mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00
Code Issues Releases Wiki Activity

Merge libapparmor: allow parsing of logs with 0x1d + uppercase items

Browse Source 
audit.log lines on Arch have an additional FSUID="username" OUID="username",
separated from the previous part of the log line with 0x1d.

Extend the log parsing to accept 0x1d as whitespace, and to recognize
(and ignore) FSUID and OUID.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/271

Also add one of the log lines from #271 as test_multi test case.

I propose this patch for 3.0..master.

Closes #271
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/940
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
This commit is contained in:
John Johansen
2022-10-28 10:25:23 +00:00
parent fab4b4e762 e933b08bd9
commit 0d61139e2a
6 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/libapparmor/src/grammar.y
View File

@@ -159,7 +159,9 @@ aa_record_event_type lookup_aa_event(unsigned int type)
%token TOK_KEY_NAMESPACE
%token TOK_KEY_ERROR
%token TOK_KEY_FSUID
%token TOK_KEY_FSUID_UPPER
%token TOK_KEY_OUID
%token TOK_KEY_OUID_UPPER
%token TOK_KEY_UID
%token TOK_KEY_AUID
%token TOK_KEY_SAUID
@@ -351,6 +353,10 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
{ ret_record->fsuid = $3;}
| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
{ ret_record->ouid = $3;}
| TOK_KEY_FSUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
{ free($3);} /* Ignore - fsuid username */
| TOK_KEY_OUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
{ free($3);} /* Ignore - ouid username */
| TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS
{ /* Ignore - Source audit ID from user AVC messages */ }
| TOK_KEY_HOSTNAME TOK_EQUALS safe_string

6
libraries/libapparmor/src/scanner.l
View File

@@ -72,7 +72,7 @@ void string_buf_append(unsigned int length, char *text)
%}
ws [ \t\r\n]
ws [ \t\r\n\x1d]
equals "="
digit [[:digit:]]
@@ -138,7 +138,9 @@ key_sock_type "sock_type"
key_protocol "protocol"
key_error "error"
key_fsuid "fsuid"
key_fsuid_upper "FSUID"
key_ouid "ouid"
key_ouid_upper "OUID"
key_uid "uid"
key_auid "auid"
key_sauid "sauid"
@@ -324,7 +326,9 @@ yy_flex_debug = 0;
{key_protocol} { return(TOK_KEY_PROTOCOL); }
{key_error} { return(TOK_KEY_ERROR); }
{key_fsuid} { return(TOK_KEY_FSUID); }
{key_fsuid_upper} { return(TOK_KEY_FSUID_UPPER); }
{key_ouid} { return(TOK_KEY_OUID); }
{key_ouid_upper} { return(TOK_KEY_OUID_UPPER); }
{key_uid} { return(TOK_KEY_UID); }
{key_auid} { return(TOK_KEY_AUID); }
{key_sauid} { return(TOK_KEY_SAUID); }

0
libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.err Normal file
View File

1
libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.in Normal file
View File

@@ -0,0 +1 @@
type=AVC msg=audit(1661734785.992:270): apparmor="ALLOWED" operation="open" profile="/usr/bin/dolphin" name="/home/otis/.config/kdedefaults/kdeglobals" pid=3483 comm="dolphin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="otis" OUID="root"

15
libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.out Normal file
View File

@@ -0,0 +1,15 @@
START
File: 0x1d-uppercase-FSUID-OUID.in
Event type: AA_RECORD_ALLOWED
Audit ID: 1661734785.992:270
Operation: open
Mask: r
Denied Mask: r
fsuid: 1000
ouid: 0
Profile: /usr/bin/dolphin
Name: /home/otis/.config/kdedefaults/kdeglobals
Command: dolphin
PID: 3483
Epoch: 1661734785
Audit subid: 270

4
libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.profile Normal file
View File

@@ -0,0 +1,4 @@
/usr/bin/dolphin {
/home/otis/.config/kdedefaults/kdeglobals r,
}