mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-30 05:47:59 +00:00
Code Issues Releases Wiki Activity

Regression testsuite: move the generation of the rules that grant

Browse Source 
write access to /proc/*/attr/current to mkprofile.pl from prologue.inc.

Signed-Off-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Steve Beattie 2012-01-12 11:39:57 +01:00
parent 62a7934ea6
commit a0fbc1f26c
2 changed files with 8 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tests/regression/apparmor/mkprofile.pl
View File

@ -32,7 +32,7 @@ sub usage {
print STDERR " help: print this message\n";
}
&usage && exit 0 if ($help || @ARGV < 1);
&usage && exit 0 if ($help || @ARGV < 1);
sub emit_netdomain {
my $rule = shift;
@ -95,13 +95,17 @@ sub emit_hat {
(!$nowarn) && print STDERR "Warning: invalid hat description '$rule', ignored\n";
} else {
$hat = $rules[1];
$output_rules{$hat} = ( );
# give every profile/hat access to change_hat
@{$output_rules{$hat}} = ( " /proc/*/attr/current w,\n",);
}
}
my $bin = shift @ARGV;
!(-e $bin || $nowarn) && print STDERR "Warning: execname '$bin': no such file or directory\n";
# give every profile/hat access to change_hat
emit_file("/proc/*/attr/current:w");
for my $rule (@ARGV) {
#($fn, @rules) = split (/:/, $rule);
if ($rule =~ /^(tcp|udp)/) {

13
tests/regression/apparmor/prologue.inc
View File

@ -433,9 +433,7 @@ fi
;;
esac
#give every profile/hat access to change_hat
args[0]="/proc/*/attr/current:w"
num_args=1
num_args=0
while [ $# -gt 0 ]
do
arg="$1"
@ -447,15 +445,8 @@ fi
eval emit_profile \"$imagename\" \"$imageperm\" \
$(for i in $(seq 0 $((${num_args} - 1))) ; do echo \"\${args[${i}]}\" ; done)
num_emitted=$((num_emitted + 1))
#give every profile/hat access to change_hat
args[0]="/proc/*/attr/current:w"
num_args=1
num_args=0
continue 2
elif [ ${arg:0:4} == "hat:" ] ; then
args[${num_args}]=${arg}
num_args=$(($num_args + 1))
args[${num_args}]="/proc/*/attr/current:w"
num_args=$(($num_args + 1))
else
args[${num_args}]=${arg}
num_args=$(($num_args + 1))