On 2015-06-19 11:05:16, Tyler Hicks wrote: > LSMs, such as AppArmor, aren't consulted when a program calls access(2). > This can result in access(2) returning 0 but a subsequent open(2) > failing. > > The aa-status utility was doing the access() -> open() sequence and we > became aware of a large number of tracebacks due to open() failing for > lack of permissions. This patch catches any IOError exceptions thrown by > open(). It continues to print the same error message as before when > access() failed but also prints that error message when AppArmor blocks > the open of the apparmorfs profiles file. > > https://launchpad.net/bugs/1466768 > > Signed-off-by: Tyler Hicks <[email protected]> > ---
Nominated for 2.9, as well.
Tyler
> utils/aa-status | 17 ++++++++++++-----
> 1 file changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/utils/aa-status b/utils/aa-status
> index 9a18285..d3dd551 100755
> --- a/utils/aa-status
> +++ b/utils/aa-status
> @@ -10,7 +10,7 @@
> #
> # ------------------------------------------------------------------
>
> -import re, os, sys
> +import re, os, sys, errno
>
> def cmd_enabled():
> '''Returns error code if AppArmor is not enabled'''
> @@ -84,15 +84,22 @@ def get_profiles():
> errormsg("apparmor filesystem is not mounted.")
> sys.exit(3)
>
> - apparmor_profiles = os.path.join(apparmorfs, "profiles")
> - if not os.access(apparmor_profiles, os.R_OK):
> - errormsg("You do not have enough privilege to read the profile set.")
> + profiles = os.path.join(apparmorfs, "profiles")
> + try:
> + f = open(profiles)
> + except IOError as e:
> + if e.errno == errno.EACCES:
> + errormsg("You do not have enough privilege to read the profile
> set.")
> + else:
> + errormsg("Could not open %s: %s" % (profiles,
> os.strerror(e.errno)))
> sys.exit(4)
>
> - for p in open(apparmor_profiles).readlines():
> + for p in f.readlines():
> match = re.search("^([^\(]+)\s+\((\w+)\)$", p)
> profiles[match.group(1)] = match.group(2)
>
> + f.close()
> +
> return profiles
>
> def get_processes(profiles):
> --
> 2.1.4
>
>
> --
> AppArmor mailing list
> [email protected]
> Modify settings or unsubscribe at:
> https://lists.ubuntu.com/mailman/listinfo/apparmor
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
