mir/apparmor
2
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 14:25:52 +00:00
Code Issues Releases Wiki Activity

ask_exec(): no longer skip exec events in hats

Browse Source 
Instead of ignoring all exec events that happen in a hat/child profile,
only disallow child exec. ix and px are valid options inside a hat and
are now offered to the user.

(When the tools support nested child profiles one day, we can even allow
child exec again.)
This commit is contained in:
Christian Boltz
2023-12-28 23:12:10 +01:00
parent f10e106a08
commit dfb6f90aee
1 changed files with 4 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
utils/apparmor/aa.py
View File

@@ -822,13 +822,6 @@ def ask_exec(hashlog):
for aamode in hashlog:
for full_profile in hashlog[aamode]:
if '//' in hashlog[aamode][full_profile]['final_name'] and hashlog[aamode][full_profile]['exec'].keys():
# TODO: is this really needed? Or would removing Cx from the options be good enough?
aaui.UI_Important(
'WARNING: Ignoring exec event in %s, nested profiles are not supported yet.'
% hashlog[aamode][full_profile]['final_name'])
continue
profile, hat = split_name(full_profile) # XXX temporary solution to avoid breaking the existing code
for exec_target in hashlog[aamode][full_profile]['exec']:
@@ -858,8 +851,10 @@ def ask_exec(hashlog):
# if exec_target == profile:
# options = 'i'
# Don't allow hats to cx?
options.replace('c', '')
# Don't allow hats to cx (nested profiles not supported by aa-logprof yet)
if '//' in hashlog[aamode][full_profile]['final_name'] and hashlog[aamode][full_profile]['exec'].keys():
options = options.replace('c', '')
# Add deny to options
options += 'd'
# Define the default option