Hello, On Mon, May 25, 2015 at 9:36 PM, Christian Boltz <[email protected]> wrote:
> Hello, > > this patch lets aa-audit print a warning if a profile is disabled. > > Users might expect that setting a profile into audit mode also activates > it (which shouldn't happen IMHO because the audit flag is not part of > the enforce/complain/disable triple), so we should at least tell them. > > References: https://bugs.launchpad.net/apparmor/+bug/1429448 > > > I propose this patch for trunk and 2.9. > > > [ 37-aa-audit-warn-about-disabled-profiles.diff ] > > === modified file utils/apparmor/tools.py > --- utils/apparmor/tools.py 2015-05-25 17:29:05.067517743 +0200 > +++ utils/apparmor/tools.py 2015-05-25 17:59:05.837870272 +0200 > @@ -186,6 +186,11 @@ > aaui.UI_Info(_('Removing audit mode from %s.') % > output_name) > apparmor.change_profile_flags(profile, program, 'audit', not > self.remove) > > + disable_link = '%s/disable/%s' % (apparmor.profile_dir, > os.path.basename(profile)) > + > The aa.py code uses: re.sub('^%s' % profile_dir, '%s/%s' % (profile_dir, subdir), path) to generate disable_link. I'd suggest we should change that code (which I think is probably a waste of an re.sub call) to follow the above style? or you could do vice versa. For fun a comparison of speed of the two methods[1]: Python 2.7: re=2.87s cboltz=0.56s Python 3.4: re=2.39s cboltz=1.09s + if os.path.exists(disable_link): > + aaui.UI_Info(_('\nWarning: the profile %s is disabled. > Use aa-enforce or aa-complain to enable it.') % os.path.basename(profile)) > + > Also, the message should probably tell the profile for which _program_ is disabled rather than give the filename? Giving program name would also be useful for a user who would like to run aa-complain or aa-enforce thereafter. With the warning message modified suitably. Acked-by: Kshitij Gupta <[email protected]>. Thanks. Regards, Kshitij Gupta [1]: timeit calls used for timing, cboltz- timeit.timeit("'%s/disable/%s' % (profile_dir, os.path.basename(profile))", setup="import os; profile_dir='/etc/apparmor.d';profile='/etc/apparmor.d/usr.sbin' ") re- timeit.timeit("re.sub('^%s' % profile_dir, '%s/%s' % (profile_dir, subdir), path)", setup="import re; profile_dir='/etc/apparmor.d';subdir='disable';path='/etc/apparmor.d/usr.sbin'") > self.reload_profile(profile) > > def cmd_autodep(self): > > > > Regards, > > Christian Boltz > -- > What are you doing?!? The message is over, GO AWAY! > > > -- > AppArmor mailing list > [email protected] > Modify settings or unsubscribe at: > https://lists.ubuntu.com/mailman/listinfo/apparmor >
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
