2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 06:16:03 +00:00

aa-status: handle profile names containing '('

aa-status crashed if a profile name contains an opening parenthesis
because the regex enforces (simplified) '^[^(]* \(.*\)' when reading
/sys/kernel/security/apparmor/profiles

This obviously doesn't match if a profile name contains '(' which is
rare and strange, but still allowed, and the match result "None" then
crashes aa-status.

Adjust the regex to allow all chars instead of all except '(' to handle
these corner cases.

Note that '(enforce)' and '(complain)' still get read correctly because
the regex ends with '\((\w+)\)$' and therefore enforces matching
"something inside parenthesis at the end of the line".

This bug exists since aa-status was rewritten into python, and even
existed in the perl version before. However, in the perl version, the
regex matching was protected with an if so profile names with '(' were
skipped and hidden from the aa-status output.

Fixes: https://gitlab.com/apparmor/apparmor/issues/51
This commit is contained in:
Christian Boltz
2019-08-16 22:10:36 +02:00
parent 2e304f82fc
commit 41d26b0197

View File

@@ -148,7 +148,7 @@ def get_profiles():
sys.exit(4)
for p in f.readlines():
match = re.search("^([^\(]+)\s+\((\w+)\)$", p)
match = re.search("^(.+)\s+\((\w+)\)$", p)
profiles[match.group(1)] = match.group(2)
f.close()