On 02/27/2015 09:11 AM, Tyler Hicks wrote: > On 2015-02-27 11:08:28, Tyler Hicks wrote: >> On 2015-01-27 10:11:48, John Johansen wrote: >>> On 01/23/2015 11:39 AM, Tyler Hicks wrote: >>>> On 2015-01-23 19:44:27, Christian Boltz wrote: >>>>> Hello, >>>>> >>>>> Am Donnerstag, 22. Januar 2015 schrieb Steve Beattie: >>>>>> On Thu, Jan 22, 2015 at 04:23:00PM -0600, Tyler Hicks wrote: >>>>>>> We don't know what a program linking to libapparmor will do with >>>>>>> stdout/stderr so I don't know if debug logging to those streams is >>>>>>> helpful. >>>>> >>>>> stderr doesn't sound too bad, but might be lost in some situations (like >>>>> starting a program via its desktop icon) >>>>> >>>>>>> Maybe in the near future we could add a debug build option to >>>>>>> libapparmor and have it support an env variable that specifies a >>>>>>> file >>>>>>> path to open and log debug messages to? >>>>>> >>>>>> That would be a very nice improvement indeed. >>>>> >>>>> Would it also be a secure improvement? ;-) >>>>> >>>>> Basically that feature would allow to overwrite any file if an attacker >>>>> is able to inject an environment variable... >>>> >>>> Debug builds of programs/libraries aren't intended to be installed on >>>> production systems. Debug output from libapparmor would only be built >>>> and enabled in debug builds of libapparmor. >>>> >>> >>> So I like the idea of an environment variable, but I think the debug >>> output should (if built) dump to stderr. >>> >>> I'd also like to see a better integration of DEBUG build controls, >>> or at least documentation of the different controls and build options. >>> But of course that can come in some separate patches. >>> >>> For now I'd just like to not lose the limited debug that is in the code. >> >> I wanted to give you a quick update on what my plans are here. The code >> that is being moved from the parser to libapparmor has calls to PERROR() >> and PDEBUG(). Here's my thoughts on how to handle them in libapparmor: >> >> >> * PDEBUG() >> - Compiled out unless libapparmor is built with --enable-debug >> - Prints to stderr if libapparmor is built with --enable-debug and >> the LIBAPPARMOR_DEBUG environment variable is set > > One correction. To match the current PDEBUG() implementation in the > parser, the libapparmor PDEBUG() would need to print to stdout instead > of stderr. > stderr is the correct place, I am not sure why thate parser currently uses stdout
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
