mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-31 14:25:52 +00:00
Remove pname to bin_name mapping in autodep()
If autodep() is called with a pname starting with / (which can happen for (N)amed exec depending on the user input), this pname is mapped to bin_name. This might look like a good idea, however if the given pname doesn't exist as file on-disk, autodep() returns None instead of a (mostly empty) profile. (Reproducer: choose (N)amed, enter "/foo/bar") Further down the road, this results in two things: a) the None result gets written as empty profile file (with only a "Last modified" line) b) a crash if someone chooses to add an abstraction to the None, because None doesn't support the delete_duplicates() method for obvious reasons ;-) Unfortunately this patch also introduces a regression - aa-logprof now fails to follow the exec and doesn't ask about the log events for the exec target anymore. However this doesn't really matter because of a) - asking and saving to /dev/null vs. not asking isn't a real difference ;-) Actually the patch slightly improves things - it creates a profile for the exec target, but only with the depmod() defaults (abstractions/base) and always in complain mode. I'd prefer a patch that also creates a complete profile for the exec target, but that isn't as easy as fixing the issues mentioned above and therefore is something for a future fix. To avoid we forget it, I opened https://bugs.launchpad.net/apparmor/+bug/1545155 Note: 2.9 "only" writes an empty file and doesn't crash - but writing an empty profile is still an improvement. Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
This commit is contained in:
@@ -638,8 +638,6 @@ def activate_repo_profiles(url, profiles, complain):
|
||||
def autodep(bin_name, pname=''):
|
||||
bin_full = None
|
||||
global repo_cfg
|
||||
if not bin_name and pname.startswith('/'):
|
||||
bin_name = pname
|
||||
if not repo_cfg and not cfg['repository'].get('url', False):
|
||||
repo_conf = apparmor.config.Config('shell', CONFDIR)
|
||||
repo_cfg = repo_conf.read_config('repository.conf')
|
||||
|
Reference in New Issue
Block a user