mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 22:05:27 +00:00
Code Issues Releases Wiki Activity

Merge Avoid aa-notify crash on log events without operation=

Browse Source 
Some STATUS log events trigger a crash in aa-notify because the log
line doesn't have operation=. Examples are:

    type=AVC msg=audit(1630913351.586:4): apparmor="STATUS" info="AppArmor Filesystem Enabled" pid=1 comm="swapper/0"

    type=AVC msg=audit(1630913352.610:6): apparmor="STATUS" info="AppArmor sha1 policy hashing enabled" pid=1 comm="swapper/0"

Fix this by not looking at log events without operation=

Also add one of the example events as libapparmor testcase.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/194
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/797
Acked-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit c37586cd11)
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
2021-09-13 23:02:15 +00:00
committed by John Johansen
parent 06dc32a9f3
commit 37f5326d0e
4 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.err Normal file
View File

1
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.in Normal file
View File

@@ -0,0 +1 @@
audit.log:type=AVC msg=audit(1630913351.586:4): apparmor="STATUS" info="AppArmor Filesystem Enabled" pid=1 comm="swapper/0"

3
libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.out Normal file
View File

@@ -0,0 +1,3 @@
START
File: status-filesystem-enabled.in
Event type: AA_RECORD_INVALID

2
utils/aa-notify
View File

@@ -324,7 +324,7 @@ def parse_logdata(logsource):
event = LibAppArmor.parse_record(entry)
# Only show actual events of contained programs and ignore among
# others AppArmor profile reloads
if event.operation[0:8] != 'profile_':
if event.operation and event.operation[0:8] != 'profile_':
yield event