mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 22:05:27 +00:00
Code Issues Releases Wiki Activity

Merge logparser: adding support for comm in capability events

Browse Source 
In order to act on capability denials, we need to parse comm.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1294
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen
2024-08-12 22:43:55 +00:00
parent 8f7da77142 76b399310c
commit 055d0f80b5
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
utils/apparmor/logparser.py
View File

@@ -238,6 +238,8 @@ class ReadLog:
case 'io_uring': case 'io_uring':
ev['peer_profile'] = event.peer_profile ev['peer_profile'] = event.peer_profile
case 'capability':
ev['comm'] = event.comm
if not ev['time']: if not ev['time']:
ev['time'] = int(time.time()) ev['time'] = int(time.time())

1
utils/test/test-capability.py
View File

@@ -138,6 +138,7 @@ class CapabilityTest(AATest):
'active_hat': None, 'active_hat': None,
'pid': 15454, 'pid': 15454,
'task': 0, 'task': 0,
'comm': 'ping',
'attr': None, 'attr': None,
'name2': None, 'name2': None,
'name': 'net_raw', 'name': 'net_raw',