On Sun, Jun 21, 2015 at 07:30:32PM +0200, Christian Boltz wrote: > aa-logprof raises an exception if > - an include file contains a hat > - that file is included in a profile and > - aa-logprof hits an audit log entry for this profile > > Reproducer: > python3 aa-logprof -f <(echo 'Jun 19 11:50:36 piorun kernel: [4474496.458789] > audit: type=1400 audit(1434707436.696:153): apparmor="DENIED" > operation="open" profile="/usr/sbin/apache2" name="/etc/gai.conf" pid=2910 > comm="apache2" requested_mask="r" denied_mask="r" fsuid=0 ouid=0') -d > ../profiles/apparmor.d/ > > This happens because profiles/apparmor.d/apache2.d/phpsysinfo was > already read when pre-loading the include files. > > This patch changes aa.py parse_profile_data() to only raise the > exception if it is not handling includes currently. > > I'm able to reproduce this issue with trunk and 2.9 and therefore > propose this patch for both. (Interestingly, this code exists since > r0.1.38, and nobody noticed it yet...) > > [ 53-fix-logprof-for-hat-in-include.diff ]
Acked-by: Steve Beattie <[email protected]> for both trunk and 2.9. -- Steve Beattie <[email protected]> http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
