_prof_data[hat][allow]['capability'].pop(capability)
data.append(line)
@@ -3988,14 +3994,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['link'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['link'] = True
write_prof_data[hat][allow]['link'].pop(link)
data.append(line)
@@ -4012,14 +4011,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['change_profile'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['change_profile'] = True
write_prof_data[hat]['change_profile'].pop(cp)
data.append(line)
@@ -4042,14 +4034,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['alias'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['alias'] = True
if profile:
write_prof_data[hat]['alias'].pop(from_name)
@@ -4071,14 +4056,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['rlimit'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['rlimit'] = True
write_prof_data[hat]['rlimit'].pop(from_name)
data.append(line)
@@ -4096,14 +4074,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['lvar'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['lvar'] = True
write_prof_data[hat]['lvar'].pop(bool_var)
data.append(line)
@@ -4127,14 +4098,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['lvar'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['lvar'] = True
if profile:
write_prof_data[hat]['lvar'].pop(list_var)
@@ -4165,14 +4129,7 @@ def serialize_profile_from_old_profile(p
(not audit or path_rule.get('audit', set()) & audit) and \
path_rule.get('file_prefix', set()):
if not segments['path'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['path'] = True
write_prof_data[hat][allow]['path'].pop(ALL)
data.append(line)
@@ -4213,14 +4170,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['path'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['path'] = True
write_prof_data[hat][allow]['path'].pop(path)
data.append(line)
@@ -4233,14 +4183,7 @@ def serialize_profile_from_old_profile(p
if profile:
if write_prof_data[hat]['include'].get(include_name, False):
if not segments['include'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['include'] = True
write_prof_data[hat]['include'].pop(include_name)
data.append(line)
@@ -4286,14 +4229,7 @@ def serialize_profile_from_old_profile(p
if correct:
if not segments['netdomain'] and True in segments.values():
- for segs in list(filter(lambda x: segments[x], segments.keys())):
- depth = len(line) - len(line.lstrip())
- data += write_methods[segs](write_prof_data[name], int(depth / 2))
- segments[segs] = False
- if write_prof_data[name]['allow'].get(segs, False):
- write_prof_data[name]['allow'].pop(segs)
- if write_prof_data[name]['deny'].get(segs, False):
- write_prof_data[name]['deny'].pop(segs)
+ data += write_prior_segments(write_prof_data[name], segments, line)
segments['netdomain'] = True
elif RE_PROFILE_CHANGE_HAT.search(line):
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
