From 232b51504cbdff20c0a3abc8b54f2df0c23b3d86 Mon Sep 17 00:00:00 2001 From: Christian Boltz Date: Tue, 3 Mar 2015 12:34:47 +0100 Subject: [PATCH] let logparser.py parse_event() change disconnected path events to 'ERROR' This means that aa-logprof will ignore the event instead of crashing with AppArmorException: 'Unexpected rank input: var/run/nscd/passwd' Note that I made the check as specific as possible to be sure it doesn't hide other events. References: https://bugzilla.opensuse.org/show_bug.cgi?id=918787 Acked-by: Steve Beattie for 2.9 (This is a backport of trunk r2877, but without the test-capability.py adjustment because that file doesn't exist in 2.9) --- utils/apparmor/logparser.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/utils/apparmor/logparser.py b/utils/apparmor/logparser.py index b0223d755..37bb27113 100644 --- a/utils/apparmor/logparser.py +++ b/utils/apparmor/logparser.py @@ -111,6 +111,7 @@ class ReadLog: ev['pid'] = event.pid ev['task'] = event.task ev['info'] = event.info + ev['error_code'] = event.error_code dmask = event.denied_mask rmask = event.requested_mask ev['magic_token'] = event.magic_token @@ -162,6 +163,11 @@ class ReadLog: except KeyError: ev['aamode'] = None + # "translate" disconnected paths to errors, which means the event will be ignored. + # XXX Ideally we should propose to add the attach_disconnected flag to the profile + if ev['error_code'] == 13 and ev['info'] == 'Failed name lookup - disconnected path': + ev['aamode'] = 'ERROR' + if ev['aamode']: #debug_logger.debug(ev) return ev