Hello, this patch lets aa-audit print a warning if a profile is disabled.
Users might expect that setting a profile into audit mode also activates it (which shouldn't happen IMHO because the audit flag is not part of the enforce/complain/disable triple), so we should at least tell them. References: https://bugs.launchpad.net/apparmor/+bug/1429448 I propose this patch for trunk and 2.9. [ 37-aa-audit-warn-about-disabled-profiles.diff ] === modified file utils/apparmor/tools.py --- utils/apparmor/tools.py 2015-05-25 17:29:05.067517743 +0200 +++ utils/apparmor/tools.py 2015-05-25 17:59:05.837870272 +0200 @@ -186,6 +186,11 @@ aaui.UI_Info(_('Removing audit mode from %s.') % output_name) apparmor.change_profile_flags(profile, program, 'audit', not self.remove) + disable_link = '%s/disable/%s' % (apparmor.profile_dir, os.path.basename(profile)) + + if os.path.exists(disable_link): + aaui.UI_Info(_('\nWarning: the profile %s is disabled. Use aa-enforce or aa-complain to enable it.') % os.path.basename(profile)) + self.reload_profile(profile) def cmd_autodep(self): Regards, Christian Boltz -- What are you doing?!? The message is over, GO AWAY! -- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
