2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-29 05:17:59 +00:00

1892 Commits

Author SHA1 Message Date
Steve Beattie
2fed7cdb61 Adjust the python setup to actually match what swig expects so it will work 2011-02-23 23:34:36 -08:00
Steve Beattie
cd97402779 Update project info in libapparmor's setup.py.in. 2011-02-23 21:10:20 -08:00
Steve Beattie
ca4906c0a3 Fix list email typo 2011-02-23 15:57:36 -08:00
Steve Beattie
a28e39cd06 Prep for 2.6.0 release 2011-02-23 15:55:03 -08:00
Steve Beattie
3768096308 Fix compilation errors that slipped in. Yes, I realize this breaks the
one translation string that was intended for regexp.y, sorry.
2011-02-23 14:40:07 -08:00
Steve Beattie
3dde3d5322 libraries/libapparmor/: more license cleanups, adjust my email address
in the AUTHORS file.
2011-02-23 14:02:45 -08:00
John Johansen
9df0a29e9e Update the copyright message in apparmor_parser --version 2011-02-22 14:58:49 -08:00
Jamie Strandboge
da1e958eb9 parser/rc.apparmor.functions: Don't unload libvirt's dynamic profiles on
reload. For now just special-case libvirt's profiles. If more applications
use dynamic profiles, this should be generalized in some way to flag profiles
as dynamic. (LP: #702774)
2011-02-22 16:24:29 -06:00
John Johansen
52ca88141a Fix previously committed translation patch that didn't correctly add the
new apparmor-parser.pot file
2011-02-22 11:36:14 -08:00
Jamie Strandboge
4cd73b7a93 parser/rc.apparmor.functions: Don't unload libvirt's dynamic profiles on
reload. For now just special-case libvirt's profiles. If more applications
use dynamic profiles, this should be generalized in some way to flag profiles
as dynamic. (LP: #702774)
2011-02-22 11:29:33 -06:00
Jamie Strandboge
fb188972dc parser/rc.apparmor.functions: Don't unload libvirt's dynamic profiles on
reload. For now just special-case libvirt's profiles. If more applications
 use dynamic profiles, this should be generalized in some way to flag profiles
 as dynamic.
2011-02-22 11:14:34 -06:00
John Johansen
6e6b57fbd1 Sync apparmor.vim to the latest version from Christian Boltz
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:57:37 -08:00
John Johansen
ee0d5b7d50 Update documentation for change_hatv, change_hat_varags and change_onexec
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:55:53 -08:00
John Johansen
6d62a3634e Update change_hatv and change_hat_vargs prototypes to use long
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:55:16 -08:00
John Johansen
54fd453d35 Update swig to export all current interface fns
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:54:35 -08:00
John Johansen
18537e6c38 Rename change_hat.c to kernel_interface.c
Rename change_hat.c to kernel_interface.c to better reflect that it
is providing multiple kernel_interfaces.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:53:39 -08:00
John Johansen
7e78ee6363 Update licencing in libapparmor
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:51:16 -08:00
John Johansen
d788969c25 Update apparmor_parser translation files
The apparmor_parser translation files where using the old subdomain_parser
domain, but the parser was binding to apparmor-parser.  Create a new
apparmor-parser.pot file and remove the subdomain_parser.pot file.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:48:03 -08:00
John Johansen
db70a37621 Update x conflict failure message
Output a better failure message when a conflict of x permissions cause
policy compilation to fail.  We don't have enough information available
to output which rules during the dfa compilation so just improve the
message to let people know that it means there are conflicting x modifiers
in the rules.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-02-22 03:47:03 -08:00
Steve Beattie
b8be715227 Remove deprecated kernel patches, no longer needed as the kernel
portion of apparmor has gone upstream. These patches had already been
dropped from the 2.5.x tree.

The compatibility kernel patches are still provided.
2011-02-18 10:42:08 -08:00
Steve Beattie
24a47e2faa Update version to prepare for impending 2.6.0 release. v2.6.0-rc1 2011-02-16 10:38:28 -08:00
Steve Beattie
c56ec9eea7 top-level Makefile:
- adjust snapshot versioning to be less than the upcoming version yet
  still embed the bzr repo version
2011-02-16 09:41:14 -08:00
Steve Beattie
a39d6e36e8 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: Inherit flags in sub-profiles when generating profiles
References: bnc#496204

 When creating profiles with cx subprofiles, genprof will set the
 sub-profile in enforce mode. When genprof cycles multiple times, it
 prohibits the sub-profile from working correctly.

 e.g.

 # Last Modified: Mon Jan 24 13:52:26 2011
 #include <tunables/global>

 /home/jeffm/mycat flags=(complain) {
   #include <abstractions/base>
   #include <abstractions/bash>
   #include <abstractions/consoles>

   /bin/bash ix,
   /bin/cat cx,
   /home/jeffm/mycat r,

 profile /bin/cat {
     #include <abstractions/base>

     /bin/cat r,
     /home/jeffm/mycat r,

   }
 }

 This patch allows sub-profiles to inherit the flags from the parent
 profile, which allows it to be created in complain mode (if appropriate).
 The temporary complain flags are cleaned up at genprof completion as
 expected.

 This issue was reported at: https://bugzilla.novell.com/show_bug.cgi?id=496204

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

Bug: https://launchpad.net/bugs/707092
2011-02-15 16:26:05 -08:00
Steve Beattie
4e01f55a81 From: Jeff Mahoney <jeffm@suse.com>
Subject: Subdomain.pm: Fix for null path
References: bnc#407959

When handling the following log entry, logprof will spew perl errors and
ultimately generate an invalid config: "r,"

Since there is nothing to do with a null path, just skip to the next entry.

type=APPARMOR_DENIED msg=audit(1214497030.421:39): operation="inode_permission" info="Failed name resolution - object not a valid entry" requested_mask="r" denied_mask="r" pid=31367 profile="/usr/sbin/httpd2-worker

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-15 14:45:04 -08:00
Jamie Strandboge
6c7492af89 dd LibreOffice to ubuntu-browsers.d/productivity abstraction 2011-02-15 15:54:48 -06:00
Steve Beattie
4c8d4490cb From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor: Subdomain.pm: Fix handling of audits of unconfined processes

 The version of AppArmor that was accepted into the mainline kernel
 issues audit events for things like change_hat while unconfined.
 Previous versions just returned -EPERM without the audit.

 This results in logprof and friends spewing uninitialized value errors
 when it hits events like:
 type=AVC msg=audit(1291742101.899:220): apparmor="DENIED" operation="change_hat" info="unconfined" error=-1 pid=28005 comm="cron

 ... which happen any time an unconfined process does something with pam
 when pam_apparmor is installed.

 This patch skips those events.

[Note that the second half of the OpenSUSE patch had already been applied.]

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-15 11:16:28 -08:00
Steve Beattie
5a56604f99 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor: Fix incorrect /proc/*/sys usage in usr.sbin.ntpd
References: bnc#634801

 /proc/sys/kernel exists, but /proc/*/sys/kernel doesn't. This patch
 fixes the profile.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-15 10:54:30 -08:00
Steve Beattie
f471bc4018 Author: Jamie Strandboge <jamie@canonical.com>
Description: the Ubuntu buildds do not have the AppArmor securityfs mounted, so
the cache tests fail. This patch skips these tests if the introspection
directory is not mounted, but runs them if it is. This should allow testing of
local builds while still allowing builds on the official buildds.

Acked-By: Steve Beattie <sbeattie@ubuntu.com> - both Ubuntu and
OpenSUSE were carrying patches that disabled the caching test,
though OpenSUSE's disabled it completely rather than checking. The
parser builds need to complete even when the kernel it's building on
doesn't support AppArmor or all the extensions that the parser needs
at runtime.
2011-02-15 10:41:29 -08:00
Steve Beattie
596cba37e8 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-docs: Fix grammar error in techdoc.pdf
References: bnc#588235

This patch fixes a grammar error in techdoc.pdf.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-09 14:29:05 -08:00
Steve Beattie
3c8538c0c6 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: Translation unification
References: bnc#586072

 This patch removes small inconsistencies between identical strings to
 allow for easier translation.

Reported-by: Isis Binder <isis.binder@gmail.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-08 16:29:59 -08:00
Steve Beattie
4df8c4c09c Purge utils/severity.pl due to incorrect license/copyright statement. It
should have been covered under both the Immunix acquisition by Novell
Inc and by the open sourcing of the apparmor tree by Novell Inc.
2011-02-08 15:50:51 -08:00
Steve Beattie
bf9a559dcc From: Jeff Mahoney <jeffm@suse.com>
Subject: [PATCH] apparmor-utils: cleanup after abort in genprof
References: bnc#307067

 The initial generation of the base profile is required to be written out
 to put the process in complain mode for observation. If the user
 decides to abort the profiling session, that base profile is left
 behind.

 This patch removes all profiles created during the run up to an abort.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
2011-02-08 14:50:43 -08:00
Steve Beattie
974d0a33b0 Remove obsolete rc.sd-event-dispatch.suse; was replaced by not nearly
but almost as obsolete aa-eventd and controlled by the main apparmor
initscript.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-02-08 14:21:51 -08:00
Steve Beattie
b5cd93aa2f Purge deprecated gnome apparmor applet, aa-notify is the preferred
notification mechanism nowadays.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-02-08 14:18:39 -08:00
Steve Beattie
ef2fa2c895 From: Jeff Mahoney <jeffm@suse.com>
utils/Immunix/Reports.pm: s/SubDomain/AppArmor/ in header comment
2011-02-08 13:58:52 -08:00
Steve Beattie
4ff5b80ee8 From: Jeff Mahoney <jeffm@suse.com>
Fix compilation in deprecated gnome apparmor applet.
2011-02-08 12:52:26 -08:00
Steve Beattie
fb8d5d05dc From: Jeff Mahoney <jeffm@suse.com>
utils/Makefile: abstract out the perl vendor location for distros to
override if necessary
2011-02-08 10:39:44 -08:00
Steve Beattie
cef7289d75 From: Jeff Mahoney <jeffm@suse.com>
Fix grammar in in utils UI text.
2011-02-08 10:25:05 -08:00
Steve Beattie
94dfe15b28 From: Jeff Mahoney <jeffm@suse.com>
libapparmor: remove LD_RUN_PATH from swig generated makefile as it
results in an rpath binding in the library.
2011-02-08 09:27:32 -08:00
Steve Beattie
788bdcafb9 From: Jeff Mahoney <jeffm@suse.com>
Fix up tomcat build, also use in-tree libapparmor.
2011-02-08 08:22:46 -08:00
Steve Beattie
0cfa2b2cf8 From: Jeff Mahoney <jeffm@suse.com>
Rip out a little bit of crufty old compatibility code with immunix.h and
support directly building with in-tree libapparmor.
2011-02-08 08:18:36 -08:00
Steve Beattie
37ac8ede4f From: Jeff Mahoney <jeffm@suse.com>
Subject: adjust includes for pam_apparmor to point at the intree version
of libapparmor, rather than depend on an external version to be
installed.
2011-02-08 07:21:20 -08:00
Steve Beattie
09edd269aa Makefile: make setup target work independently 2011-02-08 07:05:39 -08:00
Jamie Strandboge
61e7aac455 make aa-disable executable 2011-02-07 21:02:57 -06:00
Jamie Strandboge
bf02536fa3 Description: add aa-disable
aa-enforce and aa-complain exist to put a profile into enforce or
 complain mode respectively. The /etc/apparmor.d/disable directory
 already exists to drop files into it to disable profile load via
 apparmor_parser (and therefore via the apparmor initscript). What
 doesn't exist is aa-disable to add a file to the disable/ directory and
 unload the profile. This patch does that. This version of aa-disable is
 based on aa-complain (in fact doing a diff between aa-complain and
 aa-disable might make review easier) and works as well as aa-enforce and
 aa-complain. In other words, aa-disable has the same limitations of not
 handling the specified binary properly if the specified attachment does
 not match the path naming scheme (eg, the profile doesn't use the
 conventional path.to.binary naming scheme, globbing is used for
 attachment within the profile, etc). Also adjust documentation to
 reference aa-disable.
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-02-07 20:48:50 -06:00
Jamie Strandboge
74b2fdc52c update documentation for aa-disable 2011-02-07 17:39:54 -06:00
Jamie Strandboge
1459c9eb20 add aa-disable 2011-02-07 17:39:36 -06:00
Steve Beattie
1005bfdf7e Subject: logprof - variable definitions should not have trailing commas.
This patch fixes a logprof bug where when profiles with variable
declarations at the top level (not hidden in an include) were written
back to a file, a trailing comma was being added to the declaration
statement, which is invalid apparmor policy syntax. This patch corrects
this and no longer adds the trailing comma.
2011-02-04 21:20:58 -08:00
John Johansen
52453313c1 Update to latest version of apparmor.vim from Chritian Boltz 2011-01-26 06:43:39 -08:00
Steve Beattie
6f620e9247 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor: Fix network event parsing
References: bnc#665483

 The upstream version of AppArmor had network mediation but it was
 removed. There's a compability patch floating around that both openSUSE
 and Ubuntu have applied to their kernels. Unfortunately, one part was
 overlooked. The socket operation event names where changed from the
 socket_ prefixed names they had when AppArmor was out-of-tree and
 utils/SubDomain.pm was never updated to understand them.

 This patch adds an operation-type table so that the code can just
 do a optype($operation) call to discover what type of operation a
 particular name refers to. It then uses this in place of the socket_
 checks to decide whether an event is a network operation.

 This allows genprof and logprof to work with networking rules again.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

Bug: https://launchpad.net/bugs/706733
2011-01-24 15:49:46 -08:00