mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-22 01:57:43 +00:00
Code Issues Releases Wiki Activity

Ignore change_hat events with error=-1 and "unconfined can not change_hat"

Browse Source 
That's much better than crashing aa-logprof ;-)  (use the log line in
the added testcase if you want to see the crash)

Reported by pfak on IRC.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
This commit is contained in:
Christian Boltz 2017-02-23 01:00:36 +01:00
parent 633f833a6e
commit 984ed2801e
5 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
libraries/libapparmor/testsuite/test_multi/unconfined-change_hat.err Normal file
View File

1
libraries/libapparmor/testsuite/test_multi/unconfined-change_hat.in Normal file
View File

@ -0,0 +1 @@
Feb 21 23:22:01 mail-20170118 kernel: [1222198.459750] audit: type=1400 audit(1487719321.954:218): apparmor="ALLOWED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=19941 comm="apache2"

12
libraries/libapparmor/testsuite/test_multi/unconfined-change_hat.out Normal file
View File

@ -0,0 +1,12 @@
START
File: unconfined-change_hat.in
Event type: AA_RECORD_ALLOWED
Audit ID: 1487719321.954:218
Operation: change_hat
Profile: unconfined
Command: apache2
Info: unconfined can not change_hat
ErrorCode: 1
PID: 19941
Epoch: 1487719321
Audit subid: 218

2
libraries/libapparmor/testsuite/test_multi/unconfined-change_hat.profile Normal file
View File

@ -0,0 +1,2 @@
profile unconfined {
}

2
utils/apparmor/logparser.py
View File

@ -243,6 +243,8 @@ class ReadLog:
if e['operation'] == 'change_hat':
if aamode != 'HINT' and aamode != 'PERMITTING':
return None
if e['error_code'] == 1 and e['info'] == 'unconfined can not change_hat':
return None
profile = e['name2']
#hat = None
if '//' in e['name2']: