Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread John Johansen
On 05/10/2013 10:22 AM, Jamie Strandboge wrote: > On 05/10/2013 11:42 AM, John Johansen wrote: >> On 05/10/2013 08:24 AM, Jamie Strandboge wrote: >>> On 05/10/2013 09:45 AM, Jamie Strandboge wrote: > > ... > >>> Well, arguably the most consistent would be tweaking Steve's grouping >>> slightly to

Re: [apparmor] dbus/pair address rule encoding (grouping via parens)

2013-05-10 Thread Steve Beattie
On Fri, May 10, 2013 at 12:27:44AM -0700, John Johansen wrote: > On 05/09/2013 05:06 PM, Steve Beattie wrote: > > Alternatively, you could use some grouping, a la: > > > > profile SubjectA { > > > > dbus bus=session name=SubjectA.service acquire, > > dbus bus=session name=SubjectA.service met

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread Jamie Strandboge
On 05/10/2013 11:42 AM, John Johansen wrote: > On 05/10/2013 08:24 AM, Jamie Strandboge wrote: >> On 05/10/2013 09:45 AM, Jamie Strandboge wrote: ... >> Well, arguably the most consistent would be tweaking Steve's grouping >> slightly to have a rule like this (my previous "I don't want commas for

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread John Johansen
On 05/10/2013 08:24 AM, Jamie Strandboge wrote: > On 05/10/2013 09:45 AM, Jamie Strandboge wrote: << snip >> >> Another option that retains the spirit of the multi-valued set (note the >> commas within peer()) is: >> >> dbus peer (name=a.peer.address, interface=a.peer.interface) send, >> net

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread John Johansen
On 05/10/2013 07:45 AM, Jamie Strandboge wrote: > On 05/10/2013 02:27 AM, John Johansen wrote: >> On 05/09/2013 05:06 PM, Steve Beattie wrote: >>> On Thu, May 09, 2013 at 02:41:19PM -0700, John Johansen wrote: > >>> I don't mind Jamie's proposed syntax above, I don't really care for >>> "(send, re

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread Jamie Strandboge
On 05/10/2013 09:45 AM, Jamie Strandboge wrote: > On 05/10/2013 02:27 AM, John Johansen wrote: >> On 05/09/2013 05:06 PM, Steve Beattie wrote: >>> On Thu, May 09, 2013 at 02:41:19PM -0700, John Johansen wrote: > >>> I don't mind Jamie's proposed syntax above, I don't really care for >>> "(send, re

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread Jamie Strandboge
On 05/10/2013 02:27 AM, John Johansen wrote: > On 05/09/2013 05:06 PM, Steve Beattie wrote: >> On Thu, May 09, 2013 at 02:41:19PM -0700, John Johansen wrote: >> I don't mind Jamie's proposed syntax above, I don't really care for >> "(send, receive)" first, because having the dbus or network identi

Re: [apparmor] dbus/pair address rule encoding

2013-05-10 Thread John Johansen
On 05/09/2013 05:06 PM, Steve Beattie wrote: > On Thu, May 09, 2013 at 02:41:19PM -0700, John Johansen wrote: >> On 05/09/2013 02:12 PM, Jamie Strandboge wrote: >>> Perhaps the problem is that the mixture of optional clauses in the >>> syntax which makes the placement of access rules awkward. Ie, w

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Steve Beattie
On Thu, May 09, 2013 at 02:41:19PM -0700, John Johansen wrote: > On 05/09/2013 02:12 PM, Jamie Strandboge wrote: > > Perhaps the problem is that the mixture of optional clauses in the > > syntax which makes the placement of access rules awkward. Ie, we always > > must have: > > > > dbus , > > >

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Seth Arnold
On Thu, May 09, 2013 at 03:27:24PM -0700, Tyler Hicks wrote: > > dbus [address spec] acquire, # unchanged > > dbus [address spec] -> [address spec], # unidirectional > > dbus [address spec] <- [address spec], # unidirectional > > dbus [address spec] <-> [address spec], # bidirectional > I'm all

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 03:15 PM, Seth Arnold wrote: > On Thu, May 09, 2013 at 03:08:35PM -0700, John Johansen wrote: >> it depends how you look at it. To me it is changing the meaning of -> >> of course I am now convinced that -> is just wrong and we need different >> syntax, because -> just seems to have t

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 15:15:50, Seth Arnold wrote: > On Thu, May 09, 2013 at 03:08:35PM -0700, John Johansen wrote: > > it depends how you look at it. To me it is changing the meaning of -> > > of course I am now convinced that -> is just wrong and we need different > > syntax, because -> just seems to hav

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 15:08:35, John Johansen wrote: > On 05/09/2013 02:59 PM, Tyler Hicks wrote: > > On 2013-05-09 14:51:38, John Johansen wrote: > >> On 05/09/2013 02:39 PM, Tyler Hicks wrote: > >>> On 2013-05-09 14:30:32, John Johansen wrote: > On 05/09/2013 02:13 PM, Tyler Hicks wrote: > > On

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Seth Arnold
On Thu, May 09, 2013 at 03:08:35PM -0700, John Johansen wrote: > it depends how you look at it. To me it is changing the meaning of -> > of course I am now convinced that -> is just wrong and we need different > syntax, because -> just seems to have too many potential different > interpretations th

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:59 PM, Tyler Hicks wrote: > On 2013-05-09 14:51:38, John Johansen wrote: >> On 05/09/2013 02:39 PM, Tyler Hicks wrote: >>> On 2013-05-09 14:30:32, John Johansen wrote: On 05/09/2013 02:13 PM, Tyler Hicks wrote: > On 2013-05-09 14:04:20, Seth Arnold wrote: >> On Thu, Ma

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 14:51:38, John Johansen wrote: > On 05/09/2013 02:39 PM, Tyler Hicks wrote: > > On 2013-05-09 14:30:32, John Johansen wrote: > >> On 05/09/2013 02:13 PM, Tyler Hicks wrote: > >>> On 2013-05-09 14:04:20, Seth Arnold wrote: > On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wr

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 16:37:06, Jamie Strandboge wrote: > On 05/09/2013 04:13 PM, Tyler Hicks wrote: > > > Take this rule for example: > > > > dbus bus=session -> name=com.example.service path=/com/example/service > > interface=com.example.service receive, > > > > If we adjust our thinking a little i

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:39 PM, Tyler Hicks wrote: > On 2013-05-09 14:30:32, John Johansen wrote: >> On 05/09/2013 02:13 PM, Tyler Hicks wrote: >>> On 2013-05-09 14:04:20, Seth Arnold wrote: On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: > I think that we're mostly ok. We just need t

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 04:41 PM, John Johansen wrote: > On 05/09/2013 02:12 PM, Jamie Strandboge wrote: >> Since *always* applies to , maybe it makes sense to >> have it be next to it. Ie: >> >> dbus [] [], >> >> such that: >> >> profile subject { >> dbus name=well.known.address acquire, >> dbus na

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:26 PM, Jamie Strandboge wrote: > On 05/09/2013 04:12 PM, Jamie Strandboge wrote: > >> Since *always* applies to , maybe it makes sense to >> have it be next to it. Ie: >> >> dbus [] [], >> >> such that: >> >> profile subject { >> dbus name=well.known.address acquire, >> db

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:12 PM, Jamie Strandboge wrote: > On 05/09/2013 03:35 PM, John Johansen wrote: >> On 05/09/2013 01:20 PM, Jamie Strandboge wrote: >>> On 05/09/2013 02:41 PM, John Johansen wrote: Lets look at it as local (subject) address and remote/peer address profile subject {

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 14:30:32, John Johansen wrote: > On 05/09/2013 02:13 PM, Tyler Hicks wrote: > > On 2013-05-09 14:04:20, Seth Arnold wrote: > >> On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: > >>> I think that we're mostly ok. We just need to think about it a little > >>> differently. H

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 04:13 PM, Tyler Hicks wrote: > Take this rule for example: > > dbus bus=session -> name=com.example.service path=/com/example/service > interface=com.example.service receive, > > If we adjust our thinking a little it could mean, "a message that flows > FROM anywhere TO com.examp

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 04:12 PM, Jamie Strandboge wrote: > On 05/09/2013 03:35 PM, John Johansen wrote: >> On 05/09/2013 01:20 PM, Jamie Strandboge wrote: >>> On 05/09/2013 02:41 PM, John Johansen wrote: Lets look at it as local (subject) address and remote/peer address profile subject {

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:13 PM, Tyler Hicks wrote: > On 2013-05-09 14:04:20, Seth Arnold wrote: >> On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: >>> I think that we're mostly ok. We just need to think about it a little >>> differently. Here's the current syntax: >>> >>> DBUS RULE = [ 'audit'

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 02:04 PM, Seth Arnold wrote: > On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: >> I think that we're mostly ok. We just need to think about it a little >> differently. Here's the current syntax: >> >> DBUS RULE = [ 'audit' ] [ 'deny' ] 'dbus' [ DBUS BUS ] [ ( DBUS LOCAL

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 04:12 PM, Jamie Strandboge wrote: > Since *always* applies to , maybe it makes sense to > have it be next to it. Ie: > > dbus [] [], > > such that: > > profile subject { > dbus name=well.known.address acquire, > dbus name=well.known.address receive, > dbus send -> name=a

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 14:04:20, Seth Arnold wrote: > On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: > > I think that we're mostly ok. We just need to think about it a little > > differently. Here's the current syntax: > > > > DBUS RULE = [ 'audit' ] [ 'deny' ] 'dbus' [ DBUS BUS ] [ ( DBUS LO

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 03:35 PM, John Johansen wrote: > On 05/09/2013 01:20 PM, Jamie Strandboge wrote: >> On 05/09/2013 02:41 PM, John Johansen wrote: >>> >>> Lets look at it as local (subject) address and remote/peer address >>> >>> profile subject { >>> >>> dbus name=well.known.address acquire, >>> >>>

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 01:45 PM, Tyler Hicks wrote: > On 2013-05-09 13:35:11, John Johansen wrote: >> On 05/09/2013 01:20 PM, Jamie Strandboge wrote: >>> On 05/09/2013 02:41 PM, John Johansen wrote: Lets look at it as local (subject) address and remote/peer address profile subject {

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Seth Arnold
On Thu, May 09, 2013 at 01:45:04PM -0700, Tyler Hicks wrote: > I think that we're mostly ok. We just need to think about it a little > differently. Here's the current syntax: > > DBUS RULE = [ 'audit' ] [ 'deny' ] 'dbus' [ DBUS BUS ] [ ( DBUS LOCAL > CONDITIONS | -> DBUS REMOTE CONDITIONS ) ] [

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 13:37:00, John Johansen wrote: > On 05/09/2013 01:32 PM, Tyler Hicks wrote: > > On 2013-05-09 15:20:56, Jamie Strandboge wrote: > >> On 05/09/2013 02:41 PM, John Johansen wrote: > >>> > >>> Lets look at it as local (subject) address and remote/peer address > >>> > >>> profile subject

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 13:35:11, John Johansen wrote: > On 05/09/2013 01:20 PM, Jamie Strandboge wrote: > > On 05/09/2013 02:41 PM, John Johansen wrote: > >> > >> Lets look at it as local (subject) address and remote/peer address > >> > >> profile subject { > >> > >> dbus name=well.known.address acquire,

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 01:32 PM, Tyler Hicks wrote: > On 2013-05-09 15:20:56, Jamie Strandboge wrote: >> On 05/09/2013 02:41 PM, John Johansen wrote: >>> >>> Lets look at it as local (subject) address and remote/peer address >>> >>> profile subject { >>> >>> dbus name=well.known.address acquire, >>> >>>

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 01:20 PM, Jamie Strandboge wrote: > On 05/09/2013 02:41 PM, John Johansen wrote: >> >> Lets look at it as local (subject) address and remote/peer address >> >> profile subject { >> >> dbus name=well.known.address acquire, >> >> dbus name=well.known.address receive, #subject can r

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Tyler Hicks
On 2013-05-09 15:20:56, Jamie Strandboge wrote: > On 05/09/2013 02:41 PM, John Johansen wrote: > > > > Lets look at it as local (subject) address and remote/peer address > > > > profile subject { > > > > dbus name=well.known.address acquire, > > > > dbus name=well.known.address receive, #s

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Jamie Strandboge
On 05/09/2013 02:41 PM, John Johansen wrote: > > Lets look at it as local (subject) address and remote/peer address > > profile subject { > > dbus name=well.known.address acquire, > > dbus name=well.known.address receive, #subject can receive messages on > this well.known.address > > d

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 12:18 PM, Christian Boltz wrote: > Hello, > > Am Donnerstag, 9. Mai 2013 schrieb John Johansen: >> On 05/09/2013 07:16 AM, Christian Boltz wrote: >>> Could we just switch it to the way that is also used for send? >>> I'd propose >>> >>> dbus name=sender.com -> name=receiver.com r

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Christian Boltz
Hello, Am Donnerstag, 9. Mai 2013 schrieb John Johansen: > On 05/09/2013 07:16 AM, Christian Boltz wrote: > > Could we just switch it to the way that is also used for send? > > I'd propose > > > > dbus name=sender.com -> name=receiver.com receive, > > > > Advantages are: > > - we can keep th

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread John Johansen
On 05/09/2013 07:16 AM, Christian Boltz wrote: > Hello, > > Am Mittwoch, 8. Mai 2013 schrieb John Johansen: >> On 05/08/2013 05:23 PM, Tyler Hicks wrote: >>> On 2013-05-08 14:43:59, John Johansen wrote: >>> The arrow notation make sense in this example, but I just realized >>> how confusing it is

Re: [apparmor] dbus/pair address rule encoding

2013-05-09 Thread Christian Boltz
Hello, Am Mittwoch, 8. Mai 2013 schrieb John Johansen: > On 05/08/2013 05:23 PM, Tyler Hicks wrote: > > On 2013-05-08 14:43:59, John Johansen wrote: > > The arrow notation make sense in this example, but I just realized > > how confusing it is if we need to specify the receive permission > > inste

Re: [apparmor] dbus/pair address rule encoding

2013-05-08 Thread John Johansen
On 05/08/2013 05:23 PM, Tyler Hicks wrote: > On 2013-05-08 14:43:59, John Johansen wrote: >> One of the decisions made last week while several us met at a sprint. Was >> to change the dbus prototype syntax slightly to make it follow the same >> general format of the proposed network/ipc rules. >> >

Re: [apparmor] dbus/pair address rule encoding

2013-05-08 Thread Tyler Hicks
On 2013-05-08 14:43:59, John Johansen wrote: > One of the decisions made last week while several us met at a sprint. Was > to change the dbus prototype syntax slightly to make it follow the same > general format of the proposed network/ipc rules. > > Currently this is just a syntactic change, no n

[apparmor] dbus/pair address rule encoding

2013-05-08 Thread John Johansen
One of the decisions made last week while several us met at a sprint. Was to change the dbus prototype syntax slightly to make it follow the same general format of the proposed network/ipc rules. Currently this is just a syntactic change, no new functionality is being added at this time. The chan