On Thu, Jan 07, 2016 at 08:53:11PM +0100, Christian Boltz wrote: > Fortunately the fix is easy - delete the code with the special handling > for 'l' events, and the remaining code that handles other file > permissions just works :-)
> aa-logprof -f <( echo 'Jan 7 03:11:24 mail kernel: [191223.562261] > type=1400 audit(1452136284.727:344): apparmor="ALLOWED" operation="link" > profile="/usr/sbin/smbd" name="/foo" pid=10262 > comm=616D617669736420286368362D3130 requested_mask="l" denied_mask="l" > fsuid=110 ouid=110 target="/bar"') > > should ask to add '/foo l,' to the profile. This fix seems useful for now, but it'd be _ideal_ if the link operations would generate the two-argument link rules, like: link subset /foo -> /bar, So I'll ACK this but consider what might be involved in preparing the longer one.. Acked-by: Seth Arnold <[email protected]> Thanks > > > I propose this patch for trunk, 2.10 and 2.9. > > > [ 63-fix-landling-of-link-events.diff ] > > === modified file ./utils/apparmor/aa.py > --- utils/apparmor/aa.py 2016-01-07 20:20:08.794298255 +0100 > +++ utils/apparmor/aa.py 2016-01-07 20:20:39.186120312 +0100 > @@ -1218,25 +1218,7 @@ > else: > do_execute = True > > - if mode & apparmor.aamode.AA_MAY_LINK: > - regex_link = re.compile('^from (.+) to (.+)$') > - match = regex_link.search(detail) > - if match: > - path = match.groups()[0] > - target = match.groups()[1] > - > - frommode = str_to_mode('lr') > - if prelog[aamode][profile][hat]['path'].get(path, > False): > - frommode |= > prelog[aamode][profile][hat]['path'][path] > - prelog[aamode][profile][hat]['path'][path] = frommode > - > - tomode = str_to_mode('lr') > - if prelog[aamode][profile][hat]['path'].get(target, > False): > - tomode |= > prelog[aamode][profile][hat]['path'][target] > - prelog[aamode][profile][hat]['path'][target] = tomode > - else: > - continue > - elif mode: > + if mode: > path = detail > > if prelog[aamode][profile][hat]['path'].get(path, False): >
signature.asc
Description: Digital signature
-- AppArmor mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
