mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 22:35:35 +00:00
Code Issues Releases Wiki Activity

disable downgrade and not enforced rule messages by default

Browse Source 
Currently the apparmor parser warns about rules that are not enforced or
downgraded. This is a problem for distros that are not carrying the out of
tree kernel patches, as most profile loads result in warnings.

Change the behavior to not output a message unless a warn flag is passed.
This patch adds 2 different warn flags
  --warn rule-downgraded    	 # warn if a rule is downgraded
  --warn rule-not-enforced	   # warn if a rule is not enforced at all

If the warnings are desired by default the flags can be set in the
parser.conf file.

v2 of patch
- update man page
- add --warn to usage statement
- make --quiet clear warn flags

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
This commit is contained in:
John Johansen
2014-10-08 13:20:20 -07:00
parent dc9474fe5a
commit c2b8a72317
10 changed files with 55 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
parser/apparmor_parser.pod
View File

@@ -239,6 +239,16 @@ Do not report on the profiles as they are loaded, and not show warnings.
Report on the profiles as they are loaded, and show warnings.
=item --warn=n
Enable various warnings during policy compilation. A single dump flag
can be specified per --warn option, but the --warn flag can be passed
multiple times.
apparmor_parser --warn=rules-not-enforced ...
Use --help=warn to see a full list of which warn flags are supported.
=item -d, --debug
Given once, only checks the profiles to ensure syntactic correctness.