2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 14:55:10 +00:00

Compare commits

..

477 Commits

Author SHA1 Message Date
John Johansen
6e0b7ca20a parser: change priority so that it accumulates based on permissions
The current behavior of priority rules can be non-intuitive with
higher priority rules completely overriding lower priority rules even in
permissions not held in common. This behavior does have use cases but
its can be very confusing, and does not normal policy behavior

Eg.
  priority=0 allow r /**,
  priority=1 deny  w /**,

will result in no allowed permissions even though the deny rule is
only removing the w permission, beause the higher priority rule
completely over ride lower priority permissions sets (including
none shared permissions).

Instead move to tracking the priority at a per permission level. This
allows the w permission to still override at priority 1, while the
read permission is allowed at priority 0.

The final constructed state will still drop priority for the final
permission set on the state.

Note: this patch updates the equality tests for the cases where
the complete override behavior was being tested for.

The complete override behavior will be reintroduced in a future
patch with a keyword extension, enabling that behavior to be used
for ordered blocks etc.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-06 12:24:04 -08:00
John Johansen
e56dbc2084 parser: fix prefix dump to include priority
The original patch adding priority to the set of prefixes failed to
update the prefix dump to include the priority priority field.

Fixes: e3fca60d1 ("parser: add the ability to specify a priority prefix to rules")

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-06 10:54:42 -08:00
John Johansen
cc31a0da22 parser: drop priority from state permissions
The priority field is only used during state construction, and can
even prevent later optimizations like minimization. The parser already
explcitily clears the states priority field as part of the last thing
done during construction so it doesn't prevent minimization
optimizations.

This means the state priority not only wastes storage because it is
unused post construction but if used it could introduce regressions,
or other issues.

The change to the minimization tests just removes looking for the
priority field that is no longer reported.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-06 10:53:19 -08:00
John Johansen
9221d291ec parser: stop using dynamic_cast for prompt permission calculations
Like was done for the other MatchFlags switch to using a node type
instead of dynamic_cast as this will result in a performance
improvement.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-06 08:34:02 -08:00
Christian Boltz
002bf1339c Merge spread: Add support for EXPECT_DENIALS in profile tests
This commit adds support for EXPECT_DENIALS in profile tests. Any test
that sets the EXPECT_DENIALS environment variable is expected to trigger
AppArmor denials and will fail if none was generated.

This allows to test that problematic behaviors are correctly blocked.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1515
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-02-05 16:44:42 +00:00
Maxime Bélair
fc3f27e255 spread: Add support for EXPECT_DENIALS in profile tests
Introduce the EXPECT_DENIALS environment variable for profile tests.
Each line of EXPECT_DENIALS is a regex that must match an AppArmor
denial for the corresponding test, and conversely.

This ensures that problematic behaviors are correctly blocked and logged.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
2025-02-05 10:02:21 +01:00
John Johansen
4831a854fe Merge Initial profile for tar binary
Profile for `tar` package.

In order to test this, I've diffed the output of the `tar`'s testsuite with and without the profile:

```
sudo apt build-dep tar
apt source tar
cd tar-*/
./configure
cd tests/
./testsuite > without_profile.log
apparmor_parser ~/tar
./testsuite > with_profile.log
diff without_profile.log with_profile.log # should not output anything
echo $? # should be zero
```

Additionally, [the testsuite available on QRT](https://git.launchpad.net/qa-regression-testing/tree/scripts/test-tar.py) for the `tar` package should continue to pass after loading the profile.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1453
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-02-03 21:46:36 +00:00
Octavio Galland
c9cfbb4668 restrict networking to localhost 2025-02-03 16:33:13 -03:00
Octavio Galland
38399e7720 disallow ${HOME}/bin 2025-02-03 16:32:58 -03:00
John Johansen
4765bcd7bc Merge parser: misc fixes on apparmor.d man page
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1516
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-31 21:54:08 +00:00
Georgia Garcia
998ee0595e parser: misc fixes on apparmor.d man page
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-31 18:23:14 -03:00
Zygmunt Krynicki
54561af112 Merge tests/spread: fix debian system name
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1511
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-30 16:22:26 +00:00
Zygmunt Krynicki
39cd3f6f21 Merge tests: unify formatting of .gitlab-ci.yml
We had some mixture of indent styles.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1510
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-30 16:22:12 +00:00
Zygmunt Krynicki
d4582f232f tests: unify formatting of .gitlab-ci.yml
We had some mixture of indent styles.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-30 08:02:33 +01:00
Zygmunt Krynicki
8967dee5b9 tests/spread: fix debian system name
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-29 19:45:45 +01:00
John Johansen
d482aab419 Merge tests: mark more regression test as known-failures
A number of tests are failing and since spread does not contain a native
XFAIL facility, we have to maintain a silent-failure feature code
ourselves. A few of those have been fixed since the first iteration of
this patch. The remaining known failures are being fixed.

Later on I would like to separate XFAIL from SKIP so that if a test is
known to exercise kernel feature unavailable on the given system, the
test is just not executed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1483
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-29 09:05:19 +00:00
Zygmunt Krynicki
219626c503 Merge utils: adjusts aa-notify tests to handle Python 3.13+
Python 3.13 changes the formatting of long-short option pairs that use a
meta-variable. Up until 3.13 the meta-variable was repeated. Since
Python change [1] the meta-var is only printed once.

[1] https://github.com/python/cpython/pull/103372

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1495
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-28 22:24:25 +00:00
Zygmunt Krynicki
0acc138712 utils: abbreviate delta for Python 3.12 argparse
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-28 23:01:42 +01:00
Zygmunt Krynicki
6336465edf utils: adjusts aa-notify tests to handle Python 3.13+
Python 3.13 changes the formatting of long-short option pairs that use a
meta-variable. Up until 3.13 the meta-variable was repeated. Since
Python change [1] the meta-var is only printed once.

[1] https://github.com/python/cpython/pull/103372

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-28 20:49:16 +01:00
Zygmunt Krynicki
32bf95bb1e tests: exclude debian systems from toybox test
This is so that we get a baseline that passes to enable testing in CI/CD
but also to spark a discussion around what to do with a profile that
indirectly relies on a kernel feature that is not available on a given
system.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-28 14:57:32 +01:00
Zygmunt Krynicki
b0422d5572 tests: mark more regression test as known-failures
A number of tests are failing and since spread does not contain a native
XFAIL facility, we have to maintain a silent-failure feature code
ourselves. A few of those have been fixed since the first iteration of
this patch. The remaining known failures are being fixed.

Later on I would like to separate XFAIL from SKIP so that if a test is
known to exercise kernel feature unavailable on the given system, the
test is just not executed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-28 14:56:02 +01:00
Georgia Garcia
6405608442 Merge tests: add fuse-overlayfs to cloud-init
This is a dependency of the overlayfs_fuse regression test.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1509
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-28 12:10:03 +00:00
Zygmunt Krynicki
237b5c0f73 tests: add fuse-overlayfs to cloud-init
This is a dependency of the overlayfs_fuse regression test.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-28 11:28:44 +01:00
John Johansen
3b7ee81f04 Merge utils: test: account for last cmd format change in test-aa-notify
The "last" command, which was supplied by util-linux in older Ubuntu
versions, is now supplied by wtmpdb in Oracular and Plucky. Unfortunately,
this changed the output format and broke our column based parsing.

While the wtmpdb upstream has added json support at
https://github.com/thkukuk/wtmpdb/issues/20, we cannot use it because
we need to support systems that do not have this new feature added.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1508
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2025-01-27 19:55:48 +00:00
John Johansen
265a1656d1 Merge libapparmor: fixes to the SWIG bindings for SWIG 4.3 and later
Unfortunately we are affected by the backwards-incompatible change introduced by https://github.com/swig/swig/pull/2907

This MR contains fixes to keep the Python-side API the same on systems using SWIG 4.3 or later, e.g. Ubuntu Plucky.

Fixes https://gitlab.com/apparmor/apparmor/-/issues/475.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

Closes #475
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1504
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-27 19:51:20 +00:00
Georgia Garcia
5f06df3868 Merge utils: look for 'file' class when parsing logs
Since kernel commit 8c4b785a86be the class is available to check if
the log belongs to which class. This fixes cases where the logparser
is not able to distinguish between network and file operations.

This issue does not manifest previous to and including apparmor-4.0
because we did not process auditing logs then.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/478
Reported-by: vyomydv vyom.yadav@canonical.com
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

This patch should be cherry-picked to apparmor-4.1

Closes #478
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1507
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-27 19:34:25 +00:00
Georgia Garcia
af6dfe5b81 utils: look for 'file' class when parsing logs
Since kernel commit 8c4b785a86be the class is available to check if
the log belongs to which class. This fixes cases where the logparser
is not able to distinguish between network and file operations.

This issue does not manifest previous to and including apparmor-4.0
because we did not process auditing logs then.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/478
Reported-by: vyomydv vyom.yadav@canonical.com
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-27 15:43:23 -03:00
Ryan Lee
afd6aa0581 utils: test: account for last cmd format change in test-aa-notify
The "last" command, which was supplied by util-linux in older Ubuntu
versions, is now supplied by wtmpdb in Oracular and Plucky. Unfortunately,
this changed the output format and broke our column based parsing.

While the wtmpdb upstream has added json support at
https://github.com/thkukuk/wtmpdb/issues/20, we cannot use it because
we need to support systems that do not have this new feature added.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-27 10:15:45 -08:00
Octavio Galland
76647b33b1 typo in tar test 2025-01-27 10:10:29 -03:00
John Johansen
c81eacacac Merge aa-load documentation improvements
This MR includes copyediting of the `aa-load --help` text as well as a man page based on the help text.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1505
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-25 01:39:42 +00:00
Ryan Lee
ee8300545e Write a man page for aa-load based on the help text
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 16:03:20 -08:00
Ryan Lee
6592daff90 Copyedit the help text for aa-load
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 16:02:05 -08:00
Ryan Lee
3fa40935f5 Replace aa_find_mountpoint cstring_output_allocate due to $isvoid issue
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 15:00:15 -08:00
Ryan Lee
1620887463 Replace simple %append_output uses with ISVOID helpers for SWIG 4.3
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 14:59:39 -08:00
Ryan Lee
1b46ab10fd Create %append_output compatibility wrappers for SWIG 4.3
Unfortunately we are affected by the backwards-incompatible change introduced by https://github.com/swig/swig/pull/2907

These wrappers will be needed to fix tests on systems using SWIG 4.3 or later, e.g. Ubuntu Plucky.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 14:59:39 -08:00
Georgia Garcia
dfb7abf2a6 Merge Set up overlayfs_fuse test that uses a FUSE implementation of overlayfs
This also reorganizes the overlayfs tests slightly in order to maximize code reuse between the old test and the new one.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1503
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-24 20:28:57 +00:00
Ryan Lee
be38da7570 Move most file setup and creation to before the overlay mount call
kernel overlayfs propagates the changes, while fuse_overlayfs doesn't

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 09:00:28 -08:00
Ryan Lee
ed8b6cb663 Add fuse_overlayfs to apt dependency list of Gitlab CI test-build-regression
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 09:00:26 -08:00
Ryan Lee
9e05668d5a Set up an overlayfs_fuse regression test by using the other path of the overlayfs_common.inc helper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 08:59:06 -08:00
Ryan Lee
a0f551d5b7 Wire up the kernel/fuse argument switch in overlayfs_common.inc regression tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 08:59:06 -08:00
Ryan Lee
9413658277 Move overlayfs test into include helper and wrap in overlayfs_kernel
By making the test a file to be included as a helper, we can reuse most of the code for a fuse_overlayfs test without copy-pasting

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-24 08:59:06 -08:00
Octavio Galland
8efe442717 tar test fixes 2025-01-24 09:30:49 -03:00
John Johansen
dcce4bc62f Merge Upadate man apparmor.d to highlight pivot_root limitation
As pointed out by https://bugs.launchpad.net/apparmor/+bug/2087875 ,
profile transitions with pivot_root are currently not supported on any
kernel.

This commit makes this limitation more obvious to users.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1436
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>
2025-01-24 11:18:44 +00:00
Zygmunt Krynicki
4c8c4a1d77 Merge tests: unify CI/CD preparation phase
We now have GitLab CI/CD pipeline co-existing with spread, coupled with
image-garden and the cloud-init profile defined for each distribution.

To avoid duplicating list of required dependencies, re-use cloud-init
profile as the reference list of dependencies (superset between build
and test) to install.

In addition to the dependency list, the build_all job now re-uses spread
prepare section in similar fashion. If it builds in spread, it should
build in CI as well.

A small quality-of-life improvement is the shape of a collapsible
section around dependency installation should make reading job logs
easier.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1494
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-24 07:25:09 +00:00
Georgia Garcia
17a09d2987 Merge Allow overrides and preservation of some environment variables in utils make check
Our ubuntu packaging builds Python-enabled libapparmor's in the directories `libapparmor/libapparmor.python[version_identifier]`. In order for the util's `make check` to pick up on the correct libapparmor during the Ubuntu build process, we need the ability to override its search path. This patch introduces a `LIBAPPARMOR_BASEDIR` variable to allow for that.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1497
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 19:11:07 +00:00
Georgia Garcia
625a919bb8 Merge utils: test: various fixes for utils testing in Ubuntu packaging
The first patch fixes a `test-aa-notify.py` `TypeError` when `APPARMOR_NOTIFY` and `__AA_CONFDIR` are both specified, which is something that was broken all this time.

The second patch ensures that `aa-notify` in the test suite is run using the same Python interpreter that the test suite itself is run with, which is necessary for testing the utils under different Pythons.

The third patch does analogous modifications to the minitools tests that launch `aa-audit`, `aa-complain`, etc.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1498
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 19:07:00 +00:00
Ryan Lee
e32c267332 utils: test: use sys.executable when launching minitools in tests
This is analogous to the previous patch's change to the aa-notify tests.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-23 10:37:57 -08:00
Octavio Galland
7a7f88ddf3 tar spread smoke-test 2025-01-23 14:03:23 -03:00
Octavio Galland
e296d5b04c follow rule ordering convention 2025-01-23 13:50:27 -03:00
Octavio Galland
790c795f90 always execute binaries under current profile 2025-01-23 13:50:27 -03:00
Octavio Galland
ef0d5b4cde allow networking 2025-01-23 13:50:27 -03:00
Octavio Galland
667816fe43 explictly allow binaries from certain directories 2025-01-23 13:50:27 -03:00
Octavio Galland
e7807b3761 allow any program to be executed 2025-01-23 13:50:27 -03:00
Octavio Galland
29637f19c9 allow more binaries and capabilities 2025-01-23 13:50:27 -03:00
Octavio Galland
5271d6a74a Fix syntax error, use l to specify executable link 2025-01-23 13:50:27 -03:00
Octavio Galland
486c8c26fe Initial profile for tar binary 2025-01-23 13:50:27 -03:00
Georgia Garcia
c80ef6fb59 Merge tests: skip profile tests on Fedora
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1501
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 13:54:06 +00:00
Georgia Garcia
e750c6c66c Merge tests: add tool for observing the profile of a given command
Using gdb in batch mode, put a breakpoint on _start and spawn the
process.  Then using the built-in python interpreter print the
confinement label on the process and terminate everything.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1500
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 13:52:24 +00:00
Zygmunt Krynicki
065c1d67ca tests: skip profile tests on Fedora
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 14:31:42 +01:00
Zygmunt Krynicki
f98c1098b0 Merge tests: add httpd-devel and pam-devel to fedora cloud-init profile
Those are needed to build the two extension modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1499
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-23 13:07:45 +00:00
Zygmunt Krynicki
ffd38b7ac4 tests: measure toybox with actual-profile-of
This should be a more readable example to follow in other tests.  The
toybox test was special given the fact that it is a shell itself, and is
fairly programmable.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 13:53:45 +01:00
Zygmunt Krynicki
23df780544 tests: add tool for observing the profile of a given command
Using gdb in batch mode, put a breakpoint on _start and spawn the
process.  Then using the built-in python interpreter print the
confinement label on the process and terminate everything.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 13:53:45 +01:00
Zygmunt Krynicki
a2ace0d5d7 tests: add httpd-devel and pam-devel to fedora cloud-init profile
Those are needed to build the two extension modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 13:48:18 +01:00
Zygmunt Krynicki
29c618a11b tests: put logs from apt-get in a collapsed section
This is a small quality-of-life improvement when looking at CI/CD logs
on GitLab.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 12:37:10 +01:00
Zygmunt Krynicki
f01a40a77c tests: unify CI/CD preparation phase
We now have GitLab CI/CD pipeline co-existing with spread, coupled with
image-garden and the cloud-init profile defined for each distribution.

To avoid duplicating list of required dependencies, re-use cloud-init
profile as the reference list of dependencies (superset between build
and test) to install.

In addition to the dependency list, the build_all job now re-uses spread
prepare section in similar fashion. If it builds in spread, it should
build in CI as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-23 12:37:10 +01:00
Georgia Garcia
25676c4694 Merge tests: add integration test for toybox
This is something that was done interactively as a part of a training
session.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1487
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-22 20:39:15 +00:00
Ryan Lee
77cabf7dba utils: test: use sys.executable when launching aa-notify in tests
If the tests are running under a different Python, then the aa-notify bin should use the same Python

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-22 12:04:35 -08:00
Ryan Lee
3365e492a7 utils: test: test-aa-notify: Ensure aanotify_bin is always a list
os.environ returns a string, but the default value is a list, and the concatenation of __AA_CONFDIR assumes a list.
Thus, if APPARMOR_NOTIFY and __AA_CONFDIR were both specified, this would error out.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-22 11:52:38 -08:00
Ryan Lee
90143494fc Allow overrides and preservation of some environment variables in utils make check
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-22 11:10:41 -08:00
Zygmunt Krynicki
1462e1c4b0 Merge tests: enable build tests on Fedora 41
Tests that interact with the kernel are skipped (tests/regression and
tests/snapd) but everything else is green. Most of the tests are
actually passing. The only exception is the aa-notify test that was
broken by Python 3.13 stdlib change. The fix for that has been posted
separately.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1496
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-22 11:06:31 +00:00
Zygmunt Krynicki
03215f46c4 Merge tests: build PAM and apparmor modules in spread
Those fell under the radar during the initial push to expose all of
the tests to spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1493
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-22 11:06:17 +00:00
Zygmunt Krynicki
ef880d325f Merge tests: switch tumbleweed to boot with security=apparmor
The openSUSE project has decided to switch to security=selinux by
default. For the purpose of continuing to test AppArmor on the
distribution, alter the cloud-init profile to switch to booting with
security=apparmor.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1492
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-22 11:06:01 +00:00
Zygmunt Krynicki
7ce6819c53 tests: enable build tests on Fedora 41
Tests that interact with the kernel are skipped (tests/regression and
tests/snapd) but everything else is green. Most of the tests are
actually passing. The only exception is the aa-notify test that was
broken by Python 3.13 stdlib change. The fix for that has been posted
separately.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 20:59:40 +01:00
Zygmunt Krynicki
be47567d27 tests: add integration test for toybox
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 12:34:42 +01:00
Zygmunt Krynicki
2ab2c8f8a1 tests: add suite with profile tests
Hopefully more and more profiles will come with smoke tests. Since the
pattern of those tests is likely to be very similar (compile profile,
run some programs, remove profile) it will be good to check if the
profile had caused any denials to be logged. Having this at the suite
level should make writing actual tests easier.

The prepare-each and restore-each logic compile the profile, check for
errors and finally remove the profile. The debug-each logic shows the
program name (with full path).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 12:34:42 +01:00
Zygmunt Krynicki
5c17df0219 profiles: attach toybox profile to /usr/bin/toybox
This is the actual path used on Debian and derivatives.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 11:16:24 +01:00
Zygmunt Krynicki
42c8745e73 tests: build PAM and apparmor modules in spread
Those fell under the radar during the initial push to expose all of
the tests to spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 01:54:24 +01:00
Zygmunt Krynicki
2b44cc09a6 tests: switch tumbleweed to boot with security=apparmor
The openSUSE project has decided to switch to security=selinux by
default. For the purpose of continuing to test AppArmor on the
distribution, alter the cloud-init profile to switch to booting with
security=apparmor.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-21 01:52:59 +01:00
Georgia Garcia
85d57b7f06 Merge tests: pair of cleanups for the coverity job
Avoid a deprecated feature and reduce YAML complexity.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1491
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-20 18:12:56 +00:00
Zygmunt Krynicki
5abbf31ce1 tests: inline .send-to-coverity command
There is no other use of this yaml fragment in the project so inline it
for simplicity.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-20 14:11:17 +01:00
Zygmunt Krynicki
61d75a11ef tests: rewrite coverity job to avoid deprecated "only" feature
The "only" feature has been deprecated for a while. The standard
replacement is the rules:if feature.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-20 14:09:45 +01:00
Christian Boltz
817d5eed1d Merge postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/incoming/.

Similar to 3c2aae3.

Example error:

```
type=AVC msg=audit(1737094364.337:12023): apparmor="DENIED" operation="open" profile="postfix-showq" name="/var/spool/postfix/incoming/B7E4C12C784A" pid=17879 comm="showq" requested_mask="r" denied_mask="r" fsuid=91 ouid=91FSUID="postfix" OUID="postfix"
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1489
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-01-18 13:08:58 +00:00
pyllyukko
ba765e0eab postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/incoming/.

Similar to 3c2aae3.
2025-01-18 09:46:24 +02:00
Georgia Garcia
a12004f96c Merge regression tests: fix the overlayfs mv test failures
The file being moved from needs rw permissions and not just w permissions.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1488
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-17 13:09:38 +00:00
Ryan Lee
63c944a01a regression tests: fix the overlayfs mv test failures
The file being moved from needs rw permissions and not just w permissions

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-16 18:10:06 -08:00
John Johansen
f171f5ebc8 Merge tests: snapd/mount-control: assorted fixes
This makes the snapd/mount-control test pass on all the currently tested systems. Note that there's a somewhat complex problem with the new mount APIs (https://lwn.net/Articles/753473/) from 2018 that are now being used on, for example, Debian 13.

I will need to make similar changes to the profiles generated by snapd, so any insight on what to do there is strongly appreciated.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1479
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-16 19:35:35 +00:00
John Johansen
2e42c33f48 Merge parser: add backend pipeline ordering info to README
Add a basic overview of the ordering of the backend of the compiler
and which stages specific dump info lines up with.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1470
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-16 19:32:26 +00:00
John Johansen
4fc3aacc8f Merge aa-notify: Use a quieter default behavior
In aa-notify, notifications are now merged by default to reduce the risk
of flooding.

Additionally, we now use an exponential backoff algorithm for the
merging time period. If there is several notications within a time
period, it doubles, up to a maximum. The time period shrinks if there is
no notification. The time period is reset if the user clicks on a
notifiation
    
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1468
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-16 19:31:19 +00:00
Maxime Bélair
7049d7b0c6 aa-notify: Use a quieter default behavior 2025-01-16 19:31:18 +00:00
Christian Boltz
692e6850ba Merge Add support for lastlog2 to get last login
lastlog2 is the 2038-safe replacement for wtmp, and in the meantime
became part of util-linux.

Adjust get_last_login_timestamp() to use the lastlog2 database
(/var/lib/lastlog/lastlog2.db) if it exists, and adjust
get_last_login_timestamp_lastlog2() to actually do that.

(If lastlog2.db doesn't exist, aa-notify will read wtmp as usual.)

Unfortunately lastlog2 doesn't have a way to get machine-readable output
(for example json), therefore - after trying and failing to parse the
lastlog2 output - directly read from lastlog2.db. Let's hope the format
never changes ;-)

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1228378

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1216660

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/372

I propose this patch for 4.0 and master.

Closes #372
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1282
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-01-14 18:56:21 +00:00
Christian Boltz
45e4c27cf0 Add support for lastlog2 to get last login
lastlog2 is the 2038-safe replacement for wtmp, and in the meantime
became part of util-linux.

This commit switches from trying to parse the lastlog2 output to
directly reading lastlog2.db with sqlite3.

Adjust get_last_login_timestamp() to use the lastlog2 database
(/var/lib/lastlog/lastlog2.db) if it exists, and adjust
get_last_login_timestamp_lastlog2() to actually do that.

(If lastlog2.db doesn't exist, aa-notify will read wtmp as usual.)

Unfortunately lastlog2 doesn't have a way to get machine-readable output
(for example json), therefore - after trying and failing to parse the
lastlog2 output - directly read from lastlog2.db. Let's hope the format
never changes ;-)

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1228378

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1216660

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/372
2025-01-14 19:36:43 +01:00
Christian Boltz
371a9ff9ec Add support for lastlog2 to get last login
lastlog2 is the 2038-safe replacement for wtmp, and in the meantime
became part of util-linux.

Adjust get_last_login_timestamp() to use lastlog2 if it exists, and add
get_last_login_timestamp_lastlog2() to actually do that.

(If lastlog2 doesn't exist, aa-notify will read wtmp as usual.)

Unfortunately lastlog2 doesn't have a way to get machine-readable output
(for example json), therefore we have to parse the output that is meant
for humans. Let's hope the format never changes ;-)

(The alternative would have been to use squlite3 to once more read the
data behind the official program's back, but that was already a bad idea
for wtmp, therefore I decided against it.)

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1228378

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1216660

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/372
2025-01-14 19:36:42 +01:00
Christian Boltz
7d537efcb0 Rename get_last_login_timestamp to get_last_login_timestamp_wtmp
... and add a wrapper function with the old name

Also rename the tests to the new name, and create a copy with the
original name. The copy will be adjusted to also check/expect lastlog2
results in a later commit.
2025-01-14 19:36:40 +01:00
Christian Boltz
9629bc8b6f Merge Support unloading profiles in kill and prompt mode
... in aa-teardown (actually everything that uses rc.apparmor.functions)
and aa-remove-unknown.

Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2093797

I propose this fix for 3.0..master, since the apparmor.d manpage in all these branches mentions the `kill` flag.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1484
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-01-14 18:24:40 +00:00
Christian Boltz
1c2d79de7f Support unloading profiles in kill and prompt mode
... in aa-teardown (actually everything that uses rc.apparmor.functions)
and aa-remove-unknown.

Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2093797
2025-01-13 18:07:39 +01:00
Zygmunt Krynicki
43355fada5 Merge tests: add dosfstools to image-garden cloud-init
The package is required by the file_unbindable_mount regression test.
To properly re-generate affected images please update image-garden
to version containing 9714dc45d0ef06862ffe7037193dc43386db48ea
(Tie .user-data and .meta-data to MAKEFILE_LIST).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1480
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>
2025-01-12 21:02:39 +00:00
John Johansen
c57d727482 parser: add backend pipeline ordering info to README
Add a basic overview of the ordering of the backend of the compiler
and which stages specific dump info lines up with.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-10 23:35:57 -08:00
Christian Boltz
b4cb33b488 Merge tests: regression: separate bash traces from errors
The BASH_XTRACEFD variable can be used to redirect "set -x" traces
to a dedicated file. We can use it to split the execution trace
(what has actually happened) from the failure messages.

On a failing test this does provide improved clarity when debugging
interactively with "spread -debug". On non-interactive runs the now
shorter error list is also implicitly printed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1481
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-01-10 20:48:16 +00:00
Christian Boltz
7fa4b82235 Merge tests: run autotools test verbosely
Instead of showing just the summary, display the actual test log as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1482
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-01-10 20:47:54 +00:00
Zygmunt Krynicki
fa33d7199b tests: run autotools test verbosely
Instead of showing just the summary, display the actual test log as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 14:04:55 +01:00
Zygmunt Krynicki
2c2e0478f8 tests: regression: separate bash traces from errors
The BASH_XTRACEFD variable can be used to redirect "set -x" traces
to a dedicated file. We can use it to split the execution trace
(what has actually happened) from the failure messages.

On a failing test this does provide improved clarity when debugging
interactively with "spread -debug". On non-interactive runs the now
shorter error list is also implicitly printed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 12:40:17 +01:00
Zygmunt Krynicki
699b598593 tests: sort cloud-init package lists
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 12:38:30 +01:00
Zygmunt Krynicki
215fab71a5 tests: add dosfstools to image-garden cloud-init
The package is required by the file_unbindable_mount regression test.
To properly re-generate affected images please update image-garden
to version containing 9714dc45d0ef06862ffe7037193dc43386db48ea
(Tie .user-data and .meta-data to MAKEFILE_LIST).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 12:37:49 +01:00
Zygmunt Krynicki
cff25b8d17 tests: snapd/mount-control: allow paths used on openSUSE
In addition allow linking to libeconf, generalize locale paths to cover
values other than C.UTF-8 and allow reading system-wide locale.alias and
gconv modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 11:09:36 +01:00
Zygmunt Krynicki
8ed810756b tests: snapd/mount-control: stop/start auditd
This is needed on openSUSE Tumbleweed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 11:09:19 +01:00
Zygmunt Krynicki
5556de53c0 tests: snapd/mount-control: allow new mount APIs
This is not the best of fixes but it seems that on Debian 13, with new
libmount calling fsopen/fsconfig/move_mount, the current apparmor mount
rule is insufficient to allow the call to go through.

The key problems are:
- the fstype is not visible to LSM
- the source directory is an empty string
- the mount is moved to final position

I don't know the extent of "new" mount API coverage by LSM hooks but
I think we should either synthesize new permissions from old rules,
.e.g match each of the system calls against what the mount class
expression, or somehow allow the exceptions better.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 11:08:26 +01:00
Zygmunt Krynicki
32116a50b0 tests: snapd/mount-control: fix bash syntax.
This masked failures that were already occuring.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2025-01-10 11:08:07 +01:00
John Johansen
72f9952a5f Merge parser: add a hfa dump that matches the renumbered chfa
Construction of the chfa can reorder states from what the numbering
given during the hfa constuctions because of reordering for better
compression, dead state removal to ensure better packing etc.

This however means the dfa dump is difficult (it is possible using
multiple dumpes) to match up to the chfa that the kernel is
using. Make this easier by making the dfa dump be able to take
the remapping as input, and provide an option to dump the
chfa equivalent hfa.

Renumbered states will show up as {new <== {orig}} in the dump

Eg.
```
--D dfa-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{5} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {5}  0 (0x 4/0//0/0/0)
    0x4 -> {5}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {5}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {5}  0 (0x 4/0//0/0/0)
    \n 0xa -> {5}  0 (0x 4/0//0/0/0)
    \  0x20 -> {5}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {6}
{6} perms: none
    1 0x31 -> {5}  0 (0x 4/0//0/0/0)
```

```
-D dfa-compressed-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{2 == {5}} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    0x4 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \n 0xa -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \  0x20 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {4 == {6}}
{4 == {6}} perms: none
    1 0x31 -> {2 == {5}}  0 (0x 4/0//0/0/0)
```

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1474
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2025-01-09 19:04:13 +00:00
John Johansen
cd8b75abc0 Merge parser: convert uint to unsigned int
As reported in https://gitlab.com/apparmor/apparmor/-/merge_requests/1475
uint requires the inclusion of sys/types.h for use in musl libc.
Including that would be fine but since it is only used for the
cast for the owner type comparison, just convert to use a more
standard type.

Reported-by: @fossd <fossdd@pwned.life>
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1478
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-09 10:40:27 +00:00
John Johansen
ff03702fde parser: convert uint to unsigned int
As reported in https://gitlab.com/apparmor/apparmor/-/merge_requests/1475
uint requires the inclusion of sys/types.h for use in musl libc.
Including that would be fine but since it is only used for the
cast for the owner type comparison, just convert to use a more
standard type.

Reported-by: @fossd <fossdd@pwned.life>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:15:00 -08:00
John Johansen
e5a960a685 Merge cupsd: Add /etc/paperspecs and convert to @etc_ro/rw
I had this message in my log

```
Dez 30 08:14:46 kernel: audit: type=1400 audit(1735542886.787:307): apparmor="DENIED" operation="open" class="file" profile="/usr/sbin/cupsd" name="/etc/paperspecs" pid=317509 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```

If the second commit is bad, I can drop it.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1472
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-09 09:48:48 +00:00
John Johansen
0eca26c6c2 Merge Allow write access to /run/user/*/dconf/user
Gtk applications like Firefox request write access to the file
`/run/user/1000/dconf/user`. The code in `dconf_shm_open` opens the file
with `O_RDWR | O_CREAT`.

4057f8c84f/shm/dconf-shm.c (L68)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1471
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-09 09:46:55 +00:00
John Johansen
50452e1147 parser: add a hfa dump that matches the renumbered chfa
Construction of the chfa can reorder states from what the numbering
given during the hfa constuctions because of reordering for better
compression, dead state removal to ensure better packing etc.

This however means the dfa dump is difficult (it is possible using
multiple dumpes) to match up to the chfa that the kernel is
using. Make this easier by making the dfa dump be able to take the
emapping as input, and provide an option to dump the chfa equivalent
hfa.

Renumbered states will show up as {new <== {orig}} in the dump

Eg.
--D dfa-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{5} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {5}  0 (0x 4/0//0/0/0)
    0x4 -> {5}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {5}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {5}  0 (0x 4/0//0/0/0)
    \n 0xa -> {5}  0 (0x 4/0//0/0/0)
    \  0x20 -> {5}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {6}
{6} perms: none
    1 0x31 -> {5}  0 (0x 4/0//0/0/0)

-D dfa-compressed-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{2 == {5}} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    0x4 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \n 0xa -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \  0x20 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {4 == {6}}
{4 == {6}} perms: none
    1 0x31 -> {2 == {5}}  0 (0x 4/0//0/0/0)

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-03 14:18:50 -08:00
John Johansen
3034c0772e Merge parser: improve unreachable state removal
Currently states are added to the reachable set when they are popped
from the workqueue. This however can result in states being
added to the work queue multiple times and reprocessed.

```
Eg. If state 2 has the transitions, and 9 is not in the reachable set
  a -> 9
  b -> 9
  c -> 9
  d -> 9
  e -> 3
```

then 9 will get pushed onto the work 4 times. Even worse other states
on the workqueue may also add state 9 to the workqueue because it has
not been added to the reachable set.

Instead add states to the reachable set when they are added to the
workqueue. The first encounter with a state will result in it being
reachable and all other encounters will see that it already in the set
and not add it to the workqueue.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1473
Acked-by: seth.arnold@gmail.com
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-01-02 09:36:48 +00:00
John Johansen
4fb3dbc7b3 parser: improve unreachable state removal
Currently states are added to the reachable set when they are popped
from the workqueue. This however can result in states being
added to the work queue multiple times and reprocessed.

Eg. If state 2 has the transitions, and 9 is not in the reachable set
  a -> 9
  b -> 9
  c -> 9
  d -> 9
  e -> 3

then 9 will get pushed onto the work 4 times. Even worse other states
on the workqueue may also add state 9 to the workqueue because it has
not been added to the reachable set.

Instead add states to the reachable set when they are added to the
workqueue. The first encounter with a state will result in it being
reachable and all other encounters will see that it already in the set
and not add it to the workqueue.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-01 17:16:17 -08:00
Jörg Sommer
318fb30446 Allow write access to /run/user/*/dconf/user
Gtk applications like Firefox request write access to the file
`/run/user/1000/dconf/user`. The code in `dconf_shm_open` opens the file
with `O_RDWR | O_CREAT`.

4057f8c84f/shm/dconf-shm.c (L68)
2024-12-31 10:23:50 +01:00
Jörg Sommer
c3af6228fd cupsd: convert profile to @etc_ro/rw
While cups itself writes to /etc the others require only read-only access
and might therefore live in /usr/etc.
2024-12-31 10:12:16 +01:00
Jörg Sommer
97d7fa3f5f cupsd: Add /etc/paperspecs read access
Cups uses libpaper which accesses /etc/paperspecs.

ce42216e2e/lib/libpaper.c.in.in (L419)
2024-12-31 10:12:16 +01:00
John Johansen
40e9b2a961 Merge parser: fix priority for file rules.
Fix priority for file rules, and the ability to dump the dfa at different stages, and update and fix the equality tests.

This in particular adds the ability to better debug the equality tests. Instead of just piping the parser output into the hash it creates a tmp dir and drops the binary files there so they can be manually examined. It adds new options particularly the -r option making so the tests will exit on first failure to make it easier to isolate and examine a failure.

Eg.
```
./equality.sh -r -d -v
Equality Tests:
................................................................................................................................................................................................................................
Binary inequality 'priority=-1'x'priority=-1' change_hat rules automatically inserted
FAIL: Hash values match
parser: ./../apparmor_parser -QKSq --features-file=./features_files/features.all
known-good (ee4f926922ecd341f1389a79dd155879) == profile-under-test (ee4f926922ecd341f1389a79dd155879) for the following profiles:
known-good         /t { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current a, ^test { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current a, /f r, }}
profile-under-test /t { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current w, ^test { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current w, /f r, }}

  files retained in "/tmp/eq.3240859-deHu10/"
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1455
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-30 09:26:45 +00:00
John Johansen
8c799f4eec Merge Allow python cache under the @{HOME}/.cache/ dir
Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment
variable to define a cache directory for Python [1]. I think most people would set
this dir to @{HOME}/.cache/python/ , so the python abstraction should allow
writing to this location.

[1]: https://docs.python.org/3/using/cmdline.html#envvar-PYTHONPYCACHEPREFIX

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1467
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-24 22:33:28 +00:00
John Johansen
027b508da8 parser: equality tests: convert to using sha256sum for the hashes
There is a general industry wide effort to move off of md5 and even
sha1 (see recent kernel changes). While in this particular use case it
doesn't make a difference (besides slightly lowering the chance of a
collision) switch to sha256sum to make sure our code doesn't depend on
tools that are deprecated and there is an effort to remove.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-23 23:36:55 -08:00
John Johansen
bf7b80c478 parser: equality tests: fix r carve out tests
Similar to the deny x permission tests, the tests that test carving
out r permissions need to be updated to be conditional on what
priority is being used on the rule.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-23 23:36:55 -08:00
John Johansen
25f16b239d parser: equality tests: update deny x perm carve out test
With priority rules, deny does not carve out permissions from the
higher priority rule. Technically it doesn't from lower priority either
as it completely overrides them, but that case already results in
an inequality so does not cause the tests to fail.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-23 23:36:55 -08:00
John Johansen
369029dc07 parser: equality tests: fix cx specified profile transition
cx rules using a specified profile transition, may be emulated by
using px and a hierarchical profile name. That is

  cx -> b

may be transformed into

  px -> profile//b

which will generate an xtable entry of

  profile//b

which means the previous patch using

  pivot_root -> b,

to reliably add b to the xtable will not cover this case.

transition to using two pivot_root rules to provide the xtable entries
  pivot_root /a -> b,
  pivot_root /c -> /t//b,

the paths /a and /c are irrelavent as long as they don't have an
overlap with the generic globbing expression in the test, Two table
entries will be generated. We guarantee no overlap by converting the

  /** to /f**

Also the xtable reserving rules are moved to the end of the profile so
the table order can be reliably created. A follow on MR around xtable
improvements should add reliability to xtable order.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-23 23:36:55 -08:00
John Johansen
84650beb2f parser: equality tests: fix equality failure due to xtable
exec rules that specify an specific target profile generate an entry
in the xtable. The test entries containing " -> b" are an example of
this.

Currently the parser allocates the xtable entry before priorities are
applied in the backend, or minimization is done. Further more the
parser does not ref count the xtable entry to know what it is no
longer referenced.

The equality tests generate rules that are designed to completely
override and remove a lower priority rule, and remove it. Eg.

  /t { priority=1 /* ux, /f px -> b, }

and then compares the generated profile to the functionaly equivalent
profile eg.

  /t { priority=1 /* ux, }

To verify the overridden rule has been completely removed.
Unfortunately the compilation is not removing the unused xtable entry
for the specified transition, causing the equality comparison to fail.

Ideally the parser should be fixed so unused xtable entries are removed,
but that should be done in a different MR, and have its own test.

To fix the current tests, and another rule that adds an xtable entry
to the same target that can not be overriden by the x rule using
pivot_root. The parser will dedup the xtable entry resulting in the
known and test profile both having the same xtable. So the test will
pass and meet the original goal of verifying the x rule being overriden
and eliminated.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-23 23:36:28 -08:00
John Johansen
cca842b897 parser: equality tests: rework and add debug features
Failed equality tests can be hard to debug. The profiles aren't always
enough to figure out what is going on. Add several options that will
help in debugging, and developing new tests.

Add switches and arg parsing.

Add the ability to run tests individually

Add a -r flag to allow retaining the test and output
similar to the regression tests, so the exact output from the
tests can be examined.

Add a -d flag to dump dfa build information.

Allow overriding the parser, features, and description for a given
test run.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:24:46 -08:00
John Johansen
05ddc61246 parser: equality tests: wrap test run in function
In preparation for some additional abilities wrap the current tests in
a function.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:24:39 -08:00
John Johansen
31e60baab2 parser: equality tests: consitently dump error output to stderr
printf of failure/error info should be going to stderr. Unfortunately
the test has a mix of 2>&1 and 1>&2. Having a mix is just wrong, we
could standardize on either but since the info is error info 1>&2
seems to be the better choice.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
57c57f198c parser: equality tests: fix failing overlapping x rule tests
The test was passing because the file priority was always zero bug
resulting in the priority rule always being correctly combined
with the specific match x rule, instead of overriding it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
4b410b67f1 parser: equality tests: fix change_hat priority test
The test was passing because the file priority always being zero bug,
the supplied rule always had the same priority as the implied
rule. Resulting in binary_equality always passing even though the
specified priority should have resulted in a failure.

Fix this by checking if the priorities are equal to the implied
rule other wise it should result in an inequality.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
d275dfdd42 parser: equality tests: output parser, config and features info
When there is a failure output the exact call info used to invoke the
parser. To facilitate manually recreating the test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
fcee32a37e parser: equality tests: convert xequality tests to equality
With the file priority fix the xequality (expected equal but known
failure) tests are now passing. So convert them to regular equality
tests.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
5d2a38e816 parser: add some new dfa dump options.
The dfa goes through several stages during the build. Allow dumping it
at the various stages instead of only at the end.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
9d5b86bc9d parser: fix priority for file rules.
File rules could drop priority info when rule matched a rule
that was the same except for having different priority. For now
fix this by treating them as a different rule.

The priority was also be dropped when add_prefix was used to
add the priority during the parse resulting in file rules always
getting a default priority of 0.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-22 15:02:04 -08:00
John Johansen
8e431ebcd9 Merge regression tests: make loop device size more generous
Depending on the system, copying echo to the loop device fails because the echo binary is too large.
Especially on systems that have echo be just a symlink to coreutils (e.g. busybox) (as opposed to echo being its own binary) 16k is just not enough.
2M seems fine on my system, but this might need yet a higher value depending on what coreutils other people actually run.

The crash in question:
```
cp: error writing '/tmp/sdtest.3937422-31490-Bxvi6g/mount_target/echo': No space left on device
Fatal Error (file_unbindable_mount): Unexpected shell error. Run with -x to debug
rm: cannot remove '/tmp/sdtest.3937422-31490-Bxvi6g/mount_target': Device or resource busy
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1469
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-20 08:53:41 +00:00
John Johansen
cd4bb05f20 Merge Add overlayfs regression tests
These tests exercise various common file operations on files in an overlayfs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1461
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>
2024-12-20 08:25:58 +00:00
Grimmauld
1cc2a3bd86 regression tests: make loop device size more generous
Depending on the system, copying echo to the loop device fails because the echo binary is too large.
Especially on systems that have echo be just a symlink to coreutils (e.g. busybox) 16k is just not enough.
2M seems fine on my system, but this might need yet a higher value depending on what coreutils other people actually run.
The actual loop device needs to be larger to properly fit the allocated file size. Testing shows 4M is sufficient, but this is basically arbitrary.
2024-12-19 23:48:43 +01:00
John Johansen
ba60bfff85 Merge Write a regression test for mediating file access in private mounts
This test, as is, emits an execname warning which is due to a bug in the `prologue.inc` infrastructure (see !1450 for a fix to this issue).

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1448
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-19 19:44:51 +00:00
John Johansen
c489631770 Merge aa-status: fix json generation
- previously, aa-status --json --show profiles would return non-standard json
- adding the --pretty flag would crash completely
- closes #470

Things done:
- removed trailing ", " in json generation
- generate json seperator (", ") for each new json field
  (profiles/processes) after the header if json is enabled

Tested on NixOS and apparmor 4.0.3 base, but should work on any version the patch applies on.

Closes #470
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1451
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-19 19:44:13 +00:00
John Johansen
59957aa1d8 Merge fixes on the testing infrastructure
This MR is meant to resolve warnings such as "Warning: execname '/home/username/Documents/apparmor/tests/regression/apparmor/file_unbindable_mount': no such file or directory" when running tests like the one in the current version of !1448.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1450
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-19 19:38:00 +00:00
John Johansen
50f260df51 Merge profiles: transmission-gtk needs attach_disconnected
From LP: #2085377, when using ip netns to torrent traffic through a
VPN, attach_disconnected is needed by the policy because ip netns sets
up a mount namespace.

Fixes: https://bugs.launchpad.net/bugs/2085377
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1395
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-19 19:15:41 +00:00
John Johansen
3ed5adb665 Merge Allow make-* flags with remount operations
While the mount syscall documentation disallows this, the kernel silently
ignores make-* flags when doing a remount, and real applications were
passing this conflicting set of flags. Because changing the kernel to
reject this combination would break userspace, we should allow them
instead.

For an example: see https://bugs.launchpad.net/apparmor/+bug/2091424.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1466
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-19 17:27:53 +00:00
Mikhail Morfikov
03b5a29b05 Allow python cache under the @{HOME}/.cache/ dir
Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment
variable to define a cache directory for Python [1]. I think most people would set
this dir to @{HOME}/.cache/python/ , so the python abstraction should allow
writing to this location.

[1]: https://docs.python.org/3/using/cmdline.html#envvar-PYTHONPYCACHEPREFIX
2024-12-19 09:33:13 +01:00
Ryan Lee
83270fcf68 Add a regression test for allowing rprivate with conflicting options
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-18 10:28:49 -08:00
Georgia Garcia
67ee5f8b39 Merge Add separator between mount flags in dump_flags
The previous code would concatenate all of them together without spacing.
While dump_flags and the corresponding operator<< function aren't currently used,
this will help for when dump_flags is used to debug parser problems.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1465
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-18 15:26:29 +00:00
Georgia Garcia
a3299ba133 Merge Use "profile//hat" in storage
TL;DR: Replace `aa[profile][hat]` with `active_profiles['profile//hat']` as a preparation to get rid of `aa`'s limits, especially to enable handling nested childs.

Since this is an extremely shortened summary, I recommend to check the individual commits for a readable and understandable diff and more details.

Note that this MR is "just" a preparation - nested childs are not supported yet. Also, `include` still uses the old structure. Both will be separate MRs - this one is already big enough ;-)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1360
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-18 12:07:01 +00:00
Christian Boltz
58664c106c read_profile: rename active_profile parameter
... to is_active_profile to prevent confusion with active_profiles
2024-12-17 22:51:12 +01:00
Christian Boltz
0551be806e ask_the_questions: use full_profile
... instead of combine_profname([profile, hat])
2024-12-17 22:51:12 +01:00
Christian Boltz
728a8717e9 aa.py: get rid of 'aa'
... which is no longer used - everything is in active_profiles now :-)
2024-12-17 22:51:12 +01:00
Christian Boltz
f66ada256a Drop now-unused split_to_merged() and its tests 2024-12-17 22:51:12 +01:00
Christian Boltz
695e472b2c Switch aa-mergeprof from aa to active_profiles 2024-12-17 22:51:12 +01:00
Christian Boltz
531f47676d ProfileList: add get_all_profiles()
... and a test for it
2024-12-17 22:51:12 +01:00
Christian Boltz
c93d560f89 Switch test-libapparmor-test_multi.py from aa to active_profiles
Note that the old code assigned dummy_prof to aa[profile][hat] and
active_profiles[profile] (= the main/parent profile) - which is
diffferent when testing a log for a child profile.

aa[profile][hat] was the wrong place - but since we used exactly that
again when checking for added exec rules, this error was hidden.

Now that the test is switched to using active_profiles, only check the
main profile for exec rules added by ask_exec(). (This will need to be
adjusted when we add a test for exec rules/events in nested childs, but
not earlier ;-)
2024-12-17 22:51:12 +01:00
Christian Boltz
61a7ba2822 Switch usage of 'aa' to active_profiles
This is mostly a search-and-replace patch.

In most cases, that means replacing `aa[profile][hat]` with
`active_profiles[full_profile]`.

In cases where the main/parent profile is meant, switch from
`aa[profile][profile]` to `active_profiles[profile]`.

Checks like `p in apparmor.aa` that check if a (main) profile exists
become `active_profiles.profile_exists(p)`.

write_profile() gets changed to loop over
`active_profiles.get_profile_and_childs()` which makes the code simpler.

`split_to_merged(aa)` becomes just `active_profiles`.

The only change that is not search-and-replace style is in
write_piece(). It expects a dict (not a ProfileList), therefore adjust
serialize_profile() so that it always hands over a dict.
2024-12-17 22:51:12 +01:00
Christian Boltz
c5bbe79338 replace original_aa with original_profiles
This also changes the internal structure - instead of the nested dict
original_aa[profile][hat], we now have a ProfileList original_profiles[profile//hat].
2024-12-17 22:51:12 +01:00
Christian Boltz
c5e495c56d ProfileList: add replace_profile()
... and some tests for it.
2024-12-17 22:51:12 +01:00
Christian Boltz
a37c65957f ProfileList: add __getitem__()
... and add some tests for it.
2024-12-17 22:51:12 +01:00
Christian Boltz
b66dfd8bfb Use active_profiles.profile_exists()
... to test if a given profile or hat exists
2024-12-17 22:51:12 +01:00
Christian Boltz
0da12fe7cb Use extra_profiles.profile_exists()
... instead of accessing the internal storage directly.
2024-12-17 22:51:12 +01:00
Christian Boltz
3a02d6d14c Use temporary object instead of working in aa[profile][hat]
... in ask_addhat() and ask_the_questions().

Also deduplicate some code in ask_the_questions().
2024-12-17 22:51:12 +01:00
Christian Boltz
f5ed9cffe3 serialize_profile(): simplify and cleanup
Drop `comment.replace('\\n', '\n')` because that doesn't make sense and
doesn't change anything - not even a comment that contains the literal
string '\n' (backslash + letter n).

Besides that, get rid of the 'string' variable and store everything in
'data'.
2024-12-17 22:51:11 +01:00
Christian Boltz
2e8a75195c De-duplicate code in read_profile() 2024-12-17 22:51:11 +01:00
Christian Boltz
578ab8da9d Store child profiles and hats in active_profiles
... including just-created child profiles and hats.

Also ensure that serialize_profile() doesn't print them out as child
profiles AND external hats.

This commit includes a bugfix for a rare corner case:
Since create_new_profile() can return more than one profile if the
program has required_hats, add all of them to active_profiles.
(aa only got the expected profile added, but not the required_hats.)
2024-12-17 22:51:11 +01:00
Christian Boltz
fe9b2542ca ProfileList: add profile_exists()
... and extend the existing tests for add_profile to also check
profile_exists().
2024-12-17 22:51:11 +01:00
Christian Boltz
a0e6fbe32a ProfileStorage: store parent profile
... and extend the tests to get some coverage.
2024-12-17 22:51:11 +01:00
Christian Boltz
792d1a5568 ProfileList addProfile(): always hand over ProfileStorage
... and make it non-optional

Note that read_profile() in aa.py skips child profiles and hats,
therefore active_profiles for now only contains the main profiles.
2024-12-17 22:51:11 +01:00
Ryan Lee
52babe8054 Allow make-* flags with remount operations
While the mount syscall documentation disallows this, the kernel silently
ignores make-* flags when doing a remount, and real applications were
passing this conflicting set of flags. Because changing the kernel to
reject this combination would break userspace, we should allow them
instead.

For an example: see https://bugs.launchpad.net/apparmor/+bug/2091424.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-17 11:59:54 -08:00
Ryan Lee
96718ea4d1 Add separator between mount flags in dump_flags
The previous code would concatenate all of them together without spacing.
While dump_flags and the corresponding operator<< function aren't currently used,
this will help for when dump_flags is used to debug parser problems.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-17 11:50:35 -08:00
Georgia Garcia
f9edc7d4c1 profiles: transmission-gtk needs attach_disconnected
From LP: #2085377, when using ip netns to torrent traffic through a
VPN, attach_disconnected is needed by the policy because ip netns sets
up a mount namespace.

Fixes: https://bugs.launchpad.net/bugs/2085377
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-17 09:32:18 -03:00
Georgia Garcia
b2f713dd83 Merge Python SWIG binding fixes (API breaking)
Changes to Python SWIG bindings that are breaking changes but that fix bindings that were previously unusable.

This MR also depends on !1334 and !1337 being merged first, though ~~I can rebase this one if necesssary~~ this MR has now been rebased after those two were merged.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1338
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-17 12:24:15 +00:00
Christian Boltz
f2c398405b Merge Update fs type comment in swap regression test
As per https://gitlab.com/apparmor/apparmor/-/merge_requests/1463#note_2259888640: this really should have been a part of !1463, except that cboltz only pointed this out after the MR was already merged. Better late than never, nevertheless.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1464
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-12-16 21:14:00 +00:00
Ryan Lee
5cd3362a81 Update fs type comment in swap regression test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 12:51:30 -08:00
Ryan Lee
1d3d48cc2a Shellcheck pass over overlayfs.sh
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
b24a820e7a Extend overlayfs test with more file ops
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
8212fa8be4 Add more operations to the regression test complain binary
This extra functionality is to be used in a different regression test that reuses the binary

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
e0127767fd Add the overlayfs regression test to task.yaml
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
1cb11f5a89 Add the overlayfs regression test to the Makefile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
2fdb5c799c Add a basic overlayfs regression test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-16 09:52:38 -08:00
Ryan Lee
fa58d3611a Shellcheck fix pass over file_unbindable_mount test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-13 12:37:50 -08:00
Georgia Garcia
6d7b5df947 Merge Fix swap regression test on btrfs
As per !1462 it turns out that the swap regression test on btrfs also needs special casing in order to work properly. This is an analogous patch to check for btrfs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1463
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-13 20:32:01 +00:00
Ryan Lee
c768a7dc79 Add file_unbindable_mount to regression task.yaml
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-13 12:27:47 -08:00
Ryan Lee
049b35dff0 Add file_unbindable_mount to regression test Makefile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-13 12:27:47 -08:00
Ryan Lee
f249c6d58f Write a regression test for mediating file access in unbindable mounts
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-13 12:27:47 -08:00
Ryan Lee
90c7af69c5 Fix swap regression test on btrfs
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-13 12:13:55 -08:00
Georgia Garcia
e8f1ac4791 Merge fix swap test on zfs file system
Swap on ZFS is *weird*. Getting it working needs some special casing, see e.g. https://askubuntu.com/questions/1198903/can-not-use-swap-file-on-zfs-files-with-holes

Currently, the swap regression test fails on my system (with /tmp in zfs):
```bash
tests/regression/apparmor ❯ ./swap.sh
Error: swap failed. Test 'SWAPON (unconfined)' was expected to 'pass'. Reason for failure 'FAIL: swapon /tmp/sdtest.872368-19048-kN4FN2/swapfile failed - Invalid argument'
Error: swap failed. Test 'SWAPOFF (unconfined)' was expected to 'pass'. Reason for failure 'FAIL: swapoff /tmp/sdtest.872368-19048-kN4FN2/swapfile failed - Invalid argument'
swapon: /tmp/sdtest.872368-19048-kN4FN2/swapfile: skipping - it appears to have holes.
Fatal Error (swap): Unexpected shell error. Run with -x to debug
```

However, just doing a file mount does make the test work on zfs, similar to how it is done with tmpfs. This means we don't need any special-casing for zfs beyond what is already there for working around (similar) tmpfs limitations.

Also, while researching this, it is possible a similar patch is needed for btrfs, but i currently don't have an easy way to test that.
This is non-breaking for anyone *not* using zfs, and it is currently broken with zfs anyways.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1462
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-13 20:06:56 +00:00
Grimmauld
9a1b538298 fix swap test on zfs file system 2024-12-13 15:35:47 +01:00
Christian Boltz
b3de4ef022 Merge limit buildpath.py setuptools version check to the relevant bits
previously, this check would fail if the setuptools version would contain non-integers.
On my system, that is the case: `setuptools.__version__` is `'75.1.0.post0'`
I believe it is entirely fair to just check the relevant bits and refuse  to continue if those can not be checked properly.
Having some extra slug on the version should not immediately cause issues (e.g. the `post0` here, or slugs like `beta`, `alpha` and the likes).
Probably only very few systems are running setuptools with weird version info, but supporting this is a simple one-line change i figured i might as well MR.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1460
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-12-11 21:25:00 +00:00
Grimmauld
3302ae98e4 limit buildpath.py setuptools version check to the relevant bits
previously, this check would fail if the setuptools version would contain non-integers.
On my system, that is the case: `setuptools.__version__` is `'75.1.0.post0'`
I believe it is entirely fair to just check the relevant bits and refuse  to continue if those can not be checked properly.
But haviong something extra on the version should not immediately cause issues (e.g. the `post0` here, or slugs like `beta`, `alpha` and the likes).
Probably only very few systems are running setuptools with weird version info, but supporting this doesn't cost much, i believe.
2024-12-11 16:30:19 +01:00
Georgia Garcia
8a6eb170e1 Merge postfix-smtp profile fix
Allow locking for /var/spool/postfix/pid/unix.relay.

Example log entry: `type=AVC msg=audit(1733851239.685:8882): apparmor="DENIED" operation="file_lock" profile="postfix-smtp" name="/var/spool/postfix/pid/unix.relay" pid=14222 comm="smtp" requested_mask="k" denied_mask="k" fsuid=91 ouid=0FSUID="postfix" OUID="root"`

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1459
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-10 20:55:43 +00:00
pyllyukko
76dcf46d4f postfix-smtp profile fix
Allow locking for /var/spool/postfix/pid/unix.relay.
2024-12-10 19:32:49 +02:00
John Johansen
a315d89a2b Merge smbd: allow capability chown
This is neeed for "inherit owner = yes" in smb.conf.

From man smb.conf:

    inherit owner (S)

    The ownership of new files and directories is normally governed by
    effective uid of the connected user. This option allows the Samba
    administrator to specify that the ownership for new files and
    directories should be controlled by the ownership of the parent
    directory.

Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1234327

I propose this fix for 3.x, 4.x and master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1456
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-10 09:34:03 +00:00
John Johansen
60f1b55ab5 Merge Use MS_SYNCHRONOUS instead of MS_SYNC
MS_SYNC is a flag for msync(2) while MS_SYNCHRONOUS is a flag for mount(2).
The header used to define MS_SYNC but IMO this is confusing since that's an
unrelated flag.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1458
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-10 08:39:18 +00:00
Zygmunt Krynicki
d164e877f5 Use MS_SYNCHRONOUS instead of MS_SYNC
MS_SYNC is a flag for msync(2) while MS_SYNCHRONOUS is a flag for mount(2).
The header used to define MS_SYNC but IMO this is confusing since that's an
unrelated flag.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-10 09:09:45 +01:00
John Johansen
239ae21b69 Merge Allow spread to use locally-provided kernel
By placing a bzImage into the top level of the AppArmor git repository one can
instruct spread and image-garden to use that image instead of booting
traditionally with an EFI / full disk image pair.

In addition, make error handling in qemu more robust, so failures are both
surfaced and do not cause endless attempts to allocate.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1452
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-10 00:47:48 +00:00
Zygmunt Krynicki
7031b5aeee Allow spread to use locally-provided kernel
By placing a bzImage into the top level of the AppArmor git repository one can
instruct spread and image-garden to use that image instead of booting
traditionally with an EFI / full disk image pair.

In addition, make error handling in qemu more robust, so failures are both
surfaced and do not cause endless attempts to allocate.

Please update image-garden to at least 5a00ead9964df6463e19432ae50e7760fc6da755

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-10 00:50:02 +01:00
Grimmauld
9967ba9873 aa-status: fix json output with --count flag 2024-12-09 23:58:04 +01:00
Christian Boltz
d305028502 smbd: allow capability chown
This is neeed for "inherit owner = yes" in smb.conf.

From man smb.conf:

    inherit owner (S)

    The ownership of new files and directories is normally governed by
    effective uid of the connected user. This option allows the Samba
    administrator to specify that the ownership for new files and
    directories should be controlled by the ownership of the parent
    directory.

Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1234327
2024-12-09 20:45:42 +01:00
Georgia Garcia
11d121409d Merge tests: add regression tests for snapd mount-control
The test adds a very small and simple smoke test that shows that a mount rule
with both fstype and options allows mounts to be performed on a real running
kernel.

The test is structured in a way that should make it easy to extend with new
variants (flags, fstype) in the future.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1445
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-09 19:25:14 +00:00
Christian Boltz
dfe771602d Merge postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/hold/.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1454
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-12-09 18:56:30 +00:00
pyllyukko
3c2aae3a22 postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/hold/.
2024-12-09 19:23:34 +02:00
Georgia Garcia
b4adff2ce0 tests: fix profile name when wrapper is specified
When settest was called with two parameters, one for the test name and
the other for the test wrapper/binary, the profile created with
genprofile would show the test name, causing an error if the file
didn't exist.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-09 12:16:13 -03:00
Georgia Garcia
0307619ed9 tests: add option to append a profile to a profile already generated
Some of the tests using the --stdin option of mkprofile.pl are adding
more than one profile at a time. Whenever a profile is created in the
test, its name is added to the file profile.names so the test
infrastructure can tell if the profile is loaded or removed when
appropriately. The issue is that the name of the second profile
created by --stdin is not added, so these checks are not applied.

This patch adds the option of appending a second profile (not rules).
The option --append was used instead of a short -A because the short
options are arguments of mkprofile.pl, which --append is not.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-09 12:16:13 -03:00
Zygmunt Krynicki
1f60021979 tests: add regression tests for snapd mount-control
The test adds a very small and simple smoke test that shows that a mount rule
with both fstype and options allows mounts to be performed on a real running
kernel.

The test is structured in a way that should make it easy to extend with new
variants (flags, fstype) in the future.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-09 14:55:03 +01:00
Grimmauld
4f006a660c aa-status: fix json generation
- previously, aa-status --json --show profiles would return non-standard json
- adding the --pretty flag would crash completely
- closes #470

Things done:
- removed trailing ", " in json generation
- generate json seperator (", ") for each new json field
  (profiles/processes) after the header if json is enabled

Tested on NixOS and apparmor 4.0.3 base, but should work on any version the patch applies on.
2024-12-09 10:57:58 +01:00
Georgia Garcia
9cc40e2dca tests: remove outdated restriction on image name specification
Due to how the tests were implemented in the past, permissions could
be passed along with the image name, and the permission part would be
discarded. The issue is that permissions are usually separated by ':',
but namespaces also contain ':', which would cause a conflict.

Since permissions are no longer passed as part of the image name,
remove that description so profile names in namespaces can be
supported.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-06 14:25:34 -03:00
Christian Boltz
5fb91616e3 Merge python 3.13 fixes/workarounds
Fixes/workarounds for python 3.13 support.

fail.py: handle missing cgitb - workaround for https://gitlab.com/apparmor/apparmor/-/issues/447

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1439
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-12-05 17:35:13 +00:00
Georgia Garcia
d9304c7653 Merge Allow running tests with spread
Spread is a full-system, or integration test suite runner initially developed
to test snapd. Over time it has spread to other projects where it provides a
structured way to organize, run and debug complex full-system interactions.
Spread is documented on https://github.com/canonical/spread and is used in
production since late 2016.

Spread has a notion of backends which are responsible for allocating and
discarding test machines. For the purpose of running AppArmor regression tests,
I've combined spread with my own tool, image garden. The tool provides
off-the-shelf images, constructed on-the-fly from freely available images, and
makes them easily available to spread.

The reason for doing it this way is so that using non-free cloud systems is not
required and anyone can repeat the test process locally, on their own computer.
Vanilla spread is somewhat limited to x86-64 systems but the way I've used it
here makes it equally possible to test x86_64 *and* aarch64 systems. I've done
most of the development on an ARM single-board-computer running on my desk.

Spread requires a top-level spread.yaml file and a collection of task.yaml
files that describe individual tasks (for us, those are just tests). Tasks have
no implied dependency except that to reach a given task, spread will run all
the _prepare_ statements leading to that task, starting from the project, test
suite and then task. With proper care one can then run a specific individual
test with a one-line command, for example:

```
spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```

This will prepare a fresh ubuntu-cloud-24.04 system (matching the CPU
architecture of the host), copy the project tree into the test machine, install
all the build dependencies, build all the parts of apparmor and then run one
specific variant of the regression test, namely the at_secure program.
Importantly the same test can also run on, say debian-cloud-13 (Debian Trixie),
but also, if you have a Google cloud account, on Google Compute Engine or in
one of the other backends either built into spread or available as a fork of
spread or as a helper for ad-hoc backend. Spread can also create more than one
worker per system and distribute the tests to all of the available instances.
In no way are we locking ourselves out of the ability to run our test suite on
our target of choice.

Spread has other useful switches, such as:
- `-reuse` for keeping machines around until discarded with -discard
- `-resend` for re-sending updated copy of the project (useful for -reuse)
- `-debug` for starting an interactive shell on any failure
- `-shell` for starting an interactive shell instead of the `execute` phase

This first patch contains just the spread elements, assuming that both spread
and image-garden are externally installed. A GitLab continuous integration
installing everything required and running a subset of tests will follow
shortly.

I've expanded the initial selection of systems to allow running all the tests
on several versions of Ubuntu, Debian and openSUSE, mainly as a sanity check
but also to showcase how practical spread is at covering real-world systems.

A number of tests are currently failing:

    - garden:debian-cloud-12:tests/regression/apparmor:attach_disconnected
    - garden:debian-cloud-12:tests/regression/apparmor:deleted
    - garden:debian-cloud-12:tests/regression/apparmor:unix_fd_server
    - garden:debian-cloud-12:tests/regression/apparmor:unix_socket_pathname
    - garden:debian-cloud-13:tests/regression/apparmor:attach_disconnected
    - garden:debian-cloud-13:tests/regression/apparmor:deleted
    - garden:debian-cloud-13:tests/regression/apparmor:unix_fd_server
    - garden:debian-cloud-13:tests/regression/apparmor:unix_socket_pathname
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:attach_disconnected
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:deleted
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:e2e
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_fd_server
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_socket_pathname
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:xattrs_profile

In addition, only on openSUSE, I've skipped the entire test suite of the utils
directory, as it requires python3 ttk themes, which I cannot find in packaged
form.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1432
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-05 14:02:31 +00:00
Zygmunt Krynicki
d27377a62f Document spread tests in README.md
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-05 14:48:58 +01:00
Mikko Rapeli
434e34bb51 fail.py: handle missing cgitb
It's no longer in python standard library starting
at version 3.13. Fixes:

root@qemuarm64:~# aa-complain /etc/apparmor.d/*
Traceback (most recent call last):
  File "/usr/sbin/aa-complain", line 18, in <module>
    from apparmor.fail import enable_aa_exception_handler
  File "/usr/lib/python3.13/site-packages/apparmor/fail.py", line 12, in <module>
    import cgitb
ModuleNotFoundError: No module named 'cgitb'

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
2024-12-05 06:58:01 +00:00
John Johansen
e1d8bf1888 Merge Add explicit test for parser priority-based carveouts
Tests #466 but is marked as expected fail due to that bug not being resolved.

Depends on !1441 which adds the xfail infrastructure to the parser equality testing framework, and should be rebased on top of master once that MR is merged.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1443
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-05 06:21:59 +00:00
Zygmunt Krynicki
1df91e2c8c Third iteration of spread support
- Tests defined in utils/test are now described by a task.yaml in the same
  directory and can run concurrently across many machines.
- Tests for utils/ are now executed on openSUSE Tumbleweed since ttk themes is
  no longer a hard dependency in master.
- Tests no longer run on openSUSE Leap 15.6 due to the age of default
  Python (3.6) and gcc/g++. The tight integration with SWIG which does
  not seem to support other Python versions very well. Perl hard-codes
  old GCC for extension modules. The upcoming openSUSE Leap 16 should be
  a viable target. In the meantime we can still test everything through
  rolling-release Tumbleweed.
- Formatting of YAML files is now more uniform, at four spaces per tab.
- The run-spread.sh script is now in the root of the tree. The script allows
  running all spread tests sequentially on one system, while collecting logs
  and artifacts for convenient analysis after the fact.
- All systems are adjusted to run _four_ workers in parallel with _two_ virtual
  cores each and equipped with 1.5GB of virtual memory. This aims to best
  utilize the capacity of a typical CI worker with two to four cores and about
  8GB of available memory.
- Failing tests are marked as such, so that as a whole the entire spread suite
  can pass and be useful at catching regressions.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-05 02:17:07 +01:00
Zygmunt Krynicki
c95ac4d350 Second iteration of spread support
Compared to v1 the following improvements have been made:

- The cost of installing packages have been shifted from each startup to image
  preparation phase, thanks to the integration of custom cloud-init profiles
  into image-garden. This has dramatic impact on iteration time while also
  entirely removing requirement to be online to run once a prepared image is
  available.

- Support for running on Google Compute Engine has been removed since it would
  not be able to use cloud-init the same way would currently only complicate
  setup.

- The number of workers have been tuned for local iteration, aiming for
  comfortable work with 16GB of memory on the host. Once CI/CD pipeline
  support is introduced I will add a dedicated entry so that resources are
  utilized well both locally and when running in CI.

- The set of regression tests listed in tests/regression/apparmor/task.yaml is
  now cross-checked so introduction of a new test to the makefile there is
  automatically flagged and causes spread to fail with a clear message.

- The task tests/unit/utils has been improved to generate profiles. Thanks to
  Christian Boltz for explaining this relationship between tests.

- A number of comments have been improved and cleaned up for readability,
  accuracy and sometimes better grammar.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-05 02:17:07 +01:00
Zygmunt Krynicki
cc04181578 Allow running tests with spread
Spread is a full-system, or integration test suite runner initially developed
to test snapd. Over time it has spread to other projects where it provides a
structured way to organize, run and debug complex full-system interactions.
Spread is documented on https://github.com/canonical/spread and is used in
production since late 2016.

Spread has a notion of backends which are responsible for allocating and
discarding test machines. For the purpose of running AppArmor regression tests,
I've combined spread with my own tool, image garden. The tool provides
off-the-shelf images, constructed on-the-fly from freely available images, and
makes them easily available to spread.

The reason for doing it this way is so that using non-free cloud systems is not
required and anyone can repeat the test process locally, on their own computer.
Vanilla spread is somewhat limited to x86-64 systems but the way I've used it
here makes it equally possible to test x86_64 *and* aarch64 systems. I've done
most of the development on an ARM single-board-computer running on my desk.

Spread requires a top-level spread.yaml file and a collection of task.yaml
files that describe individual tasks (for us, those are just tests). Tasks have
no implied dependency except that to reach a given task, spread will run all
the _prepare_ statements leading to that task, starting from the project, test
suite and then task. With proper care one can then run a specific individual
test with a one-line command, for example:

```
spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```

This will prepare a fresh ubuntu-cloud-24.04 system (matching the CPU
architecture of the host), copy the project tree into the test machine, install
all the build dependencies, build all the parts of apparmor and then run one
specific variant of the regression test, namely the at_secure program.
Importantly the same test can also run on, say debian-cloud-13 (Debian Trixie),
but also, if you have a Google cloud account, on Google Compute Engine or in
one of the other backends either built into spread or available as a fork of
spread or as a helper for ad-hoc backend. Spread can also create more than one
worker per system and distribute the tests to all of the available instances.
In no way are we locking ourselves out of the ability to run our test suite on
our target of choice.

Spread has other useful switches, such as:
- `-reuse` for keeping machines around until discarded with -discard
- `-resend` for re-sending updated copy of the project (useful for -reuse)
- `-debug` for starting an interactive shell on any failure
- `-shell` for starting an interactive shell instead of the `execute` phase

This first patch contains just the spread elements, assuming that both spread
and image-garden are externally installed. A GitLab continuous integration
installing everything required and running a subset of tests will follow
shortly.

I've expanded the initial selection of systems to allow running all the tests
on several versions of Ubuntu, Debian and openSUSE, mainly as a sanity check
but also to showcase how practical spread is at covering real-world systems.

A number of systems and tests are currently failing:

- garden:debian-cloud-12:tests/regression/apparmor:attach_disconnected
- garden:debian-cloud-12:tests/regression/apparmor:deleted
- garden:debian-cloud-12:tests/regression/apparmor:unix_fd_server
- garden:debian-cloud-12:tests/regression/apparmor:unix_socket_pathname
- garden:debian-cloud-13:tests/regression/apparmor:attach_disconnected
- garden:debian-cloud-13:tests/regression/apparmor:deleted
- garden:debian-cloud-13:tests/regression/apparmor:unix_fd_server
- garden:debian-cloud-13:tests/regression/apparmor:unix_socket_pathname
- garden:opensuse-cloud-15.6:tests/regression/apparmor:attach_disconnected
- garden:opensuse-cloud-15.6:tests/regression/apparmor:deleted
- garden:opensuse-cloud-15.6:tests/regression/apparmor:e2e
- garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_fd_server
- garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_socket_pathname
- garden:opensuse-cloud-15.6:tests/regression/apparmor:xattrs_profile
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:attach_disconnected
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:deleted
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:unix_fd_server
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:unix_socket_pathname
- garden:ubuntu-cloud-22.04:tests/regression/apparmor:attach_disconnected

In addition, only on openSUSE, I've skipped the entire test suite of the utils
directory, as it requires python3 ttk themes, which I cannot find in packaged
form.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-05 02:17:07 +01:00
Zygmunt Krynicki
9588b06e0f Allow running exactly one test in utils/test
The new check-one-test-% pattern rule allows running individual test scripts.
This allows them to be tested in parallel across many Make worker threads or
across many distinct machines with spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-12-05 02:17:07 +01:00
Georgia Garcia
57bcb02629 Merge Revert "Merge Fix regression test bug involving binaries different from name"
This reverts merge request !1446 due to breakage in the aa-exec and userns regression tests.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1447
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-04 21:33:26 +00:00
Ryan Lee
5cfdf9867f Revert "Merge Fix regression test bug involving binaries different from name"
This reverts merge request !1446
2024-12-04 21:05:55 +00:00
Georgia Garcia
1c4322a095 Merge Fix regression test bug involving binaries different from name
When the test name and test binary differed and genprofile was used, there would be an execname warning about the original expected binary not existing. This fixes that warning.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1446
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-04 20:36:26 +00:00
Ryan Lee
b7669222dc Fix regression test bug involving binaries different from name
When the test name and test binary differed and genprofile was used, there would be an execname warning about the original expected binary not existing. This fixes that warning.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-04 12:19:21 -08:00
Ryan Lee
b925d8acff parser equality tests: print both profiles upon test failure
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-04 11:37:36 -08:00
Ryan Lee
7b5f4c0d6f Add explicit test for parser priority-based carveouts
These are marked as expected fail due to a bug in the parser's priority
handling.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-04 11:29:40 -08:00
John Johansen
53e322b755 Merge parser: equality tests: add the ability have tests that are a known problem
currently the equality tests require the tests to PASS as known equality
or inequality. Add the ability to add tests that are a known problem
and are expected to fail the equality, or inequality test.

This is done by using

   verify_binary_xequality
   verify_binary_xinequality

This allows new tests to be added to document a known issue, without
having to develop the fix for the issue. The use of this facility
is expected to be temporary, so any test marked as xequality or
xinequality will be noisy but not fail the other tests until they
are fixed, at which point they will cause the tests to fail to
force them to be updated to the correct equality or inequality
test.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1441
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-12-04 02:55:57 +00:00
John Johansen
662a26d133 Merge profiles: update bwrap profile
Update the bwrap profile so that it will attach to application profiles
if present.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1435
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-12-03 21:45:49 +00:00
John Johansen
b81ea65c1c parser: equality tests: add the ability have tests that are a known problem
currently the equality tests require the tests to PASS as known equality
or inequality. Add the ability to add tests that are a known problem
and are expected to fail the equality, or inequality test.

This is done by using

   verify_binary_xequality
   verify_binary_xinequality

This allows new tests to be added to document a known issue, without
having to develop the fix for the issue. The use of this facility
is expected to be temporary, so any test marked as xequality or
xinequality will be noisy but not fail the other tests until they
are fixed, at which point they will cause the tests to fail to
force them to be updated to the correct equality or inequality
test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-12-03 13:44:53 -08:00
Georgia Garcia
ea7e75cde7 Merge Drop useless code in test-regex_matches.py
No need to assign a variable to itsself, not even conditionally.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1442
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-03 16:35:17 +00:00
Georgia Garcia
36ae21e3fa Merge Remove match statements in utils for older Python compatibility
Somehow the use of new match statements slipped by review despite our commitment to supporting older Python versions. Replace them with an unfortunately-needed if-elif chain.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1440
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-03 12:20:30 +00:00
Christian Boltz
ce0cfccfd7 Drop useless code in test-regex_matches.py
No need to assign a variable to itsself, not even conditionally.
2024-12-02 21:33:34 +01:00
Ryan Lee
2068ea8720 Remove match statements in utils for older Python compatibility
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-12-02 10:47:16 -08:00
Christian Boltz
93c7035148 Merge aa-remove-unknown: fix readability check [upstreaming]
I am upstreaming this patch that is part of the nix package of apparmor for close to a year now.
This fixes the issue at https://github.com/NixOS/nixpkgs/issues/273164 for more distros than just NixOS.
The original merge Request on the nix side patching this was https://github.com/NixOS/nixpkgs/pull/285915.
However, people had issues with gitlab, so this never hit apparmor upstream until now. This does however also mean this patch has seen production and seems to work quite well.

## Original reasoning/message of the patch author:

This check is intended for ensuring that the profiles file can actually
be opened.  The *actual* check is performed by the shell, not the read
utility, which won't even be executed if the input redirection (and
hence the test) fails.

If the test succeeds, though, using `read` here might actually
jeopardize the test result if there are no profiles loaded and the file
is empty.

This commit fixes that case by simply using `true` instead of `read`.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1438
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-12-01 16:11:13 +00:00
Andreas Wiese
b4aa00de51 aa-remove-unknown: fix readability check
This check is intended for ensuring that the profiles file can actually
be opened.  The *actual* check is performed by the shell, not the read
utility, which won't even be executed if the input redirection (and
hence the test) fails.

If the test succeeds, though, using `read` here might actually
jeopardize the test result if there are no profiles loaded and the file
is empty.

This commit fixes that case by simply using `true` instead of `read`.
2024-11-29 12:20:48 +01:00
Maxime Bélair
cf51f7aadd Upadate man apparmor.d to highlight pivot_root limitation
As pointed out by https://bugs.launchpad.net/apparmor/+bug/2087875 ,
profile transitions with pivot_root are currently not supported on any
kernel.

This commit makes this limitation more obvious to users.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
2024-11-27 17:29:42 +01:00
John Johansen
420945139c Merge Note in README which build/test steps can be meaningfully parallelized
This MR documents the lessons learned from the experiments that ultimately resulted in !1416.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1434
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-27 08:23:21 +00:00
John Johansen
74a67394ac Merge Make signal.cc:signal_map an unordered map
This also includes renaming SIGTSTP "stp" to "tstp" while preserving backwards compatibility.

Analogous to !1420.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1425
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-11-27 08:20:13 +00:00
John Johansen
c5b17d85ea Merge regression tests: Add test to check for DAC permissions to the testsuite
The regression test suite uses root with capabilities restricted in
several tests. This can cause the test suite to fail in weird and
confusing ways.

Add a test to check for DAC permissiosns from / to the testsuite
and abort running the tests with an error message if DAC permissions
are going to cause the test suite to fail.

Currently the test is pretty basic, but is better than nothing.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1411
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-11-27 08:14:11 +00:00
Georgia Garcia
9d2cde168e Merge aa-notify: Adding support for merging notification.
The new flag --merge-notifications enables the merging of all
notifications from a fixed time period into a single one, thus
preventing notification flooding.
A new GUI allows users to choose either a synthetic or a comprehensive
view of the notifications.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1324
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-11-26 18:35:37 +00:00
Maxime Bélair
f63fcdc8d2 aa-notify: Adding support for merging notification. 2024-11-26 18:35:37 +00:00
John Johansen
1979af7710 profiles: update bwrap profile
Update the bwrap profile so that it will attach to application profiles
if present.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-26 09:52:17 -08:00
Ryan Lee
4286d3a79f Apply 1 suggestion(s) to 1 file(s)
Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-11-26 16:49:57 +00:00
Ryan Lee
967685352c Note in README which build/test steps can be meaningfully parallelized
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-25 17:42:41 -08:00
Christian Boltz
6f5cdb7b44 Merge Assorted fixes for test suite portability
I've been working on improved end-to-end testing of AppArmor on a number
of popular Linux distributions. My first run contains Debian, Ubuntu and openSUSE.

This branch contains three small fixes that, mainly, allow running more tests on
openSUSE Tumbleweed.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1431
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-11-25 21:58:08 +00:00
Zygmunt Krynicki
4caf0aff81 On openSUSE 15.6 make fails to find awk
Using this version of make:
```
GNU Make 4.2.1
Built for x86_64-suse-linux-gnu
```
I'm not entirely sure why but the alternative syntax I've used works correctly.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-11-25 15:05:23 +01:00
Zygmunt Krynicki
32ee85cef8 Use larger loop device in mult_mount.sh test
This fixes the test to pass on openSUSE Tumbleweed, where the small size
prevented alloction of an inode for the `lost+found` directory:

```
garden:opensuse-cloud-tumbleweed .../tests/regression/apparmor# mkfs.ext2 -F -m 0 -N 10 /tmp/sdtest.32929-21402-6x826m/image.ext3
mke2fs 1.47.0 (5-Feb-2023)
Discarding device blocks: done
Creating filesystem with 512 1k blocks and 8 inodes

Allocating group tables: done
Writing inode tables: done
ext2fs_mkdir: Could not allocate inode in ext2 filesystem while creating /lost+found
```

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-11-25 13:55:19 +01:00
Zygmunt Krynicki
92fcdcab9e Quote trailing backslash in test case
This fixes an error with Python 3.11:

```
test/test-parser-simple-tests.py:420:21: E502 the backslash is redundant between brackets
```

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-11-25 13:55:05 +01:00
Zygmunt Krynicki
4b0adc63f5 Use command -v rather than which
Which is technically not POSIX and command -v works everywhere. This fixes
building and running the test suite on openSUSE Tumbleweed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-11-25 13:54:41 +01:00
Zygmunt Krynicki
f58fe9cd52 parser: quote BISON_MAJOR in case it is empty
On a test system without bison installed, make setup fails with:

  /bin/sh: 1: bison: not found
  /bin/sh: 1: test: -ge: unexpected operator

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
2024-11-25 13:54:25 +01:00
Christian Boltz
2b45586fa9 Merge Dovecot profile: Allow reading of /proc/sys/kernel/core_pattern
See <https://dovecot.org/bugreport.html>

(the link describes how Dovecot requires access to `core_pattern`)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1331
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-11-21 20:51:13 +00:00
Georgia Garcia
a2d52fedb2 Merge tests: fix incorrect setfattr call in xattrs_profile
The file was quoted with the following space, making the test broken.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1429
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-11-21 18:05:24 +00:00
Zygmunt Krynicki
8c16fb2700 tests: fix incorrect setfattr call in xattrs_profile
The file was quoted with the following space, making the test broken.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
2024-11-21 18:10:14 +01:00
pyllyukko
0a5a9c465f Dovecot profile: Allow reading of /proc/sys/kernel/core_pattern
See <https://dovecot.org/bugreport.html>
2024-11-21 16:21:17 +02:00
Ryan Lee
f21a243ce4 Make signal.cc:signal_map an unordered_map
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-18 15:25:56 -08:00
Ryan Lee
5bcf05dd3d Similar name adjustments for signal.cc:signal_map
Because this is used in parsing profiles, we keep backwards compatibility by including
both names and mapping them to the same underlying signal number.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-18 15:25:27 -08:00
Ryan Lee
7a85f6282f Name adjustments to signal.cc::sig_names
Because sig_names is only used to dump parsed signals for debugging purposes,
renaming SIGTSTP "stp" to "tstp" is not a breaking change.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-18 15:21:27 -08:00
Christian Boltz
e27b0ad2b6 Merge Quote some variables in regression test suite to allow for spaces
This is not a complete fix for the spaces issue, but it is the next simple step that can be taken before the more difficult work of finding the remaining bugs in each shell script.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1424
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-11-18 21:30:46 +00:00
Ryan Lee
e7ec01f075 Quote some variables in regression test suite to allow for spaces
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-18 10:16:28 -08:00
John Johansen
2e77129e15 Merge parser: fix expr MatchFlag dump
Match Flags convert output to hex but don't restore after outputting
the flag resulting in following numbers being hex encoded. This
results in dumps that can be confusing eg.

rule: \d2  ->  \x2 priority=1001 (0x4/0)< 0x4>

rule: \d7  ->  \a priority=3e9 (0x4/0)< 0x4>

rule: \d10  ->  \n priority=3e9 (0x4/0)< 0x4>

rule: \d9  ->  \t priority=3e9 (0x4/0)< 0x4>

rule: \d14  ->  \xe priority=1001 (0x4/0)< 0x4>

where priority=3e9 is the hex encoded priority 1001.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1419
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 17:41:13 +00:00
John Johansen
4af8acee6f Merge Initialize the backmap field in new_entry for capability addition
The old code implicitly initialized it to 0 by overwriting a
zero-initialized array terminator. Now that we construct the new entry
from scratch, we need to do this manually.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1423
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 02:07:44 +00:00
Ryan Lee
a513d02297 Initialize the backmap field in new_entry for capability addition
The old code implicitly initialized it to 0 by overwriting a
zero-initialized array terminator. Now that we construct the new entry
from scratch, we need to do this manually.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-14 17:14:19 -08:00
John Johansen
a422d2ea17 Merge Partial fix for regression tests if parent directory contains spaces
Most `tests/regression/apparmor/*.sh` scripts contain

    . $bin/prologue.inc

This will explode if one of the parent directories contains a space.

Minimized reproducer:

```
# cat test.sh
pwd=`dirname $0`
pwd=`cd $pwd ; /bin/pwd`
bin=$pwd
echo "pwd: $bin"
. $bin/prologue.inc
# ./test.sh
pwd: /tmp/foo bar
./test.sh: line 9: /tmp/foo: No such file or directory
```

Notice that test.sh tries to source `/tmp/foo` instead of `/tmp/foo bar/prologue.inc`.

The fix is to quote the prologue.inc path:

    . "$bin/prologue.inc"

While on it, also fix other uses of $bin - directly and indirectly - by quoting them.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1418
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:46:04 +00:00
John Johansen
015b41aeb4 Merge parser: improve libapparmor_re build and dump info
Fix libapparmor_re/Makefile so it works correctly with rebuilds and improve state machine dump information, to aid with debugging of permission handling during the compile.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1410
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:32:30 +00:00
John Johansen
48bf4d1df9 Merge Small fixset 2 for parser code nits
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1422
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:31:57 +00:00
John Johansen
95c648c0d2 Merge Pass parallelism arg to parser_sanity test prove invocation
Unfortunately, meaningfully parallelizing parser testing is a giant task:

- Parser equality testing is a shell script based framework where adding parallelism would be a major rework.
- Parser testing using Python’s unittest framework also needs a different test runner to enable parallelism.
- Parser testing using Perl’s prove framework already supports parallelism, but adding -j to Prove does not result in speedups. Thus, I suspect most of the overhead is in spawning the processes, and that speeding this part up will require making the parser a library and testing it that way.

The commit in this MR passes a `-j` parallelism flag to Perl's prove framework, but local testing has shown that this does not create speedups, and Gitlab CI has a very modest improvement of 11 minutes 16 seconds for the parser testing stage without `-j $(nproc)` vs 10 minutes 51 seconds with `-j $(nproc)`. Instead of passing `-j $(nproc)`, pass a fixed `-j 2` to gain some speedups, as the overhead of `-j $(nproc)` on a system with more than 2 cores eats up any time gains that parallelism would have brought.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1416
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:27:31 +00:00
John Johansen
926929da16 Merge Write basic file complain-mode regression tests
The test "Complain mode profile (file exec cx permission entry)" currently will only pass on a Ubuntu Oracular system due to a kernel bugfix patch that has not yet been upstreamed or backported.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1415
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:26:40 +00:00
John Johansen
d0d6975a1f Merge Remove unused and broken dup_value_list function
This function was broken all this time: instead of duplicating each entry in the list, it would duplicate the first entry n times. Since this function is currently not used anywhere, delete it instead of fixing it.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1421
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:24:52 +00:00
John Johansen
b6adc6b9e5 Merge Make parser_misc keyword_table and rlimit_table unordered_maps
Besides of transitioning towards C++, this also eliminates the linear scan search that the functions using these arrays did.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1420
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-15 00:24:09 +00:00
Ryan Lee
ae5a16bfd1 Use list_remove_at macro in mount.cc:extract_flags
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-14 10:36:30 -08:00
John Johansen
82e4b4ba00 regression tests: Add test to check for DAC permissions to the testsuite
The regression test suite uses root with capabilities restricted in
several tests. This can cause the test suite to fail in weird and
confusing ways.

Add a test to check for DAC permissiosns from / to the testsuite
and abort running the tests with an error message if DAC permissions
are going to cause the test suite to fail.

Currently the test is pretty basic, but is better than nothing.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-14 10:20:37 -08:00
Ryan Lee
af5cd5002b Remove unused and broken dup_value_list function
This function was broken all this time: instead of duplicating each entry
in the list, it would duplicate the first entry n times. Since this
function is currently not used anywhere, delete it instead of fixing it.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-13 15:53:08 -08:00
Ryan Lee
88719dbb7b Fix infinite loop in chfa.cc:weld_file_to_policy
This is simple enough to fix even if weld_file_to_policy isn't used in practice
with the compat layer that uses it being a target for deletion

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-13 15:46:38 -08:00
Ryan Lee
5b391a5a4f Remove unused list_remove and list_find_prev helper macros in parser.h
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-13 14:51:08 -08:00
Ryan Lee
d9ee417dc3 Add missing null check in mount.cc:extract_flags
There is a null check before storing invflags into inv, but not before initializing the value at inv to 0.
Assuming the null check is needed, it should be there in both places.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-13 14:45:55 -08:00
Ryan Lee
9689e3a39f Clarify duplicate insertion logic in parser_alias.c:process_entries
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-13 14:34:55 -08:00
Ryan Lee
cb110eaf98 Write basic file complain-mode regression tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-12 12:08:22 -08:00
John Johansen
a31343c5f7 parser: fix expr MatchFlag dump
Match Flags convert output to hex but don't restore after outputting
the flag resulting in following numbers being hex encoded. This
results in dumps that can be confusing eg.

rule: \d2  ->  \x2 priority=1001 (0x4/0)< 0x4>

rule: \d7  ->  \a priority=3e9 (0x4/0)< 0x4>

rule: \d10  ->  \n priority=3e9 (0x4/0)< 0x4>

rule: \d9  ->  \t priority=3e9 (0x4/0)< 0x4>

rule: \d14  ->  \xe priority=1001 (0x4/0)< 0x4>

where priority=3e9 is the hex encoded priority 1001.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-11 14:39:40 -08:00
John Johansen
f24fc4841f Merge parser: fix mapping of AA_CONT_MATCH for policydb compat entries
The mapping of AA_CONT_MATCH was being dropped resulting in the
tcp tests failing because they would only match up to the first conditional
match check in the layout.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/462
Fixes: e29f5ce5f ("parser: if extended perms are supported by the kernel build a permstable")
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1409
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-11 20:53:08 +00:00
John Johansen
eb365b374d Merge parser: bug fix do not change auditing information when applying deny
The parser recently changed how/where deny information is applied.
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed the implicit filtering of explicit denies during
the minimization pass. The implicit clear allowed the explicit
information to be carried into the minimization pass and merged with
implicit denies. The end result being a minimized dfa with the explicit
deny information available to be applied post minimization, and
then dropped later at permission encoding in the accept entries.

Extended permission however enable carrying explicit deny information
into the kernel to fix certain bugs like complain mode not being
able to distinguish between implicit and explicit deny rules (ie.
deny rules get ignored in complain mode). However keeping explicit
deny information when unnecessary result in a larger state machine
than necessary and slower compiles.

commit 179c1c1ba ("parser: fix minimization check for filtering_deny")
Moved the explicit apply_and_clear_deny() pass to before minimization
to restore mnimization's ability to create a minimized dfa with
explicit and implicit deny information merged but this also cleared
the explicit deny information that used to be carried through
minimization. This meant that when the deny information was applied
post minimization it resulted in the audit and quiet information
being cleared.

This resulted in the query_label tests failing as they are checking
for the expected audit infomation in the permissions.

Fixes: 179c1c1ba ("parser: fix minimization check for filtering_deny")
Bug: https://gitlab.com/apparmor/apparmor/-/issues/461
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1408
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-11 20:52:19 +00:00
Christian Boltz
55db4af979 Quote indirect uses of $bin and ${bin}
... to avoid issues with spaces in a parent directory's name.

"Indirect uses" means usage of $bin via another variable, for example
`foo=$bin/whatever`
2024-11-10 22:10:42 +01:00
Christian Boltz
22cf88b7c7 Quote all uses of $bin and ${bin}
... to avoid issues with spaces in a parent directory's name.
2024-11-10 22:10:42 +01:00
Christian Boltz
e1972eb22f Fix sourcing prologue.inc if parent directory contains spaces
Most `tests/regression/apparmor/*.sh` scripts contain

    . $bin/prologue.inc

This will explode if one of the parent directories contains a space.

Minimized reproducer:

```
pwd=`dirname $0`
pwd=`cd $pwd ; /bin/pwd`
bin=$pwd
echo "pwd: $bin"
. $bin/prologue.inc
pwd: /tmp/foo bar
./test.sh: line 9: /tmp/foo: No such file or directory
```

Notice that test.sh tries to source `/tmp/foo` instead of `/tmp/foo bar/prologue.inc`.

The fix - as done in this commit - is to quote the prologue.inc path:

    . "$bin/prologue.inc"
2024-11-10 22:10:32 +01:00
John Johansen
4c32ad8fb7 Merge test-logprof: Increase timeout once more
Builds for risc64 are much slower than on other architectures (4-5
seconds with qemu-user or on Litchi Pi 4A).

Since the timeout is only meant as a safety net, increase it generously,
and hopefully for the last time.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/463

I propose this patch for 4.0 and master.

Closes #463
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1417
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-09 22:37:24 +00:00
Christian Boltz
508ace452d test-logprof: Increase timeout once more
Builds for risc64 are much slower than on other architectures (4-5
seconds with qemu-user or on Litchi Pi 4A).

Since the timeout is only meant as a safety net, increase it generously,
and hopefully for the last time.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/463
2024-11-09 19:57:00 +01:00
Ryan Lee
d7cf845437 Make capabilities tracker into a class
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-08 14:55:43 -08:00
Ryan Lee
f6f3279c10 Make parser_misc keyword_table and rlimit_table unordered_maps
Besides of transitioning towards C++ this also eliminates the linear scan search that the functions using these arrays did.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-08 14:52:16 -08:00
Ryan Lee
f9a2c3c0eb Pass parallelism arg to parser_sanity test prove invocation
Because the main overhead of the parser_sanity test suite is process
spawning, parallelizing too much could end up hurting performance instead
of helping it. Thus, use a fixed value of 2 instead of $(nproc).

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-08 09:34:03 -08:00
Steve Beattie
5b98577a4d gitlab-ci: Build regression test suite in CI
Even if we can't run the regression tests in our GitLab CI environment, we can at least ensure the binaries in the regression test suite compile successfully.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1414
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
2024-11-07 20:06:30 +00:00
Ryan Lee
630b38238d Build regression tests in GitLab CI
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-07 11:47:55 -08:00
John Johansen
0828ab67b2 Merge regression tests: check for setfattr binary used by xattrs_profile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1412
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-07 03:27:28 +00:00
John Johansen
aa24194981 Merge Don't use hardcoded cerr in hfa.h State::dump
After https://gitlab.com/apparmor/apparmor/-/merge_requests/1410#note_2197215172 I did a quick grep and uncovered one other potential instance of `cerr` being written to in a dump function that takes an `ostream`.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1413
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-07 03:25:42 +00:00
Ryan Lee
d1cecd5f46 Don't use hardcoded cerr in hfa.h State::dump
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-06 18:00:16 -08:00
Ryan Lee
b39a535cb9 regression tests: check for setfattr binary used by xattrs_profile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-06 17:36:37 -08:00
John Johansen
15a02e0948 parser: fix mapping of AA_CONT_MATCH for policydb compat entries
The mapping of AA_CONT_MATCH was being dropped resulting in the
tcp tests failing because they would only match up to the first conditional
match check in the layout.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/462
Fixes: e29f5ce5f ("parser: if extended perms are supported by the kernel build a permstable")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-06 12:33:36 -08:00
John Johansen
45964d34e7 parser: add the abilitiy to dump the permissions table
Instead of encoding permissions in the accept and accept2 tables
extended perms uses a permissions table and accept becomes an index
into the table.

Add the ability to dump the permissions table so that it can be
compared and debugged.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-06 11:44:30 -08:00
John Johansen
00dedf10ad parser: add the accept2 table entry to the chfa dump
The chfa dump is missing information about the accept2 entry. The
accept2 information is necessary to help with debugging state machine
builds as accept2 is used to store quiet and audit information in the
old format or conditional information in the extended perms format.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-06 09:21:03 -08:00
John Johansen
7cc7f47424 parser: fix and cleanup libapparmor_re/Makefile
The Makefile is missing some of its .h depenedncies causing compiles
to either fail or worse result in bad builds when rebuilding in an
already built tree.

Move the header dependencies into a variable and use it for each
target. While some targets don't need every include as a dependency
and this will result in unnecessary rebuilds in some cases, it makes
the Makefile cleaner, easier to maintain and makes sure a dependency
isn't accidentally missed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-06 09:20:51 -08:00
John Johansen
9ea0d4f89b parser: bug fix do not change auditing information when applying deny
The parser recently changed how/where deny information is applied.
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed the implicit filtering of explicit denies during
the minimization pass. The implicit clear allowed the explicit
information to be carried into the minimization pass and merged with
implicit denies. The end result being a minimized dfa with the explicit
deny information available to be applied post minimization, and
then dropped later at permission encoding in the accept entries.

Extended permission however enable carrying explicit deny information
into the kernel to fix certain bugs like complain mode not being
able to distinguish between implicit and explicit deny rules (ie.
deny rules get ignored in complain mode). However keeping explicit
deny information when unnecessary result in a larger state machine
than necessary and slower compiles.

commit 179c1c1ba ("parser: fix minimization check for filtering_deny")
Moved the explicit apply_and_clear_deny() pass to before minimization
to restore mnimization's ability to create a minimized dfa with
explicit and implicit deny information merged but this also cleared
the explicit deny information that used to be carried through
minimization. This meant that when the deny information was applied
post minimization it resulted in the audit and quiet information
being cleared.

This resulted in the query_label tests failing as they are checking
for the expected audit infomation in the permissions.

Fixes: 179c1c1ba ("parser: fix minimization check for filtering_deny")
Bug: https://gitlab.com/apparmor/apparmor/-/issues/461
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-11-06 09:11:43 -08:00
Ryan Lee
a2df3143d1 Remove aa_query_file_{path,link}_len wrappers
The prefix can be done in higher-level languages via slicing and having an explicit length exposes an out-of-bounds memory read footgun to those higher level languages

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-06 09:10:56 -08:00
Ryan Lee
53e3116350 Write test for aa_gettaskcon SWIG wrapper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-06 09:10:56 -08:00
Ryan Lee
d199c2ae33 Write custom SWIG typemap for pid_t
Surprisingly, SWIG did not pick up the "typedef int pid_t" from the C headers.
As such, we need to provide our own wrapper. We don't just replicate the typdef
because we still support systems that have 16-bit PIDs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-06 09:10:45 -08:00
John Johansen
8df57ba89c Merge aa.py is_known_rule(): remove obsolete sanity check
We use ProfileStorage everywhere, which makes checking if a specific
rule_type exists obsolete.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1405
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:13:36 +00:00
John Johansen
e36ef0ed43 Merge aa.py: drop unused function profile_exists()
I don't know when (or even: if) this function was in use. A quick look
at the git history of aa.py shows that the function was (blindly?)
updated a few times. However, I didn't find a commit that uses or stops
using profile_exists(), so maybe it was never used at all.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1404
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:12:38 +00:00
John Johansen
5ebbe788ea Merge aa-mergeprof: prevent backtrace if file not found
If a user specifies a non-existing file to merge into the profiles
(`aa-mergeprof /file/not/found`), this results in a backtrace showing an
AppArmorBug because that file unsurprisingly doesn't end up in the
active_profiles filelist.

Handle this more gracefully by adding a read_error_fatal parameter to
read_profile() that, if set, forwards the exception. With that,
aa-mergeprof doesn't try to list the profiles in this non-existing file.

Note that all other callers of read_profile() continue to ignore read
errors, because aborting just because a single file in /etc/apparmor.d/
(for example a broken symlink) isn't readable would be a bad idea.

This bug was introduced in 4e09f315c3, therefore I propose this patch for 3.0..master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1403
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:11:27 +00:00
John Johansen
3c40aab1a0 Merge profiles: update dconf abstraction to use @{etc_ro}
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1402
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:06:57 +00:00
John Johansen
bfa9147182 Merge php-fpm: widen allowed socket paths
It is common for packaged PHP applications to ship a PHP-FPM
configuration using a scheme of "$app.sock" or or "$app.socket" instead
of using a generic FPM socket.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1406
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:05:29 +00:00
John Johansen
14f54f3df2 Merge Misc small fixes to resolve some compiler warnings in regression test suite
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1407
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-11-06 03:04:18 +00:00
Ryan Lee
2ce217b873 Test SWIG Python bindings for aa_query_file_path
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
edb4a72c8c SWIG aa_query helper bitmask constants and stdint header
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
5db4908fd7 SWIG Python test for change_hat type signatures
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
930fca1e39 SWIG Python test refactoring of AppArmor enabled checks
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
369c9e73de Test aa_getcon SWIG bindings and leave some comments for untested ones
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
48901f2118 Write a test for aa_splitcon's SWIG bindings
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
c471acbe44 Typemaps for allowed, audited outputs of query functions
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:53 -08:00
Ryan Lee
cdb3e4a14e Add typemap for Python SWIG aa_change_hatv so it can take a string list
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:38:35 -08:00
Ryan Lee
ea2c957f14 Write basic test for Python aa_find_mountpoint
Also exercises aa_is_enabled

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:37:51 -08:00
Ryan Lee
04da4c86b0 Write custom typemap for aa_splitcon
Can't use %cstring_mutable because aa_splitcon also returns a ptr

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:37:51 -08:00
Ryan Lee
f05112b5e9 aa_is_enabled now returns a boolean in Python
Because boooleans are a subclass of ints in Python, this isn't a breaking change

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:37:51 -08:00
Ryan Lee
a15768b0bf Write an output typemap for errno-based functions
In Python, return status is signalled by exceptions (or lack thereof)
instead of int. Keep the typemap portable for any other languages we may
add in the future.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 18:37:23 -08:00
Ryan Lee
50d26beb00 Include cstring.i and some cstring output typemaps for libapparmor SWIG
This includes a custom typemap to handle (char **label, char **mode)
pairs and a cstring_output_allocate declaration for char **mnt.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 16:40:48 -08:00
Ryan Lee
d273055ebf Use fn arg in pivot_root _clone instead of hardcoding everywhere
The only use of this _clone function passes in the same function that was
hardcoded, so this doesn't change any functionality.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 12:34:44 -08:00
Ryan Lee
823d14df80 Reserve enough space for full possible fd length
Even if file descriptor values would not exercise the full range provided
by int, it doesn't hurt to allocate enough space for all ints.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-11-05 12:34:12 -08:00
Georg Pfuetzenreuter
f575817b68 php-fpm: widen allowed socket paths
It is common for packaged PHP applications to ship a PHP-FPM
configuration using a scheme of "$app.sock" or or "$app.socket" instead
of using a generic FPM socket.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2024-11-05 20:03:11 +01:00
Christian Boltz
db1ca4f5e8 aa.py is_known_rule(): remove obsolete sanity check
We use ProfileStorage everywhere, which makes checking if a specific
rule_type exists obsolete.
2024-11-03 21:21:39 +01:00
Christian Boltz
c10b39f3fe aa.py: drop unused function profile_exists()
I don't know when (or even: if) this function was in use. A quick look
at the git history of aa.py shows that the function was (blindly?)
updated a few times. However, I didn't find a commit that uses or stops
using profile_exists(), so maybe it was never used at all.
2024-11-03 21:06:27 +01:00
Christian Boltz
e5479bd7ef aa-mergeprof: prevent backtrace if file not found
If a user specifies a non-existing file to merge into the profiles
(`aa-mergeprof /file/not/found`), this results in a backtrace showing an
AppArmorBug because that file unsurprisingly doesn't end up in the
active_profiles filelist.

Handle this more gracefully by adding a read_error_fatal parameter to
read_profile() that, if set, forwards the exception. With that,
aa-mergeprof doesn't try to list the profiles in this non-existing file.

Note that all other callers of read_profile() continue to ignore read
errors, because aborting just because a single file in /etc/apparmor.d/
(for example a broken symlink) isn't readable would be a bad idea.
2024-11-01 22:39:32 +01:00
Georgia Garcia
cbe8d295a5 profiles: update dconf abstraction to use @{etc_ro}
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-31 09:52:07 +01:00
Georgia Garcia
f7b5d0e783 Merge Improvements to Postfix profiles
* Support /usr/libexec/postfix/ path
* Added abstractions/{nameservice,postfix-common} to postfix-postscreen
* Added postfix-tlsproxy, postscreen & spawn to postfix-master
    * Added missing postfix-tlsproxy profile
* Added postscreen cache map (see <https://www.postfix.org/postconf.5.html#postscreen_cache_map>)
* Added /{var/spool/postfix/,}pid/pass.smtpd to postfix-smtpd

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1330
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-30 10:43:47 +00:00
John Johansen
3d1a3493af Merge profiles: add support for ArchLinux php-legacy package to php-fpm
ArchLinux ships a secondary PHP package called php-legacy with different
paths. As of now, the php-fpm profile will cover this binary but
inadequately restrict it.

Fixes: #454

Closes #454
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1401
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-10-30 09:37:08 +00:00
Christian Pfeiffer
6a5432b2b0 profiles: add support for ArchLinux php-legacy package to php-fpm
ArchLinux ships a secondary PHP package called php-legacy with different
paths. As of now, the php-fpm profile will cover this binary but
inadequately restrict it.

Fixes: #454
2024-10-30 09:39:37 +01:00
pyllyukko
4ccf567d31 Improvements to Postfix profiles
* Support /usr/libexec/postfix/ path
* Added abstractions/{nameservice,postfix-common} to postfix-postscreen
* Added postfix-tlsproxy, postscreen & spawn to postfix-master
    * Added missing postfix-tlsproxy profile
* Added postscreen cache map (see <https://www.postfix.org/postconf.5.html#postscreen_cache_map>)
* Added /{var/spool/postfix/,}pid/pass.smtpd to postfix-smtpd
2024-10-29 20:35:28 +02:00
John Johansen
4fe3e30abc Merge abstractions/nameservice: include nameservice-strict
... and drop all rules it contains from abstractions/nameservice.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1373
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 15:26:43 +00:00
John Johansen
82a4e70248 Merge zgrep: deny passwd access
Bash will try to read the passwd database to find the shell of a user if
$SHELL is not set. This causes zgrep to trigger

```
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```

if called in a sanitized environment. As the functionality of zgrep is
not impacted by a limited Bash environment, add deny rules to avoid the
potentially misleading AVC messages.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1361
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 13:50:06 +00:00
John Johansen
d5777c0403 Merge ProfileStorage: store correct name
Instead of always storing the name of the main profile, store the child
profile/hat name if we are in a child profile or hat.

As a result, we always get the correct "profile xy" header even for
child profiles when dumping the ProfileStorage object.

Also extend the tests to check that the name gets stored correctly.

.

Add aa-complain tests for profile with hats and subprofiles

So far, change_profile_flags() in aa.py is the only user of
ProfileStorage's 'name'.

Rewrite minitools test_cleanprof() so that most of its code can be
reused, and add a test that runs 'aa-complain
/usr/bin/a/simple/cleanprof/test/profile' on cleanprof.in to ensure
aa-complain still works as expected on subprofiles and hats.

Note: aa-complain $profilename will change the flags of hats, but not
child profiles. This is a known issue, and doesn't change with this MR.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1359
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 13:48:30 +00:00
John Johansen
e48ab421b5 Merge Check if all profiles and abstractions contain abi/4.0
... and add abi/4.0 where it was missing

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1358
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 12:48:41 +00:00
John Johansen
ab16377838 Merge zgrep: allow reading /etc/nsswitch.conf and /etc/passwd
Seen on various VMs, my guess is that bash wants to translate a uid to a
username.

Log events (slightly shortened)

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I propose this patch for 3.0..master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1357
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 12:45:48 +00:00
John Johansen
ac704a5ba6 Merge Small fixset 1 for parser code nits
Numbered as 1 because I expect to find and fix more things like this as I continue to dig into the parser code.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1400
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 12:33:02 +00:00
Georgia Garcia
a8b6c90d29 Merge common_test setup_aa(): drop try/except
... which only existed for historical reasons

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1389
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-29 11:16:30 +00:00
Georgia Garcia
45a3bbb2c9 Merge Several test-libapparmor-test_multi.py fixes
Several fixes for test-libapparmor-test_multi.py and the expected profiles. The most important fix is that testing exec events/rules now works.

Please check the individual commits for details and readable diffs.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1390
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-29 11:15:09 +00:00
John Johansen
99261bad11 Merge Fix memory leak in aare_rules UniquePermsCache
When the find fails but the insertion also fails, we leak the new node
that we generated. Delete the new node in this case to avoid leaking
memory.

The question remains, however, as to whether we should implement `operator==` in addition to `operator<` so that they are consistent with each other and `find` works correctly.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1399
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-10-29 11:12:05 +00:00
Georgia Garcia
c6edb65fc1 Merge Add a test for aa-autodep
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1398
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-29 11:07:14 +00:00
Ryan Lee
6a1e9f916b Replace BOOL,TRUE,FALSE macros with actual C++ boolean type
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-28 12:35:57 +01:00
Ryan Lee
b43f1c4073 Make parser_include push_include_stack take const char because it doesn't actually modify it
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-28 12:35:26 +01:00
Ryan Lee
81950dae4e Fix memory leak in aare_rules UniquePermsCache
When the find fails but the insertion also fails, we leak the new node
that we generated. Delete the new node in this case to avoid leaking
memory.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-28 12:23:17 +01:00
John Johansen
e9d6e0ba14 Merge parser: fix minimization check for filtering deny
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed implicit filtering of explicit denies in the
minimization pass (the information was ignored in building the set of
final accept states).

The filtering of explicit denies reduces the size of the produced
dfa. Since we need to be smarter about when explicit denies are
kept (eg. during complain mode), and most dfas are limited to 65k
states we currently need to filter explicit deny perms by default.

To compensate commit 2737cb2c2 ("parser: minimization - remove
unnecessary second minimization pass") moved the
apply_and_clear_deny() to before minimization. However its check to
apply removal denials before minimization is broken. Remove minimization
triggering apply_and_clear_deny() and just set the FILTER_DENY flag
by default, until we have better selection of rules/conditions where
explicit deny information should be carried through to the backend.

Fixes: 2737cb2c2 ("parser: minimization - remove unnecessary second minimization pass")
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1397
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-10-28 11:22:57 +00:00
John Johansen
a5da9d5b5d Merge parser: fix integer overflow bug in rule priority comparisons
There is an integer overflow when comparing priorities when cmp is
used because it uses subtraction to find lessthan, equal, and greater
than in one operation.

But INT_MAX and INT_MIN are being used by priorities and this results
in INT_MAX - INT_MIN and INT_MIN - INT_MAX which are both overflows
causing an incorrect comparison result and selection of the wrong
rule permission.

Closes: https://gitlab.com/apparmor/apparmor/-/issues/452
Fixes: e3fca60d1 ("parser: add the ability to specify a priority prefix to rules")
Signed-off-by: John Johansen <john.johansen@canonical.com>

Closes #452
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1396
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-10-28 11:21:31 +00:00
John Johansen
e2d55844a2 parser: fix integer overflow bug in rule priority comparisons
There is an integer overflow when comparing priorities when cmp is
used because it uses subtraction to find lessthan, equal, and greater
than in one operation.

But INT_MAX and INT_MIN are being used by priorities and this results
in INT_MAX - INT_MIN and INT_MIN - INT_MAX which are both overflows
causing an incorrect comparison result and selection of the wrong
rule permission.

Closes: https://gitlab.com/apparmor/apparmor/-/issues/452
Fixes: e3fca60d1 ("parser: add the ability to specify a priority prefix to rules")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:03:53 -07:00
Christian Boltz
1f8227e671 Add a test for aa-autodep 2024-10-27 21:55:35 +01:00
John Johansen
179c1c1ba7 parser: fix minimization check for filtering_deny
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed implicit filtering of explicit denies in the
minimization pass (the information was ignored in building the set of
final accept states).

The filtering of explicit denies reduces the size of the produced
dfa. Since we need to be smarter about when explicit denies are
kept (eg. during complain mode), and most dfas are limited to 65k
states we currently need to filter explicit deny perms by default.

To compensate commit 2737cb2c2 ("parser: minimization - remove
unnecessary second minimization pass") moved the
apply_and_clear_deny() to before minimization. However its check to
apply removal denials before minimization is broken. Remove minimization
triggering apply_and_clear_deny() and just set the FILTER_DENY flag
by default, until we have better selection of rules/conditions where
explicit deny information should be carried through to the backend.

Fixes: 2737cb2c2 ("parser: minimization - remove unnecessary second minimization pass")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-25 01:14:18 -07:00
John Johansen
8d6270e1fe Merge Use parallelism and make --touch when building in GitLab CI for faster CI times
As per https://docs.gitlab.com/ee/ci/pipelines/compute_minutes.html#gitlab-hosted-runner-cost-factors, GitLab CI computes minutes as wall clock time per stage * a constant cost factor derived from the runner type, so using parallelism in `make -j $(nproc)` will reduce the time it takes for GitLab CI to complete without increasing usage of GitLab CI minutes.

When investigating this, I also found out that the test stages needlessly rebuilt large parts of the C code base due to mtimes not being preserved when artifacts are restored from the build stage. Adding `make --touch` updates the mtimes so that the subsequent tests do not need to rebuild binaries needlessly.

The combined changes in this MR reduce the CI time from 13 minutes and 57 seconds (cb0f84e101 of `master`, https://gitlab.com/rlee287/apparmor/-/pipelines/1501017669 on my own fork without Coverity) to 12 minutes and 49 seconds (https://gitlab.com/rlee287/apparmor/-/pipelines/1502723883). This comparison omits the `make -j $(nproc)` addition to cov-build since I do not have a way of testing its effectiveness.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1387
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-24 12:30:12 +00:00
Christian Boltz
8eff7cd98f test-multi: no longer expect testcase01, 12 and 13 to fail
'testcase01', 'testcase12' and 'testcase13' contain a strange mix of
exec and network events.

Nevertheless, there's enough information to parse them as good-enough
exec events. While this is not perfectly correct, it's better than
skipping these logs in this test.

Stop expecting that these profiles have a wrong content, and adjust them
so that they contain the (somewhat) expected exec rule.
2024-10-23 19:25:35 +02:00
Christian Boltz
02e2ce0ad9 test exec events/rules in test-libapparmor-test_multi.py
So far, exec events were accidentally skipped in
test-libapparmor-test_multi.py because aa[profile][hat] was not
initialized, and ask_exec() exited early because of this.

Initialize aa[profile][hat] in the test to fix this.

To avoid that someone needs to select "inherit" each time the tests run,
add an optional default_ans parameter to ask_exec(), and let the test
call it with 'CMD_ix'.

(In case you wonder - defaulting to CMD_cx would ask to sanitize the
environment. CMD_ix avoids this.)

Also, we have to copy over aa[profile][hat] to log_dict in the test
because ask_exec() modifies aa[...], but the test only checks its local
log_dict.

Finally, add the expected exec rules to the *.profile files
2024-10-23 19:25:35 +02:00
Christian Boltz
5d0fd65a69 test-libapparmor-test_multi.py: use reset_aa()
... instead of resetting various apparmor.aa variables manually.
2024-10-23 19:25:35 +02:00
Christian Boltz
4276e80ed5 aa.py: Add load_sev_db()
... to de-duplicate code loading the severity db.
2024-10-23 19:25:35 +02:00
Christian Boltz
183d00e087 test_multi: fix testcase_dbus_09.profile
peer name=... is invalid in dbus message rules.

Note that this testcase is currently disabled in the utils tests because
it's based on a multiline log.
2024-10-23 19:25:34 +02:00
Christian Boltz
209dd851b3 test_multi: no longer skip testcase31
It is handled correctly in the current codebase.

It would be even better if it would generate a link rule that includes
the source, but let's leave that for a later fix.
2024-10-23 19:25:32 +02:00
Christian Boltz
19b4aeb338 Merge aa.py: drop unused confirm_and_abort() and delete_profile()
confirm_and_abort() is unused (note that a function with the same name
exists in ui.py and is used there)

Also delete the now-unused delete_profile() - luckily it was never used,
because it would also have deleted profiles that were "just" modified.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1388
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-10-21 14:20:48 +00:00
Christian Boltz
8791c7c48d common_test setup_aa(): drop try/except
... which only existed for historical reasons
2024-10-20 20:49:03 +02:00
Christian Boltz
4dd3ce0097 aa.py: drop unused confirm_and_abort() and delete_profile()
confirm_and_abort() is unused (note that a function with the same name
exists in ui.py and is used there)

Also delete the now-unused delete_profile() - luckily it was never used,
because it would also have deleted profiles that were "just" modified.
2024-10-20 16:16:30 +02:00
Steve Beattie
4d3b094d9e profiles: transmission-daemon needs attach_disconnected
Systemd's PrivateTmp= in transmission service is causing mount namespaces to be used leading to disconnected paths

[395201.414562] audit: type=1400 audit(1727277774.392:573): apparmor="ALLOWED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="transmission-daemon" name="run/systemd/notify" pid=193060 comm="transmission-da" requested_mask="w" denied_mask="w" fsuid=114 ouid=0

Fixes: https://bugs.launchpad.net/bugs/2083548
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1355
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
2024-10-18 21:47:09 +00:00
Steve Beattie
3478558904 .gitignore: add mod_apparmor and pam_apparmor files
... that are generated during `make`

I propose this patch for 3.x..master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1374
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
2024-10-18 21:45:52 +00:00
Ryan Lee
01435aaaa3 Pass -j flag for cov-build as well
This is separated out because I have no way of testing this

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-18 13:15:18 -07:00
Ryan Lee
030f991320 GitLab CI: touch built files in test stages before running tests
The artifact restoration step does not preserve mtime, resulting in source files newer than built files, resulting in a needless rebuild of everything before actually running the tests.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-18 11:46:46 -07:00
Ryan Lee
c47943f1af Invoke tst_binaries target with parallelism in GitLab CI
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-18 11:46:40 -07:00
Ryan Lee
2e841655cf Add a tst_binaries target to the parser to build tst binaries
This allows building the tst_* binaries in parallel independently of running the parser test suite

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-18 11:46:40 -07:00
Ryan Lee
88287d4eec Update .gitlab-ci.yml file with -j $(nproc) lines for faster building
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-18 11:45:38 -07:00
John Johansen
cb0f84e101 Merge utils: catch TypeError exception for binary logs
When a log like system.journal is passed on to aa-genprof, for
example, the user receives a TypeError exception: in method
'parse_record', argument 1 of type 'char *'

This patch catches that exception and displays a more meaningful
message.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/436
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #436
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1354
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>
2024-10-17 18:56:25 +00:00
Ryan Lee
099d7aca5d Merge Fix parser compiler warnings about format specifiers with DEBUG set
This fixes format string specification warnings that are emitted when DEBUG=1 is set. As for %s when the pointer is null: even if gcc prints (null) this is still undefined behavior, so we should do this explicitly.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1382
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-17 18:55:28 +00:00
Georgia Garcia
bb5e69f8db utils: catch TypeError exception for binary logs
When a log like system.journal is passed on to aa-genprof, for
example, the user receives a TypeError exception: in method
'parse_record', argument 1 of type 'char *'

This patch catches that exception and displays a more meaningful
message.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/436
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-16 20:35:40 -03:00
Ryan Lee
c1480d761f Merge Future-proof the Python abstraction for beyond Python 3.19
See https://gitlab.com/apparmor/apparmor/-/merge_requests/1376#note_2161284748

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1381
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-16 22:27:21 +00:00
Ryan Lee
776c56bd7e Fix compiler warnings about format specifiers with DEBUG set
As for %s when the pointer is null: even if gcc prints (null) this is still undefined behavior, so we should do this explicitly

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-16 12:26:54 -07:00
John Johansen
e23633ff0e Merge abstractions/nameservice: tighten libnss_libvirt file access
Limit access to \*.status files located in /var/lib/libvirt/dnsmasq/ as opposed to every file in the same directory.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1379
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>
2024-10-16 18:24:04 +00:00
Ryan Lee
8eb7e7f63b Future-proof the Python abstraction for beyond Python 3.19
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-16 09:36:32 -07:00
Ryan Lee
6d20a10606 Merge Small fixes to libapparmor man pages, including type signature fix
These are small changes to the man pages, with the most important one being updating some function signatures to be consistent with apparmor.h.

We should put together a man page for aalogparse functions too, but I'm submitting this MR first to get the smaller changes in faster.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1378
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-16 16:25:12 +00:00
Christian Boltz
04c9ffbb19 Merge Replace sigalarm-based subprocess timeout with the built-in one
The timeout parameter for subprocess.Popen.communicate has been available since Python 3.3. Given the fragility of SIGALRM based mechanisms, there's no reason to reimplement our own timeout instead of using the built-in one.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1377
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-10-16 12:25:33 +00:00
Giampaolo Fresi Roglia
5be4295b5a abstractions/nameservice: tighten libnss_libvirt file access 2024-10-16 10:48:03 +02:00
Ryan Lee
ffc46247ad Proofreading of libapparmor manpages to fix a few nits
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-15 17:07:02 -07:00
Ryan Lee
6c8a5bedff Add comment to explain podchecker warning for aa_find_mountpoint.pod
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-15 17:05:42 -07:00
Ryan Lee
38e06cf09a Make libapparmor man page type signatures consistent with apparmor.h
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-15 17:05:42 -07:00
Ryan Lee
ed0b539c94 Replace sigalarm-based subprocess timeout with the built-in one
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-15 16:51:17 -07:00
Christian Boltz
2ea82b866d .gitignore: add mod_apparmor and pam_apparmor files
... that are generated during `make`
2024-10-11 22:07:54 +02:00
Christian Boltz
372ad8f6b9 abstractions/nameservice: include nameservice-strict
... and drop all rules it contains from abstractions/nameservice.
2024-10-11 20:53:52 +02:00
Georgia Garcia
68376e7fee Merge abstraction: add nameservice-strict.
As I have read multiple MR mentioning the `nameservice-strict`. Therefore, I thought it would make sense to directly import it here.

To give some context, this abstraction is probably the most commonly included abstraction (after `base`). In `apparmor.d`, it is used by over 700 profiles (only counting direct import). Therefore, adding new rules can have an important impact over a lot of profiles.

Note: the abstraction is a direct import from https://gitlab.com/roddhjav/apparmor.d. The license is the same, I obviously kept Morfikov copyright line. However, I am not sure either or not the SPDX identifier can be used here.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1368
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-11 12:36:42 +00:00
Alexandre Pujol
1966c36c1d abstraction: add missing abi in nameservice-strict. 2024-10-09 21:42:48 +01:00
Alexandre Pujol
62e7220271 abstraction: include nss-systemd in nameservice-strict. 2024-10-09 21:25:57 +01:00
Alexandre Pujol
1a8d8f3695 abstraction: add nameservice-strict.
Imported from gitlab.com/roddhjav/apparmor.d
2024-10-09 19:57:16 +01:00
Georgia Garcia
a522e11129 Merge Support name resolution via libnss-libvirt
Add support for hostname resolution via libnss-libvirt. This change has been tested against the latest oracular version 10.6.0-1ubuntu3.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1362
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-09 15:12:05 +00:00
Giampaolo Fresi Roglia
e53f300821 nameservice: add support for libnss-libvirt 2024-10-09 10:12:26 +02:00
Georg Pfuetzenreuter
48483f2ff8 zgrep: deny passwd access
Bash will try to read the passwd database to find the shell of a user if
$SHELL is not set. This causes zgrep to trigger

```
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```

if called in a sanitized environment. As the functionality of zgrep is
not impacted by a limited Bash environment, add deny rules to avoid the
potentially misleading AVC messages.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2024-10-06 23:18:52 +02:00
Christian Boltz
d8e86fee75 Add aa-complain tests for profile with hats and subprofiles
So far, change_profile_flags() in aa.py is the only user of
ProfileStorage's 'name'.

Rewrite minitools test_cleanprof() so that most of its code can be
reused, and add a test that runs 'aa-complain
/usr/bin/a/simple/cleanprof/test/profile' on cleanprof.in to ensure
aa-complain still works as expected on subprofiles and hats.

Note: aa-complain $profilename will change the flags of hats, but not
child profiles. This is a known issue, and doesn't change with this MR.
2024-10-06 16:51:12 +02:00
Christian Boltz
cb943e4efc ProfileStorage: store correct name
Instead of always storing the name of the main profile, store the child
profile/hat name if we are in a child profile or hat.

As a result, we always get the correct "profile xy" header even for
child profiles when dumping the ProfileStorage object.

Also extend the tests to check that the name gets stored correctly.
2024-10-06 14:44:12 +02:00
Christian Boltz
8c80c56252 Check if all profiles and abstractions contain abi/4.0
... and add abi/4.0 where it was missing
2024-10-06 12:07:58 +02:00
Christian Boltz
68d42c3e37 zgrep: allow reading /etc/nsswitch.conf and /etc/passwd
Seen on various VMs, my guess is that bash wants to translate a uid to a
username.

Log events (slightly shortened)

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
2024-10-06 11:05:52 +02:00
John Johansen
bb460ba467 Merge .gitlab-ci.yml: run pipeline in merge requests too
Hopefully this will allow us to run pipelines in regular branches but
also run it on merge requests on the parent project. This is needed
for users that are not verified by Gitlab.
https://docs.gitlab.com/ee/ci/pipelines/merge_request_pipelines.html#run-pipelines-in-the-parent-project

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1346
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-04 21:31:51 +00:00
John Johansen
254b324a83 Merge Rename aa_log_record struct fields (C only) to allow inclusion in C++
Do an identifier rename combined with preprocessor directives and SWIG directives to allow the header to be included in C++ while keeping backwards compatibility to the extent possible.

Closes: #439 

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

Closes #439
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1342
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-04 21:28:14 +00:00
Georgia Garcia
645320ae84 profiles: transmission-daemon needs attach_disconnected
Systemd's PrivateTmp= in transmission service is causing mount namespaces to be used leading to disconnected paths

[395201.414562] audit: type=1400 audit(1727277774.392:573): apparmor="ALLOWED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="transmission-daemon" name="run/systemd/notify" pid=193060 comm="transmission-da" requested_mask="w" denied_mask="w" fsuid=114 ouid=0

Fixes: https://bugs.launchpad.net/bugs/2083548
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-04 10:54:48 -03:00
Ryan Lee
2d7440350f Basic test that uses aa_log_record struct fields via old, C++-incompatible names
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 12:46:00 -07:00
Ryan Lee
645b1406d1 Basic test that invokes aalogparse functions from C++ code
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 12:45:55 -07:00
Ryan Lee
3cb61b6b41 Add extern "C" decls to aalogparse.h for C++ usage of aalogparse
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 12:44:25 -07:00
Ryan Lee
e2c407c614 Add SWIG renames for fields to preserve backcompat
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 12:44:18 -07:00
Ryan Lee
3f5180527d Rename aa_log_record struct fields (C only) to allow inclusion in C++
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 12:43:33 -07:00
John Johansen
b52c9bb860 Merge Convert original_aa from hasher to dict
This requires adding some `.get()` guards at one place, but should
otherwise be a boring change.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1347
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-03 18:36:29 +00:00
Ryan Lee
5b141dd580 Merge Remove aa_query_label from SWIG bindings
This is one of those functions that never worked anyways, because it
modified the passed-in label in place. Moreover, it is a low-level
interface that requires its callers to manually construct a binary query.
As such, it would be better not to expose it and to add wrappers like
aa_query_file_path for the other query classes if that functionality is
needed later.

The removal of this function from the bindings was dropped from !1337 because it exposed functionality that was not present in wrappers around aa_query_label. However, upon further discussion, we decided that it'd be better to remove it now and add other wrappers to libapparmor itself if the functionality provided by the existing wrappers became insufficient.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1352
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-03 18:25:52 +00:00
Ryan Lee
d3603a1f20 Remove aa_query_label from SWIG bindings
This is one of those functions that never worked anyways, because it
modified the passed-in label in place. Moreover, it is a low-level
interface that requires its callers to manually construct a binary query.
As such, it would be better not to expose it and to add wrappers like
aa_query_file_path for the other query classes if that functionality is
needed later.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-03 10:59:25 -07:00
Georgia Garcia
7867a46e2e Merge gitlab-ci.yml: only run coverity in the upstream project
This pipeline only makes sense to run in the upstream project where
the coverity variables are defined, so they currently fail in forks.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1351
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-03 17:46:54 +00:00
Georgia Garcia
c382efe119 gitlab-ci.yml: only run coverity in the upstream project
This pipeline only makes sense to run in the upstream project where
the coverity variables are defined, so they currently fail in forks.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-03 11:12:36 -03:00
Christian Boltz
a56516851e Convert original_aa from hasher to dict
This requires adding some `.get()` guards at one place, but should
otherwise be a boring change.
2024-10-02 22:44:04 +02:00
Georgia Garcia
248e5673ef .gitlab-ci.yml: run pipeline in merge requests too
Hopefully this will allow us to run pipelines in regular branches but
also run it on merge requests on the parent project. This is needed
for users that are not verified by Gitlab.
https://docs.gitlab.com/ee/ci/pipelines/merge_request_pipelines.html#run-pipelines-in-the-parent-project
2024-10-02 17:37:27 -03:00
John Johansen
07fe0e9a1b Merge Fix ABI break for aa_log_record
Commit 3c825eb001 adds a field called `execpath` to the `aa_log_record` struct. This field was added in the middle of the struct instead of the end, causing an ABI break in libapparmor without a corresponding major version number bump.
Bug report: https://bugs.launchpad.net/apparmor/+bug/2083435
This is fixed by simply moving execpath at the end of the struct.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1345
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-10-01 22:06:45 +00:00
Maxime Bélair
c86c87e886 Fix ABI break for aa_log_record 2024-10-01 22:06:45 +00:00
Ryan Lee
d35a6939be Merge Remove broken SWIG functions that we don't actually want to expose
It doesn't make sense to expose the *_raw functions or the varg version
of aa_change_hatv to higher-level languages. While technically a breaking
change, the generated bindings for these functions never actually worked
anyways:

 - aa_change_hat_vargs uses C varargs, which SWIG passes in NULL for by
   default. It does not attempt to process the passed-in arguments at all
   (and in fact caused an unused-argument compiler warning when compiling
   the generated bindings).
 - aa_getprocattr_raw and aa_getpeercon_raw both place output into a ``char
   **mode`` pointer. SWIG by default generates these as opaque pointer
   object arguments, rendering them unusable for getting output. Future
   patches would be needed to fix ``char**`` arguments for the other functions
   that use them. Moreover, these functions expect their caller to handle
   memory allocation, which is also not possible from a higher-level
   language point of view.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1337
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-01 19:16:38 +00:00
Ryan Lee
bdc8889cc0 Remove private _aa_is_blacklisted from SWIG bindings
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-01 11:58:07 -07:00
Ryan Lee
2bd1884654 Remove SWIG aa_change_hat_vargs, aa_get_procattr_raw, aa_get_peercon_raw
It doesn't make sense to expose the *_raw functions or the varg version
of aa_change_hatv to higher-level languages. While technically a breaking
change, the generated bindings for these functions never actually worked
anyways:

 - aa_change_hat_vargs uses C varargs, which SWIG passes in NULL for by
   default. It does not attempt to process the passed-in arguments at all
   (and in fact caused an unused-argument compiler warning when compiling
   the generated bindings).
 - aa_getprocattr_raw and aa_getpeercon_raw both place output into a char
   **mode pointer. SWIG by default generates these as opaque pointer
   object arguments, rendering them unusable for getting output. Future
   patches would be needed to fix char** arguments for the other functions
   that use them. Moreover, these functions expect their caller to handle
   memory allocation, which is also not possible from a higher-level
   language point of view.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-10-01 11:58:07 -07:00
Ryan Lee
bcab725670 Merge Improvements to the SWIG binding handling of aa_log_record and %exception memory management
This patchset adds annotations so that SWIG can automatically manage the memory lifetimes of aa_log_record objects, and ensures proper cleanup is done in the %exception handler.

This is the first of a sequence of MRs to overhaul the SWIG bindings and fix pieces that never actually worked in the first place. As fixing those other pieces will require breaking changes, I am separating out the non-breaking changes into separate MRs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1334
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-10-01 18:55:24 +00:00
Ryan Lee
61b1501f48 Apply 1 suggestion(s) to 1 file(s)
Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-10-01 18:38:04 +00:00
Christian Boltz
4b6df10fe3 Merge ping: allow reading /proc/sys/net/ipv6/conf/all/disable_ipv6
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082190

I propose this patch for 3.0..master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1340
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-09-30 21:42:56 +00:00
Christian Boltz
62ff290c02 Merge abstractions/mesa: allow ~/.cache/mesa_shader_cache_db/
... which is used by Mesa 24.2.2

Reported by darix.

Fixes: https://bugs.launchpad.net/bugs/2081692

I propose this addition for 3.x, 4.0 and master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1333
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-09-30 21:40:03 +00:00
Christian Boltz
247bdd5deb Merge apparmor.vim: Add missing units for rlimit cpu and rttime
... and allow whitespace between the number and the unit.

I propose this patch for 3.x, 4.0 and master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1336
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-09-30 21:35:40 +00:00
Christian Boltz
df4d7cb8da ping: allow reading /proc/sys/net/ipv6/conf/all/disable_ipv6
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082190
2024-09-27 12:05:29 +02:00
Ryan Lee
398f0790de Add DeprecationWarning emission to Python free_record wrapper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-26 11:57:04 -07:00
Ryan Lee
4a7a8fa213 Make Python-side free_record a no-op to prevent double-free
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-26 11:57:04 -07:00
Ryan Lee
e5fd0fc636 Annotate SWIG aa_log_record alloc+dealloc
Swig generates a "thisown" attribute, which is an escape hatch in case
higher-level code does something weird and needs to tell SWIG whether to
free the C object when Python garbage collects it. Adding this attribute
is not a breaking change w.r.t access to the other attributes of the parsed
record.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-26 11:57:04 -07:00
Ryan Lee
436ebda9b5 Use SWIG_fail in %exception upon throwing OSError for errno
Unfortunately SWIG_exception does not support throwing OSError, so this
still requires Python-specific code.

Unlike just returning NULL, this will clean up intermediate allocations.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-26 11:57:04 -07:00
Steve Beattie
65e6620014 libapparmor: merge Rename aa_query_label allow and audit params in headers
This change matches the names in the .c source and the man page for aa_query_label,
and also simplifies the typemap annotations needed to make the SWIG versions usable.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1339
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
2024-09-26 18:52:19 +00:00
Ryan Lee
0c4cda2f1c Rename aa_query_label allow and audit params in headers
This change matches the names in the .c source and the man page for aa_query_label,
and also simplifies the typemap annotations needed to make the SWIG versions usable.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-26 10:58:00 -07:00
Christian Boltz
49b9a20997 abstractions/mesa: allow ~/.cache/mesa_shader_cache_db/
... which is used by Mesa 24.2.2

Reported by darix.

Fixes: https://bugs.launchpad.net/bugs/2081692
2024-09-24 16:39:52 +02:00
Steve Beattie
c4bb6969f5 libapparmor: remove emove remnants of SWIG java files
Merge branch https://gitlab.com/rlee287/apparmor/-/tree/remove_swig_java

The autoconf infrastructure for building this doesn't even show up in the Git history, so there should be no issue with removing the ghosts of Java from the codebase.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1335
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
2024-09-24 05:37:16 +00:00
Christian Boltz
9cb591c5a7 apparmor.vim: Add missing units for rlimit cpu and rttime
... and allow whitespace between the number and the unit.
2024-09-22 16:11:24 +02:00
Ryan Lee
225ea202cf Remove remnants of SWIG java files
The autoconf infrastructure for building this doesn't even show up in the Git history, so there should be no issue with removing the ghosts of Java from the codebase

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-20 16:33:58 -07:00
Georgia Garcia
7dc167ea48 Merge Change swig prototype of aa_getprocattr to match argname
This will matter later on for adding SWIG annotations

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1329
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-09-18 18:05:31 +00:00
Ryan Lee
80bdd22ed7 Change swig prototype of aa_getprocattr to match argname
This will matter later on for adding SWIG annotations

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-17 10:49:41 -07:00
Christian Boltz
7a081cfc67 Merge test-file.py: don't expect translated file permissions
Translating things like 'rw' is pointless and will/should never happen.
Therefore the tests should also expect non-translated file permissions.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1328
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2024-09-17 15:12:32 +00:00
Christian Boltz
b8de035542 test-file.py: don't expect translated file permissions
Translating things like 'rw' is pointless and will/should never happen.
Therefore the tests should also expect non-translated file permissions.
2024-09-17 14:44:20 +02:00
John Johansen
1940b1b7cd Merge utils: fixes when handling owner file rules
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/429
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/430

Closes #429 and #430
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1320
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-17 09:23:30 +00:00
John Johansen
9fe5a6d853 Merge update translations pot file for C code
The parser and binutils pot file have not been recently refreshed. Update them to current code and add missing pot files for aa_load and aa_status. Also give aa_status base support for translations to populate its pot file.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1318
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-17 09:18:10 +00:00
John Johansen
b5af7d5492 Merge aa-notify: Simplify user interfaces and update man page
aa-notify: Simplify user interfaces and update man page

In notifications, Clicking on "allow" now directly adds the rule without
intermediate window, leading to a smoother UX.
Aligning man page with notify.conf.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1313
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-09-17 09:17:24 +00:00
Maxime Bélair
2b32130280 aa-notify: Simplify user interfaces and update man page 2024-09-17 09:17:23 +00:00
John Johansen
37cac653d1 Merge Make libaalogparse fully reentrant by removing its globals
Tested by using Valgrind's Helgrind and DRD against the reentrancy test that I wrote: they both report no errors with the changes while reporting many errors with the old versions.

Commits "Inline _parse_yacc in libaalogparse" and "Make parse_record take a const char pointer since it never modified str anyways" have a tiny potential to be backwards-incompatible changes: I have justified why they shouldn't be in the commit messages, but it's worth looking over in case I was mistaken and we need to back those out.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1322
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-11 07:54:39 +00:00
John Johansen
4628f8e880 Merge Add parser_sanity-no-gen target to run simple_tests
... without all the profiles generated by the gen-*.py scripts.

This target is meant for local manual testing, especially when working
on additional simple_tests profiles.

It makes local testing much faster (15 seconds for ~2k profiles vs.
several minutes for the additional ~70k profiles generated by gen-*.py)

Needless to say that the CI should continue to use the parser_sanity
target that includes all the generated profiles.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1325
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-11 07:50:01 +00:00
John Johansen
43b30b694c Merge Add more tests for network port range
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1326
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-11 07:48:01 +00:00
Christian Boltz
762df7e753 Add more tests for network port range 2024-09-10 23:10:32 +02:00
Christian Boltz
0d5ae170d4 Add parser_sanity-no-gen target to run simple_tests
... without all the profiles generated by the gen-*.py scripts.

This target is meant for local manual testing, especially when working
on additional simple_tests profiles.

It makes local testing much faster (15 seconds for ~2k profiles vs.
several minutes for the additional ~70k profiles generated by gen-*.py)

Needless to say that the CI should continue to use the parser_sanity
target that includes all the generated profiles.
2024-09-10 22:31:11 +02:00
Ryan Lee
79670745d6 Remove remnants of comments regarding old apparmor log format
The entry AA_RECORD_SYNTAX_V1 is only there for API compatibility reasons.
If we wanted to remove it, we could just renumber the other two entries
to preserve ABI compatibility. However, it seems easier to just delete the
entry if we ever break backcompat with a libapparmor2.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:24 -07:00
Ryan Lee
78f138c37f Make parse_record take a const char pointer since it never modified str anyways
This shouldn't be a breaking change because it's fine to pass a
non-const pointer to a function taking a const pointer, but not the other way round

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:24 -07:00
Ryan Lee
66e1439293 Add an aalogparse reentrancy test for simultaneous log parsing from different threads
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:24 -07:00
Ryan Lee
6a55fb5613 Inline _parse_yacc in libaalogparse
This function was only ever called once inside libaalogparse.c, and it looks
simple enough to not need to be split out into its own helper function.

As this function was never exposed publicly in installed header files, removing it
is not a breaking API change.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:24 -07:00
Ryan Lee
7ff045583d Remove manual YYDEBUG define in grammar.y
The generated grammar.h already sets the correct YYDEBUG value regardless
of whether parse.trace is defined

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:24 -07:00
Ryan Lee
dba7669443 Also make the bison parser of libaalogparse fully reentrant
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-10 11:33:20 -07:00
John Johansen
ebeb89cbce Merge parser: add port range support on network policy
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1321
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-09 21:01:21 +00:00
Georgia Garcia
93f3a0fa99 parser: add equality tests for network port range
To run the network port range equality tests, we need to check if the
kernel supports the network_v8/af_inet feature. Also, a new file
features.af_inet is needed containing the af_inet feature.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-09-06 09:49:59 -03:00
Georgia Garcia
f9621054d7 parser: add port range support on network policy
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-09-05 17:01:46 -03:00
Georgia Garcia
2097e82d4a utils: 'owner' should come before 'file'
When both the owner and file keywords were used, the clean rule
generated would have owner after file which is not accepted by the
parser.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/430
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-09-05 14:55:41 -03:00
Georgia Garcia
39f84c3767 utils: fix file handling of old perms with owner
When the profile already contains a "file" rule containing the owner
prefix and the tool is trying to handle a new file entry, it tries to
show it in the logprof header as "old mode".

The issue is that when the owner rule is an implicit all files
permission, then the object "FileRule" is used instead of the set of
permissions. When subtracting FileRule from set() a TypeError
exception is thrown.

Fix this by "translating" FileRule.ALL perms to "mrwlkix".

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/429
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-09-05 14:54:59 -03:00
Ryan Lee
c5c7565357 Silence -Wyacc because we rely on GNU bison extensions to yacc
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-04 14:54:02 -07:00
Ryan Lee
e0504e697a Make libaalogparse lexer fully reentrant by removing its globals
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-04 12:00:13 -07:00
John Johansen
729e28e8b2 Merge Update apparmor-utils.pot
Followup to !1315 that updates apparmor-utils.pot. The other ones should also be updated at some point, so I'm marking this as a draft until we have a better idea of when/how we want to do that.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1316
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-09-03 17:07:04 +00:00
Ryan Lee
c6181c2dbe Update po README with correct directories and pygettext3 binary
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-03 09:35:05 -07:00
Ryan Lee
0f42187672 Run pygettext3 to update apparmor-utils.pot
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-09-03 09:33:33 -07:00
John Johansen
bdedaf61c8 binutils: add translation support to aa_status and initial pot file
Unfortunately aa_status did not support translations. Add a base support
and the initial pot file. There are no translations done at this time.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-09-03 03:39:16 -07:00
John Johansen
3ac53e75d0 binutils: add pot file for aa_load
aa_load was missing a pot file for translations. Add a pot file for
aa_load and sync it to the code.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-09-03 03:39:16 -07:00
John Johansen
0f09501a84 binutils: update pot files for aa_enabled, aa_exec, aa_features_abi
Update the pot files for message changes in aa_enabled.c, aa_exec.c
and aa_features_abi.c

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-09-03 03:39:16 -07:00
John Johansen
ef95c96f45 parser: update translations pot file to current code
The parser pot file should have been updated before beta. Make
sure it is up to date with the current code.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-09-03 03:39:16 -07:00
John Johansen
ab5f180b08 Merge utils: ignore peer when parsing logs for non-peer access modes
utils: ignore peer when parsing logs for non-peer access modes

Some access modes (create, setopt, getopt, bind, shutdown, listen,
getattr, setattr) cannot be used with a peer in network rules.

Due to how auditing is implemented in the kernel, the peer information
might be available in the log (as faddr= but not daddr=), which causes
a failure in log parsing.

When parsing the log, check if that's the case and ignore the peer,
avoiding the exception on the NetworkRule constructor.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/427

Reported-by: Evan Caville <evan.caville@canonical.com>

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #427
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1314
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>
2024-08-30 23:17:08 +00:00
Ryan Lee
8cb2e4ca9f Merge Replace 'scrub the environment' and similar wordings
The wording of "scrub the environment" with respect to execution modes is misleading, because a quick read of it could imply that it removes all environment variables. However, it actually enables ld.so's secure-execution mode, which removes a very limited subset of them. This MR rewords the relevant documentation and prompts. If proper environment variable filtering is added later, the documentation can be updated again then.

Synchronizes-with:
- Wiki page update, which I can do after this MR is approved
- Kernel patch to update wording of debug logs (patch submitted to the Apparmor mailing list [here](https://lists.ubuntu.com/archives/apparmor/2024-August/013339.html))

Things that may need updating first:

- Translations: attempting to update `utils/po/apparmor-utils.pot` resulted in a bunch of unrelated changes, so I'd like to ask about translation statuses before making a commit that updates that file properly.
- Adding info on which libc's actually behave differently based on AT_SECURE: glibc and musl libc both do, but they may do subtly different things. I don't know about other libc's.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1315
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2024-08-30 16:14:13 +00:00
Georgia Garcia
1f7d7cd0e0 test_multi: add example of getattr perm with peer in the logs
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-29 17:12:54 -03:00
Georgia Garcia
7562c48c74 utils: ignore peer when parsing logs for non-peer access modes
Some access modes (create, setopt, getopt, bind, shutdown, listen,
getattr, setattr) cannot be used with a peer in network rules.

Due to how auditing is implemented in the kernel, the peer information
might be available in the log (as faddr= but not daddr=), which causes
a failure in log parsing.

When parsing the log, check if that's the case and ignore the peer,
avoiding the exception on the NetworkRule constructor.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/427
Reported-by: Evan Caville <evan.caville@canonical.com>
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-29 17:11:41 -03:00
John Johansen
74f254212a Merge profiles: enable php-fpm in /usr/bin and /usr/sbin
To enable the profile in distros that merge sbin into bin.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/421
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #421
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1301
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-08-29 18:46:47 +00:00
John Johansen
cf3428f774 Merge profiles: slirp4netns: allow pivot_root
`pivot_root` is required for running `slirp4netns --enable-sandbox` inside LXD.
- https://github.com/rootless-containers/slirp4netns/issues/348
- https://github.com/rootless-containers/slirp4netns/blob/v1.3.1/sandbox.c#L101-L234

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1298
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-08-29 18:44:15 +00:00
John Johansen
b6e9df3495 Merge parser: fix rule priority destroying rule permissions for some classes
io_uring and userns mediation are encoding permissions on the class
byte. This is a mistake that should never have been allowed.

With the addition of rule priorities the class byte mediates rule,
that ensure the kernel can determine a class is being mediated is
given the highest priority possible, to ensure class mediation can not
be removed by a deny rule. See
  61b7568e1 ("parser: bug fix mediates_X stub rules.")
for details.

Unfortunately this breaks rule classes that encode permissions on the
class byte, because those rules will always have a lower priority and
the class mediates rule will always be selected over them resulting in
only the class mediates permission being on the rule class state.

Fix this by adding the mediaties class rules for these rule classes
with the lowest priority possible. This means that any rule mediating
the class will wipe out the mediates class rule. So add a new mediates
class rule at the same priority, as the rule being added.

This is a naive implementation and does result in more mediates rules
being added than necessary. The rule class could keep track of the
highest priority rule that had been added, and use that to reduce the
number of mediates rules it adds for the class.

Technically we could also get away with not adding the rules for allow
rules, as the kernel doesn't actually check the encoded permission but
whether the class state is not the trap state. But it is required with
deny rules to ensure the deny rule doesn't result in permissions being
removed from the class, resulting in the kernel thinking it is
unmediated. We also want to ensure that mediation is encoded for other
rule types like prompt, and in the future the kernel could check the
permission so we do want to guarantee that the class state has the
MAY_READ permission on it.

Note: there is another set of classes (file, mqueue, dbus, ...) which
encodes a default rule permission as

  class .* <perm>

this encoding is unfortunate in that it will also add the permission
to the class byte, but also sets up following states with the permission.
thankfully, this accespt anything, including nothing generally isn't
valid in the nothing case (eg. a file without any absolute name). For
this set of classes, the high priority mediates rule just ensures
that the null match case does not have permission.

Fixes: 61b7568e1 parser: bug fix mediates_X stub rules.
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1307
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
2024-08-29 18:41:51 +00:00
John Johansen
159c179193 Merge apparmor.d.pod: Fix writing of aa_change_profile
Signed-off-by: Jörg Sommer <joerg@jo-so.de>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1308
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-08-29 18:24:44 +00:00
Ryan Lee
8865ff69d8 Replace 'sanitise the environment' wording in aa.py ask_rule_questions
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-08-28 13:39:52 -07:00
Ryan Lee
65c84071bb Replace 'scrub the environment' wording in man pages with something more accurate
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2024-08-28 11:22:08 -07:00
Georgia Garcia
0ec0e2b035 Merge libapparmor: make af_protos.h consistent in different archs
af_protos.h is a generated table of the protocols created by looking
for definitions of IPPROTO_* in netinet/in.h. Depending on the
architecture, the order of the table may change when using -dM in the
compiler during the extraction of the defines.

This causes an issue because there is more than one IPPROTO defined
by the value 0: IPPROTO_IP and IPPROTO_HOPOPTS which is a header
extension used by IPv6. So if IPPROTO_HOPOPTS was first in the table,
then protocol=0 in the audit logs would be translated to hopopts.

This caused a failure in arm 32bit:

Output doesn't match expected data:
--- ./test_multi/testcase_unix_01.out	2024-08-15 01:47:53.000000000 +0000
+++ ./test_multi/out/testcase_unix_01.out	2024-08-15 23:42:10.187416392 +0000
@@ -12,7 +12,7 @@
 Peer Addr: @test_abstract_socket
 Network family: unix
 Socket type: stream
-Protocol: ip
+Protocol: hopopts
 Class: net
 Epoch: 1711454639
 Audit subid: 322

By the time protocol is resolved in grammar.y, we don't have have
access to the net family to check if it's inet6. Instead of making
protocol dependent on the net family, make the order of the
af_protos.h table consistent between architectures using -dD.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1309
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-26 12:39:26 +00:00
John Johansen
90c1358e49 Merge Revert "utils/emacs: add apparmor-mode.el"
This reverts commit 65b0f83aea.

This has since been moved into its own repo under the apparmor gitlab project at https://gitlab.com/apparmor/apparmor-mode

Signed-off-by: Alex Murray <alex.murray@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1312
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-08-26 05:21:59 +00:00
Alex Murray
2b1ddef16e Revert "utils/emacs: add apparmor-mode.el"
This reverts commit 65b0f83aea.

Signed-off-by: Alex Murray <alex.murray@canonical.com>
2024-08-26 13:54:28 +09:30
Georgia Garcia
95c419dc45 libapparmor: make af_protos.h consistent in different archs
af_protos.h is a generated table of the protocols created by looking
for definitions of IPPROTO_* in netinet/in.h. Depending on the
architecture, the order of the table may change when using -dM in the
compiler during the extraction of the defines.

This causes an issue because there is more than one IPPROTO defined
by the value 0: IPPROTO_IP and IPPROTO_HOPOPTS which is a header
extension used by IPv6. So if IPPROTO_HOPOPTS was first in the table,
then protocol=0 in the audit logs would be translated to hopopts.

This caused a failure in arm 32bit:

Output doesn't match expected data:
--- ./test_multi/testcase_unix_01.out	2024-08-15 01:47:53.000000000 +0000
+++ ./test_multi/out/testcase_unix_01.out	2024-08-15 23:42:10.187416392 +0000
@@ -12,7 +12,7 @@
 Peer Addr: @test_abstract_socket
 Network family: unix
 Socket type: stream
-Protocol: ip
+Protocol: hopopts
 Class: net
 Epoch: 1711454639
 Audit subid: 322

By the time protocol is resolved in grammar.y, we don't have have
access to the net family to check if it's inet6. Instead of making
protocol dependent on the net family, make the order of the
af_protos.h table consistent between architectures using -dD.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-19 18:29:56 -03:00
Jörg Sommer
8195500a1e apparmor.d.pod: Fix writing of aa_change_profile
Signed-off-by: Jörg Sommer <joerg@jo-so.de>
2024-08-17 14:13:08 +02:00
John Johansen
204c0c5a3a parser: fix rule priority destroying rule permissions for some classes
io_uring and userns mediation are encoding permissions on the class
byte. This is a mistake that should never have been allowed.

With the addition of rule priorities the class byte mediates rule,
that ensure the kernel can determine a class is being mediated is
given the highest priority possible, to ensure class mediation can not
be removed by a deny rule. See
  61b7568e1 ("parser: bug fix mediates_X stub rules.")
for details.

Unfortunately this breaks rule classes that encode permissions on the
class byte, because those rules will always have a lower priority and
the class mediates rule will always be selected over them resulting in
only the class mediates permission being on the rule class state.

Fix this by adding the mediaties class rules for these rule classes
with the lowest priority possible. This means that any rule mediating
the class will wipe out the mediates class rule. So add a new mediates
class rule at the same priority, as the rule being added.

This is a naive implementation and does result in more mediates rules
being added than necessary. The rule class could keep track of the
highest priority rule that had been added, and use that to reduce the
number of mediates rules it adds for the class.

Technically we could also get away with not adding the rules for allow
rules, as the kernel doesn't actually check the encoded permission but
whether the class state is not the trap state. But it is required with
deny rules to ensure the deny rule doesn't result in permissions being
removed from the class, resulting in the kernel thinking it is
unmediated. We also want to ensure that mediation is encoded for other
rule types like prompt, and in the future the kernel could check the
permission so we do want to guarantee that the class state has the
MAY_READ permission on it.

Note: there is another set of classes (file, mqueue, dbus, ...) which
encodes a default rule permission as

  class .* <perm>

this encoding is unfortunate in that it will also add the permission
to the class byte, but also sets up following states with the permission.
thankfully, this accespt anything, including nothing generally isn't
valid in the nothing case (eg. a file without any absolute name). For
this set of classes, the high priority mediates rule just ensures
that the null match case does not have permission.

Fixes: 61b7568e1 parser: bug fix mediates_X stub rules.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-08-15 03:51:20 -07:00
John Johansen
4c8a27457e Merge utils: change os.mkdir to self.mkpath to create intermediary dirs
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1306
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2024-08-15 04:45:12 +00:00
Georgia Garcia
a3eca67f38 utils: change os.mkdir to self.mkpath to create intermediary dirs
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-15 00:44:55 -03:00
Georgia Garcia
2083994513 profiles: enable php-fpm in /usr/bin and /usr/sbin
To enable the profile in distros that merge sbin into bin.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/421
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-08-14 10:52:53 -03:00
Akihiro Suda
bf5db67284 profiles: slirp4netns: allow pivot_root
`pivot_root` is required for running `slirp4netns --enable-sandbox` inside LXD.
- https://github.com/rootless-containers/slirp4netns/issues/348
- https://github.com/rootless-containers/slirp4netns/blob/v1.3.1/sandbox.c#L101-L234

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-08-14 17:29:13 +09:00
267 changed files with 4555 additions and 10778 deletions

3
.gitignore vendored
View File

@@ -1,4 +1,4 @@
apparmor-
apparmor-*
cscope.*
binutils/aa-enabled
binutils/aa-enabled.1
@@ -203,7 +203,6 @@ utils/apparmor/*.pyc
utils/apparmor/rule/*.pyc
utils/apparmor.egg-info/
utils/build/
!utils/emacs/apparmor-mode.el
utils/htmlcov/
utils/test/common_test.pyc
utils/test/.coverage

View File

@@ -1,9 +1,3 @@
spec:
inputs:
build-test-images:
default: false
type: boolean
description: Explicitly build virtual machine images used by integration tests.
---
image: ubuntu:latest
@@ -19,10 +13,8 @@ workflow:
stages:
- build
- test
- spread
.ubuntu-common:
interruptible: true
before_script:
# Install build-dependencies by loading the package list from the ubuntu/debian cloud-init profile.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_deps "Installing dependencies..."
@@ -134,6 +126,19 @@ test-profiles:
- make -C profiles check-abstractions.d
- make -C profiles check-local
# Build the regression tests (don't run them because that needs kernel access)
test-build-regression:
stage: test
needs: ["build-all"]
extends:
- .ubuntu-common
script:
# Additional dependencies required by regression tests
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
- apt-get install --no-install-recommends -y attr fuse-overlayfs libdbus-1-dev liburing-dev
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
- make -C tests/regression/apparmor -j $(nproc)
shellcheck:
stage: test
needs: []
@@ -170,7 +175,6 @@ variables:
coverity:
stage: .post
interruptible: true
extends:
- .ubuntu-common
script:
@@ -192,146 +196,3 @@ coverity:
- "apparmor-*.tar.gz"
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "apparmor/apparmor"
.image-garden-x86_64:
stage: spread
interruptible: true
# TODO: use tagged release once container tagging is improved upstream.
image: registry.gitlab.com/zygoon/image-garden:latest
tags:
- linux
- x86_64
- kvm
variables:
ARCH: x86_64
GARDEN_DL_DIR: dl
CACHE_POLICY: pull-push
CACHE_COMPRESSION_LEVEL: fastest
before_script:
# Restore the mtime of the .image-garden.mk file. This helps make determine
# if there's actually something to do correctly. Git does not preserve the
# mtime of files during checkout.
- git restore-mtime .image-garden.mk
# Prepare the image in dry-run mode. This helps in debugging cache misses
# when files are not cached correctly by the runner, causing the build section
# below to always do hevy-duty work.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image_dry_run "Prepare image (dry run)"
- image-garden make --dry-run --debug "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image_dry_run
script:
# Prepare the image, for real.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image "Prepare image"
# If there's nothing to do then remove all the files that we would normally
# cache so that GitLab skips the cache upload step. This saves significant
# time required to re-compress and upload unchanged content.
# The idea for how to do is is documented at
# https://olex.biz/2025/04/gitlab-ci-prevent-cache-reupload-without-changes/
# The GitLab issue requesting a proper feature is
# https://gitlab.com/gitlab-org/gitlab/-/issues/226068
- |
if image-garden make --question "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"; then
rm -f "$GARDEN_SYSTEM".* efi-code.*.img efi-vars.*.img
rm -rf "$GARDEN_DL_DIR"
else
image-garden make "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
fi
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image
cache:
# Cache the base image (pre-customization).
- key: image-garden-base-${GARDEN_SYSTEM}.${ARCH}
policy: $CACHE_POLICY
when: always
paths:
- $GARDEN_DL_DIR
# Those are never mutated so they are safe to share.
- efi-code.*.img
- efi-vars.*.img
# Cache the customized system. This cache depends on .image-garden.mk file
# so that any customization updates are immediately acted upon.
- key:
prefix: image-garden-custom-${GARDEN_SYSTEM}.${ARCH}-
files:
- .image-garden.mk
policy: $CACHE_POLICY
when: always
paths:
- $GARDEN_SYSTEM.*
- $GARDEN_SYSTEM.seed.iso
- $GARDEN_SYSTEM.meta-data
- $GARDEN_SYSTEM.user-data
# This job builds and caches the image that the job below looks at.
image-ubuntu-cloud-24.04-x86_64:
extends: .image-garden-x86_64
variables:
GARDEN_SYSTEM: ubuntu-cloud-24.04
needs: []
dependencies: []
rules:
- if: $CI_COMMIT_TAG
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
changes:
paths:
- .image-garden.mk
- .gitlab-ci.yml
compare_to: "refs/heads/master"
- if: $CI_COMMIT_BRANCH && "$[[ inputs.build-test-images ]]" == "true"
.spread-x86_64:
extends: .image-garden-x86_64
variables:
# GitLab project identifier of zygoon/spread-dist can be seen on
# https://gitlab.com/zygoon/spread-dist, under the three-dot menu on
# top-right.
SPREAD_GITLAB_PROJECT_ID: "65375371"
# Git revision of spread to install.
# This must have been built via spread-dist.
# TODO: switch to upstream 1.0 release when available.
SPREAD_REV: 413817eda7bec07a3885e0717c178b965f8924e1
# Run all the tasks for a given system.
SPREAD_ARGS: "garden:$GARDEN_SYSTEM:"
SPREAD_GOARCH: amd64
before_script:
# Restore the mtime of the .image-garden.mk file. This helps make determine
# if there's actually something to do correctly. Git does not preserve the
# mtime of files during checkout.
- git restore-mtime .image-garden.mk
# Prepare the image in dry-run mode. This helps in debugging cache misses
# when files are not cached correctly by the runner, causing the build section
# below to always do hevy-duty work.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image_dry_run "Prepare image (dry run)"
- image-garden make --dry-run --debug "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
- stat .image-garden.mk "$GARDEN_SYSTEM".* || true
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image_dry_run
# Install the selected revision of spread.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_spread "Installing spread..."
# Install pre-built spread from https://gitlab.com/zygoon/spread-dist generic package repository.
- |
curl --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --location --output spread "${CI_API_V4_URL}/projects/${SPREAD_GITLAB_PROJECT_ID}/packages/generic/spread/${SPREAD_REV}/spread.${SPREAD_GOARCH}"
- chmod +x spread
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_spread
script:
- printf '\e[0K%s:%s:%s\r\e[0K%s\n' section_start "$(date +%s)" run_spread "Running spread for $GARDEN_SYSTEM..."
# TODO: transform to inject ^...$ to properly select jobs to run.
- mkdir -p spread-logs spread-artifacts
- ./spread -list $SPREAD_ARGS |
split --number=l/"${CI_NODE_INDEX:-1}"/"${CI_NODE_TOTAL:-1}" |
xargs --verbose ./spread -v -artifacts ./spread-artifacts -v | tee spread-logs/"$GARDEN_SYSTEM".log
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" run_spread
artifacts:
paths:
- spread-logs
- spread-artifacts
when: always
spread-ubuntu-cloud-24.04-x86_64:
extends: .spread-x86_64
variables:
GARDEN_SYSTEM: ubuntu-cloud-24.04
SPREAD_ARGS: garden:$GARDEN_SYSTEM:tests/regression/ garden:$GARDEN_SYSTEM:tests/profiles/
CACHE_POLICY: pull
dependencies: []
needs:
- job: image-ubuntu-cloud-24.04-x86_64
optional: true
parallel: 4

View File

@@ -2,11 +2,6 @@
# All the package installation happens through cloud-init profiles defined
# below.
# NOTE: Should the kernel be out of date, just increment this value. Make will
# re-create the image whenever the .image-garden.mk file is more recent than
# the image itself. In reality all you need is touch(1), but this is more apt.
unused=1
# This is the cloud-init user-data profile for all Debian systems. Note that it
# is an extension of the default profile necessary for operation of
# image-garden.
@@ -41,12 +36,6 @@ packages:
- python3-ttkthemes
- swig
- toybox
# Update all the packages. This allows us to be on the up-to-date kernel
# version that we cannot otherwise easily select with cloud init alone. Note
# that we do not need to reboot the system as image garden shuts down the image
# after first boot. On subsequent boot we will be running the latest kernel.
package_upgrade: true
package_update: true
endef
# Ubuntu shares cloud-init profile with Debian.
@@ -89,10 +78,6 @@ packages:
- python311
- python311-devel
- swig
- which
# See above for rationale.
package_upgrade: true
package_update: true
endef
define FEDORA_CLOUD_INIT_USER_DATA_TEMPLATE
@@ -122,7 +107,4 @@ packages:
- python3-notify2
- python3-tkinter
- swig
# See above for rationale.
package_upgrade: true
package_update: true
endef

View File

@@ -111,13 +111,21 @@ $ export PYTHON_VERSION=3
$ export PYTHON_VERSIONS=python3
```
Note that, in general, the build steps can be run in parallel, while the test
steps do not gain much speedup from being run in parallel. This is because the
test steps spawn a handful of long-lived test runner processes that mostly
run their tests sequentially and do not use `make`'s jobserver. Moreover,
process spawning overhead constitutes a significant part of test runtime, so
reworking the test harnesses to add parallelism (which would be a major undertaking
for the harnesses that do not have it already) would not produce much of a speedup.
### libapparmor:
```
$ cd ./libraries/libapparmor
$ sh ./autogen.sh
$ sh ./configure --prefix=/usr --with-perl --with-python # see below
$ make
$ make -j $(nproc)
$ make check
$ make install
```
@@ -130,7 +138,7 @@ generate Ruby bindings to libapparmor.]
```
$ cd binutils
$ make
$ make -j $(nproc)
$ make check
$ make install
```
@@ -139,7 +147,8 @@ $ make install
```
$ cd parser
$ make # depends on libapparmor having been built first
$ make -j $(nproc) # depends on libapparmor having been built first
$ make -j $(nproc) tst_binaries # a build step of make check that can be parallelized
$ make check
$ make install
```
@@ -149,7 +158,7 @@ $ make install
```
$ cd utils
$ make
$ make -j $(nproc)
$ make check PYFLAKES=/usr/bin/pyflakes3
$ make install
```
@@ -158,7 +167,7 @@ $ make install
```
$ cd changehat/mod_apparmor
$ make # depends on libapparmor having been built first
$ make -j $(nproc) # depends on libapparmor having been built first
$ make install
```
@@ -167,7 +176,7 @@ $ make install
```
$ cd changehat/pam_apparmor
$ make # depends on libapparmor having been built first
$ make -j $(nproc) # depends on libapparmor having been built first
$ make install
```
@@ -205,18 +214,6 @@ in an ephemeral virtual machine. This allows testing in isolation from the
host, as well as testing across different commonly used distributions and their
real kernels.
Image Garden is available as a snap. If you wish to use it this way then snap
then install the snap with:
```sh
sudo snap install image-garden
```
If you need to install snapd first, see https://snapcraft.io/docs/installing-snapd
Alternatively you may build image-garden and spread from source, and install
dependencies manually.
```sh
sudo apt install git golang whois ovmf genisoimage qemu-utils qemu-system
go install github.com/snapcore/spread/cmd/spread@latest
@@ -230,9 +227,8 @@ git clean -xdf
# or ~/go/bin/spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```
Running the `run_spread.sh` script, with `image-garden` snap installed or with
`spread` on `PATH` will run all the tests across several supported systems
(Debian, Ubuntu and openSUSE).
Running the `run_spread.sh` script, with `spread` on `PATH` will run all the
tests across several supported systems (Debian, Ubuntu and openSUSE).
If you include a `bzImage` file in the root of the repository then that kernel
will be used in the integration test. Please look at `spread.yaml` for details.
@@ -247,7 +243,7 @@ To run:
### Regression tests - using apparmor userspace installed on host
```
$ cd tests/regression/apparmor (requires root)
$ make USE_SYSTEM=1
$ make -j $(nproc) USE_SYSTEM=1
$ sudo make tests USE_SYSTEM=1
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```
@@ -260,7 +256,7 @@ $ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```
$ cd tests/regression/apparmor (requires root)
$ make
$ make -j $(nproc)
$ sudo make tests
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```

View File

@@ -80,109 +80,6 @@ aa-exec.
=back
=head1 RESTRICTIONS
aa-exec uses I<aa_change_profile(3)> to change application confinement.
The use of I<aa_change_profile(3)> may be restricted by policy in ways
that will cause failure or results different than expected.
Even when using I<aa-exec> from unconfined restrictions in policy can
causes failure or the confinement entered to be different than requested
See the unpriviled unconfined restriction documentation for more detail.
https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined_restriction
=head1 STACKING
aa-exec can be used to setup a stack of profiles as confinement. When an
application is confined by a stack, all profiles in the stack are checked
as if they were the profile confining the application. The resulting
mediation is the intersection of what is allowed by each profile in the
stack.
The profiles in a stack are treated independently. Each profile can have
its own flags and profile transitions. During an exec each profile gets
to specify its transition and the results brought together to form a
new canonicalized stack.
The profile separator indicating a stack is the character sequence I<//&>.
Thus a stack can be expressed using
=over 4
$ aa-exec -p "unconfined//&firefox" -- bash
$ ps -Z
LABEL PID TTY TIME CMD
unconfined 30714 pts/12 00:00:00 bash
firefox//&unconfined (unconfined) 31160 pts/12 00:00:00 bash
firefox//&unconfined (unconfined) 31171 pts/12 00:00:00 ps
=back
=head1 NAMESPACES
aa-exec can be used to enter confinement in another policy namespace
if the policy namespaces exists, is visible, and the profile exists in
the namespace. Note applications launched within the namespace will
not be able to exit the namespace, and may be restricted by additional
confinement around namespacing. Files and resources visible to the
parent that launches the application may not be visible in the policy
namespace resulting in access denials.
To enter a policy namespace the profile is prefixed with the namespace's
name, using a I<:> prefix and suffix.
Eg.
=over 4
$ aa-exec -p :ex1:unconfined -- bash
$ ps -Z
LABEL PID TTY TIME CMD
- 30714 pts/12 00:00:00 bash
unconfined 34372 pts/12 00:00:00 bash
unconfined 34379 pts/12 00:00:00 ps
=back
Confinement of processes outside of the namespace may not be visible
in which case the confinement will be represented with a -. If policy
is stacked only part of the confinement might be visible. However
confinement is usually fully visible from the parent policy namespace.
Eg. the confinement of the child can be queried in the parent to see
=over 4
$ ps -Z 34372
LABEL PID TTY STAT TIME COMMAND
:ex1:unconfined 34372 pts/12 S+ 0:00 bash
=back
And in the case of stacking with namespaces
=over 4
$ aa-exec -p "unconfined//&:ex1:unconfined" -- bash
$ ps -Z
LABEL PID TTY TIME CMD
- 30714 pts/12 00:00:00 bash
unconfined 36298 pts/12 00:00:00 bash
unconfined 36305 pts/12 00:00:00 ps
=back
while from the parent namespace the full confinement can be seen
=over 4
$ ps -Z 36298
LABEL PID TTY STAT TIME COMMAND
unconfined//&:ex1:unconfined 36298 pts/12 S+ 0:00 bash
=back
=head1 BUGS
If you find any bugs, please report them at
@@ -190,7 +87,7 @@ L<https://gitlab.com/apparmor/apparmor/-/issues>
=head1 SEE ALSO
apparmor(7), apparmor.d(5), aa_change_profile(3),
aa-stack(8), aa-namespace(8), apparmor(7), apparmor.d(5), aa_change_profile(3),
aa_change_onexec(3) and L<https://wiki.apparmor.net>.
=cut

View File

@@ -117,13 +117,13 @@ display only counts for selected information.
=item --filter.mode=filter
Allows specifying a posix regular expression filter that will be
applied against the displayed processes and profiles apparmor profile
applied against the displayed processess and profiles apparmor profile
mode, reducing the output.
=item --filter.profiles=filter
Allows specifying a posix regular expression filter that will be
applied against the displayed processes and profiles confining
applied against the displayed processess and profiles confining
profile, reducing the output.
=item --filter.pid=filter

View File

@@ -17,7 +17,6 @@
#include <fcntl.h>
#include <string.h>
#include <dirent.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>

View File

@@ -20,6 +20,8 @@
#include <ctype.h>
#include <dirent.h>
#include <regex.h>
#include <libintl.h>
#define _(s) gettext(s)
#include <sys/apparmor.h>
#include <sys/apparmor_private.h>
@@ -131,7 +133,7 @@ const char *process_statuses[] = {"enforce", "complain", "prompt", "kill", "unco
#define eprintf(...) \
do { \
if (!quiet) \
fprintf(stderr, __VA_ARGS__); \
fprintf(stderr, __VA_ARGS__); \
} while (0)
#define dprintf(...) \
@@ -156,14 +158,14 @@ static int open_profiles(FILE **fp)
ret = stat("/sys/module/apparmor", &st);
if (ret != 0) {
eprintf("apparmor not present.\n");
eprintf(_("apparmor not present.\n"));
return AA_EXIT_DISABLED;
}
dprintf("apparmor module is loaded.\n");
dprintf(_("apparmor module is loaded.\n"));
ret = aa_find_mountpoint(&apparmorfs);
if (ret == -1) {
eprintf("apparmor filesystem is not mounted.\n");
eprintf(_("apparmor filesystem is not mounted.\n"));
return AA_EXIT_NO_CONTROL;
}
@@ -176,9 +178,9 @@ static int open_profiles(FILE **fp)
*fp = fopen(apparmor_profiles, "r");
if (*fp == NULL) {
if (errno == EACCES) {
eprintf("You do not have enough privilege to read the profile set.\n");
eprintf(_("You do not have enough privilege to read the profile set.\n"));
} else {
eprintf("Could not open %s: %s", apparmor_profiles, strerror(errno));
eprintf(_("Could not open %s: %s"), apparmor_profiles, strerror(errno));
}
return AA_EXIT_NO_PERM;
}
@@ -351,7 +353,7 @@ static int get_processes(struct profile *profiles,
continue;
} else if (rc == -1 ||
asprintf(&exe, "/proc/%s/exe", entry->d_name) == -1) {
eprintf("ERROR: Failed to allocate memory\n");
eprintf(_("ERROR: Failed to allocate memory\n"));
ret = AA_EXIT_INTERNAL_ERROR;
goto exit;
} else if (mode) {
@@ -374,7 +376,7 @@ static int get_processes(struct profile *profiles,
// ensure enough space for NUL terminator
real_exe = calloc(PATH_MAX + 1, sizeof(char));
if (real_exe == NULL) {
eprintf("ERROR: Failed to allocate memory\n");
eprintf(_("ERROR: Failed to allocate memory\n"));
ret = AA_EXIT_INTERNAL_ERROR;
goto exit;
}
@@ -598,7 +600,7 @@ static int detailed_profiles(FILE *outf, filters_t *filters, bool json,
*/
subfilters.mode = &mode_filter;
if (regcomp(&mode_filter, profile_statuses[i], REG_NOSUB) != 0) {
eprintf("Error: failed to compile sub filter '%s'\n",
eprintf(_("Error: failed to compile sub filter '%s'\n"),
profile_statuses[i]);
return AA_EXIT_INTERNAL_ERROR;
}
@@ -664,7 +666,7 @@ static int detailed_processes(FILE *outf, filters_t *filters, bool json,
*/
subfilters.mode = &mode_filter;
if (regcomp(&mode_filter, process_statuses[i], REG_NOSUB) != 0) {
eprintf("Error: failed to compile sub filter '%s'\n",
eprintf(_("Error: failed to compile sub filter '%s'\n"),
profile_statuses[i]);
return AA_EXIT_INTERNAL_ERROR;
}
@@ -726,7 +728,7 @@ exit:
static int print_legacy(const char *command)
{
printf("Usage: %s [OPTIONS]\n"
printf(_("Usage: %s [OPTIONS]\n"
"Legacy options and their equivalent command\n"
" --profiled --count --profiles\n"
" --enforced --count --profiles --mode=enforced\n"
@@ -734,8 +736,8 @@ static int print_legacy(const char *command)
" --kill --count --profiles --mode=kill\n"
" --prompt --count --profiles --mode=prompt\n"
" --special-unconfined --count --profiles --mode=unconfined\n"
" --process-mixed --count --ps --mode=mixed\n",
command);
" --process-mixed --count --ps --mode=mixed\n"),
command);
exit(0);
return 0;
@@ -745,7 +747,7 @@ static int usage_filters(void)
{
long unsigned int i;
printf("Usage of filters\n"
printf(_("Usage of filters\n"
"Filters are used to reduce the output of information to only\n"
"those entries that will match the filter. Filters use posix\n"
"regular expression syntax. The possible values for exes that\n"
@@ -755,7 +757,7 @@ static int usage_filters(void)
" --filter.profiles: regular expression to match displayed profile names\n"
" --filter.pid: regular expression to match displayed processes pids\n"
" --filter.exe: regular expression to match executable\n"
);
));
for (i = 0; i < ARRAY_SIZE(process_statuses); i++) {
printf("%s%s", i ? ", " : "", process_statuses[i]);
}
@@ -773,7 +775,7 @@ static int print_usage(const char *command, bool error)
status = EXIT_FAILURE;
}
printf("Usage: %s [OPTIONS]\n"
printf(_("Usage: %s [OPTIONS]\n"
"Displays various information about the currently loaded AppArmor policy.\n"
"Default if no options given\n"
" --show=all\n\n"
@@ -790,8 +792,8 @@ static int print_usage(const char *command, bool error)
" --verbose (default) displays data points about loaded policy set\n"
" --quiet don't output error messages\n"
" -h[(legacy|filters)] this message, or info on the specified option\n"
" --help[=(legacy|filters)] this message, or info on the specified option\n",
command);
" --help[=(legacy|filters)] this message, or info on the specified option\n"),
command);
exit(status);
@@ -867,7 +869,7 @@ static int parse_args(int argc, char **argv)
} else if (strcmp(optarg, "filters") == 0) {
usage_filters();
} else {
eprintf("Error: Invalid --help option '%s'.\n", optarg);
eprintf(_("Error: Invalid --help option '%s'.\n"), optarg);
print_usage(argv[0], true);
break;
}
@@ -935,7 +937,7 @@ static int parse_args(int argc, char **argv)
} else if (strcmp(optarg, "processes") == 0) {
opt_show = SHOW_PROCESSES;
} else {
eprintf("Error: Invalid --show option '%s'.\n", optarg);
eprintf(_("Error: Invalid --show option '%s'.\n"), optarg);
print_usage(argv[0], true);
break;
}
@@ -957,7 +959,7 @@ static int parse_args(int argc, char **argv)
break;
default:
eprintf("Error: Invalid command.\n");
eprintf(_("Error: Invalid command.\n"));
print_usage(argv[0], true);
break;
}
@@ -982,7 +984,7 @@ int main(int argc, char **argv)
if (argc > 1) {
int pos = parse_args(argc, argv);
if (pos < argc) {
eprintf("Error: Unknown options.\n");
eprintf(_("Error: Unknown options.\n"));
print_usage(progname, true);
}
} else {
@@ -994,24 +996,24 @@ int main(int argc, char **argv)
init_filters(&filters, &filter_set);
if (regcomp(filters.mode, opt_mode, REG_NOSUB) != 0) {
eprintf("Error: failed to compile mode filter '%s'\n",
eprintf(_("Error: failed to compile mode filter '%s'\n"),
opt_mode);
return AA_EXIT_INTERNAL_ERROR;
}
if (regcomp(filters.profile, opt_profiles, REG_NOSUB) != 0) {
eprintf("Error: failed to compile profiles filter '%s'\n",
eprintf(_("Error: failed to compile profiles filter '%s'\n"),
opt_profiles);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
if (regcomp(filters.pid, opt_pid, REG_NOSUB) != 0) {
eprintf("Error: failed to compile ps filter '%s'\n",
eprintf(_("Error: failed to compile ps filter '%s'\n"),
opt_pid);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
if (regcomp(filters.exe, opt_exe, REG_NOSUB) != 0) {
eprintf("Error: failed to compile exe filter '%s'\n",
eprintf(_("Error: failed to compile exe filter '%s'\n"),
opt_exe);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
@@ -1026,7 +1028,7 @@ int main(int argc, char **argv)
outf_save = outf;
outf = open_memstream(&buffer, &buffer_size);
if (!outf) {
eprintf("Failed to open memstream: %m\n");
eprintf(_("Failed to open memstream: %m\n"));
return AA_EXIT_INTERNAL_ERROR;
}
}
@@ -1036,8 +1038,8 @@ int main(int argc, char **argv)
* have policy associated.
*/
ret = get_profiles(fp, &profiles, &nprofiles);
if (ret != 0 && !opt_json) {
eprintf("Failed to get profiles: %d....\n", ret);
if (ret != 0) {
eprintf(_("Failed to get profiles: %d....\n"), ret);
goto out;
}
@@ -1066,7 +1068,7 @@ int main(int argc, char **argv)
ret = get_processes(profiles, nprofiles, &processes, &nprocesses);
if (ret != 0) {
eprintf("Failed to get processes: %d....\n", ret);
eprintf(_("Failed to get processes: %d....\n"), ret);
} else if (opt_count) {
ret = simple_filtered_process_count(outf, &filters, opt_json,
processes, nprocesses);
@@ -1092,14 +1094,14 @@ int main(int argc, char **argv)
outf = outf_save;
json = cJSON_Parse(buffer);
if (!json) {
eprintf("Failed to parse json output");
eprintf(_("Failed to parse json output"));
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
pretty = cJSON_Print(json);
if (!pretty) {
eprintf("Failed to print pretty json");
eprintf(_("Failed to print pretty json"));
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}

View File

@@ -1,14 +1,14 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Translations for aa_enabled
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Translations for aa_exec
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Translations for aa_features_abi
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2011.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Translations for aa_load
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2025-02-18 07:37-0800\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

165
binutils/po/aa_status.pot Normal file
View File

@@ -0,0 +1,165 @@
# Translations for aa_status
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2024.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 17:49-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=CHARSET\n"
"Content-Transfer-Encoding: 8bit\n"
#: ../aa_status.c:161
msgid "apparmor not present.\n"
msgstr ""
#: ../aa_status.c:164
msgid "apparmor module is loaded.\n"
msgstr ""
#: ../aa_status.c:168
msgid "apparmor filesystem is not mounted.\n"
msgstr ""
#: ../aa_status.c:181
msgid "You do not have enough privilege to read the profile set.\n"
msgstr ""
#: ../aa_status.c:183
#, c-format
msgid "Could not open %s: %s"
msgstr ""
#: ../aa_status.c:356 ../aa_status.c:379
msgid "ERROR: Failed to allocate memory\n"
msgstr ""
#: ../aa_status.c:587 ../aa_status.c:653
#, c-format
msgid "Error: failed to compile sub filter '%s'\n"
msgstr ""
#: ../aa_status.c:715
#, c-format
msgid ""
"Usage: %s [OPTIONS]\n"
"Legacy options and their equivalent command\n"
" --profiled --count --profiles\n"
" --enforced --count --profiles --mode=enforced\n"
" --complaining --count --profiles --mode=complain\n"
" --kill --count --profiles --mode=kill\n"
" --prompt --count --profiles --mode=prompt\n"
" --special-unconfined --count --profiles --mode=unconfined\n"
" --process-mixed --count --ps --mode=mixed\n"
msgstr ""
#: ../aa_status.c:734
#, c-format
msgid ""
"Usage of filters\n"
"Filters are used to reduce the output of information to only\n"
"those entries that will match the filter. Filters use posix\n"
"regular expression syntax. The possible values for exes that\n"
"support filters are below\n"
"\n"
" --filter.mode: regular expression to match the profile "
"mode modes: enforce, complain, kill, unconfined, mixed\n"
" --filter.profiles: regular expression to match displayed profile names\n"
" --filter.pid: regular expression to match displayed processes pids\n"
" --filter.exe: regular expression to match executable\n"
msgstr ""
#: ../aa_status.c:762
#, c-format
msgid ""
"Usage: %s [OPTIONS]\n"
"Displays various information about the currently loaded AppArmor policy.\n"
"Default if no options given\n"
" --show=all\n"
"\n"
"OPTIONS (one only):\n"
" --enabled returns error code if AppArmor not enabled\n"
" --show=X What information to show. {profiles,processes,all}\n"
" --count print the number of entries. Implies --quiet\n"
" --filter.mode=filter see filters\n"
" --filter.profiles=filter see filters\n"
" --filter.pid=filter see filters\n"
" --filter.exe=filter see filters\n"
" --json displays multiple data points in machine-readable JSON "
"format\n"
" --pretty-json same data as --json, formatted for human consumption as "
"well\n"
" --verbose (default) displays data points about loaded policy set\n"
" --quiet don't output error messages\n"
" -h[(legacy|filters)] this message, or info on the specified option\n"
" --help[=(legacy|filters)] this message, or info on the specified option\n"
msgstr ""
#: ../aa_status.c:856
#, c-format
msgid "Error: Invalid --help option '%s'.\n"
msgstr ""
#: ../aa_status.c:924
#, c-format
msgid "Error: Invalid --show option '%s'.\n"
msgstr ""
#: ../aa_status.c:946
msgid "Error: Invalid command.\n"
msgstr ""
#: ../aa_status.c:971
msgid "Error: Unknown options.\n"
msgstr ""
#: ../aa_status.c:983
#, c-format
msgid "Error: failed to compile mode filter '%s'\n"
msgstr ""
#: ../aa_status.c:988
#, c-format
msgid "Error: failed to compile profiles filter '%s'\n"
msgstr ""
#: ../aa_status.c:994
#, c-format
msgid "Error: failed to compile ps filter '%s'\n"
msgstr ""
#: ../aa_status.c:1000
#, c-format
msgid "Error: failed to compile exe filter '%s'\n"
msgstr ""
#: ../aa_status.c:1015
#, c-format
msgid "Failed to open memstream: %m\n"
msgstr ""
#: ../aa_status.c:1026
#, c-format
msgid "Failed to get profiles: %d....\n"
msgstr ""
#: ../aa_status.c:1050
#, c-format
msgid "Failed to get processes: %d....\n"
msgstr ""
#: ../aa_status.c:1076
msgid "Failed to parse json output"
msgstr ""
#: ../aa_status.c:1083
msgid "Failed to print pretty json"
msgstr ""

View File

@@ -1,67 +0,0 @@
# Belarusian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-05 21:55+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Belarusian <be@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-06 05:41+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Catalan translation for apparmor
# Copyright (c) 2024 Rosetta Contributors and Canonical Ltd 2024
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2024.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2024-09-14 10:17+0000\n"
"Last-Translator: Walter Garcia-Fontes <walter.garcia@upf.edu>\n"
"Language-Team: Catalan <ca@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-09-15 07:16+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opcions]\n"
" opcions:\n"
" -q | --quiet No imprimeixis cap missatge\n"
" -h | --help Imprimeix l'ajuda\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opcions desconegudes o incompatibles\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opció desconeguda «%s»\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Sí\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "No - no esta disponible a aquest sistema\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "No - desactivat a l'inici.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Potser - la interfície de política no està disponible.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Potser - permisos insuficient per determinar la disponibilitat.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Error - '%s'\n"

View File

@@ -1,67 +0,0 @@
# Czech translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-01-09 11:59+0000\n"
"Last-Translator: Marek Hladík <mhladik@seznam.cz>\n"
"Language-Team: Czech <cs@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-01-10 06:32+0000\n"
"X-Generator: Launchpad (build 1682fd44eec4f62371f0bed122a83482daf08e23)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "neznámé nebo nekompatibilní volby\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "neznámá volba '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Ano\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ne - není v tomto systému k dispozici.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ne - zakázáno při startu.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Možná - rozhraní zásad není k dispozici.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Možná - nedostatečná oprávnění k určení dostupnosti.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Chyba - '%s'\n"

View File

@@ -1,67 +0,0 @@
# English (Australia) translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-11-28 04:45+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: English (Australia) <en_AU@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-11-29 06:26+0000\n"
"X-Generator: Launchpad (build 12d09381f8e8eee3115395875b132e165fa96574)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,67 +0,0 @@
# English (Canada) translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-10-01 04:55+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: English (Canada) <en_CA@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-10-02 06:17+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Estonian translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-07-04 08:52+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Estonian <et@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-07-05 04:31+0000\n"
"X-Generator: Launchpad (build beda0e9dd2b131780db60fe479d4b43618b27243)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [valikud]\n"
" valikud:\n"
" -q | --quiet Ärge printige sõnumeid välja\n"
" -h | --help Prindi abiinfo\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "tundmatud või ühildumatud valikud\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "tundmatu valik '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Jah\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ei pole selles süsteemis saadaval.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ei käivitamisel keelatud.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Võib-olla poliisiliides pole saadaval.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Võib-olla - kättesaadavuse määramiseks pole piisavalt õigusi.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Viga '%s'\n"

View File

@@ -1,67 +0,0 @@
# Galician translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-21 14:59+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Galician <gl@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-22 06:10+0000\n"
"X-Generator: Launchpad (build aad6b57d58e2f621954298e262c1cc904860f5d2)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Hebrew translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-10-05 05:12+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Hebrew <he@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-10-06 08:32+0000\n"
"X-Generator: Launchpad (build bd6cfd0cfc024dbe1dcd7d5d91165fb4f6a6c596)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [אפשרויות]\n"
" אפשרויות:\n"
" -q | --quiet לא להציג הודעות\n"
" -h | --help הצגת עזרה\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "אפשרויות לא ידועות או לא נתמכות\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "האפשרות %s לא מוכרת\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "כן\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "לא - לא זמין במערכת הזאת.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "לא - מושבת בעלייה.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "אולי - מנשק המדיניות לא זמין.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "אולי - אין מספיק הרשאות לקבוע זמינות.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "שגיאה - %s\n"

View File

@@ -1,67 +0,0 @@
# Hindi translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-01-09 07:39+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Hindi <hi@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-01-10 06:22+0000\n"
"X-Generator: Launchpad (build 87bfee1fd14ea3245297d63eeec1e4c8a1d203a8)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Croatian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-10-03 10:17+0000\n"
"Last-Translator: gogo <trebelnik2@gmail.com>\n"
"Language-Team: Croatian <hr@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-10-04 06:23+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [mogućnosti]\n"
" options:\n"
" -q | --quiet Ne prikazuj poruke\n"
" -h | --help Prikaži pomoć\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "nepoznata ili nepotpuna mogućnost\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "nepoznata mogućnost '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Da\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ne - nedostupno na ovom sustavu.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ne - onemogućeno pri pokretanju.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Možda - pravilo sučelja nedostupno.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Možda - nedovoljna dozvola za određivanje dostupnosti.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Greška - '%s'\n"

View File

@@ -1,72 +0,0 @@
# Italian translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-06-30 17:54+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Italian <it@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-07-01 04:30+0000\n"
"X-Generator: Launchpad (build f48158886a49da429840bcd298f0c7ed60f9ad7b)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opzioni]\n"
" opzioni:\n"
" -q | --quiet Non stampa nessun messaggio\n"
" -h | --help Stampa la guida\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opzioni sconosciute o incompatibili\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opzione sconosciuta '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Si\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "No - non disponibile su questo sistema.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "No - disabilitato all'avvio.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Forse - interfaccia dei criteri non disponibile.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
"Forse - autorizzazioni insufficienti per determinare la disponibilità.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Errore - '%s'\n"

View File

@@ -1,72 +0,0 @@
# Georgian translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-06-26 15:06+0000\n"
"Last-Translator: NorwayFun <temuri.doghonadze@gmail.com>\n"
"Language-Team: Georgian <ka@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-06-27 04:31+0000\n"
"X-Generator: Launchpad (build aedf8597c50c1abc5fb7f9e871e686dfcb381fde)\n"
"Language: aa\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [პარამეტრები]\n"
" პარამეტრები:\n"
" -q | --quiet შეტყობინებები გამოტანილი არ იქნება\n"
" -h | --help დახმარების გამოტანა\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "უცნობი ან შეუთავსებელი პარამეტრები\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "უცნობი პარამეტრი \"%s\"-სთვის\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "დიახ\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "არა - მიუწვდომელია ამ სისტემაზე\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "არა - გამორთულია ჩატვირთვისას\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "შეიძლება - პოლიტიკის ინტერფეისი ხელმისაწვდომი არაა.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "შეიძლება - არასაკმარისი წვდომები ხელმისაწვდომობის დასადგენად.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "შეცდომა - \"%s\"\n"

View File

@@ -1,67 +0,0 @@
# Kabyle translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-29 14:31+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Kabyle <kab@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-30 05:44+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,73 +0,0 @@
# Burmese translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-06-26 11:50+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Burmese <my@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-06-27 04:30+0000\n"
"X-Generator: Launchpad (build 51a2e4fa2e9b8e45f00904ad7f53546f45ac48a5)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s- [options]\n"
" ရွေးချယ်စရာများ-\n"
" -q | --quiet မည်သည့်စာတိုကိုမှ ပရင့်မထုတ်ပါနှင့်။\n"
" -h | --help ပရင့်အကူအညီ\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "အမည်မသိ သို့မဟုတ် သဟဇာတမဖြစ်သော ရွေးချယ်စရာများ\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "အမည်မသိရွေးချယ်မှု '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "ဟုတ်\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "မဟုတ်ပါ - ဤစနစ်တွင် မရနိုင်ပါ။\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "မဟုတ်ပါ - boot တွင် ပိတ်ထားပါသည်။\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "ဖြစ်နိုင်ပါသည် - မူဝါဒ interface ကို မရနိုင်ပါ။\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
"ဖြစ်နိုင်ပါသည် - ရရှိနိုင်မှုကို ဆုံးဖြတ်ရန်အတွက် ခွင့်ပြုချက်များမှာ "
"လုံလောက်မှုမရှိပါ။\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "အမှား- '%s'\n"

View File

@@ -1,67 +0,0 @@
# Occitan (post 1500) translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-01-14 18:26+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Occitan (post 1500) <oc@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-01-15 07:59+0000\n"
"X-Generator: Launchpad (build 511b4a3b6512aa3d421c5f7d74f3527e78bff26e)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Polish translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-07-22 20:10+0000\n"
"Last-Translator: Marek Adamski <Unknown>\n"
"Language-Team: Polish <pl@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-07-23 06:03+0000\n"
"X-Generator: Launchpad (build 7edebbcd0516593cf020aaa3c59299732a7c73cc)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opcje]\n"
" opcje:\n"
" -q | --quiet Nie wyświetlaj żadnych komunikatów\n"
" -h | --help Wyświetl pomoc\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "nieznane lub niekompatybilne opcje\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "nieznana opcja '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Tak\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Nie - nie jest dostępne w tym systemie.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Nie - wyłączone podczas rozruchu.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Może - interfejs zasad nie jest dostępny.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Może - brak wystarczających uprawnień do określenia dostępności.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Błąd - '%s'\n"

View File

@@ -1,71 +0,0 @@
# Brazilian Portuguese translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-27 20:32+0000\n"
"Last-Translator: Rodrigo Farias <Unknown>\n"
"Language-Team: Brazilian Portuguese <pt_BR@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-28 05:52+0000\n"
"X-Generator: Launchpad (build d1105341713c5be348effe2a5142c4a210ce4cde)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [options]\n"
" opções:\n"
" -q | --quiet Não imprimir nenhum mensagem\n"
" -h | --help Assistente de impressão\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opções incompatíveis ou desconhecidas\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opção desconhecida '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Sim\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Não - não disponível neste sistema.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Não - desabilitado na inicialização.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Talvez - interface de política não disponível.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Talvez - permissões insuficientes para determinar disponibilidade.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Erro - '%s'\n"

View File

@@ -1,26 +1,21 @@
# Romanian translation for apparmor, "apparmor-binutils" component.
# Mesajele în limba română pentru pachetul „apparmor”, componenta „apparmor-binutils”.
# Copyright © 2020 Rosetta Contributors and Canonical Ltd.
# Copyright © 2024 Canonical Ltd.
# Romanian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
#
# Daniel Slavu <Unknown>, feb-2020.
# Remus-Gabriel Chelu <remusgabriel.chelu@disroot.org>, sep-2024.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor-binutils\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2024-09-23 22:45+0000\n"
"Last-Translator: Remus-Gabriel Chelu <Unknown>\n"
"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
"PO-Revision-Date: 2020-02-20 21:47+0000\n"
"Last-Translator: Daniel Slavu <Unknown>\n"
"Language-Team: Romanian <ro@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-09-25 04:33+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
"Language: ro\n"
"X-Launchpad-Export-Date: 2020-02-21 05:39+0000\n"
"X-Generator: Launchpad (build 19413b719a8df7423ab1390528edadce9e0e4aca)\n"
#: ../aa_enabled.c:26
#, c-format
@@ -32,8 +27,8 @@ msgid ""
msgstr ""
"%s: [opțiuni]\n"
" opțiuni:\n"
" -q | --quiet nu afișează niciun mesaj\n"
" -h | --help imprimă ajutorul\n"
" -q | --calm Nu imprima niciun mesaj\n"
" -h | - ajutor Imprimare ajutor\n"
#: ../aa_enabled.c:45
#, c-format
@@ -43,7 +38,7 @@ msgstr "opțiuni necunoscute sau incompatibile\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opțiune necunoscută %s\n"
msgstr "opțiune necunoscută '%s'\n"
#: ../aa_enabled.c:64
#, c-format
@@ -63,8 +58,7 @@ msgstr "Nu - dezactivat la pornire.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
"Poate - interfața politică (de directive politice) nu este disponibilă.\n"
msgstr "Poate - interfața politică nu este disponibilă.\n"
#: ../aa_enabled.c:81
#, c-format
@@ -75,4 +69,4 @@ msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Eroare - %s\n"
msgstr "Eroare - '%s'\n"

View File

@@ -1,67 +0,0 @@
# Serbian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-11-23 18:06+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Serbian <sr@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-11-24 05:55+0000\n"
"X-Generator: Launchpad (build c35ff22711d15549e2303ae18ae521fd91f6bf00)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

View File

@@ -1,71 +0,0 @@
# Ukrainian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-19 21:48+0000\n"
"Last-Translator: Nazarii Ritter <nazariy.ritter@gmail.com>\n"
"Language-Team: Ukrainian <uk@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-20 05:42+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [опції]\n"
" опції:\n"
" -q | --quiet Не виводити жодних повідомлень\n"
" -h | --help Вивести довідку\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "невідомі або несумісні опції\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "невідомий параметр «%s»\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Так\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ні недоступно на цій системі.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ні вимкнено під час завантаження.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Можливо інтерфейс політики недоступний.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Можливо недостатньо дозволів для визначення наявності.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Помилка - '%s'\n"

View File

@@ -1,71 +0,0 @@
# Chinese (Simplified) translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-14 09:16+0000\n"
"Last-Translator: 玉堂白鹤 <yjwork@qq.com>\n"
"Language-Team: Chinese (Simplified) <zh_CN@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-15 05:51+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [选项]\n"
" 选项:\n"
" -q | --quiet 不要打印任何消息\n"
" -h | --help 打印帮助\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "未知或不兼容的选项\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "未知选项 '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "是\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "否 - 在此系统上不可用。\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "否 - 引导时被禁用。\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "也许 - 策略界面不可用\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "也许 - 没有足够的权限确定可用性。\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "错误 - '%s'\n"

View File

@@ -35,14 +35,14 @@ VERSION=$(shell cat $(COMMONDIR)/Version)
pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH)))))
map = $(foreach a,$(2),$(call $(1),$(a)))
AWK?=$(or $(shell which awk),$(error awk utility required for build but not available))
AWK?=$(or $(shell command -v awk),$(error awk utility required for build but not available))
define nl
endef
REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || $(AWK) '{ print $2 }' common/.stamp_rev
REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || awk '{ print $2 }' common/.stamp_rev
ifndef PYTHON_VERSIONS
PYTHON_VERSIONS = $(call map, pathsearch, python3)

View File

@@ -1 +1 @@
4.1.1
4.1.0~beta1

View File

@@ -22,15 +22,15 @@
=head1 NAME
aa_change_hat - change to or from a "hat" within a AppArmor profile
aa_change_hat - change to or from a "hat" within a AppArmor profile
=head1 SYNOPSIS
B<#include E<lt>sys/apparmor.hE<gt>>
B<int aa_change_hat (char *subprofile, unsigned long magic_token);>
B<int aa_change_hat (const char *subprofile, unsigned long magic_token);>
B<int aa_change_hatv (char *subprofiles[], unsigned long magic_token);>
B<int aa_change_hatv (const char *subprofiles[], unsigned long magic_token);>
B<int aa_change_hat_vargs (unsigned long magic_token, ...);>

View File

@@ -22,7 +22,7 @@
=head1 NAME
aa_change_profile, aa_change_onexec - change a tasks profile
aa_change_profile, aa_change_onexec - change a task's profile
=head1 SYNOPSIS
@@ -58,8 +58,8 @@ The aa_change_onexec() function is like the aa_change_profile() function
except it specifies that the profile transition should take place on the
next exec instead of immediately. The delayed profile change takes
precedence over any exec transition rules within the confining profile.
Delaying the profile boundary has a couple of advantages, it removes the
need for stub transition profiles and the exec boundary is a natural security
Delaying the profile boundary has a couple of advantages: it removes the
need for stub transition profiles, and the exec boundary is a natural security
layer where potentially sensitive memory is unmapped.
=head1 RETURN VALUE

View File

@@ -54,7 +54,7 @@ B<typedef struct aa_features aa_features;>
B<int aa_features_new(aa_features **features, int dirfd, const char *path);>
B<int aa_features_new_from_file(aa_features **features, int fd);>
B<int aa_features_new_from_file(aa_features **features, int file);>
B<int aa_features_new_from_string(aa_features **features, const char *string, size_t size);>

View File

@@ -58,6 +58,9 @@ appropriately.
=head1 ERRORS
# podchecker warns about duplicate link targets for EACCES, EBUSY, ENOENT,
# and ENOMEM, but this is a warning that is safe to ignore.
B<aa_is_enabled>
=over 4

View File

@@ -41,7 +41,7 @@ result is an intersection of all profiles which are stacked. Stacking profiles
together is desirable when wanting to ensure that confinement will never become
more permissive. When changing between two profiles, as performed with
aa_change_profile(2), there is always the possibility that the new profile is
more permissive than the old profile but that possibility is eliminated when
more permissive than the old profile, but that possibility is eliminated when
using aa_stack_profile().
To stack a profile with the current confinement context, a task can use the
@@ -68,7 +68,7 @@ The aa_stack_onexec() function is like the aa_stack_profile() function
except it specifies that the stacking should take place on the next exec
instead of immediately. The delayed profile change takes precedence over any
exec transition rules within the confining profile. Delaying the stacking
boundary has a couple of advantages, it removes the need for stub transition
boundary has a couple of advantages: it removes the need for stub transition
profiles and the exec boundary is a natural security layer where potentially
sensitive memory is unmapped.

View File

@@ -32,10 +32,10 @@ INCLUDES = $(all_includes)
#
# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
AA_LIB_CURRENT = 25
AA_LIB_REVISION = 2
AA_LIB_AGE = 24
EXPECTED_SO_NAME = libapparmor.so.1.24.2
AA_LIB_CURRENT = 20
AA_LIB_REVISION = 0
AA_LIB_AGE = 19
EXPECTED_SO_NAME = libapparmor.so.1.19.0
SUFFIXES = .pc.in .pc

View File

@@ -399,10 +399,6 @@ static bool walk_one(const char **str, const struct component *component,
i = 0;
cur++;
/* Partial match, continue to search */
if (i == component->len && !isbrace_space_or_nul(*cur))
i = 0;
}
/* Return false if a full match was not found */

View File

@@ -1,3 +1,3 @@
SUBDIRS = perl python ruby
EXTRA_DIST = SWIG/*.i java/Makefile.am
EXTRA_DIST = SWIG/*.i

View File

@@ -258,13 +258,7 @@ extern int aa_is_enabled(void);
* allocation uninitialized (0) != SWIG_NEWOBJ
*/
%#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
/*
* Some older versions of SWIG place this right after a goto label
* This would then be a label followed by a declaration, a C23 extension (!)
* To ensure this works for older SWIG versions and older compilers,
* make this a block element with curly braces.
*/
{static_assert(SWIG_NEWOBJ != 0, "SWIG_NEWOBJ is 0");}
static_assert(SWIG_NEWOBJ != 0);
%#endif
if ($1 != NULL && alloc_tracking$argnum != NULL) {
for (Py_ssize_t i=0; i<seq_len$argnum; i++) {
@@ -278,35 +272,6 @@ extern int aa_is_enabled(void);
}
#endif
#ifdef SWIGPERL
// Copied from perl's argcargv.i, which should be good enough for us
%typemap(in) (const char *subprofiles[]) {
int i;
SSize_t len;
AV *av = (AV *)SvRV($input);
if (SvTYPE(av) != SVt_PVAV) {
SWIG_croak("in method '$symname', Expecting reference to argv array");
goto fail;
}
len = av_len(av) + 1;
$1 = (char **) malloc((len+1)*sizeof(char *));
for (i = 0; i < len; i++) {
SV **tv = av_fetch(av, i, 0);
$1[i] = SvPV_nolen(*tv);
}
$1[i] = NULL;
}
%typemap(typecheck, precedence=SWIG_TYPECHECK_STRING_ARRAY) (const char *subprofiles[]) {
AV *av = (AV *)SvRV($input);
$1 = SvTYPE(av) == SVt_PVAV;
}
%typemap(freearg) (const char *subprofiles[]) {
free((void *)$1);
}
#endif
/* These should not receive the VOID_Object typemap */
extern int aa_change_hat(const char *subprofile, unsigned long magic_token);
extern int aa_change_profile(const char *profile);
@@ -350,17 +315,10 @@ extern int aa_stack_onexec(const char *profile);
* We can't use "typedef int pid_t" because we still support systems
* with 16-bit PIDs and SWIG can't find sys/types.h
*
* Capture the passed-in value as a long because pid_t is guaranteed
* to be a signed integer and because the aalogparse struct uses
* (unsigned) longs to store pid values. While intmax_t would be more
* technically correct, if sizeof(pid_t) > sizeof(long) then aalogparse
* itself would also need fixing.
* Capture the passed-in value as an intmax_t because pid_t is guaranteed
* to be a signed integer
*/
%typemap(in,noblock=1,fragment="SWIG_AsVal_long") pid_t (int conv_pid, long pid_large) {
%#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
static_assert(sizeof(pid_t) <= sizeof(long),
"pid_t type is too large to be stored in a long");
%#endif
%typemap(in,noblock=1,fragment="SWIG_AsVal_long") pid_t (int conv_pid, intmax_t pid_large) {
conv_pid = SWIG_AsVal_long($input, &pid_large);
if (!SWIG_IsOK(conv_pid)) {
%argument_fail(conv_pid, "pid_t", $symname, $argnum);
@@ -370,7 +328,7 @@ extern int aa_stack_onexec(const char *profile);
* Technically this is implementation-defined behaviour but we should be fine
*/
$1 = (pid_t) pid_large;
if ((long) $1 != pid_large) {
if ((intmax_t) $1 != pid_large) {
SWIG_exception_fail(SWIG_OverflowError, "pid_t is too large");
}
}

View File

@@ -1,21 +0,0 @@
WRAPPERFILES = apparmorlogparse_wrap.c
BUILT_SOURCES = apparmorlogparse_wrap.c
all-local: apparmorlogparse_wrap.o
$(CC) -module apparmorlogparse_wrap.o -o libaalogparse.so
apparmorlogparse_wrap.o: apparmorlogparse_wrap.c
$(CC) -c apparmorlogparse_wrap.c $(CFLAGS) -I../../src -I/usr/include/classpath -fno-strict-aliasing -o apparmorlogparse_wrap.o
clean-local:
rm -rf org
apparmorlogparse_wrap.c: org/aalogparse ../SWIG/*.i
$(SWIG) -java -I../SWIG -I../../src -outdir org/aalogparse \
-package org.aalogparse -o apparmorlogparse_wrap.c libaalogparse.i
org/aalogparse:
mkdir -p org/aalogparse
EXTRA_DIST = $(BUILT_SOURCES)

View File

@@ -15,7 +15,6 @@ PYTHON_DIST_BUILD_PATH = '$(builddir)/../build/$$($(PYTHON) buildpath.py)'
TESTS = test_python.py
TESTS_ENVIRONMENT = \
LD_LIBRARY_PATH='$(top_builddir)/src/.libs:$(PYTHON_DIST_BUILD_PATH)' \
PYTHONPATH='$(PYTHON_DIST_BUILD_PATH)' \
PYTHONDONTWRITEBYTECODE='1'
PYTHONPATH='$(PYTHON_DIST_BUILD_PATH)'
endif

View File

@@ -1,2 +1,4 @@
/home/cb/bin/hello.sh {
/usr/bin/rm mrix,
}

View File

@@ -1,2 +1,4 @@
/usr/bin/wireshark {
/usr/lib64/wireshark/extcap/androiddump mrix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
ping2 ix,
/bin/ping mrix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
/bin/ping ix,
/bin/ping mrix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
/bin/ping ix,
/bin/ping mrix,
}

View File

@@ -0,0 +1,4 @@
/home/steve/aa-regression-tests/link {
/tmp/sdtest.8236-29816-IN8243/target l,
}

View File

@@ -1,3 +1,4 @@
/tmp/apparmor-2.8.0/tests/regression/apparmor/dbus_service {
dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName peer=( name=org.freedesktop.systemd1, label=unconfined),
dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName peer=(label=unconfined),
}

View File

@@ -37,7 +37,7 @@ MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 aa-teardown.8 apparmor_xattrs
# default behavior changed in version 3.6
# parse.error=verbose supported from 3.0 so just test on that
# TODO move to autoconf
BISON_MAJOR:=$(shell bison --version | ${AWK} '/^bison/ { print ($$NF) }' | ${AWK} -F. '{print $$1 }')
BISON_MAJOR:=$(shell bison --version | awk '/^bison/ { print ($$NF) }' | awk -F. '{print $$1 }')
USE_PARSE_ERROR:=$(shell test "${BISON_MAJOR}" -ge 3 && echo true)
YACC := bison
@@ -375,7 +375,7 @@ tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
errnos.h:
echo '#include <errno.h>' > dump.c
$(CC) $(CPPFLAGS) -E -dD dump.c | $(AWK) '/^#define E/ { printf "{ \"%s\", %s },\n", $$2, $$2 }' > errnos.h
$(CC) -E -dD dump.c | awk '/^#define E/ { printf "{ \"%s\", %s },\n", $$2, $$2 }' > errnos.h
rm -f dump.c
.SILENT: check

View File

@@ -114,7 +114,7 @@ B<XATTR VALUE FILEGLOB> = I<FILEGLOB>
B<PROFILE FLAG CONDS> = [ 'flags=' ] '(' comma or white space separated list of I<PROFILE FLAGS> ')'
B<PROFILE FLAGS> = I<PROFILE MODE> | I<AUDIT_MODE> | 'mediate_deleted'
| 'attach_disconnected' | 'attach_disconnected.path='I<ABS PATH> | 'chroot_relative'
| 'attach_disconnected' | 'attach_disconneced.path='I<ABS PATH> | 'chroot_relative'
| 'debug' | 'interruptible' | 'kill.signal='I<SIGNAL> | 'error='I<ERROR CODE>
B<ERROR CODE> = (case insensitive error code name starting with 'E'; see errno(3))
@@ -388,7 +388,7 @@ aa_change_hat(2) can take advantage of subprofiles to run under different
confinements, dependent on program logic. Several aa_change_hat(2)-aware
applications exist, including an Apache module, mod_apparmor(5); a PAM
module, pam_apparmor; and a Tomcat valve, tomcat_apparmor. Applications
written or modified to use change_profile(2) transition permanently to the
written or modified to use aa_change_profile(2) transition permanently to the
specified profile. libvirt is one such application.
=head2 Profile Head
@@ -604,7 +604,7 @@ modes:
=item B<Ux>
- unconfined execute -- scrub the environment
- unconfined execute -- use ld.so(8) secure-execution mode
=item B<px>
@@ -612,7 +612,7 @@ modes:
=item B<Px>
- discrete profile execute -- scrub the environment
- discrete profile execute -- use ld.so(8) secure-execution mode
=item B<cx>
@@ -620,7 +620,7 @@ modes:
=item B<Cx>
- transition to subprofile on execute -- scrub the environment
- transition to subprofile on execute -- use ld.so(8) secure-execution mode
=item B<ix>
@@ -632,7 +632,7 @@ modes:
=item B<Pix>
- discrete profile execute with inherit fallback -- scrub the environment
- discrete profile execute with inherit fallback -- use ld.so(8) secure-execution mode
=item B<cix>
@@ -640,7 +640,7 @@ modes:
=item B<Cix>
- transition to subprofile on execute with inherit fallback -- scrub the environment
- transition to subprofile on execute with inherit fallback -- use ld.so(8) secure-execution mode
=item B<pux>
@@ -648,7 +648,7 @@ modes:
=item B<PUx>
- discrete profile execute with fallback to unconfined -- scrub the environment
- discrete profile execute with fallback to unconfined -- use ld.so(8) secure-execution mode
=item B<cux>
@@ -656,7 +656,7 @@ modes:
=item B<CUx>
- transition to subprofile on execute with fallback to unconfined -- scrub the environment
- transition to subprofile on execute with fallback to unconfined -- use ld.so(8) secure-execution mode
=item B<deny x>
@@ -715,20 +715,20 @@ constrained, see the apparmor(7) man page.
B<WARNING> 'ux' should only be used in very special cases. It enables the
designated child processes to be run without any AppArmor protection.
'ux' does not scrub the environment of variables such as LD_PRELOAD;
as a result, the calling domain may have an undue amount of influence
over the callee. Use this mode only if the child absolutely must be
'ux' does not use ld.so(8) secure-execution mode to clear variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee. Use this mode only if the child absolutely must be
run unconfined and LD_PRELOAD must be used. Any profile using this mode
provides negligible security. Use at your own risk.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Ux - unconfined execute -- scrub the environment>
=item B<Ux - unconfined execute -- use ld.so(8) secure-execution mode>
'Ux' allows the named program to run in 'ux' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
B<WARNING> 'Ux' should only be used in very special cases. It enables the
designated child processes to be run without any AppArmor protection.
@@ -743,18 +743,18 @@ This mode requires that a discrete security profile is defined for a
program executed and forces an AppArmor domain transition. If there is
no profile defined then the access will be denied.
B<WARNING> 'px' does not scrub the environment of variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
B<WARNING> 'px' does not use ld.so(8) secure-execution mode to clear variables
such as LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Px - Discrete Profile execute mode -- scrub the environment>
=item B<Px - Discrete Profile execute mode -- use ld.so(8) secure-execution mode>
'Px' allows the named program to run in 'px' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
Incompatible with other exec transition modes and the deny qualifier.
@@ -764,18 +764,18 @@ This mode requires that a local security profile is defined and forces an
AppArmor domain transition to the named profile. If there is no profile
defined then the access will be denied.
B<WARNING> 'cx' does not scrub the environment of variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
B<WARNING> 'cx' does not use ld.so(8) secure-execution mode to clear variables
such as LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Cx - Transition to Subprofile execute mode -- scrub the environment>
=item B<Cx - Transition to Subprofile execute mode -- use ld.so(8) secure-execution mode>
'Cx' allows the named program to run in 'cx' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
Incompatible with other exec transition modes and the deny qualifier.
@@ -788,7 +788,7 @@ will inherit the current profile.
This mode is useful when a confined program needs to call another
confined program without gaining the permissions of the target's
profile, or losing the permissions of the current profile. There is no
version to scrub the environment because 'ix' executions don't change
version to set secure-execution mode because 'ix' executions don't change
privileges.
Incompatible with other exec transition modes and the deny qualifier.
@@ -1690,11 +1690,11 @@ rule set. Eg.
change_profile /bin/bash -> {new_profile1,new_profile2,new_profile3},
The exec mode dictates whether or not the Linux Kernel's B<unsafe_exec>
routines should be used to scrub the environment, similar to setuid programs.
(See ld.so(8) for some information on setuid/setgid environment scrubbing.) The
B<safe> mode sets up environment scrubbing to occur when the new application is
executed and B<unsafe> mode disables AppArmor's requirement for environment
scrubbing (the kernel and/or libc may still require environment scrubbing). An
routines should be used to set ld.so(8) secure-execution mode and clear
environment variables such as LD_PRELOAD, similar to setuid programs.
(See ld.so(8) for more information.) The B<safe> mode sets up secure-execution
mode for the new application, and B<unsafe> mode disables AppArmor's
requirement for it (the kernel and/or libc may still turn it on). An
exec mode can only be specified when an exec condition is present.
change_profile safe /bin/bash -> new_profile,
@@ -1796,61 +1796,6 @@ F</etc/apparmor.d/tunables/xdg-user-dirs.d> for B<@{XDG_*}>.
The special B<@{profile_name}> variable is set to the profile name and may be
used in all policy.
=head3 Notes on variable expansion and the / character
It is important to note that how AppArmor performs variable expansion
depends on the context where a variable is used. When a variable is
expanded it can result in a string with multiple path characters
next to each other, in a way that is not evident when looking at
policy.
Eg.
=over 4
Given the following variable definition and rule
@{HOME}=/home/*/
file rw @{HOME}/*,
The variable expansion results in a rule of
file rw /home/*//*.
=back
When this occurs in a context where a path is expected, AppArmor will
canonicalize the path by collapsing consecutive / characters into
a single character. For the above example, this would be
file rw /home/*/*,
There is one exception to this rule, when the consecutive / characters
are at the beginning of a path, this indicates a posix namespace
and the characters will not be collapsed.
Eg.
=over 4
@{HOME}=/home/*/
file rw /@{HOME}/*,
will result in an expansion of
file rw //home/*//*,
which is collapsed to
file rw //home/*/*,
Note: that the leading // in the above example is not collapsed to a
single /. However the second // (that was also seen in the first
example) is collapsed.
=back
=head2 Alias rules
AppArmor also provides alias rules for remapping paths for site-specific
@@ -2152,7 +2097,7 @@ An example AppArmor profile:
/usr/lib/** r,
/tmp/foo.pid wr,
/tmp/foo.* lrw,
@{HOME}/.foo_file rw,
/@{HOME}/.foo_file rw,
/usr/bin/baz Cx -> baz,
# a comment about foo's hat (subprofile), bar.
@@ -2214,7 +2159,7 @@ negative values match when specifying one or the other. Eg, 'rw' matches when
=head1 SEE ALSO
apparmor(7), apparmor_parser(8), apparmor_xattrs(7), aa-complain(1),
aa-enforce(1), aa_change_hat(2), mod_apparmor(5), and
aa-enforce(1), aa_change_hat(2), aa_change_profile(2), mod_apparmor(5), and
L<https://wiki.apparmor.net>.
=cut

View File

@@ -206,8 +206,8 @@ which can help debugging profiles.
=head2 Enable debug mode
When debug mode is enabled, AppArmor will log a few extra messages to
dmesg (not via the audit subsystem). For example, the logs will tell
whether environment scrubbing has been applied.
dmesg (not via the audit subsystem). For example, the logs will state when
ld.so(8) secure-execution mode has been applied in a profile transition.
To enable debug mode, run:

View File

@@ -63,7 +63,6 @@ typedef enum capability_flags {
} capability_flags;
int name_to_capability(const char *keyword);
void capabilities_init(void);
void __debug_capabilities(uint64_t capset, const char *name);
bool add_cap_feature_mask(struct aa_features *features, capability_flags flags);
void clear_cap_flag(capability_flags flags);

View File

@@ -10,6 +10,199 @@ aare_rules.{h,cc} - code to that binds parse -> expr-tree -> hfa generation
-> chfa generation into a basic interface for converting
rules to a runtime ready state machine.
Notes on the compiler pipeline order
============================================
Front End: Program driver logic and policy text parsing into an
abstract syntax tree.
Middle Layer: Transforms and operations on the abstract syntax tree.
Converts syntax tree into expression tree for back end.
Back End: transforms of syntax tree, and creation of policy HFA from
expression trees and HFAs.
Basic order of the backend of the compiler pipe line and where the
dump information occurs in the pipeline.
===== Front End (parse -> AST ================
|
v
yyparse
|
+--->--+-->-+
| |
| +-->---- +---------------------------<-----------------------+
| | | |
| | v |
| | yylex |
| | | |
| ^ token match |
| | | |
| | +----------------------------+ |
| | | | ^
| | v v |
| +-<- rule match? preprocess |
| | | |
| early var expansion +----------+-----------+ |
| | | | | |
^ v v v v |
| new rule() / new ent include variable conditional |
| | | | | |
| v +---->-----+----->-----+----->----+
| new rule semantic check
| |
+-----<-----+
|
----------- | ------ End of Parse --------------------
|
v
post_parse_profile semantic check
|
v
post_process
|
v
add implied rules()
|
v
process_profile_variables()
|
v
rule->expand_variables()
|
+--------+
|
v
replace aliases (to be moved to backend rewrite)
|
v
merge rules
|
v
profile->merge_rules()
|
v
+-->--rule->is_mergeable()
| |
^ v
| add to table
| |
+-------+--------+
|
v
sort->cmp()/oper<()
|
rule->merge()
|
+------------+
|
v
process_profile_rules
|
v
rule->gen_policy_re()
|
v
===== Mid layer (AST -> expr tree) =================
|
+-> add_rule() (aare_rules.{h,cc})
| |
| v
| rule parse (parse.y)
| | |
| | v
| | expr tree (expr-tree.{h,cc})
| | |
| v |
| unique perms | (aare_rules.{h,cc})
| | |
| +------ +
| |
| v
| add to rules expr tree (aare_rules.{h,c})
| |
+------+
|
+------------------+
|
v
create_dfablob()
|
v
expr tree
|
v
create_chfa() (aare_rules.cc)
|
v
expr normalization (expr-tree.{h,cc})
|
v
expr simplification (expr-tree.{h,c})
|
+- D expr-tree
|
+- D expr-simplified
|
==== Back End - Create cHFA out of expr tree and other HFAs ====
v
hfa creation (hfa.{h,cc})
|
+- D dfa-node-map
|
+- D dfa-uniq-perms
|
+- D dfa-states-initial
|
v
hfa rewrite (not yet implemented)
|
v
filter deny (hfa.{h,cc})
|
+- D dfa-states-post-filter
|
v
minimization (hfa.{h,cc})
|
+- D dfa-minimize-partitions
|
+- D dfa-minimize-uniq-perms
|
+- D dfa-states-post-minimize
|
v
unreachable state removal (hfa.{h,cc})
|
+- D dfa-states-post-unreachable
|
+- D dfa-states constructed hfa
|
+- D dfa-graph
|
v
equivalence class construction
|
+- D equiv
|
diff encode (hfa.{h,cc})
|
+- D diff-encode
|
compute perms table
|
+- D compressed-dfa == perm table dump
|
compressed hfa (chfa.{h,cc}
|
+- D compressed-dfa == transition tables
|
+- D dfa-compressed-states - compress HFA in state form
|
v
Return to Mid Layer
Notes on the compress hfa file format (chfa)
==============================================

View File

@@ -25,6 +25,8 @@
#include <iostream>
#include <fstream>
#include <limits>
#include <arpa/inet.h>
#include <stdio.h>
#include <string.h>
@@ -592,10 +594,11 @@ void CHFA::weld_file_to_policy(CHFA &file_chfa, size_t &new_start,
// to repeat
assert(accept.size() == old_base_size);
accept.resize(accept.size() + file_chfa.accept.size());
size_t size = policy_perms.size();
assert(policy_perms.size() < std::numeric_limits<ssize_t>::max());
ssize_t size = (ssize_t) policy_perms.size();
policy_perms.resize(size*2 + file_perms.size());
// shift and double the policy perms
for (size_t i = size - 1; size >= 0; i--) {
for (ssize_t i = size - 1; i >= 0; i--) {
policy_perms[i*2] = policy_perms[i];
policy_perms[i*2 + 1] = policy_perms[i];
}

View File

@@ -558,6 +558,14 @@ void DFA::dump_uniq_perms(const char *s)
//TODO: add prompt
}
// make sure work_queue and reachable insertion are always done together
static void push_reachable(set<State *> &reachable, list<State *> &work_queue,
State *state)
{
work_queue.push_back(state);
reachable.insert(state);
}
/* Remove dead or unreachable states */
void DFA::remove_unreachable(optflags const &opts)
{
@@ -565,19 +573,18 @@ void DFA::remove_unreachable(optflags const &opts)
/* find the set of reachable states */
reachable.insert(nonmatching);
work_queue.push_back(start);
push_reachable(reachable, work_queue, start);
while (!work_queue.empty()) {
State *from = work_queue.front();
work_queue.pop_front();
reachable.insert(from);
if (from->otherwise != nonmatching &&
reachable.find(from->otherwise) == reachable.end())
work_queue.push_back(from->otherwise);
push_reachable(reachable, work_queue, from->otherwise);
for (StateTrans::iterator j = from->trans.begin(); j != from->trans.end(); j++) {
if (reachable.find(j->second) == reachable.end())
work_queue.push_back(j->second);
push_reachable(reachable, work_queue, j->second);
}
}
@@ -1391,31 +1398,9 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
MatchFlag *match, perms_t &perms, perms_t &exact,
bool filedfa)
{
// scaling priority *4
int pri = match->priority<<2;
/* use priority to get proper ordering and application of the type
* of match flag.
*
* Note: this is the last use of priority, it is dropped and not
* used in the backend.
*/
if (match->is_type(NODE_TYPE_DENYMATCHFLAG))
pri += 3;
// exact match must be same priority as allow as its audit
// flags has the same priority.
// current no ALLOWMATCHFLAG it is just absence of other flags
// so it has to be second last in this list, using !last
// until this gets fixed
else if (match->is_type(NODE_TYPE_EXACTMATCHFLAG) ||
(!match->is_type(NODE_TYPE_PROMPTMATCHFLAG)))
pri += 2;
else if (match->is_type(NODE_TYPE_PROMPTMATCHFLAG))
pri += 1;
if (priority[i] > pri) {
if (priority[i] > match->priority) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " > " << pri << " SKIPPING " << hex << (match->perms) << "/" << (match->audit) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " > " << match->priority << " SKIPPING " << hex << (match->perms) << "/" << (match->audit) << dec << "\n";
return 0;
}
@@ -1431,8 +1416,8 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
if (match->perms & AA_EXEC_INHERIT) {
xmask |= AA_USER_EXEC_MMAP;
//USER_EXEC_MAP = 6
if (priority[6] < pri)
priority[6] = pri;
if (priority[6] < match->priority)
priority[6] = match->priority;
}
amask = mask | xmask;
} else if (mask & AA_OTHER_EXEC) {
@@ -1441,8 +1426,8 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
if (match->perms & AA_OTHER_EXEC_INHERIT) {
xmask |= AA_OTHER_EXEC_MMAP;
//OTHER_EXEC_MAP = 20
if (priority[20] < pri)
priority[20] = pri;
if (priority[20] < match->priority)
priority[20] = match->priority;
}
amask = mask | xmask;
} else if (((mask & AA_USER_EXEC_MMAP) &&
@@ -1451,17 +1436,17 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
(match->perms & AA_OTHER_EXEC_INHERIT))) {
// if exec && ix we handled mmp above
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " SKIPPING mmap unmasked " << hex << match->perms << "/" << match->audit << " masked " << (match->perms & amask) << "/" << (match->audit & amask) << " data " << (perms.allow & mask) << "/" << (perms.audit & mask) << " exact " << (exact.allow & mask) << "/" << (exact.audit & mask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " SKIPPING mmap unmasked " << hex << match->perms << "/" << match->audit << " masked " << (match->perms & amask) << "/" << (match->audit & amask) << " data " << (perms.allow & mask) << "/" << (perms.audit & mask) << " exact " << (exact.allow & mask) << "/" << (exact.audit & mask) << dec << "\n";
return 0;
}
}
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " vs. " << pri << " mask: " << hex << mask << " xmask: " << xmask << " amask: " << amask << dec << "\n";
if (priority[i] < pri) {
cerr << " " << match << "[" << i << "]=" << priority[i] << " vs. " << match->priority << " mask: " << hex << mask << " xmask: " << xmask << " amask: " << amask << dec << "\n";
if (priority[i] < match->priority) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " < " << pri << " clearing " << hex << (perms.allow & amask) << "/" << (perms.audit & amask) << " -> " << dec;
priority[i] = pri;
cerr << " " << match << "[" << i << "]=" << priority[i] << " < " << match->priority << " clearing " << hex << (perms.allow & amask) << "/" << (perms.audit & amask) << " -> " << dec;
priority[i] = match->priority;
perms.clear_bits(amask);
exact.clear_bits(amask);
if (opts.dump & DUMP_DFA_PERMS)
@@ -1471,7 +1456,7 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
// the if conditions in order of permission priority
if (match->is_type(NODE_TYPE_DENYMATCHFLAG)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " deny " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " deny " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
perms.deny |= match->perms & amask;
perms.quiet |= match->audit & amask;
@@ -1481,11 +1466,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
} else if (match->is_type(NODE_TYPE_EXACTMATCHFLAG)) {
/* exact match only asserts dominance on the XTYPE */
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " exact " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " exact " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa &&
!is_merged_x_consistent(exact.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " exact match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " exact match conflict" << "\n";
return 1;
}
exact.allow |= match->perms & amask;
@@ -1506,11 +1491,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
// allow perms, if exact has been encountered will already be set
// if overlaps x here, don't conflict, because exact will override
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " allow " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " allow " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa && !(exact.allow & mask) &&
!is_merged_x_consistent(perms.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " allow match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " allow match conflict" << "\n";
return 1;
}
// mask off if XTYPE in xmatch
@@ -1524,11 +1509,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
}
} else { // if (match->is_type(NODE_TYPE_PROMPTMATCHFLAG)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " prompt " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " promt " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa && !((exact.allow | perms.allow) & mask) &&
!is_merged_x_consistent(perms.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " prompt match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " prompt match conflict" << "\n";
return 1;
}
if ((exact.allow | exact.audit | perms.allow | perms.audit) & mask) {
@@ -1554,8 +1539,9 @@ int accept_perms(optflags const &opts, NodeVec *state, perms_t &perms,
{
int error = 0;
perms_t exact;
// scaling priority by *4
std::vector<int> priority(sizeof(perm32_t)*8, MIN_INTERNAL_PRIORITY<<2); // 32 but wan't tied to perm32_t
// size of vector needs to be number of bits in the data type
// being used for the permission set.
std::vector<int> priority(sizeof(perm32_t)*8, MIN_INTERNAL_PRIORITY);
perms.clear();
if (!state)

View File

@@ -275,7 +275,7 @@ public:
ostream &dump(ostream &os)
{
cerr << *this << "\n";
os << *this << "\n";
for (StateTrans::iterator i = trans.begin(); i != trans.end(); i++) {
os << " " << i->first.c << " -> " << *i->second << "\n";
}

View File

@@ -288,7 +288,7 @@ static struct mnt_keyword_table mnt_opts_table[] = {
{"make-rshared", MS_RSHARED, 0},
{"relatime", MS_RELATIME, 0},
{"norelatime", 0, MS_RELATIME},
{"norelatime", 0, MS_NORELATIME},
{"iversion", MS_IVERSION, 0},
{"noiversion", 0, MS_IVERSION},
{"strictatime", MS_STRICTATIME, 0},
@@ -355,7 +355,8 @@ int is_valid_mnt_cond(const char *name, int src)
static unsigned int extract_flags(struct value_list **list, unsigned int *inv)
{
unsigned int flags = 0, invflags = 0;
*inv = 0;
if (inv)
*inv = 0;
struct value_list *entry, *tmp, *prev = NULL;
list_for_each_safe(*list, entry, tmp) {
@@ -368,11 +369,7 @@ static unsigned int extract_flags(struct value_list **list, unsigned int *inv)
" => req: 0x%x inv: 0x%x\n",
entry->value, mnt_opts_table[i].set,
mnt_opts_table[i].clear, flags, invflags);
if (prev)
prev->next = tmp;
if (entry == *list)
*list = tmp;
entry->next = NULL;
list_remove_at(*list, prev, entry);
free_value_list(entry);
} else
prev = entry;
@@ -683,7 +680,7 @@ int mnt_rule::cmp(rule_t const &rhs) const {
return cmp_vec_int(opt_flagsv, rhs_mnt.opt_flagsv);
}
static int build_mnt_flags(char *buffer, int size, unsigned int flags,
static bool build_mnt_flags(char *buffer, int size, unsigned int flags,
unsigned int opt_flags)
{
char *p = buffer;
@@ -693,8 +690,8 @@ static int build_mnt_flags(char *buffer, int size, unsigned int flags,
/* all flags are optional */
len = snprintf(p, size, "%s", default_match_pattern);
if (len < 0 || len >= size)
return FALSE;
return TRUE;
return false;
return true;
}
for (i = 0; i <= 31; ++i) {
if ((opt_flags) & (1 << i))
@@ -705,7 +702,7 @@ static int build_mnt_flags(char *buffer, int size, unsigned int flags,
continue;
if (len < 0 || len >= size)
return FALSE;
return false;
p += len;
size -= len;
}
@@ -716,15 +713,15 @@ static int build_mnt_flags(char *buffer, int size, unsigned int flags,
* like the empty string
*/
if (size < 9)
return FALSE;
return false;
strcpy(p, "(\\xfe|)");
}
return TRUE;
return true;
}
static int build_mnt_opts(std::string& buffer, struct value_list *opts)
static bool build_mnt_opts(std::string& buffer, struct value_list *opts)
{
struct value_list *ent;
pattern_t ptype;
@@ -732,19 +729,19 @@ static int build_mnt_opts(std::string& buffer, struct value_list *opts)
if (!opts) {
buffer.append(default_match_pattern);
return TRUE;
return true;
}
list_for_each(opts, ent) {
ptype = convert_aaregex_to_pcre(ent->value, 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
if (ent->next)
buffer.append(",");
}
return TRUE;
return true;
}
void mnt_rule::warn_once(const char *name)
@@ -847,12 +844,8 @@ int mnt_rule::gen_policy_bind_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (device && strcmp(device, "detached") == 0) {
/* see note in move_mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
if (!clear_and_convert_entry(devbuf, device))
goto fail;
}
vec[1] = devbuf.c_str();
/* skip type */
vec[2] = default_match_pattern;
@@ -953,12 +946,8 @@ int mnt_rule::gen_policy_move_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (device && strcmp(device, "detached") == 0) {
/* see note in move_mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
if (!clear_and_convert_entry(devbuf, device))
goto fail;
}
vec[1] = devbuf.c_str();
/* skip type */
vec[2] = default_match_pattern;
@@ -998,12 +987,8 @@ int mnt_rule::gen_policy_new_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (device && strcmp(device, "detached") == 0) {
/* see note in move mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
if (!clear_and_convert_entry(devbuf, device))
goto fail;
}
vec[1] = devbuf.c_str();
typebuf.clear();
if (!build_list_val_expr(typebuf, dev_type))

View File

@@ -148,8 +148,6 @@ ostream &mqueue_rule::dump(ostream &os)
os << ")";
}
if (label)
os << " label=" << label;
if (qname)
os << " " << qname;
@@ -240,19 +238,6 @@ int mqueue_rule::gen_policy_re(Profile &prof)
audit == AUDIT_FORCE ? map_mqueue_perms(perms) : 0, 1,
vec, parseopts, false))
goto fail;
/* create should be allowed when label is present since the
* queue needs to be created to have a label associated to it
*/
if (perms & AA_MQUEUE_CREATE &&
!prof.policy.rules->add_rule_vec(
priority,
rule_mode,
map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS),
audit == AUDIT_FORCE ? map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS) : 0, 1,
vec, parseopts, false))
goto fail;
/* also provide label match with perm */
if (!prof.policy.rules->add_rule_vec(priority,
rule_mode,
@@ -297,19 +282,6 @@ int mqueue_rule::gen_policy_re(Profile &prof)
audit == AUDIT_FORCE ? map_mqueue_perms(perms) : 0, 1,
vec, parseopts, false))
goto fail;
/* create should be allowed when label is present since the
* queue needs to be created to have a label associated to it
*/
if (perms & AA_MQUEUE_CREATE &&
!prof.policy.rules->add_rule_vec(
priority,
rule_mode,
map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS),
audit == AUDIT_FORCE ? map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS) : 0, 1,
vec, parseopts, false))
goto fail;
/* also provide label match with perm */
if (!prof.policy.rules->add_rule_vec(priority,
rule_mode,

View File

@@ -69,12 +69,6 @@
#define AA_VALID_MQUEUE_PERMS (AA_VALID_POSIX_MQ_PERMS | \
AA_VALID_SYSV_MQ_PERMS)
/* read and write needed with create because mq_open can be called
* with O_CREAT | O_RDWR, which all show up in the requested perms at
* the same time during creation
*/
#define AA_MQUEUE_CREATE_PERMS (AA_MQUEUE_CREATE | AA_MQUEUE_READ | \
AA_MQUEUE_WRITE)
// warning getting into overlap area
/* Type of mqueue - can be explicit or implied by rule id/path */

View File

@@ -179,8 +179,6 @@ struct var_string {
#define OPTION_STDOUT 4
#define OPTION_OFILE 5
#define BOOL int
extern int preprocess_only;
#define PATH_CHROOT_REL 0x1
@@ -213,13 +211,6 @@ do { \
errno = perror_error; \
} while (0)
#ifndef TRUE
#define TRUE (1)
#endif
#ifndef FALSE
#define FALSE (0)
#endif
#define MIN_PORT 0
#define MAX_PORT 65535
@@ -251,17 +242,6 @@ do { \
len; \
})
#define list_find_prev(LIST, ENTRY) \
({ \
typeof(ENTRY) tmp, prev = NULL; \
list_for_each((LIST), tmp) { \
if (tmp == (ENTRY)) \
break; \
prev = tmp; \
} \
prev; \
})
#define list_pop(LIST) \
({ \
typeof(LIST) _entry = (LIST); \
@@ -279,12 +259,6 @@ do { \
(LIST) = (ENTRY)->next; \
(ENTRY)->next = NULL; \
#define list_remove(LIST, ENTRY) \
do { \
typeof(ENTRY) prev = list_find_prev((LIST), (ENTRY)); \
list_remove_at((LIST), prev, (ENTRY)); \
} while (0)
#define DUP_STRING(orig, new, field, fail_target) \
do { \
@@ -347,7 +321,6 @@ extern int features_supports_inet;
extern int kernel_supports_policydb;
extern int kernel_supports_diff_encode;
extern int features_supports_mount;
extern bool features_supports_detached_mount;
extern int features_supports_dbus;
extern int features_supports_signal;
extern int features_supports_ptrace;
@@ -424,10 +397,10 @@ extern const char *basedir;
#define glob_null 1
extern pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
std::string& pcre, int *first_re_pos);
extern int build_list_val_expr(std::string& buffer, struct value_list *list);
extern int convert_entry(std::string& buffer, char *entry);
extern bool build_list_val_expr(std::string& buffer, struct value_list *list);
extern bool convert_entry(std::string& buffer, char *entry);
extern int clear_and_convert_entry(std::string& buffer, char *entry);
extern int convert_range(std::string& buffer, bignum start, bignum end);
extern bool convert_range(std::string& buffer, bignum start, bignum end);
extern int process_regex(Profile *prof);
extern int post_process_entry(struct cod_entry *entry);
@@ -446,7 +419,6 @@ extern void free_var_string(struct var_string *var);
extern void warn_uppercase(void);
extern int is_blacklisted(const char *name, const char *path);
extern struct value_list *new_value_list(char *value);
extern struct value_list *dup_value_list(struct value_list *list);
extern void free_value_list(struct value_list *list);
extern void print_value_list(struct value_list *list);
extern struct cond_entry *new_cond_entry(char *name, int eq, struct value_list *list);

View File

@@ -142,8 +142,10 @@ static void process_entries(const void *nodep, VISIT value, int level unused)
}
if (dup) {
dup->alias_ignore = true;
/* adds to the front of the list, list iteratition
* will skip it
/* The original entry->next is in dup->next, so we don't lose
* any of the original elements of the linked list. Also, by
* setting dup->alias_ignore, we trigger the check at the start
* of the loop, skipping the new entry we just inserted.
*/
entry->next = dup;

View File

@@ -73,7 +73,6 @@ int features_supports_inet = 0; /* kernel supports inet network rules */
int features_supports_unix = 0; /* kernel supports unix socket rules */
int kernel_supports_policydb = 0; /* kernel supports new policydb */
int features_supports_mount = 0; /* kernel supports mount rules */
bool features_supports_detached_mount = false;
int features_supports_dbus = 0; /* kernel supports dbus rules */
int kernel_supports_diff_encode = 0; /* kernel supports diff_encode */
int features_supports_signal = 0; /* kernel supports signal rules */

View File

@@ -202,7 +202,7 @@ static void start_include_position(const char *filename)
current_lineno = 1;
}
void push_include_stack(char *filename)
void push_include_stack(const char *filename)
{
struct include_stack_t *include = NULL;

View File

@@ -29,7 +29,7 @@ extern void parse_default_paths(void);
extern int do_include_preprocessing(char *profilename);
FILE *search_path(char *filename, char **fullpath, bool *skip);
extern void push_include_stack(char *filename);
extern void push_include_stack(const char *filename);
extern void pop_include_stack(void);
extern void reset_include_stack(const char *filename);

View File

@@ -245,7 +245,7 @@ static inline void sd_write_uint64(std::ostringstream &buf, u64 b)
static inline void sd_write_name(std::ostringstream &buf, const char *name)
{
PDEBUG("Writing name '%s'\n", name);
PDEBUG("Writing name '%s'\n", name ? name : "(null)");
if (name) {
sd_write8(buf, SD_NAME);
sd_write16(buf, strlen(name) + 1);

View File

@@ -956,14 +956,6 @@ void set_supported_features()
features_supports_mount = features_intersect(kernel_features,
policy_features,
"mount");
/*
* note: detached mounts are just a null condition, so previous
* mount rule encoding supports it, if the kernel supports
* it. So support for detached depends on mount intersect and
* kernel detached.
*/
features_supports_detached_mount = aa_features_supports(kernel_features,
"mount/move_mount/detached");
features_supports_dbus = features_intersect(kernel_features,
policy_features, "dbus");
features_supports_signal = features_intersect(kernel_features,
@@ -1628,7 +1620,6 @@ int main(int argc, char *argv[])
progname = argv[0];
init_base_dir();
capabilities_init();
process_early_args(argc, argv);
process_config_file(config_file);

View File

@@ -35,6 +35,7 @@
#include <sys/apparmor_private.h>
#include <algorithm>
#include <unordered_map>
#include "capability.h"
#include "lib.h"
@@ -61,6 +62,10 @@ void *reallocarray(void *ptr, size_t nmemb, size_t size)
}
#endif
#ifndef NULL
#define NULL nullptr
#endif
int is_blacklisted(const char *name, const char *path)
{
int retval = _aa_is_blacklisted(name);
@@ -71,12 +76,7 @@ int is_blacklisted(const char *name, const char *path)
return !retval ? 0 : 1;
}
struct keyword_table {
const char *keyword;
unsigned int token;
};
static struct keyword_table keyword_table[] = {
static const unordered_map<string, int> keyword_table = {
/* network */
{"network", TOK_NETWORK},
{"unix", TOK_UNIX},
@@ -132,16 +132,9 @@ static struct keyword_table keyword_table[] = {
{"sqpoll", TOK_SQPOLL},
{"all", TOK_ALL},
{"priority", TOK_PRIORITY},
/* terminate */
{NULL, 0}
};
/* glibc maps bsd ofile to nofile but musl does not. */
#ifndef RLIMIT_OFILE
#define RLIMIT_OFILE RLIMIT_NOFILE
#endif
static struct keyword_table rlimit_table[] = {
static const unordered_map<string, int> rlimit_table = {
{"cpu", RLIMIT_CPU},
{"fsize", RLIMIT_FSIZE},
{"data", RLIMIT_DATA},
@@ -149,7 +142,9 @@ static struct keyword_table rlimit_table[] = {
{"core", RLIMIT_CORE},
{"rss", RLIMIT_RSS},
{"nofile", RLIMIT_NOFILE},
#ifdef RLIMIT_OFILE
{"ofile", RLIMIT_OFILE},
#endif
{"as", RLIMIT_AS},
{"nproc", RLIMIT_NPROC},
{"memlock", RLIMIT_MEMLOCK},
@@ -165,37 +160,33 @@ static struct keyword_table rlimit_table[] = {
#ifdef RLIMIT_RTTIME
{"rttime", RLIMIT_RTTIME},
#endif
/* terminate */
{NULL, 0}
};
/* for alpha matches, check for keywords */
static int get_table_token(const char *name unused, struct keyword_table *table,
const char *keyword)
static int get_table_token(const char *name unused, const unordered_map<string, int> &table,
const string &keyword)
{
int i;
for (i = 0; table[i].keyword; i++) {
PDEBUG("Checking %s %s\n", name, table[i].keyword);
if (strcmp(keyword, table[i].keyword) == 0) {
PDEBUG("Found %s %s\n", name, table[i].keyword);
return table[i].token;
}
auto token_entry = table.find(keyword);
if (token_entry == table.end()) {
PDEBUG("Unable to find %s %s\n", name, keyword.c_str());
return -1;
} else {
PDEBUG("Found %s %s\n", name, keyword.c_str());
return token_entry->second;
}
PDEBUG("Unable to find %s %s\n", name, keyword);
return -1;
}
/* for alpha matches, check for keywords */
int get_keyword_token(const char *keyword)
{
return get_table_token("keyword", keyword_table, keyword);
// Can't use string_view because that requires C++17
return get_table_token("keyword", keyword_table, string(keyword));
}
int get_rlimit(const char *name)
{
return get_table_token("rlimit", rlimit_table, name);
// Can't use string_view because that requires C++17
return get_table_token("rlimit", rlimit_table, string(name));
}
@@ -211,55 +202,164 @@ struct capability_table {
capability_flags flags;
};
/*
* Enum for the results of adding a capability, with values assigned to match
* the int values returned by the old capable_add_cap function:
*
* -1: error
* 0: no change - capability already in table
* 1: added flag to capability in table
* 2: added new capability
*/
enum add_cap_result {
ERROR = -1, // Was only used for OOM conditions
ALREADY_EXISTS = 0,
FLAG_ADDED = 1,
CAP_ADDED = 2
};
static struct capability_table base_capability_table[] = {
/* capabilities */
#include "cap_names.h"
};
static const size_t BASE_CAP_TABLE_SIZE = sizeof(base_capability_table)/sizeof(struct capability_table);
/* terminate */
{NULL, 0, 0, CAPFLAGS_CLEAR}
class capability_lookup {
vector<capability_table> cap_table;
// Use unordered_map to avoid pulling in two map implementations
// We may want to switch to boost::multiindex to avoid duplication
unordered_map<string, capability_table&> name_cap_map;
unordered_map<unsigned int, capability_table&> int_cap_map;
private:
void add_capability_table_entry_raw(capability_table entry) {
cap_table.push_back(entry);
capability_table &entry_ref = cap_table.back();
name_cap_map.emplace(string(entry_ref.name), entry_ref);
int_cap_map.emplace(entry_ref.cap, entry_ref);
}
public:
capability_lookup() :
cap_table(vector<capability_table>()),
name_cap_map(unordered_map<string, capability_table&>(BASE_CAP_TABLE_SIZE)),
int_cap_map(unordered_map<unsigned int, capability_table&>(BASE_CAP_TABLE_SIZE)) {
cap_table.reserve(BASE_CAP_TABLE_SIZE);
for (size_t i=0; i<BASE_CAP_TABLE_SIZE; i++) {
add_capability_table_entry_raw(base_capability_table[i]);
}
}
capability_table* find_cap_entry_by_name(string const & name) const {
auto map_entry = this->name_cap_map.find(name);
if (map_entry == this->name_cap_map.end()) {
return NULL;
} else {
PDEBUG("Found %s %s\n", name.c_str(), map_entry->second.name);
return &map_entry->second;
}
}
capability_table* find_cap_entry_by_num(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return NULL;
} else {
PDEBUG("Found %d %d\n", cap, map_entry->second.cap);
return &map_entry->second;
}
}
int name_to_capability(string const &cap) const {
auto map_entry = this->name_cap_map.find(cap);
if (map_entry == this->name_cap_map.end()) {
PDEBUG("Unable to find %s %s\n", "capability", cap.c_str());
return -1;
} else {
return map_entry->second.cap;
}
}
const char *capability_to_name(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return "invalid-capability";
} else {
return map_entry->second.name;
}
}
int capability_backmap(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return NO_BACKMAP_CAP;
} else {
return map_entry->second.backmap;
}
}
bool capability_in_kernel(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return false;
} else {
return map_entry->second.flags & CAPFLAG_KERNEL_FEATURE;
}
}
void __debug_capabilities(uint64_t capset, const char *name) const {
printf("%s:", name);
for (auto it = this->cap_table.cbegin(); it != this->cap_table.cend(); it++) {
if ((1ull << it->cap) & capset)
printf (" %s", it->name);
}
printf("\n");
}
add_cap_result capable_add_cap(string const & str, unsigned int cap,
capability_flags flag) {
struct capability_table *ent = this->find_cap_entry_by_name(str);
if (ent) {
if (ent->cap != cap) {
pwarn(WARN_UNEXPECTED, "feature capability '%s:%d' does not equal expected %d. Ignoring ...\n", str.c_str(), cap, ent->cap);
/* TODO: make warn to error config */
return add_cap_result::ALREADY_EXISTS;
}
if (ent->flags & flag)
return add_cap_result::ALREADY_EXISTS;
ent->flags = (capability_flags) (ent->flags | flag);
return add_cap_result::FLAG_ADDED;
} else {
struct capability_table new_entry;
new_entry.name = strdup(str.c_str());
if (!new_entry.name) {
yyerror(_("Out of memory"));
return add_cap_result::ERROR;
}
new_entry.cap = cap;
new_entry.backmap = 0;
new_entry.flags = flag;
try {
this->add_capability_table_entry_raw(new_entry);
} catch (const std::bad_alloc &_e) {
yyerror(_("Out of memory"));
return add_cap_result::ERROR;
}
// TODO: exception catching for causes other than OOM
return add_cap_result::CAP_ADDED;
}
}
void clear_cap_flag(capability_flags flags)
{
for (auto it = this->cap_table.begin(); it != this->cap_table.end(); it++) {
PDEBUG("Clearing capability flag for capability \"%s\"\n", it->name);
it->flags = (capability_flags) (it->flags & ~flags);
}
}
};
static struct capability_table *cap_table;
static int cap_table_size;
void capabilities_init(void)
{
cap_table = (struct capability_table *) malloc(sizeof(base_capability_table));
if (!cap_table)
yyerror(_("Memory allocation error."));
memcpy(cap_table, base_capability_table, sizeof(base_capability_table));
cap_table_size = sizeof(base_capability_table)/sizeof(struct capability_table);
}
struct capability_table *find_cap_entry_by_name(const char *name)
{
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Checking %s %s\n", name, cap_table[i].name);
if (strcmp(name, cap_table[i].name) == 0) {
PDEBUG("Found %s %s\n", name, cap_table[i].name);
return &cap_table[i];
}
}
return NULL;
}
struct capability_table *find_cap_entry_by_num(unsigned int cap)
{
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Checking %d %d\n", cap, cap_table[i].cap);
if (cap == cap_table[i].cap) {
PDEBUG("Found %d %d\n", cap, cap_table[i].cap);
return &cap_table[i];
}
}
return NULL;
}
static capability_lookup cap_table;
/* don't mark up str with \0 */
static const char *strn_token(const char *str, size_t &len)
@@ -297,59 +397,6 @@ bool strcomp (const char *lhs, const char *rhs)
return null_strcmp(lhs, rhs) < 0;
}
/*
* Returns: -1: error
* 0: no change - capability already in table
* 1: added flag to capability in table
* 2: added new capability
*/
static int capable_add_cap(const char *str, int len, unsigned int cap,
capability_flags flag)
{
/* extract name from str so we can treat as a string */
autofree char *name = strndup(str, len);
if (!name) {
yyerror(_("Out of memory"));
return -1;
}
struct capability_table *ent = find_cap_entry_by_name(name);
if (ent) {
if (ent->cap != cap) {
pwarn(WARN_UNEXPECTED, "feature capability '%s:%d' does not equal expected %d. Ignoring ...\n", name, cap, ent->cap);
/* TODO: make warn to error config */
return 0;
}
if (ent->flags & flag)
return 0; /* no change */
ent->flags = (capability_flags) (ent->flags | flag);
return 1; /* modified */
} else {
struct capability_table *tmp;
tmp = (struct capability_table *) reallocarray(cap_table, sizeof(struct capability_table), cap_table_size+1);
if (!tmp) {
yyerror(_("Out of memory"));
/* TODO: change away from yyerror */
return -1;
}
cap_table = tmp;
ent = &cap_table[cap_table_size - 1]; /* overwrite null */
ent->name = strndup(name, len);
if (!ent->name) {
/* TODO: change away from yyerror */
yyerror(_("Out of memory"));
return -1;
}
ent->cap = cap;
ent->flags = flag;
cap_table[cap_table_size].name = NULL; /* new null */
cap_table_size++;
}
return 2; /* added */
}
bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
{
autofree char *value = NULL;
@@ -366,7 +413,8 @@ bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
for (capstr = strn_token(value, len);
capstr;
capstr = strn_token(capstr + len, len)) {
if (capable_add_cap(capstr, len, n, flags) < 0)
string capstr_as_str = string(capstr, len);
if (cap_table.capable_add_cap(capstr_as_str, n, flags) < 0)
return false;
n++;
if (len > valuelen) {
@@ -382,70 +430,32 @@ bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
void clear_cap_flag(capability_flags flags)
{
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Clearing capability flag for capability \"%s\"\n", cap_table[i].name);
cap_table[i].flags = (capability_flags) (cap_table[i].flags & ~flags);
}
cap_table.clear_cap_flag(flags);
}
int name_to_capability(const char *cap)
{
struct capability_table *ent;
ent = find_cap_entry_by_name(cap);
if (ent)
return ent->cap;
PDEBUG("Unable to find %s %s\n", "capability", cap);
return -1;
return cap_table.name_to_capability(string(cap));
}
const char *capability_to_name(unsigned int cap)
{
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->name;
return "invalid-capability";
return cap_table.capability_to_name(cap);
}
int capability_backmap(unsigned int cap)
{
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->backmap;
return NO_BACKMAP_CAP;
return cap_table.capability_backmap(cap);
}
bool capability_in_kernel(unsigned int cap)
{
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->flags & CAPFLAG_KERNEL_FEATURE;
return false;
return cap_table.capability_in_kernel(cap);
}
void __debug_capabilities(uint64_t capset, const char *name)
{
unsigned int i;
printf("%s:", name);
for (i = 0; cap_table[i].name; i++) {
if ((1ull << cap_table[i].cap) & capset)
printf (" %s", cap_table[i].name);
}
printf("\n");
cap_table.__debug_capabilities(capset, name);
}
char *processunquoted(const char *string, int len)
@@ -1203,37 +1213,6 @@ void free_value_list(struct value_list *list)
}
}
struct value_list *dup_value_list(struct value_list *list)
{
struct value_list *entry, *dup, *head = NULL;
char *value;
list_for_each(list, entry) {
value = NULL;
if (list->value) {
value = strdup(list->value);
if (!value)
goto fail2;
}
dup = new_value_list(value);
if (!dup)
goto fail;
if (head)
list_append(head, dup);
else
head = dup;
}
return head;
fail:
free(value);
fail2:
free_value_list(head);
return NULL;
}
void print_value_list(struct value_list *list)
{
struct value_list *entry;

View File

@@ -178,8 +178,6 @@ Profile *merge_policy(Profile *a, Profile *b)
}
}
a->rule_ents.splice(a->rule_ents.end(), b->rule_ents);
merge_hats(a, b->hat_table);
delete b;
out:

View File

@@ -50,7 +50,7 @@ enum error_type {
void filter_slashes(char *path)
{
char *sptr, *dptr;
BOOL seen_slash = 0;
bool seen_slash = false;
if (!path || (strlen(path) < 2))
return;
@@ -69,7 +69,7 @@ void filter_slashes(char *path)
++sptr;
} else {
*dptr++ = *sptr++;
seen_slash = TRUE;
seen_slash = true;
}
} else {
seen_slash = 0;
@@ -111,14 +111,14 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
#define MAX_ALT_DEPTH 50
*first_re_pos = 0;
int ret = TRUE;
int ret = 1;
/* flag to indicate input error */
enum error_type error;
const char *sptr;
pattern_t ptype;
BOOL bEscape = 0; /* flag to indicate escape */
bool bEscape = false; /* flag to indicate escape */
int ingrouping = 0; /* flag to indicate {} context */
int incharclass = 0; /* flag to indicate [ ] context */
int grouping_count[MAX_ALT_DEPTH] = {0};
@@ -150,7 +150,7 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
if (bEscape) {
pcre.append("\\\\");
} else {
bEscape = TRUE;
bEscape = true;
++sptr;
continue; /*skip turning bEscape off */
} /* bEscape */
@@ -393,7 +393,7 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
break;
} /* switch (*sptr) */
bEscape = FALSE;
bEscape = false;
++sptr;
} /* while error == e_no_error && *sptr) */
@@ -419,12 +419,12 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
PERROR(_("%s: Unable to parse input line '%s'\n"),
progname, aare);
ret = FALSE;
ret = 0;
goto out;
}
out:
if (ret == FALSE)
if (ret == 0)
ptype = ePatternInvalid;
if (parseopts.dump & DUMP_DFA_RULE_EXPR)
@@ -464,7 +464,7 @@ static void warn_once_xattr(const char *name)
common_warn_once(name, "xattr attachment conditional ignored", &warned_name);
}
static int process_profile_name_xmatch(Profile *prof)
static bool process_profile_name_xmatch(Profile *prof)
{
std::string tbuf;
pattern_t ptype;
@@ -479,7 +479,7 @@ static int process_profile_name_xmatch(Profile *prof)
/* don't filter_slashes for profile names, do on attachment */
name = strdup(local_name(prof->name));
if (!name)
return FALSE;
return false;
}
filter_slashes(name);
ptype = convert_aaregex_to_pcre(name, 0, glob_default, tbuf,
@@ -491,7 +491,7 @@ static int process_profile_name_xmatch(Profile *prof)
PERROR(_("%s: Invalid profile name '%s' - bad regular expression\n"), progname, name);
if (!prof->attachment)
free(name);
return FALSE;
return false;
}
if (!prof->attachment)
@@ -506,11 +506,11 @@ static int process_profile_name_xmatch(Profile *prof)
/* build a dfa */
aare_rules *rules = new aare_rules();
if (!rules)
return FALSE;
return false;
if (!rules->add_rule(tbuf.c_str(), 0, RULE_ALLOW,
AA_MAY_EXEC, 0, parseopts)) {
delete rules;
return FALSE;
return false;
}
if (prof->altnames) {
struct alt_name *alt;
@@ -525,7 +525,7 @@ static int process_profile_name_xmatch(Profile *prof)
RULE_ALLOW, AA_MAY_EXEC,
0, parseopts)) {
delete rules;
return FALSE;
return false;
}
}
}
@@ -567,7 +567,7 @@ static int process_profile_name_xmatch(Profile *prof)
&len);
if (!rules->append_rule(tbuf.c_str(), true, true, parseopts)) {
delete rules;
return FALSE;
return false;
}
}
}
@@ -581,10 +581,10 @@ build:
prof->xmatch = rules->create_dfablob(&prof->xmatch_size, &prof->xmatch_len, prof->xmatch_perms_table, parseopts, false, false, false);
delete rules;
if (!prof->xmatch)
return FALSE;
return false;
}
return TRUE;
return true;
}
static int warn_change_profile = 1;
@@ -606,21 +606,21 @@ static bool is_change_profile_perms(perm32_t perms)
return perms & AA_CHANGE_PROFILE;
}
static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
{
std::string tbuf;
pattern_t ptype;
int pos;
if (!entry) /* shouldn't happen */
return TRUE;
return false;
if (!is_change_profile_perms(entry->perms))
filter_slashes(entry->name);
ptype = convert_aaregex_to_pcre(entry->name, 0, glob_default, tbuf, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
entry->pattern_type = ptype;
@@ -649,13 +649,13 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
entry->perms & ~(AA_LINK_BITS | AA_CHANGE_PROFILE),
entry->audit == AUDIT_FORCE ? entry->perms & ~(AA_LINK_BITS | AA_CHANGE_PROFILE) : 0,
parseopts))
return FALSE;
return false;
} else if (!is_change_profile_perms(entry->perms)) {
if (!dfarules->add_rule(tbuf.c_str(), entry->priority,
entry->rule_mode, entry->perms,
entry->audit == AUDIT_FORCE ? entry->perms : 0,
parseopts))
return FALSE;
return false;
}
if (entry->perms & (AA_LINK_BITS)) {
@@ -669,7 +669,7 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
filter_slashes(entry->link_name);
ptype = convert_aaregex_to_pcre(entry->link_name, 0, glob_default, lbuf, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
if (entry->subset)
perms |= LINK_TO_LINK_SUBSET(perms);
vec[1] = lbuf.c_str();
@@ -681,7 +681,7 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
entry->rule_mode, perms,
entry->audit == AUDIT_FORCE ? perms & AA_LINK_BITS : 0,
2, vec, parseopts, false))
return FALSE;
return false;
}
if (is_change_profile_perms(entry->perms)) {
const char *vec[3];
@@ -702,7 +702,7 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (entry->onexec) {
ptype = convert_aaregex_to_pcre(entry->onexec, 0, glob_default, xbuf, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
vec[0] = xbuf.c_str();
} else
/* allow change_profile for all execs */
@@ -713,14 +713,14 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!parse_label(&stack, &ns, &name,
tbuf.c_str(), false)) {
return FALSE;
return false;
}
if (stack) {
fprintf(stderr,
_("The current kernel does not support stacking of named transitions: %s\n"),
tbuf.c_str());
return FALSE;
return false;
}
if (ns)
@@ -734,13 +734,13 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
AA_CHANGE_PROFILE | onexec_perms,
0, index - 1, &vec[1], parseopts, false))
return FALSE;
return false;
/* onexec rules - both rules are needed for onexec */
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
onexec_perms,
0, 1, vec, parseopts, false))
return FALSE;
return false;
/**
* pick up any exec bits, from the frontend parser, related to
@@ -750,19 +750,19 @@ static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
onexec_perms, 0, index, vec,
parseopts, false))
return FALSE;
return false;
}
return TRUE;
return true;
}
int post_process_entries(Profile *prof)
bool post_process_entries(Profile *prof)
{
int ret = TRUE;
int ret = true;
struct cod_entry *entry;
list_for_each(prof->entries, entry) {
if (!process_dfa_entry(prof->dfa.rules, entry))
ret = FALSE;
ret = false;
}
return ret;
@@ -815,7 +815,7 @@ out:
return error;
}
int build_list_val_expr(std::string& buffer, struct value_list *list)
bool build_list_val_expr(std::string& buffer, struct value_list *list)
{
struct value_list *ent;
pattern_t ptype;
@@ -823,7 +823,7 @@ int build_list_val_expr(std::string& buffer, struct value_list *list)
if (!list) {
buffer.append(default_match_pattern);
return TRUE;
return true;
}
buffer.append("(");
@@ -840,12 +840,12 @@ int build_list_val_expr(std::string& buffer, struct value_list *list)
}
buffer.append(")");
return TRUE;
return true;
fail:
return FALSE;
return false;
}
int convert_entry(std::string& buffer, char *entry)
bool convert_entry(std::string& buffer, char *entry)
{
pattern_t ptype;
int pos;
@@ -853,12 +853,12 @@ int convert_entry(std::string& buffer, char *entry)
if (entry) {
ptype = convert_aaregex_to_pcre(entry, 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
} else {
buffer.append(default_match_pattern);
}
return TRUE;
return true;
}
int clear_and_convert_entry(std::string& buffer, char *entry)
@@ -959,7 +959,7 @@ static std::string generate_regex_range(bignum start, bignum end)
return result.str();
}
int convert_range(std::string& buffer, bignum start, bignum end)
bool convert_range(std::string& buffer, bignum start, bignum end)
{
pattern_t ptype;
int pos;
@@ -969,24 +969,24 @@ int convert_range(std::string& buffer, bignum start, bignum end)
if (!regex_range.empty()) {
ptype = convert_aaregex_to_pcre(regex_range.c_str(), 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return FALSE;
return false;
} else {
buffer.append(default_match_pattern);
}
return TRUE;
return true;
}
int post_process_policydb_ents(Profile *prof)
bool post_process_policydb_ents(Profile *prof)
{
for (RuleList::iterator i = prof->rule_ents.begin(); i != prof->rule_ents.end(); i++) {
if ((*i)->skip())
continue;
if ((*i)->gen_policy_re(*prof) == RULE_ERROR)
return FALSE;
return false;
}
return TRUE;
return true;
}
@@ -1449,9 +1449,6 @@ int main(void)
int rc = 0;
int retval;
// Default is parser_common.c, but it should be this source file instead
progname = __FILE__;
retval = test_filter_slashes();
if (retval != 0)
rc = retval;

View File

@@ -79,7 +79,7 @@ struct var_string *split_out_var(const char *string)
{
struct var_string *n = NULL;
const char *sptr;
BOOL bEscape = 0; /* flag to indicate escape */
bool bEscape = false; /* flag to indicate escape */
if (!string) /* shouldn't happen */
return NULL;
@@ -89,15 +89,11 @@ struct var_string *split_out_var(const char *string)
while (!n && *sptr) {
switch (*sptr) {
case '\\':
if (bEscape) {
bEscape = FALSE;
} else {
bEscape = TRUE;
}
bEscape = !bEscape;
break;
case '@':
if (bEscape) {
bEscape = FALSE;
bEscape = false;
} else if (*(sptr + 1) == '{') {
const char *eptr = get_var_end(sptr + 2);
if (!eptr)
@@ -111,8 +107,7 @@ struct var_string *split_out_var(const char *string)
}
break;
default:
if (bEscape)
bEscape = FALSE;
bEscape = false;
}
sptr++;
}

View File

@@ -704,7 +704,7 @@ rules: rules opt_prefix block
if (($2).priority != 0) {
yyerror(_("priority is not allowed on rule blocks"));
}
PDEBUG("matched: %s%s%sblock\n",
PDEBUG("matched: %s%s%s%sblock\n",
$2.audit == AUDIT_FORCE ? "audit " : "",
$2.rule_mode == RULE_DENY ? "deny " : "",
$2.rule_mode == RULE_PROMPT ? "prompt " : "",

View File

@@ -8,33 +8,33 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2020-03-12 02:48+0000\n"
"Last-Translator: bernard stafford <Unknown>\n"
"PO-Revision-Date: 2013-11-15 01:27+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-03-13 05:43+0000\n"
"X-Generator: Launchpad (build 3a6db24bbe7280ec09bae73384238390fcc98ad3)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: af\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Fout: Buite geheue.\n"
msgstr ""
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Fout: basedir %s is nie 'n gids, huppel tans.\n"
msgstr ""
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Fout: Kon gids nie by te voeg %s om soek pad.\n"
msgstr ""
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Fout: Kon nie geheue toeken.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
@@ -50,7 +50,7 @@ msgstr "Geheue is opgebruik\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "Kon nie profiel kopieer: Slegte geheue-adres\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -62,7 +62,7 @@ msgstr "Profiel stem nie ooreen met handtekening nie\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "Profiel weergawe nie gesteunde deur Apparmora module\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -74,12 +74,12 @@ msgstr "Profiel bestaan nie\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "Toestemming ontkened; poging tot laai 'n profiel terwyl confined?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Onbekende fout (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -109,7 +109,7 @@ msgstr "%s: Kan nie na stdout toe skryf nie\n"
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: Nie in staat is om te skryf aan uitset lêer\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -145,11 +145,11 @@ msgstr "PANIEK slegs inkrementbuffer %p pos %p uitbr %p grootte %d res %p\n"
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "profiel %s netwerk reëls nie afgedwing\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "Onbekend patroon tipe\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -162,13 +162,13 @@ msgstr "Kan %s - %s nie open nie\n"
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr "Geheue Allokasie Fout: Nie in staat om verwyder ^%s\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr "Geheue Allokasie Fout: Nie in staat om verwyder %s:%s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -190,32 +190,32 @@ msgstr "%s: Kan nie volledige profielinskrywing skryf nie\n"
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: Nie in staat skryf die entire profiel inskrywing om kas\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "Kon nie oopmaak '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "fstat misluk vir '%s'"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "oopdir misluk '%s'"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "stat misluk vir '%s'"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "Kon nie oopmaak '%s' in '%s'"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -225,17 +225,17 @@ msgstr "Onverwagte karakter gevind: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "Veranderlike aangiftes aanvaar nie trailing kommas"
msgstr ""
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr "(netwerk_modus) Gevind onverwagte karakter: '%s'"
msgstr ""
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "Waarskuwing vanaf %s (%s%sline %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -248,8 +248,6 @@ msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"Waarskuwing: nie in staat om vind 'n geskikte fs in %s, is dit gemonteer?\n"
"Gebruik --subdomainfs om override.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
@@ -257,8 +255,6 @@ msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: Jammer. Wat jy nodig het root voorregte om hierdie program uit te voer.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
@@ -267,16 +263,12 @@ msgid ""
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: Waarskuwing! Jy het stel hierdie program setuid root.\n"
"Enigiemand wat hierdie programe kan jou AppArmor profiele by te werk kan "
"hardloop.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Fout: Kan nie profiel lees %s: %s.\n"
msgstr ""
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -302,12 +294,12 @@ msgstr "Geheuetoekenningsfout."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "Kas laai suksesvol vir \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "Kas relaai suksesvol vir \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -319,14 +311,11 @@ msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
"Hoofletters kwalifiseerders \"RWLIMX\" is deprecated, asseblief omskakel na "
"kleinletters\n"
"Sien die apparmor.d(5) manpage vir besonderhede.\n"
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "Konflik 'a' en 'w' perms is onderling uitsluitend."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
@@ -340,17 +329,12 @@ msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
"Onbegrensde exec kwalifiseerder (%c%c) toelaat sommige gevaarlike omgewing "
"veranderlikes om wees geslaag om die onbegrensde proses; 'man 5 apparmor.d' "
"vir besonderhede.\n"
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kwalifiseerder '%c' ongeldig, konflikterende kwalifiseerder reeds "
"gespesifiseer"
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
@@ -358,24 +342,22 @@ msgstr ""
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kwalifiseerder '%c%c' ongeldig, konflikterende kwalifiseerder reeds "
"gespesifiseer"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Interne: onverwagte modus karakter '%c' in insette"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Interne fout gegenereer ongeldige perm 0x%llx\n"
msgstr ""
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr "AppArmor parser fout: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
@@ -384,50 +366,47 @@ msgstr "Kon inskrywings nie saamvleg nie. Geheue is opgebruik\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "profiel %s: het saamgevoegde reël %s met konflikterende x wysigers\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "Profiel beslaglegging moet begin met 'n '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Profiel name moet begin met 'n '/', naamruimte of sleutelwoord 'profile' of "
"'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "Kon nie alias skep %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr "Profiel vlag chroot_relatiewe konflik met naamruimte_relatiewe"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr "Profiel vlag bemiddel_geskrap konflikte met delegeer_geskrap"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Profiel vlag hechten_ontkoppelde konflikte met geen_hechten_ontkoppel"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr "Profiel vlag chroot_hechten konflik met chroot_geen_hechten"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr "Profiel vlag 'debug' is nie meer geldig."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Ongeldige profiel vlag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
@@ -439,29 +418,23 @@ msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"Ongeldige modus, in ontken reëls 'x' moet nie voorafgegaan word deur exec "
"kwalifiseerder 'i', 'p', of 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Ongeldige modus, 'x' moet voorafgegaan word deur exec kwalifiseerder 'i', "
"'p', 'c', of 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Ongeldige modus, 'x' moet voorafgegaan word deur exec kwalifiseerder 'i', "
"'p', of 'u'"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Assert: `network_rule' ongeldige protokol terugstuur."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "Assert: `change_profile' teruggekeer NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
@@ -469,28 +442,28 @@ msgstr "Beweer: `hat-reël' het NUL teruggestuur."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Assert: 'local_profile rule' teruggekeer NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "Unset boolean veranderlike %s gebruik in if-uitdrukking"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr "onveilige reël ontbreek exec toestemmings"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr "subset kan slegs gebruik word met skakel reëls."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr "skakel en exec perms konflik op 'n lêer reël met behulp van ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr "skakel perms word nie toegelaat op 'n vernoem profiel oorgang.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
@@ -500,22 +473,22 @@ msgstr "ontbreek daar n reëleindkarakter? (inskrywing: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr "Ongeldig netwerk inskrywing."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr "Ongeldige capvermoë %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "AppArmor parser fout vir %s%s%s by lyn %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "AppArmor parser fout,%s%s lyn %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -541,8 +514,6 @@ msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
"%s: Regex groepering fout: Unclosed groepering of karakter klas, verwag tans "
"sluit }\n"
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
@@ -557,12 +528,12 @@ msgstr "%s: Kan insetreël '%s' nie ontleed nie\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: Ongeldig profiel naam '%s' - slegte gereelde uitdrukking\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr "FOUT samesmelting reëls vir profiele %s, kon nie laai nie\n"
msgstr ""
#: ../parser_policy.c:234
#, c-format
@@ -571,24 +542,21 @@ msgid ""
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
"FOUT profiel %s bevat beleid elemente nie bruikbaar met hierdie kern:\n"
"\t'*', '?', karakter reekse, en alternations is nie toegelaat.\n"
"\t'**' mag enigste wees gebruik an die einde van 'n rule.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr "FOUT verwerking regexs vir profiel %s, misluk om laai\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr "FOUT uitbrei tans veranderlikes vir praofiel %s, misluk om laai\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "FOUT bygevoeg hoed toegang reël vir profiel %s\n"
msgstr ""
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
@@ -598,17 +566,17 @@ msgstr "FOUT in profiel %s, het misluk om te laai\n"
#: ../parser_policy.c:675
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr "%s: Foute gevind tydens naverwerking. Aborteer tans.\n"
msgstr ""
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr "%s: Foute gevind tydens regex naverwerking. Aborteer tans.\n"
msgstr ""
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr "%s: Foute gevind tydens na-proses. Aborteer tans.\n"
msgstr ""
#: ../parser_policy.c:696
#, c-format
@@ -619,162 +587,161 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "Kon nie proses -insluit gids '%s' in '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Funksie buffer volle."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Uit van geheue"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "Kan nie kasgids skep nie: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Lêer in kas directory plek: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "Kan nie kasgids opdateer: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "interne: onverwagte DBUS modus karakter '%c' in insette"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "Interne fout gegenereer ongeldig DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "ontken voorvoegsel nie toegelaat"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "eienaar voorvoegsel nie toegelaat"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "eienaar voorvoegsel nie toegelaat op reëls berg"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "eienaar voorvoegsel nie toelaat op dbus reëls"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "eienaar voorvoegsel nie toelaat op capvermoë reëls"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "ongeldig berg voorwaardelike %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "slegte berg reël"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "hegpunt voorwaardes tans nie ondersteun nie"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "ongeldig pivotroot voorwaardelike '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Regex groepering fout: Ongeldig naby ], geen bypassende oop [ bespeur\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr "%s: Regex groepering fout: Oorskry maksimum nes van {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr "FOUT verwerking beleiddb reëls vir profiel %s, kon nie laai nie\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "FOUT vervanging van aliasse vir profiel %s, misluk om laai\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: Nie in staat om skryf %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr "Fout: Kon nie lees binêre profiel of kaslêer %s: %s.\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Fout: Kon nie lees kaslêer '%s', huppel tans...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Interne: onverwagte %s modus karakter '%c' in inset"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Interne fout gegenereer ongeldig %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "eienaar voorvoegsel nie toegelaat op reëls berg"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "eienaar voorvoegsel nie toegelaat op dbus reëls"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "eienaar voorvoegsel nie toegelaat op sein reëls"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "eienaar voorvoegsel nie toegelaat op ptrace reëls"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "eienaar voorvoegsel nie toegelaat op unix reëls"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "eienaar voorvoegsel nie toegelaat op capvermoë reëls"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "dbus reël: ongeldig voorwaardelike groep %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "unix reël: ongeldig voorwaardelike groep %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: Regex fout: trailing '\\' ontsnapping karakter\n"
msgstr ""

View File

@@ -1,14 +1,14 @@
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
# Translations for apparmor_parser
# Copyright (C) 2024 YEAR Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2011.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2025-02-18 07:32-0800\n"
"POT-Creation-Date: 2024-08-31 15:55-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
@@ -326,7 +326,7 @@ msgstr ""
#: parser_yacc.y:744 parser_yacc.y:1073 parser_yacc.y:1160 parser_yacc.y:1169
#: parser_yacc.y:1173 parser_yacc.y:1183 parser_yacc.y:1193 parser_yacc.y:1287
#: parser_yacc.y:1365 parser_yacc.y:1561 parser_yacc.y:1569 parser_yacc.y:1619
#: parser_yacc.y:1624 parser_yacc.y:1701 parser_yacc.y:1750 ../network.cc:945
#: parser_yacc.y:1624 parser_yacc.y:1701 parser_yacc.y:1750 ../network.cc:899
#: ../af_unix.cc:197 ../all_rule.cc:102 ../all_rule.cc:131
msgid "Memory allocation error."
msgstr ""
@@ -411,12 +411,12 @@ msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71 ../parser_merge.c:77
#: ../parser_merge.c:71 ../parser_merge.c:74
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93 ../parser_merge.c:100
#: ../parser_merge.c:93 ../parser_merge.c:97
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -542,7 +542,7 @@ msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: ../network.cc:515
#: ../network.cc:484
msgid "Invalid network entry."
msgstr ""
@@ -830,16 +830,16 @@ msgstr ""
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
#: ../parser_common.c:112 ../parser_common.c:139
#: ../parser_common.c:112 ../parser_common.c:134
#, c-format
msgid "%s from %s (%s%sline %d): %s"
msgstr ""
#: ../parser_common.c:113 ../parser_common.c:140
#: ../parser_common.c:113 ../parser_common.c:135
msgid "Warning converted to Error"
msgstr ""
#: ../parser_common.c:113 ../parser_common.c:140
#: ../parser_common.c:113 ../parser_common.c:135
msgid "Warning"
msgstr ""
@@ -1051,13 +1051,13 @@ msgstr ""
msgid "Internal: unexpected %s perms character '%c' in input"
msgstr ""
#: ../parser_misc.c:1100
#: ../parser_misc.c:1098
msgid ""
"Invalid perms, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: ../parser_misc.c:1104
#: ../parser_misc.c:1102
msgid "Invalid perms, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
@@ -1091,16 +1091,16 @@ msgstr ""
msgid "attach_disconnected_path value must begin with a /"
msgstr ""
#: ../mount.cc:903
#: ../mount.cc:897
msgid ""
"The use of source as mount point for propagation type flags is deprecated.\n"
msgstr ""
#: ../network.h:202
#: ../network.h:200
msgid "priority prefix not allowed on network rules"
msgstr ""
#: ../network.h:206
#: ../network.h:204
msgid "owner prefix not allowed on network rules"
msgstr ""

View File

@@ -1,741 +0,0 @@
# Belarusian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2020-05-03 16:54+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Belarusian <be@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-04 04:32+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr ""
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr ""
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr ""
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr ""
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
msgstr ""
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
msgid "Profile does not match signature\n"
msgstr ""
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
msgstr ""
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
msgid "Profile doesn't exist\n"
msgstr ""
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr ""
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr ""
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr ""
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr ""
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr ""
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr ""
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
msgstr ""
#: ../parser_interface.c:818 ../parser_interface.c:810
#, c-format
msgid "unable to serialize profile %s\n"
msgstr ""
#: ../parser_interface.c:829 ../parser_interface.c:916
#: ../parser_interface.c:821 ../parser_interface.c:908
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr ""
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr ""
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr ""
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
#: parser_yacc.y:624 parser_yacc.y:939 parser_yacc.y:948 parser_yacc.y:960
#: parser_yacc.y:1008 parser_yacc.y:1019 parser_yacc.y:1101 parser_yacc.y:1119
#: parser_yacc.y:1126 ../parser_main.c:850 ../parser_main.c:1015
#: ../parser_main.c:1229 ../parser_main.c:1283 ../parser_misc.c:431
#: parser_yacc.y:268 parser_yacc.y:416 parser_yacc.y:426 parser_yacc.y:537
#: parser_yacc.y:626 parser_yacc.y:976 parser_yacc.y:1021 parser_yacc.y:1030
#: parser_yacc.y:1042 parser_yacc.y:1078 parser_yacc.y:1082 parser_yacc.y:1092
#: parser_yacc.y:1102 parser_yacc.y:1201 parser_yacc.y:1223 parser_yacc.y:1234
#: parser_yacc.y:1309 parser_yacc.y:1327 parser_yacc.y:1334 parser_yacc.y:1385
#: ../parser_main.c:735 ../parser_main.c:923 ../parser_main.c:1133
#: ../parser_main.c:1187 parser_yacc.y:311 parser_yacc.y:462 parser_yacc.y:472
#: parser_yacc.y:583 parser_yacc.y:662 parser_yacc.y:669 parser_yacc.y:1130
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr ""
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr ""
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:234
#, c-format
msgid ""
"ERROR profile %s contains policy elements not usable with this kernel:\n"
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
msgid "ERROR in profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:675
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr ""
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr ""
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr ""
#: ../parser_policy.c:696
#, c-format
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -8,33 +8,33 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2024-09-14 11:03+0000\n"
"Last-Translator: Walter Garcia-Fontes <walter.garcia@upf.edu>\n"
"PO-Revision-Date: 2013-11-15 01:59+0000\n"
"Last-Translator: Christian Boltz <Unknown>\n"
"Language-Team: Catalan\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-09-15 07:16+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: ca\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Error: Sense memòria.\n"
msgstr ""
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Error: basedir %s no és un directori, s'omet.\n"
msgstr ""
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Error: no s'ha pogut afegir el directori %s al camí de cerca.\n"
msgstr ""
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Error: no s'ha pogut assignar memòria.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
@@ -50,7 +50,7 @@ msgstr "Sense memòria\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "No s'ha pogut copiar el perfil: adreça de memòria incorrecta\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -62,7 +62,7 @@ msgstr "El perfil no coincideix amb la signatura\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "La versió del perfil no és compatible amb el mòdul Apparmor\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -75,13 +75,11 @@ msgstr "El perfil no existeix\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
"S'ha denegat el permís; s'ha intentat carregar un perfil mentre està "
"confinat?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Error desconegut (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -111,7 +109,7 @@ msgstr "%s: no es pot escriure a l'stdout\n"
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: no s'ha pogut escriure al fitxer de sortida\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -149,11 +147,11 @@ msgstr ""
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "el perfil %s de les regles de xarxa no està obligat\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "Tipus de patró desconegut\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -166,13 +164,13 @@ msgstr "No es pot obrir %s - %s\n"
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr "Error d'assignació de memòria: no es pot eliminar ^%s\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr "Error d'assignació de memòria: no es pot eliminar %s:%s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -195,32 +193,31 @@ msgstr "%s: no es pot escriure tota l'entrada del perfil\n"
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
"%s: No s'ha pogut escriure l'entrada de perfil sencera a la memòria cau\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "No s'ha pogut obrir «%s»"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "ha fallat fstat per a «%s»"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "opendir ha fallat «%s»"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "stat ha fallat per a «%s»"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "No s'ha pogut obrir «%s» a «%s»"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -230,17 +227,17 @@ msgstr "S'ha trobat un caràcter inesperat: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "Les declaracions de variables no accepten comes finals"
msgstr ""
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr "(networkmode) S'ha trobat un caràcter inesperat: «%s»"
msgstr ""
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "Avís de %s (%s%slínia %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -255,8 +252,6 @@ msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"Avís: no s'ha pogut trobar un fs adequat a %s, està muntat?\n"
"Utilitzeu --subdomainfs per a substituir.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
@@ -264,8 +259,6 @@ msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: Ho sento. Necessiteu privilegis de root per a executar aquest programa.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
@@ -274,16 +267,12 @@ msgid ""
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: Avís! Heu establert el setuid d'aquest programa a root.\n"
"Qualsevol persona que pugui executar aquest programa pot actualitzar els "
"perfils de l'AppArmor.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Error: no s'ha pogut llegir el perfil %s: %s.\n"
msgstr ""
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -309,12 +298,12 @@ msgstr "S'ha produït un error d'assignació de memòria."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "La càrrega a la memòria cau ha estat correcta per a «%s».\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "S'ha recarregat a la memòria cau amb èxit per a «%s».\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -326,14 +315,11 @@ msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
"Els classificadors «RWLIMX» en majúscules estan obsolets, si us plau "
"convertiu-los a minúscules\n"
"Vegeu la pàgina del manual apparmor.d(5) per a més detalls.\n"
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "Els perms del conflicte «a» i «w» són mútuament excloents."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
@@ -347,17 +333,12 @@ msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
"El qualificador d'exec no confiat (%c%c) permet passar algunes variables "
"d'entorn perilloses al procés no confiat; «man 5 apparmor.d» per als "
"detalls.\n"
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
"El qualificador d'execució «%c» no és vàlid, ja s'ha especificat un "
"qualificador conflictiu"
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
@@ -365,24 +346,22 @@ msgstr ""
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
"El qualificador d'execució «%c%c» no és vàlid, ja s'ha especificat un "
"qualificador conflictiu"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Intern: el caràcter de mode «%c» no és esperat a l'entrada"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Error intern generat un perm 0x%llx no vàlid\n"
msgstr ""
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr "Error de l'analitzador AppArmor: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
@@ -391,56 +370,47 @@ msgstr "No s'han pogut fusionar les entrades. Sense memòria\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "perfil %s: té la regla fusionada %s amb modificadors X conflictius\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "L'adjunt del perfil ha de començar amb una «/»."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Els noms de perfil han de començar amb un '/', espai de noms o paraula clau "
"'profile' o 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "No s'ha pogut crear l'àlies %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"L'indicador de perfil chrootrelative entra en conflicte amb "
"namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"L'indicador del perfil mediate_deleted entre en conflicte amb "
"delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"L'indicador de perfil attach_disconnected entra en conflicte amb "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"El perfil de l'etiqueta chroot_attach entra en conflicte amb chroot_noattach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr "L'indicador de perfil «debug» ja no és vàlid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Indicador de perfil no vàlid: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
@@ -452,29 +422,23 @@ msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"El mode no és vàlid, a les regles de denegació «x» no s'ha de precedir per "
"«i», «p» o «u»"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"El mode no és vàlid, «x» ha d'anar precedit del qualificador «i», «p», «c» o "
"«u»"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"El mode no és vàlid, «x» ha d'anar precedit del qualificador exec «i», «p» o "
"«u»"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Assert: «network_rule» retorna un protocol no vàlid."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "Confirmació: «change_profile» ha retornat NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
@@ -482,32 +446,28 @@ msgstr "Confirmació: 'hat rule' ha retornat NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Confirmació: «local_profile rule» ha retornat NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
"No s'ha establert la variable booleana %s utilitzada a l'expressió if"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr "manca permisos d'execució per a la regla insegura"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr "el subconjunt només es pot utilitzar amb regles d'enllaç."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
"l'enllaç i els permisos exec entren en conflicte amb una regla de fitxer "
"utilitzant ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
"no es permeten permisos d'enllaç en una transició de perfil amb nom.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
@@ -517,22 +477,22 @@ msgstr "falta un caràcter de final de línia? (entrada: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr "Entrada de xarxa no vàlida."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr "Capacitat no vàlida %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "Error de l'analitzador AppArmor per a %s%s%s a la línia %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "Error de l'analitzador AppArmor, %s%s línia %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -561,8 +521,6 @@ msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
"%s: error d'agrupament d'expressions regulars: agrupació sense tancar o "
"classe de caràcters, esperant tancar }\n"
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
@@ -580,14 +538,11 @@ msgstr "%s: no es pot analitzar la línia d'entrada '%s'\n"
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
"%s: el nom del perfil «%s» no és vàlid - expressió regular incorrecta\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
"S'ha produït un ERROR en fusionar les regles per al perfil %s, no s'ha pogut "
"carregar\n"
#: ../parser_policy.c:234
#, c-format
@@ -596,28 +551,21 @@ msgid ""
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
"El perfil d'ERROR %s conté elements de política no usables amb aquest "
"nucli:\n"
"\t'*', '?', intervals de caràcters i alternances no estan permesos.\n"
"\t«**» només es pot utilitzar al final d'una regla.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
"S'ha produït un ERROR en processar les expressions regulars del perfil %s, "
"no s'ha pogut carregar\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"ERROR en expandir les variables del perfil %s, no s'ha pogut carregar\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "ERROR en afegir la regla d'accés al barret per al perfil %s\n"
msgstr ""
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
@@ -628,20 +576,16 @@ msgstr "ERROR al perfil %s, no s'ha pogut carregar\n"
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocessament. S'està avortant.\n"
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocés de l'expressió regular. S'està "
"avortant.\n"
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocessament. S'està avortant.\n"
#: ../parser_policy.c:696
#, c-format
@@ -653,171 +597,161 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "No s'ha pogut processar el directori d'inclusió «%s» a «%s»"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Memòria intermèdia de funcions plena."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Sense memòria"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "No es pot crear el directori de la memòria cau: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Fitxer a la ubicació del directori de la memòria cau: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "No es pot actualitzar el directori de la memòria cau: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "Intern: el caràcter «%c» del mode DBus no és esperat a l'entrada"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "S'ha produït un error intern al DBus perm 0x%x no vàlid\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "no es permet el prefix de denegació"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "no es permet el prefix del propietari"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "el prefix propietari no permet les regles de muntatge"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "el prefix del propietari no permet a les regles de dbus"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "el prefix del propietari no permet les regles de capacitat"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "el muntatge condicional %s%s no és vàlid"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "regla de muntatge incorrecta"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "les condicions del punt de muntatge no són compatibles actualment"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "la condició «%s» de l'arrel dinàmica no és vàlida"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: error d'agrupament d'expressions regulars: tancament invàlid ], no s'ha "
"trobat cap obert coincident [ detectat\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Error d'agrupament d'expressions regulars: s'ha superat la imbricació "
"màxima de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"S'ha produït un error en processar les regles policydb per al perfil %s, no "
"s'ha pogut carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
"ERROR en substituir els àlies del perfil %s, no s'ha pogut carregar\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: no s'ha pogut escriure %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Error: no s'ha pogut llegir el perfil binari o el fitxer de memòria cau %s: "
"%s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
"Error: no s'ha pogut llegir el fitxer de la memòria cau «%s», s'omet...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Intern: al mode %s el caràcter «%c» no és l'esperat"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Error intern generat no vàlid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "no es permet el prefix del propietari a les regles de muntatge"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "no es permet el prefix del propietari a les regles de dbus"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "no es permet el prefix del propietari a les regles del senyal"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "no es permet el prefix del propietari a les regles «ptrace»"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "no es permet el prefix del propietari a les regles unix"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "no es permet el prefix del propietari a les regles de capacitat"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "regla dbus: el grup condicional %s()() no és vàlid"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "regla unix: el grup condicional %s()() no és vàlid"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: error d'expressió regular: caràcter d'escapament «\\» al final\n"
msgstr ""

View File

@@ -6,142 +6,130 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2022-03-10 18:26+0000\n"
"Last-Translator: Marek Hladík <mhladik@seznam.cz>\n"
"PO-Revision-Date: 2013-11-15 02:07+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-03-11 06:22+0000\n"
"X-Generator: Launchpad (build 61f4697954ab70d633d14d8ceecff69a20b08a6b)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: cs\n"
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Chyba: Nedostatek paměti\n"
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Chyba: Základní adresář %s není adresář, přeskakuje se.\n"
#: ../parser_include.c:137 ../parser_include.c:122
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Chyba: Adresář %s nelze přidat ke hledané cestě.\n"
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Chyba: Nelze přidělit paměť\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Špatná pozice zápisu\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "Oprávnění odepřeno\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Nedostatek paměti\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "Nelze zkopírovat profil: Špatná adresa paměti\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Profil neodpovídá protokolu\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Profil neodpovídá podpisu\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Modul Apparmor nepodporuje verzi profilu.\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "Profil již existuje\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "Profil neexistuje\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "Přístup odepřen. Pokoušíte se načíst profil, i přes jistá omezeni?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Neznámá chyba (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Nelze přidat \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101 ../parser_interface.c:105
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Nelze nahradit \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106 ../parser_interface.c:110
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: Nelze odstranit \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111 ../parser_interface.c:115
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: nelze zapisovat na standardní výstup\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115 ../parser_interface.c:119
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: Nelze zapsat výstupní soubor\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: ASSERT: neplatná volba: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127 ../parser_interface.c:132
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "Přidání uspělo pro \"%s\".\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131 ../parser_interface.c:136
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "Nahrazení uspělo pro \"%s\".\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135 ../parser_interface.c:140
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "Odstranění uspělo pro \"%s\".\n"
@@ -152,14 +140,14 @@ msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr "PANIKA: chybný přírůstkový buffer %p pos %p ext %p size %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446 ../parser_interface.c:476
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "profilu %s nejsou vynucena síťová pravidla\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "Neznámý typ vzoru\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -197,35 +185,35 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Nelze zapsat celý záznam profilu\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593 ../parser_interface.c:579
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: Nelze zapsat celý záznam profilu do mezipaměti\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "Nelze otevřít '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "fstat selhal pro '%s'"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "opendir selhal '%s'"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "stat selhal pro '%s'"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "Nelze otevřít '%s' v '%s'"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -233,9 +221,9 @@ msgstr "Nelze otevřít '%s' v '%s'"
msgid "Found unexpected character: '%s'"
msgstr "Nalezen neočekávaný znak: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "U deklarace proměnných nejsou přípustné koncové čárky"
msgstr ""
#: parser_lex.l:420
#, c-format
@@ -245,7 +233,7 @@ msgstr "(režim_sítě) Nalezen neplatný znak: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "Pozor na %s (%s%s řádku %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -253,7 +241,6 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr "%s: Nelze alokovat paměť pro bod připojení subdomainbase\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -263,7 +250,6 @@ msgstr ""
"Možnost lze přepsat pomocí možnosti --subdomainfs.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -273,7 +259,6 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -287,7 +272,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Chyba: Nelze číst profil %s: %s.\n"
@@ -309,36 +294,26 @@ msgstr "Chyba: Nelze číst profil %s: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr "Chyba alokace paměti."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "Načtení z mezipaměti pro „%s“ bylo úspěšné\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "Opětovné načtení mezipaměti pro „%s“ bylo úspěšné\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Chyby v souboru. Ukončuji.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -349,19 +324,16 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "Oprávnění 'a' a 'w' se vzájemně vylučují."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kvalifikátor 'i' je neplatný, byl již specifikován konfliktní "
"kvalifikátor"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -373,7 +345,6 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -382,7 +353,6 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
@@ -391,13 +361,11 @@ msgstr ""
"kvalifikátor"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Vnitřní: Neznámý znak režimu '%c' na vstupu."
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Vnitřní chyba způsobila neplatné perm 0x%llx\n"
@@ -409,148 +377,137 @@ msgid "AppArmor parser error: %s\n"
msgstr "Chyba parseru AppArmor: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Nelze sloučit záznamy. Nedostatek paměti\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "profil %s: bylo sloučeno pravidlo %s s konfliktními x modifikátory\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "Příloha profilu musí začínat znakem '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Názvy profilů musí začínat znakem '/', jmenným prostorem nebo klíčovým "
"slovem 'profile' nebo 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "Nelze vytvořit alias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"Příznak profilu 'chroot_relative' je v konfliktu s 'namespace_relative'"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"Příznak profilu 'mediate_deleted' je v konfliktu s 'delegate_deleted'"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Příznak profilu 'connect_disconnected' je v konfliktu s "
"'no_attach_disconnected'"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr "Příznak profilu 'chroot_attach' je v konfliktu s 'chroot_no_attach'"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr "Příznak profilu 'debug' již není platný."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Neplatný příznak profilu: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Assert: `rule' vrátil NULL."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"Neplatný režim, před 'x' musí být exec kvalifikátor 'i', 'p' nebo 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Neplatný režim, před 'x' musí být exec kvalifikátor 'i', 'p', 'c' nebo 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr "Neplatný režim, před 'x' musí být kvalifikátor 'i', 'p' nebo 'u'."
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Assert: `pravidlo_sítě' vrací neplatný protokol."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "Assert: `změna_profilu' vrátila hodnotu NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr "Assert: 'hat rule' vrátil NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Assert: 'local_profile rule' vrátil NULL."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "Ve výrazu 'if' byla použita nenastavená booleovská proměnná %s."
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr "nebezpečné pravidlo nemá oprávnění ke spuštění"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr "podskupina může být použita pouze s pravidly odkazů."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr "link a exec perms konflikt souboru pravidel používajícím ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr "link perms nejsou povoleny na přechodu pojmenovaného profilu.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "chybí znak konce řádku? (záznam: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr "Neplatná položka sítě."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr "Neplatná schopnost %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "Chyba parseru AppArmor pro %s%s%s na řádku %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "Chyba parseru AppArmor, %s%s řádek %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -558,13 +515,11 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: nepovolená otvírací {, vnořené seskupování není povoleno\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr "%s: Chyba seskupování regex: neplatný počet položek mezi {}\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -573,7 +528,6 @@ msgstr ""
"otevírací {\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -588,19 +542,16 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Detekováno vnitřní přetečení zásobníku, přesáhlo %d znaků\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Nelze analyzovat vstupní řádku '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: Neplatné jméno profilu '%s' - špatný regulární výraz\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -618,7 +569,6 @@ msgstr ""
"\t'**' lze použít pouze na konci pravidla.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
@@ -626,14 +576,12 @@ msgstr ""
"načítání.\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"CHYBA při rozšíření proměnných pro profil %s, došlo k chybě při načítání.\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "Chyba při přidání pravidla pro přístup k hat pro profil %s\n"
@@ -665,170 +613,164 @@ msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
"%s: Nalezeny chyby při postprocesingu kombinačních pravidel. Ukončuji.\n"
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "Nelze zpracovat vloženého adresáře '%s' v '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Vyrovnávací paměť pro funkce je plná."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Nedostatek paměti"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "Nelze vytvořit adresář mezipaměti: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Soubor v adresáři mezipaměti: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "Nelze aktualizovat adresář mezipaměti: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "Interní: Neočekávaný znak '%c' režimu DBus na vstupu"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "Interní chyba vygenerovaná neplatnou DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "deny prefix není povolen"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "prefix vlastníka není povolen"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "prefix vlastníka není povolen v pravidlech pro připojení"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "prefix vlastníka není povolen v pravidlech dbus"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "prefix vlastníka není povolen v pravidlech schopností"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "neplatná podmínka připojení %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "špatné pravidlo připojení"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "podmínky přípojného bodu nejsou aktuálně podporovány"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "neplatný podmíněný pivotroot '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Chyba seskupení regulárních výrazů: Neplatné uzavření ], nebylo zjištěno "
"žádné odpovídající otevření [\n"
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Chyba seskupení regulárních výrazů: Překročen maximální počet vnoření "
"{}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"CHYBA zpracování pravidel policydb pro profil %s, načtení se nezdařilo\n"
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "CHYBA při nahrazení aliasů pro profil %s, načtení se nezdařilo\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: Nelze zapsat %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr "Chyba: Nelze přečíst binární profil nebo soubor mezipaměti %s: %s.\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Chyba: Nelze přečíst soubor mezipaměti '%s', přeskočení...\n"
msgstr ""
#: ../parser_misc.c:575 ../parser_misc.c:768
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Interní: V režimu %s se na vstupu vyskytl neočekávaný znak '%c'"
msgstr ""
#: ../parser_misc.c:599 ../parser_misc.c:792
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Interní chyba vygenerovala neplatné %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703 parser_yacc.y:784
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "prefix vlastníka není v pravidlech připojení povolen"
msgstr ""
#: parser_yacc.y:720 parser_yacc.y:801
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "prefix vlastníka není v pravidlech dbus povolen"
msgstr ""
#: parser_yacc.y:736 parser_yacc.y:817
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "prefix vlastníka není v pravidlech signálu povolen"
msgstr ""
#: parser_yacc.y:752 parser_yacc.y:833
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "prefix vlastníka není v pravidlech ptrace povolen"
msgstr ""
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "prefix vlastníka není v pravidlech unixu povolen"
msgstr ""
#: parser_yacc.y:794 parser_yacc.y:885
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "prefix vlastníka není v pravidlech schopností povolen"
msgstr ""
#: parser_yacc.y:1293 parser_yacc.y:1377
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "pravidlo dbus: neplatná podmíněná skupina %s=()"
msgstr ""
#: parser_yacc.y:1371 parser_yacc.y:1455
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "unixové pravidlo: neplatná podmíněná skupina %s=()"
msgstr ""
#: ../parser_regex.c:368 ../parser_regex.c:410
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: Chyba regulárního výrazu: koncový znak escape '\\'\n"
msgstr ""

View File

@@ -6,38 +6,38 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2024-10-09 22:03+0000\n"
"Last-Translator: Rodrigo Lledó <rodhos92@gmail.com>\n"
"PO-Revision-Date: 2013-11-26 03:48+0000\n"
"Last-Translator: Monkey <monkey.libre@gmail.com>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-10-10 07:50+0000\n"
"X-Generator: Launchpad (build 6341c735b243a0768c3cb66edf85737937cab327)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: es\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Error: Memoria insuficiente.\n"
msgstr "Error: memoria insuficiente.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Error: el directorio base %s no es un directorio. Se omitido.\n"
msgstr "Error: el directorio base %s no es un directorio. Se va a omitir.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
"Error: No se ha podido añadir el directorio %s a la ruta de búsqueda.\n"
"Error: no se ha podido añadir el directorio %s a la a de búsqueda.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Error: la memoria no pudo ser asignada.\n"
msgstr "Error: no es posible asignar memoria.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr "Escrito en el lugar equivocado.\n"
msgstr "Posición de escritura incorrecta\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
@@ -45,15 +45,15 @@ msgstr "Permiso denegado\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr "Sin memoria.\n"
msgstr "Memoria agotada\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "No se pudo copiar el perfil. Dirección de memoria incorrecta.\n"
msgstr "No se puede copiar el perfil. Dirección de memoria incorrecta\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
msgstr "El perfil no cumple el protocolo.\n"
msgstr "El perfil no se ajusta al protocolo\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
msgid "Profile does not match signature\n"
@@ -61,7 +61,7 @@ msgstr "El perfil no coincide con la firma\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "Versión del perfil no compatible con el módulo Apparmor.\n"
msgstr "La versión del perfil no se admite en el módulo de Apparmor.\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -73,7 +73,8 @@ msgstr "El perfil no existe\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "Permiso denegado. ¿Intentó cargar un perfil restringido?\n"
msgstr ""
"Permiso denegado. ¿Intentando cargar un perfil mientras estaba confinado?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
@@ -139,7 +140,8 @@ msgstr "Eliminación correcta de \"%s\".\n"
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
"PÁNICO: error en el aumento del búfer %p pos %p ext %p size %d res %p\n"
"PANIC: incremento de buffer incorrecto; pos %p; ext %p; tamaño %p; res %d "
"%p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
@@ -184,18 +186,18 @@ msgstr "no es posible poner en serie el perfil %s\n"
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: no es posible escribir el acceso al perfil completo\n"
msgstr "%s: no es posible escribir todo el perfil\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: no es posible escribir el acceso al perfil completo al caché\n"
msgstr "%s: Imposible escribir la entrada de perfil completa a la caché\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "No se pudo abrir «%s»"
msgstr "No se pudo abrir '%s'"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
@@ -210,7 +212,7 @@ msgstr "opendir falló «%s»"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "stat falló para «%s»"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
@@ -221,11 +223,11 @@ msgstr "No se pudo abrir «%s» en «%s»"
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr "Se ha detectado un carácter inesperado: «%s»"
msgstr "Se ha detectado un carácter inesperado: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "Las declaraciones de variables no aceptan comas al final"
msgstr ""
#: parser_lex.l:420
#, c-format
@@ -235,7 +237,7 @@ msgstr "(network_mode) Se ha encontrado un carácter inesperado: %s"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "Aviso desde %s (%s%slínea %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -306,12 +308,12 @@ msgstr "Error de asignación de memoria."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "Se ha cargado caché con éxito para «%s».\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "Se ha recargado caché con éxito para «%s».\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -389,18 +391,15 @@ msgstr "No es posible fusionar las entradas. Memoria agotada\n"
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
"el perfil %s: ha fusionado la regla %s con modificadores x en conflicto\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "El adjunto al perfil debe empezar con un «/»."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Los nombres del perfil deben empezar con un «/», espacio de nombre o palabra "
"clave «profile» o «hat»."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -410,24 +409,19 @@ msgstr "Error al crear el alias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"La marca del perfi chroot_relative está en conflicto con namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"La marca del perfil mediate_deleted está en conflicto con delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"La marca del perfil attach_disconnected está en conflicto con "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"La marca del perfil chroot_attach está en conflicto con chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -522,12 +516,12 @@ msgstr "Característica no válida %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "Error del analizador AppArmor para %s%s%s en la línea %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "Error de análisis AppArmor,%s%s línea %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -571,7 +565,7 @@ msgstr "%s: no es posible analizar la línea de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: nombre de perfil no válido «%s» - expresión regular incorrecta\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -637,166 +631,161 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "No se pudo procesar la inclusión del directorio «%s» en «%s»"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Buffer de características lleno."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Memoria agotada"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "No se puede crear el directorio de antememoria: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Archivo en ubicación de directorio de caché: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "No se puede actualizar el directorio de caché: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "Interno: carácter de modo DBUS «%c» inesperado en entrada"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "Error interno generado perm DBus no válido 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "prefijo de denegación no permitido"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "prefijo de propietario no permitido"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "prefijo de propietario no permitido en reglas de montaje"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "prefijo de propietario no permitido en reglas dbus"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "prefijo de priopietario no permitido en reglas de capacidades"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "condicional de montaje %s%s no válido"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "regla de montaje errónea"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "condiciones de punto de montaje actualmente no soportadas"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "condicional pivotroot no válido «%s»"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Error de agrupamiento regex: Cierre no válido ], no se detectó pareja de "
"apertura [\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Error de agrupamiento regex: Se excedió el máximo de anidado de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"ERROR al procesar reglas policydb para el perfil %s, falló al cargar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "ERROR al reemplazar aliases para el perfil %s, falló al cargar\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: no se pudo escribir %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Error: no se pudo leer archivo de perfil binario o archivo de caché %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Error: no se pudo leer archivo de caché «%s», omitiendo...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Interno: modo inesperado %s carácter «%c» en la entrada"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Un error interno ha generado un %s perm no válido 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "prefijo de propietario no permitido en reglas de montaje"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "prefijo de propietario no permitido en reglas de dbus"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "prefijo de propietario no permitido en reglas de señal"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "prefijo de propietario no permitido en reglas de ptrace"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "prefijo de propietario no permitido en las reglas de Unix"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "prefijo de propietario no permitido en las reglas de capacidad"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "regla dbus: grupo condicional no válido %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "regla unix: grupo condicional no válido %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: Error regex: arrastrando carácter de escape «\\»\n"
msgstr ""

View File

@@ -8,145 +8,132 @@ msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2023-12-31 16:22+0000\n"
"Last-Translator: S.M.Mousavi <Unknown>\n"
"PO-Revision-Date: 2019-12-27 08:23+0000\n"
"Last-Translator: VahidNameni <Unknown>\n"
"Language-Team: Persian <fa@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-01-01 04:31+0000\n"
"X-Generator: Launchpad (build e1eeab5b20e19239bd7d5f36676f7a52988db88b)\n"
"X-Launchpad-Export-Date: 2019-12-28 05:38+0000\n"
"X-Generator: Launchpad (build bceb5ef013b87ef7aafe0755545ceb689ca7ac60)\n"
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "خطا: خارج از حافظه.\n"
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "خطا: basedir %s یک شاخه نیست، در حال رد کردن.\n"
msgstr ""
#: ../parser_include.c:137 ../parser_include.c:122
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "خطا: امکان اضافه کردن پوشه %s به مسیر جستجو نیست.\n"
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "خطا: عدم توانایی تخصیص حافظه.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "مکان نوشتن اشتباه\n"
msgstr ""
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "مجوز صادر نگردید\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "خارج از حافظه\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "عدم توانایی رونوشت از نمایه: آدرس حافظه بد\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "نمایه با پروتکل مطابقت ندارد\n"
msgstr ""
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "نمایه با امضا مطابقت ندارد\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "نسخه نمایه توسط ماژول Apparmor پشتیبانی نمی‌شود\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "نمایه موجود است\n"
msgstr ""
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "نمایه موجود نیست\n"
msgstr ""
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
"اجازه رد شد؛ آیا در حالیکه محدود هستید، سعی در بارگزاری یک نمایه کردید؟\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "خطای ناشناخته (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: عدم توانایی اضافه کردن \"%s\". "
msgstr ""
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101 ../parser_interface.c:105
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: عدم توانایی جایگزینی \"%s\". "
msgstr ""
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106 ../parser_interface.c:110
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: عدم توانایی حذف \"%s\". "
msgstr ""
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111 ../parser_interface.c:115
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: عدم توانایی نوشتن در stdout\n"
msgstr ""
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115 ../parser_interface.c:119
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: عدم توانایی نوشتن در فایل خروجی\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr ""
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127 ../parser_interface.c:132
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "اضافه کردن \"%s\" با موفقیت انجام شد.\n"
msgstr ""
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131 ../parser_interface.c:136
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "جایگزینی \"%s\" با موفقیت انجام شد.\n"
msgstr ""
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135 ../parser_interface.c:140
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "حذف \"%s\" با موفقیت انجام شد.\n"
msgstr ""
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
@@ -154,33 +141,33 @@ msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446 ../parser_interface.c:476
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "نوع الگوی ناشناخته\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr "عدم توانایی بازکردن %s - %s\n"
msgstr ""
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr "خطای تخصیص حافظه: عدم توانایی حذف ^%s\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr "خطای تخصیص حافظه: عدم توانایی حذف %s:%s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -199,7 +186,7 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr ""
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593 ../parser_interface.c:579
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
@@ -209,7 +196,7 @@ msgstr ""
msgid "Could not open '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
@@ -235,7 +222,7 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr ""
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
@@ -255,7 +242,6 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -263,7 +249,6 @@ msgid ""
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -271,7 +256,6 @@ msgid ""
msgstr ""
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -280,7 +264,7 @@ msgid ""
msgstr ""
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
@@ -302,36 +286,26 @@ msgstr ""
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr ""
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr ""
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -339,17 +313,14 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -358,27 +329,23 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
@@ -390,12 +357,10 @@ msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -404,118 +369,115 @@ msgstr ""
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
@@ -531,20 +493,17 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -557,19 +516,16 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -583,19 +539,16 @@ msgid ""
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -625,7 +578,7 @@ msgstr ""
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
@@ -635,8 +588,7 @@ msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
@@ -665,11 +617,11 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
@@ -685,41 +637,41 @@ msgstr ""
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -739,51 +691,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575 ../parser_misc.c:768
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599 ../parser_misc.c:792
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703 parser_yacc.y:784
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720 parser_yacc.y:801
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736 parser_yacc.y:817
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752 parser_yacc.y:833
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794 parser_yacc.y:885
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293 parser_yacc.y:1377
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371 parser_yacc.y:1455
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368 ../parser_regex.c:410
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -16,14 +16,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2021-04-11 15:29+0000\n"
"Last-Translator: Markus Mikkonen <Unknown>\n"
"PO-Revision-Date: 2014-05-01 19:38+0000\n"
"Last-Translator: Jiri Grönroos <Unknown>\n"
"Language-Team: Suomi <fi@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-04-12 06:41+0000\n"
"X-Generator: Launchpad (build f3c8a1aed7c0b9bc4f5601dbf2698b30e1ab66f1)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: fi\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -643,7 +643,7 @@ msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Muisti lopussa"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format

View File

@@ -11,49 +11,49 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2021-10-03 10:20+0000\n"
"Last-Translator: gogo <trebelnik2@gmail.com>\n"
"PO-Revision-Date: 2013-11-15 02:58+0000\n"
"Last-Translator: Krešimir Jozić <Unknown>\n"
"Language-Team: Croatian <en@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-10-04 06:23+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: hr\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Greška: ponestalo memorije.\n"
msgstr "Greška: Nedovoljno memorije.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Greška: osnovni direktorij %s nije direktorij, preskačem.\n"
msgstr "Greška: temeljni direktorij %s nije direktorij, preskačem.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Greška: nemoguće dodavanje direktorija %s u putanju pretrage.\n"
msgstr "Greška: Ne mogu dodati direktorij %s u putanju za pretragu.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Greška: nemoguće dodijeliti memoriju.\n"
msgstr "Greška: Ne mogu rezervirati memoriju.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr "Netočan položaj zapisivanja\n"
msgstr "Neipravan položaj za zapisivanje\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr "Pristup uskraćen\n"
msgstr "Pristup odbijen\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr "Ponestalo memorije\n"
msgstr "Nema dovoljno memorije\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "Nemoguće kopiranje profila: neispravna memorijska adresa\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -65,7 +65,7 @@ msgstr "Profil ne odgovara potpisu\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "Inačicu profila ne podržava Apparmor modul\n"
msgstr "Verzija profila nije podržana od Apparmor modula\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -77,42 +77,42 @@ msgstr "Profil ne postoji\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "Pristup odbijen, pokušaj učitavanja profila tijekom ograničenja?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Nepoznata greška (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Nemoguće je dodati \"%s\". "
msgstr "%s: Ne mogu dodati \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Nemoguće je zamijeniti \"%s\". "
msgstr "%s: Ne mogu zamijeniti \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s : Nemoguće je ukloniti \"%s\". "
msgstr "%s : Ne mogu ukloniti \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: Nemoguće je zapisivati u stdout\n"
msgstr "%s: Ne mogu pisati na stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: Nemoguće je zapisivati u izlaznu datoteku\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165

View File

@@ -9,293 +9,267 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2023-06-26 15:06+0000\n"
"Last-Translator: NorwayFun <temuri.doghonadze@gmail.com>\n"
"PO-Revision-Date: 2013-11-14 22:25+0000\n"
"Last-Translator: George Machitidze <giomac@gmail.com>\n"
"Language-Team: Georgian <i18n@suse.de>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-06-27 04:31+0000\n"
"X-Generator: Launchpad (build aedf8597c50c1abc5fb7f9e871e686dfcb381fde)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: ka\n"
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "შეცდომა: არასაკმარისი მეხსიერება.\n"
msgstr ""
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
"შეცდომა: საბაზისო საქაღალდე %s საქაღალდეს არ წარმოადგენს. გამოტოვება\n"
#: ../parser_include.c:137 ../parser_include.c:122
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "შეცდომა: საქაღალდის %s ძებნის ბილიკში ჩამატების შეცდომა.\n"
msgstr ""
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "შეცდომა: მეხსიერების გამოყოფა შეუძლებელია.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "არასწორი ჩაწერის მდებარეობა\n"
msgstr ""
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "წვდომა აკრძალულია\n"
msgstr ""
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "არასაკმარისი მეხსიერება\n"
msgstr ""
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "პროფილს კოპირება შეუძლებელია: არასწორი მეხსიერების მისამართი\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "პროფილი პროტოკოლს არ ემორჩილება\n"
msgstr ""
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "პროფილი ხელმოწერას არ ემთხვევა\n"
msgstr ""
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "პროფილის ვერსია Apparmor-ის მოდულის მიერ მხარდაჭერილი არაა\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "პროფილი უკვე არსებობს\n"
msgstr ""
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "პროფილი არ არსებობს\n"
msgstr ""
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "წვდომა აკრძალულია. პროფილის ჩატვირთვის მცდელობა შეზღუდვისას?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "უცნობი შეცდომა (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: \"%s\"-ის დამატების შეცდომა. "
msgstr ""
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101 ../parser_interface.c:105
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: \"%s\"-ის ჩანაცვლების შეცდომა. "
msgstr ""
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106 ../parser_interface.c:110
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: \"%s\"-ის წაშლის შეცდომა. "
msgstr ""
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111 ../parser_interface.c:115
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: stdout-ში ჩაწერის შეცდომა\n"
msgstr ""
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115 ../parser_interface.c:119
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: გამოტანის ფაილში ჩაწერის შეცდომა\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: მტკიცება: არასწორი პარამეტრი: %d\n"
msgstr ""
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127 ../parser_interface.c:132
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "\"%s\"-სთვის დამატება წარმატებულია.\n"
msgstr ""
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131 ../parser_interface.c:136
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "\"%s\"-სთვის ჩანაცვლება წარმატებულია.\n"
msgstr ""
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135 ../parser_interface.c:140
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "\"%s\"-სთვის წაშლა წარმატებულია.\n"
msgstr ""
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr "პანიკა. არასწორი ზრდადი ბუფერი %p მდებ %p გაფართ %p ზომა %d რეს %p\n"
msgstr ""
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446 ../parser_interface.c:476
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "პროფილის %s ქსელის წესები არ მოქმედებს\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "უცნობი ნიმუშის ტიპი\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr "%s-ის გახსნა შეუძლებელია - %s\n"
msgstr ""
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr "მეხსიერების გამოყოფის შეცდომა: ^%s-ის წაშლა შეუძლებელია\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr "მეხსიერების გამოყოფის შეცდომა: %s-ის წაშლა შეუძლებელია: %s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
msgstr "სამუშაო ფართობის შექმნა შეუძლებელია\n"
msgstr ""
#: ../parser_interface.c:818 ../parser_interface.c:810
#, c-format
msgid "unable to serialize profile %s\n"
msgstr "პროფილის %s სერიალიზაცია შეუძლებელია\n"
msgstr ""
#: ../parser_interface.c:829 ../parser_interface.c:916
#: ../parser_interface.c:821 ../parser_interface.c:908
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: სრული პროფილის ელემენტის ჩაწერა შეუძლებელია\n"
msgstr ""
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593 ../parser_interface.c:579
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: სრული პროფილის ელემენტის კეშში ჩაწერა შეუძლებელია\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "'%s'-ის გახსნის შეცდომა"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "fstat-ის შეცდომა '%s'-სთვის"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "opendir -ის შეცდომა '%s'-სთვის"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "%s-სთვის stat()-ის შეცდომა"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "'%s'-ის '%s'-ში გახსნის შეცდომა"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr "ნაპოვნია მოულოდნელი სიმბოლო: '%s'"
msgstr ""
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "ცვლადის სახელებს ბოლოში მიწერილი მძიმეების მხარდაჭერა არ გააჩნია"
msgstr ""
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr "(network_mode) ნაპოვნია მოულოდნელი სიმბოლო: '%s'"
msgstr ""
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "გაფრთხილება %s-დან (%s%s ხაზი %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
"%s: მეხსიერების გამოყოფის შეცდომა subdomainbase მიმაგრების წერტილისთვის\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"გაფრთხილება: %s-ში შესაბამისი FS ვერ ვიპოვე. მიმაგრებულია?\n"
"გადასაფარად გამოიყენეთ --subdomainfs.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: უკაცრავად, მაგრამ ამ პროგრამის გასაშვებად root-ის პრივილეგიები "
"დაგჭირდებათ.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: გაფრთხილება: პროგრამაზე setuid root დააყენეთ.\n"
"ყველა, ვინც ამ პროგრამას გაუშვებს, AppArmor-ის პროფილების განახლება "
"შეეძლება.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "შეცდომა: პროფილის '%s' წაკითხვის შეცდომა: %s.\n"
msgstr ""
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -314,36 +288,26 @@ msgstr "შეცდომა: პროფილის '%s' წაკითხ
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr "მეხსიერების გამოყოფის შეცდომა."
msgstr ""
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "დაკეშილი ჩატვირთვა \"%s\"-სთვის წარმატებულია.\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "დაკეშილი თავიდან ჩატვირთვა \"%s\"-სთვის წარმატებულია.\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: ფაილში აღმოჩენილია შეცდომები. მუშაობის დასრულება.\n"
msgstr ""
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -351,17 +315,14 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "წვდომები 'a' და 'w' ურთიერთგამომრიცხავია."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -370,176 +331,163 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "შიდა: შეყვანაში აღმოჩენილია მოულოდნელი რეჟიმის სიმბოლო '%c'"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "შიდა შეცდომის მიერ გენერირებული არასწორი წვდომა 0x%llx\n"
msgstr ""
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr "AppArmor-ის დამმუშავებლის შეცდომა: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "ელემენტების შერწყმა შეუძლებელია. არასაკმარისი მეხსიერება\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "პროფილის მიმაგრება '/'-ით უნდა იწყებოდეს."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"პროფილის სახელი '/'-ით, სახელის სივრცით ან საკვანძო სიტყვებიდან 'profile' ან "
"'hat' უნდა იწყებოდეს."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "შეცდომა ფსევდონიმის (%s) შექმნისას -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"პროფილის ალამი chroot_relative კონფლიქტშია ალამთან namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr "პროფილის ალამი mediate_deleted კონფლიქტშია ალამთან delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"პროფილის ალამი attach_disconnect კონფლიქტშია ალამთან no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr "პროფილის ალამი chroot_attach კონფლიქტშია ალამთან chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr "პროფილის ალამი 'debug' აღარ გამოიყენება."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr "არასწორი პროფილის ალამი: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr "არასწორი ქსელის ჩანაწერი."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr "არასწორი შესაძლებლობა %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "AppArmor-ის დამმუშავებლის შეცდომა. %s%s%s ხაზზე ნომრით %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "AppArmor-ის დამმუშავებლის შეცდომა. %s%s ხაზზე ნომრით %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -547,20 +495,17 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -573,19 +518,16 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -599,19 +541,16 @@ msgid ""
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -641,35 +580,34 @@ msgstr ""
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "ჩასასმელი საქაღალდის ('%s') '%s'-ში დამუშავება შეუძლებელია"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "თვისების ბუფერი სავსეა."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "არასაკმარისი მეხსიერება"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "კეშის საქაღალდის შექმნის შეცდომა: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "ფაილი კეშის საქაღალდის მდებარეობაზე: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "კეშის საქაღალდის განახლების შეცდომა: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
@@ -681,61 +619,61 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "აკრძალვის პრეფიქსი დაშვებული არაა"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "მფლობლის პრეფიქსი დაშვებული არაა"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "მფლობლის პრეფიქსი მიმაგრების წესებში დაშვებული არაა"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "მფლობლის პრეფიქსი dbus-ის წესებში დაშვებული არაა"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "მფლობლის პრეფიქსი შესაძლებლობების წესებში დაშვებული არაა"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "არასწორი მიმაგრების პირობითი %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "არასწორი მიმაგრების წესი"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "მიმაგრების წერტილის პირობები ამჟამად მხარდაჭერილი არაა"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "არასწორი pivotroot პირობითი '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -755,51 +693,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575 ../parser_misc.c:768
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599 ../parser_misc.c:792
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703 parser_yacc.y:784
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "მფლობლის პრეფიქსი მიმაგრების წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:720 parser_yacc.y:801
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "მფლობლის პრეფიქსი dbus-ის წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:736 parser_yacc.y:817
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "მფლობლის პრეფიქსი სიგნალის წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:752 parser_yacc.y:833
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "მფლობლის პრეფიქსი ptrace-ის წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "მფლობლის პრეფიქსი unix-ის წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:794 parser_yacc.y:885
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "მფლობლის პრეფიქსი შესაძლებლობების წესებზე დაშვებული არაა"
msgstr ""
#: parser_yacc.y:1293 parser_yacc.y:1377
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "dbus-ის წესი: არასწორი პირობითი ჯგუფი %s=0"
msgstr ""
#: parser_yacc.y:1371 parser_yacc.y:1455
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "unix-ის წესი: არასწორი პირობითი ჯგუფი %s=0"
msgstr ""
#: ../parser_regex.c:368 ../parser_regex.c:410
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -11,14 +11,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2020-07-13 00:17+0000\n"
"Last-Translator: Peter J. Mello <admin@petermello.net>\n"
"PO-Revision-Date: 2016-03-03 08:40+0000\n"
"Last-Translator: Ivo Xavier <ivofernandes12@gmail.com>\n"
"Language-Team: Portuguese <opensuse-pt@opensuse.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-07-14 05:50+0000\n"
"X-Generator: Launchpad (build 4809fcb62f445aaa3ae919f7f6c3cc7d156ea57a)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: pt\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -230,7 +230,7 @@ msgstr "Encontrado caracter inesperado: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "As declarações variáveis não aceitam vírgulas de seguimento"
msgstr ""
#: parser_lex.l:420
#, c-format
@@ -308,12 +308,12 @@ msgstr "Erro de alocação de memória."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "A carga em cache foi bem sucedida para \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "A recarga em cache foi bem sucedida para \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -390,7 +390,7 @@ msgstr "Não é possível intercalar as entradas. Memória Esgotada\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "perfil %s: fundiu a regra %s com modificadores conflitantes x\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
@@ -400,8 +400,6 @@ msgstr "Anexo de perfil deve começar com '/'."
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Os nomes dos perfis têm que começar com '/', espaço de nomes, ou palavra-"
"chave 'profile' ou 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -411,21 +409,19 @@ msgstr "Falha na criação da alcunha %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"A marcação do perfil chroot_relative conflitos com o namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr "A marcação do perfil mediate_deleted conflitos com delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"A marcação do perfil attach_disconnected conflitos com no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr "A marcação do perfil chroot_attach conflitos com chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -519,12 +515,12 @@ msgstr "Capacidade inválida %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "Erro de analisador AppArmor para %s%s%s na linha %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "Erro de analisador AppArmor,%s%s linha %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -569,7 +565,7 @@ msgstr "%s: Não foi possível analisar a linha de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: Nome de perfil inválido '%s' - má expressão regular\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -637,11 +633,11 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "Não foi possível processar incluir pasta '%s' em '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Amortecedor de características cheio."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
@@ -656,7 +652,7 @@ msgstr "Não foi possível criar diretório de cache: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Ficheiro na localização da pasta do cache: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
@@ -666,137 +662,132 @@ msgstr "Não foi possível atualizar o diretório da cache: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "Interno: carácter do modo D-Bus '%c' inesperado na entrada"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "Erro interno gerado por permissão do D-Bus inválido 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "Não é permitido prefixo deny"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "Não é permitido prefixo owner"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "Não é permitido prefixo owner nas regras de montar"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "Não é permitido prefixo owner nas regras de D-Bus"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "Não é permitido prefixo owner nas regras de capacidade"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "montar condicional inválido %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "regra de montagem errada"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "condições do ponto de montagem não suportadas atualmente"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "pivotroot condicional inválido '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Erro de agrupamento de expressões regulares: Fechamento inválido ], sem "
"abertura correspondente [ detectado\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Erro de agrupamento de expressões regulares: Excedido o máximo de "
"aninhamento de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"O ERRO processando regras de policydb para perfil %s, falhou em carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "O ERRO substituindo aliases para perfil %s, falhou em carregar\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: Não foi possível gravar %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr "Erro: Não pôde ler o perfil binário ou o ficheiro de cache %s: %s.\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Erro: Não foi possível ler o ficheiro de cache '%s', a ignorar...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Interno: caractere inesperado do modo %s: '%c' na entrada"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Erro interno gerado permissão %s inválido 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "prefixo owner não permitido nas regras de montar"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "prefixo owner não permitido nas regras de D-Bus"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "prefixo owner não permitido nas regras do sinal"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "prefixo owner não permitido nas regras de ptrace"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "prefixo owner não permitido nas regras de unix"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "prefixo owner não permitido nas regras de capacidade"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "regra dbus: grupo condicional inválido %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "regra unix: grupo condicional inválido %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: Erro de expressão regular: carácter de fuga '\\' seguinte\n"
msgstr ""

View File

@@ -6,143 +6,131 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2022-06-17 21:43+0000\n"
"Last-Translator: Isabella Rocha de Oliveira <Unknown>\n"
"PO-Revision-Date: 2013-11-15 03:51+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-06-18 04:31+0000\n"
"X-Generator: Launchpad (build ae54683eb2eb8ed62cda30dc44e60c5387c78159)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: pt_BR\n"
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Erro: Sem memória.\n"
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Erro: O diretório base %s não é um diretório; ignorando.\n"
#: ../parser_include.c:137 ../parser_include.c:122
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
"Erro: Não foi possível adicionar o diretório %s ao caminho de pesquisa.\n"
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Erro: Não foi possível alocar memória.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Posição de gravação incorreta\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "Permissão negada\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Memória insuficiente\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "Não foi possível copiar perfil: Endereço de memória incorreto\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Perfil não compatível com o protocolo\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Perfil não corresponde à assinatura\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Versão de perfil não suportada pelo módulo do AppArmor\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "O perfil já existe\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "O perfil não existe\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "Permissão negada; tentou carregar um perfil enquanto restrito?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Erro desconhecido (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Impossível adicionar \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101 ../parser_interface.c:105
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Impossível substituir \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106 ../parser_interface.c:110
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: Impossível remover \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111 ../parser_interface.c:115
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: Impossível gravar em stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115 ../parser_interface.c:119
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: Não é possível salvar no arquivo de saída\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: DECLARAR: Opção inválida: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127 ../parser_interface.c:132
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "Adição bem-sucedida de \"%s\".\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131 ../parser_interface.c:136
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "Substituição bem-sucedida de \"%s\".\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135 ../parser_interface.c:140
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "Remoção bem-sucedida de \"%s\".\n"
@@ -154,14 +142,14 @@ msgstr ""
"PÂNICO: buffer de incremento incorreto %p pos %p ext %p tamanho %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446 ../parser_interface.c:476
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "perfil %s regras de rede não impostas\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "Tipo padrão desconhecido\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -199,35 +187,35 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Impossível gravar toda a entrada do perfil\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593 ../parser_interface.c:579
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: Não é possível gravar o perfil de entrada completo no cache\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "Não foi possível abrir '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "fstat falhou para '%s'"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "opendir falhou '%s'"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "stat falhou para '%s'"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "Não foi possível abrir '%s' em '%s'"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -235,9 +223,9 @@ msgstr "Não foi possível abrir '%s' em '%s'"
msgid "Found unexpected character: '%s'"
msgstr "Caractere inesperado encontrado: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "Declarações de variável não aceitam vírgulas como último caractere"
msgstr ""
#: parser_lex.l:420
#, c-format
@@ -247,7 +235,7 @@ msgstr "(network_mode) Caractere inesperado encontrado: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "Aviso de %s (%s%sline %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -256,7 +244,6 @@ msgstr ""
"%s: Impossível alocar memória para ponto de montagem de base de subdomínio\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -266,7 +253,6 @@ msgstr ""
"Use --subdomainfs para anular.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -276,7 +262,6 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -289,7 +274,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Erro: Não foi possível ler o perfil %s: %s.\n"
@@ -311,36 +296,26 @@ msgstr "Erro: Não foi possível ler o perfil %s: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr "Erro de alocação de memória."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "Cache carregado com sucesso para \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "Cache recarregado com sucesso para \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Erros encontrados no arquivo. Interrompendo.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -351,19 +326,16 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "As permissões 'a' e 'w' de conflito são mutuamente exclusivas."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Qualificador de execução 'i' inválido. Qualificador em conflito já "
"especificado"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -375,7 +347,6 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -384,7 +355,6 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
@@ -393,13 +363,11 @@ msgstr ""
"especificado"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Interno: caractere '%c' inesperado de modo na entrada"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Erro interno gerou permissão inválida 0x%llx\n"
@@ -411,70 +379,60 @@ msgid "AppArmor parser error: %s\n"
msgstr "Erro do analisador do AppArmor: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Impossível mesclar entradas. Memória Insuficiente\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "perfil % s: mesclou regra %s com conflitantes x modificadores\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "O anexo do perfil deve começar com um '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Nomes de perfil devem começar com um '/', namespace ou palavra-chave "
"'perfil' ou 'chapéu'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "Falha ao criar o álias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"Sinalizador de perfil chroot_relative está em conflito com namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"Sinalizador de perfil mediate_deleted está em conflito com delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Sinalizador de perfil attach_disconnected está em conflito com "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"Sinalizador de perfil chroot_attach está em conflito com chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr "O flag de perfil 'debug' não é mais válido."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Flag de perfil inválido: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Declarar: `rule' retornou NULL."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
@@ -482,84 +440,82 @@ msgstr ""
"Modo inválido. Nas regras de negação, o 'x' não deve ser precedido pelo "
"qualificador de execução 'i', 'p' ou 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Modo inválido. O 'x' deve ser precedido pelo qualificador de execução 'i', "
"'p','c' ou 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Modo inválido; 'x' deve ser precedido pelo qualificador de execução 'i', 'p' "
"ou 'u'"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Declarar: `network_rule' retornou um protocolo inválido."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "Declarar: `change_profile' retornou NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr "Declarar: 'hat rule' retornou NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Declaração: a regra 'local_profile' retornou NULO."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "Cancelar a definição da variável booleana %s usada na expressão if"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr "permissões de execução não seguras com regra ausente"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr "subconjunto somente deve ser usado com regras de link."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
"conflito de permissões de link e execução em uma regra de arquivo usando ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
"permissões de link não são permitidas em uma transição de perfil nomeada.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "caractere de fim de linha ausente? (entrada: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr "Entrada de rede inválida."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr "Recurso inválido %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "Erro do analisador AppArmor para %s%s%s na linha %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "Erro do analisador AppArmor,%s%s linha %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -567,7 +523,6 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: Abertura ilegal {, agrupamentos aninhados não permitidos\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
@@ -575,7 +530,6 @@ msgstr ""
"{}\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -584,7 +538,6 @@ msgstr ""
"abertura correspondente { detectada\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -599,19 +552,16 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Overflow de buffer interno detectado; %d caracteres excedidos\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Impossível analisar linha de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: Nome do perfil inválido '%s' - expressão regular inválida\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr "ERRO ao fundir regras para o perfil %s; falha ao carregar\n"
@@ -629,7 +579,6 @@ msgstr ""
"\t'**' somente podem ser usados no final de uma regra.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
@@ -637,13 +586,11 @@ msgstr ""
"carregar\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr "ERRO ao expandir variáveis para o perfil %s; falha ao carregar\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "ERRO ao adicionar a regra de acesso hat para o perfil %s\n"
@@ -677,170 +624,164 @@ msgstr ""
"%s: Erros encontrados no pós-processamento de regras de combinação. "
"Interrompendo.\n"
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "Não foi possível processar a inclusão do diretório '%s' em '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "Recurso buffer está lotado."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Memória insuficiente"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "Não é possível criar o diretório de cache: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "Arquivo no local do diretório de cache: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "Não é possível atualizar o diretório de cache: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "Interno: caractere mode DBus '%c' inesperado na entrada"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "Erro interno gerou DBus perm 0x%x inválido\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "Prefixo deny não é permitido"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "Prefixo owner não é permitido"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "Prefixo owner não é permitido em regras de montagem"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "Prefixo owner não é permitido em regras de dbus"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "Prefixo owner não é permitido em regras de capacidade"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "montagem condicional inválida %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "regra de montagem inválida"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "condições do ponto de montagem não são suportadas atualmente"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "pivotroot condicional inválido '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Erro de agrupamento de regex: Fechamento inválido ], nenhuma abertura "
"compatível ] foi detectada\n"
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Erro de agrupamento de regex: Excedeu o aninhamento máximo de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"ERRO processando regras do policydb para o perfil %s, falha ao carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "Erro substituindo pseudônimos para o perfil %s, falha ao carregar\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: Não foi possível escrever %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Erro: Não foi possível ler o perfil binário ou arquivo cache %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Erro: Não foi possível ler o arquivo cache '%s', pulando...\n"
msgstr ""
#: ../parser_misc.c:575 ../parser_misc.c:768
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "Interno: modo %s caractere '%c' inesperado na entrada"
msgstr ""
#: ../parser_misc.c:599 ../parser_misc.c:792
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Erro interno gerou %s perm 0x%x inválido\n"
msgstr ""
#: parser_yacc.y:703 parser_yacc.y:784
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "prefixo owner não permitido em regras de montagem"
msgstr ""
#: parser_yacc.y:720 parser_yacc.y:801
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "prefixo owner não permitido em regras dbus"
msgstr ""
#: parser_yacc.y:736 parser_yacc.y:817
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "prefixo owner não permitido em regras de sinal"
msgstr ""
#: parser_yacc.y:752 parser_yacc.y:833
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "prefixo owner não permitido em regras ptrace"
msgstr ""
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "prefixo owner não permitido em regras unix"
msgstr ""
#: parser_yacc.y:794 parser_yacc.y:885
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "prefixo owner não permitido em regras de capacidade"
msgstr ""
#: parser_yacc.y:1293 parser_yacc.y:1377
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "regra dbus: grupo condicional inválido %s=()"
msgstr ""
#: parser_yacc.y:1371 parser_yacc.y:1455
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "regra unix: grupo condicional inválido %s=()"
msgstr ""
#: ../parser_regex.c:368 ../parser_regex.c:410
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: Erro regex: caractere de escape à direita '\\'\n"
msgstr ""

File diff suppressed because it is too large Load Diff

View File

@@ -11,142 +11,130 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2022-04-25 20:47+0000\n"
"Last-Translator: Sabri Ünal <Unknown>\n"
"PO-Revision-Date: 2013-11-15 03:41+0000\n"
"Last-Translator: Ömer Kehri <Unknown>\n"
"Language-Team: turkish <i18n@suse.de>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-04-26 06:26+0000\n"
"X-Generator: Launchpad (build 1445a2883c2be41f8e3d484e7c1c2b98b0a1caf9)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: tr\n"
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Hata: Yetersiz bellek.\n"
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Hata: %s temel dizini bir dizin değil, atlanıyor.\n"
#: ../parser_include.c:137 ../parser_include.c:122
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Hata: %s dizini arama yollarına eklenemedi.\n"
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Hata: Bellek tahsis edilemedi.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Hatalı yazma pozisyonu\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "İzin verilmedi\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Yetersiz bellek\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Profil protokole uymuyor\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Profil imzası tutmuyor\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Profil sürümü Apparmor modülü tarafından desteklenmiyor\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "Profil zaten mevcut\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "Profil mevcut değil\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "Bilinmeyen hata (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: \"%s\" eklenemedi. "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101 ../parser_interface.c:105
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: \"%s\" değiştirilemedi. "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106 ../parser_interface.c:110
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: \"%s\" silinemedi. "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111 ../parser_interface.c:115
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: stdout'a yazılamadı.\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115 ../parser_interface.c:119
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: çıkış dosyasına yazılamıyor\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: ASSERT: Geçersiz seçenek: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127 ../parser_interface.c:132
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "\"%s\" için ekleme başarılı oldu.\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131 ../parser_interface.c:136
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "\"%s\" için değiştirme başarılı oldu.\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135 ../parser_interface.c:140
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "\"%s\" için silme başarılı oldu.\n"
@@ -158,7 +146,7 @@ msgstr ""
"PANİK hatalı arttırma arabelleği %p pozisyon %p ext %p boyut %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446 ../parser_interface.c:476
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
@@ -203,7 +191,7 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Profil girdisinin tamamı yazılamadı\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593 ../parser_interface.c:579
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
@@ -211,9 +199,9 @@ msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "'%s' açılamadı"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
@@ -239,7 +227,7 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr "Beklenmeyen karakter bulundu: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
@@ -259,7 +247,6 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr "%s: subdomainbase bağlantı noktası için bellek ayrılamadı\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -267,7 +254,6 @@ msgid ""
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -277,7 +263,6 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -289,7 +274,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Hata: %s profili okunamadı: %s.\n"
@@ -311,36 +296,26 @@ msgstr "Hata: %s profili okunamadı: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr "Bellek ayırma hatası."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Dosyada hatalar bulundu. Durduruluyor.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -351,18 +326,15 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Çalıştırma niteleyicisi 'i' geçersiz, çakışan niteleyici zaten belirtilmiş"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -371,7 +343,6 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -379,20 +350,17 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Dahili: girdide beklenmeyen mod karakteri '%c'"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
@@ -404,12 +372,10 @@ msgid "AppArmor parser error: %s\n"
msgstr "AppArmor inceleyici hatası: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Girdiler birleştirilemiyor. Yetersiz bellek\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -418,120 +384,117 @@ msgstr ""
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Assert: `rule' NULL döndürdü."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Geçersiz mod; 'x', çalıştırma değişkenleri 'i', 'p' ya da 'u'dan sonra "
"gelmelidir."
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr "Assert: `hat rule' NULL döndürdü."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "If deyimi içinde ayarlanmamış boolean değişkeni %s"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "eksik satır sonu karakteri? (girdi: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
@@ -547,13 +510,11 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: Kural dışıık {, iç içe konan gruplamalara izin verilmez\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr "%s: Regex gruplama hatası: {} içinde geçersiz öğe sayısı\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -562,7 +523,6 @@ msgstr ""
"bulunamadı\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -577,19 +537,16 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Dahili ara bellek taşması saptandı, %d karakter aşıldı\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Giriş satırı '%s' incelenemedi\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -608,20 +565,17 @@ msgstr ""
"\t'**' sadece bir kuralın sonunda kullanılabilir.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr "HATA: %s profilinin regex'leri işlenemedi, yükleme başarısız oldu\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"HATA: %s profili için değişkenler genişletilemedi, yükleme başarısız oldu\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -652,7 +606,7 @@ msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
"%s: Kural birleştirme sonrası işlemlerde hata bulundu. Durduruluyor.\n"
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
@@ -662,10 +616,9 @@ msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "Yetersiz bellek"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
@@ -692,11 +645,11 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
@@ -712,41 +665,41 @@ msgstr ""
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -766,51 +719,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575 ../parser_misc.c:768
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599 ../parser_misc.c:792
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703 parser_yacc.y:784
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720 parser_yacc.y:801
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736 parser_yacc.y:817
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752 parser_yacc.y:833
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794 parser_yacc.y:885
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293 parser_yacc.y:1377
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371 parser_yacc.y:1455
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368 ../parser_regex.c:410
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -13,14 +13,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2020-05-19 21:52+0000\n"
"Last-Translator: Nazarii Ritter <nazariy.ritter@gmail.com>\n"
"PO-Revision-Date: 2013-11-15 12:27+0000\n"
"Last-Translator: yurchor <Unknown>\n"
"Language-Team: Ukrainian <translation@linux.org.ua>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-20 05:42+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: uk\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -747,29 +747,27 @@ msgstr "ПОМИЛКА заміри псевдонімів для профілю
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: Неможливо записати %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Помилка: Не вдалося прочитати бінарний профіль або файл кешу %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "Помилка: Не вдалося прочитати файл кешу '%s', пропуск…\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
"Внутрішня помилка: неочікуваний режим %s символу «%c» у вхідних даних"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "Внутрішня помилка, спричинена невірним дозволом %s 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"

View File

@@ -6,14 +6,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2022-01-15 11:52+0000\n"
"Last-Translator: Yulin Yang <yylteam@icloud.com>\n"
"PO-Revision-Date: 2013-11-15 04:12+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-01-16 04:32+0000\n"
"X-Generator: Launchpad (build 0072e2709f85567cc6c8d33e98acde9fcc09f491)\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"Language: zh_CN\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -40,7 +40,7 @@ msgstr "写入位置无效\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr "权限不足\n"
msgstr "拒绝许可权限\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
@@ -48,7 +48,7 @@ msgstr "内存不足\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "无法复制配置文件:内存地址不正确\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -72,12 +72,12 @@ msgstr "配置文件不存在\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr "权限被拒绝;试图在受限时加载配置文件?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr "未知错误 (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -101,13 +101,13 @@ msgstr "%s: 无法去除\"%s\"。 "
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: 无法写入到标准输出\n"
msgstr "%s: 无法写入 stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr "%s: 无法写入输出文件\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -143,11 +143,11 @@ msgstr "PANIC 无效的递增缓冲区:%p pos %p ext %p size %d res %p\n"
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr "配置文件%s网络规则未强制执行\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr "未知模式类型\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -188,32 +188,32 @@ msgstr "%s: 无法写入整个配置文件项\n"
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: 无法将整个配置文件项写入缓存\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "无法打开“%s”"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr "\"%s\"的 fstat 失败"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr "打开目录\"%s\"失败"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr "\"%s\"的 stat 失败"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr "无法在\"%2$s\"中打开\"%1$s\""
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -223,7 +223,7 @@ msgstr "发现意外字符: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr "变量声明不接受尾随逗号"
msgstr ""
#: parser_lex.l:420
#, c-format
@@ -233,7 +233,7 @@ msgstr "(network_mode) 发现意外字符:“%s”"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr "来自%s%s%s行 %d的警告%s"
msgstr ""
#: ../parser_main.c:531
#, c-format
@@ -299,12 +299,12 @@ msgstr "内存分配错误。"
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr "\"%s\"的缓存加载成功。\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr "\"%s\"的缓存重加载成功。\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -372,16 +372,16 @@ msgstr "无法合并项。内存不足\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr "配置文件%s已将规则%s与冲突的x修饰符合并\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr "配置文件附件必须以\"/\"开头。"
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr "配置文件名称必须以\"/\"、命名空间或关键字\"profile\"或\"hat\"开头。"
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -390,20 +390,20 @@ msgstr "无法创建别名 %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr "配置文件标志 chroot_relative 与 namespace_relative 冲突"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr "配置文件标志 mediate_deleted 与 delegate_deleted 冲突"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr "配置文件标志 attach_disconnected 与 no_attach_disconnected 冲突"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr "配置文件标志 chroot_attach 与 chroot_no_attach 冲突"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -416,7 +416,7 @@ msgstr "无效的配置文件标志:%s。"
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
msgstr "声明:`rule'返回空值(NULL)。"
msgstr "声明:`rule'返回 NULL。"
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
@@ -440,15 +440,15 @@ msgstr "声明“network_rule”返回无效协议。"
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "声明“change_profile”返回空值(NULL)。"
msgstr "声明“change_profile”返回 NULL。"
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr "声明:'hat rule'返回空值(NULL)。"
msgstr "声明:'hat rule'返回 NULL。"
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "声明“local_profile rule”返回空值(NULL)。"
msgstr "声明“local_profile rule”返回 NULL。"
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
@@ -489,12 +489,12 @@ msgstr "功能 %s 无效。"
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr "第 %4$d 行 %1$s%2$s%3$s 的AppArmor分析器错误%5$s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr "AppArmor分析器错误在 %s%s 行 %d%s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
@@ -532,7 +532,7 @@ msgstr "%s: 无法对输入行'%s'进行语法分析\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr "%s: 配置文件名称\"%s\"无效-错误的正则表达式\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -593,161 +593,161 @@ msgstr "%s: 在组合规则后处理中发现错误。正在中止。\n"
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr "无法处理\"%s\"中的包含目录\"%s\""
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr "功能缓冲区已满。"
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr "内存不足"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr "无法创建目录:%s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr "缓存目录位置中的文件:%s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr "无法更新缓存目录:%s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr "内部输入中意外的DBus模式字符\"%c\""
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr "内部错误生成了无效的DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr "不允许使用拒绝前缀"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr "不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr "装载规则中不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr "dbus规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr "不允许在功能规则上使用所有者前缀"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr "无效的装载条件%s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr "错误的装载规则"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr "当前不支持装载点条件"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr "无效的pivotroot条件\"%s\""
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr "%s: 正则表达式分组错误:无效的关闭\"]\",未检测到匹配的打开\"[\"\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr "%s: 正则表达式分组错误:超过了{}的最大嵌套\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr "处理配置文件 %s 的policydb规则时出错加载失败\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr "替换配置文件 %s 的别名时出错,加载失败\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr "%s: 无法写入 %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr "错误:无法读取二进制配置文件或缓存文件 %s%s。\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr "错误:无法读取缓存文件\"%s\",正在跳过...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr "内部:输入中出现意外的 %s 模式字符\"%c\""
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr "内部错误,生成了无效的 %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr "装载规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr "dbus规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr "信号规则中不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr "ptrace规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr "unix规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr "功能规则上不允许使用所有者前缀"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr "dbus规则无效的条件组 %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr "unix规则无效的条件组 %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr "%s: 正则表达式错误:尾随\"\\\"转义字符\n"
msgstr ""

View File

@@ -226,13 +226,13 @@ static bool add_proc_access(Profile *prof, const char *rule)
char *buffer = strdup("/proc/*/attr/apparmor/");
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
add_entry_to_policy(prof, new_ent);
@@ -240,13 +240,13 @@ static bool add_proc_access(Profile *prof, const char *rule)
buffer = strdup("/sys/module/apparmor/parameters/enabled");
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
add_entry_to_policy(prof, new_ent);
@@ -254,17 +254,17 @@ static bool add_proc_access(Profile *prof, const char *rule)
buffer = strdup(rule);
if (!buffer) {
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
new_ent = new_entry(buffer, AA_MAY_WRITE, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return FALSE;
return false;
}
add_entry_to_policy(prof, new_ent);
return TRUE;
return true;
}
#define CHANGEPROFILE_PATH "/proc/*/attr/{apparmor/,}{current,exec}"

View File

@@ -363,7 +363,7 @@ public:
struct cond_entry_list xattrs;
/* char *sub_name; */ /* subdomain name or NULL */
/* int default_deny; */ /* TRUE or FALSE */
/* bool default_deny; */
bool local;
Profile *parent;

View File

@@ -23,7 +23,7 @@
#include <iomanip>
#include <string>
#include <sstream>
#include <map>
#include <unordered_map>
#include "parser.h"
#include "profile.h"
@@ -35,7 +35,7 @@
#define MAXRT_SIG 32 /* Max RT above MINRT_SIG */
/* Signal names mapped to and internal ordering */
static struct signal_map { const char *name; int num; } signal_map[] = {
static unordered_map<string, int> signal_map = {
{"hup", 1},
{"int", 2},
{"quit", 3},
@@ -55,7 +55,8 @@ static struct signal_map { const char *name; int num; } signal_map[] = {
{"chld", 17},
{"cont", 18},
{"stop", 19},
{"stp", 20},
{"stp", 20}, // parser's previous name for SIGTSTP
{"tstp", 20},
{"ttin", 21},
{"ttou", 22},
{"urg", 23},
@@ -64,14 +65,12 @@ static struct signal_map { const char *name; int num; } signal_map[] = {
{"vtalrm", 26},
{"prof", 27},
{"winch", 28},
{"io", 29},
{"io", 29}, // SIGIO == SIGPOLL
{"poll", 29},
{"pwr", 30},
{"sys", 31},
{"emt", 32},
{"exists", 35},
/* terminate */
{NULL, 0}
};
/* this table is ordered post sig_map[sig] mapping */
@@ -96,7 +95,7 @@ static const char *const sig_names[MAXMAPPED_SIG + 1] = {
"chld",
"cont",
"stop",
"stp",
"tstp",
"ttin",
"ttou",
"urg",
@@ -105,7 +104,7 @@ static const char *const sig_names[MAXMAPPED_SIG + 1] = {
"vtalrm",
"prof",
"winch",
"io",
"io", // SIGIO == SIGPOLL
"pwr",
"sys",
"emt",
@@ -130,12 +129,14 @@ int find_signal_mapping(const char *sig)
return -1;
return MINRT_SIG + n;
} else {
for (int i = 0; signal_map[i].name; i++) {
if (strcmp(sig, signal_map[i].name) == 0)
return signal_map[i].num;
// Can't use string_view because that requires C++17
auto sigmap = signal_map.find(string(sig));
if (sigmap != signal_map.end()) {
return sigmap->second;
} else {
return -1;
}
}
return -1;
}
void signal_rule::extract_sigs(struct value_list **list)

View File

@@ -6,7 +6,7 @@ PARSER_BIN=apparmor_parser
PARSER=$(PARSER_DIR)/$(PARSER_BIN)
# parser.conf to use in tests. Note that some test scripts have the parser options hardcoded, so passing PARSER_ARGS=... is not enough to override it.
PARSER_ARGS=--config-file=./parser.conf
PROVE_ARG=-f --directives
PROVE_ARG=-f --directives -j2
ifeq ($(VERBOSE),1)
PROVE_ARG+=-v
@@ -37,6 +37,11 @@ error_output: $(PARSER)
parser_sanity: $(PARSER) gen_xtrans gen_dbus
$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
# use this target for faster manual testing if you don't want/need to test all the profiles generated by gen-*.py
parser_sanity-no-gen: clean $(PARSER)
@echo WARNING: not creating the profiles using the gen-*.py scripts
$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
caching: $(PARSER)
LANG=C ./caching.py -p "$(PARSER)" $(PYTEST_ARG)

View File

@@ -879,11 +879,28 @@ verify_binary_equality "'$p1'x'$p2' link rules slash filtering" \
@{BAR}=/mnt/
/t { $p2 link @{FOO}/foo -> @{BAR}/bar, }"
# Verify equality with mount detached source
verify_binary_equality "'$p1'x'$p2' attachment slash filtering" \
"/t /bin/foo { }" \
"/t /bin//foo { }" \
"@{BAR}=/bin/
/t @{BAR}/foo { }" \
"@{FOO}=/foo
/t /bin/@{FOO} { }" \
"@{BAR}=/bin/
@{FOO}=/foo
/t @{BAR}/@{FOO} { }"
# verify comment at end of variable assignment is not treated as a value
verify_binary_equality "comment at end of set var" \
"/t { /bin/ r, }" \
"@{BAR}=/bin/ #a tail comment
/t { @{BAR} r, }"
verify_binary_equality "value like comment at end of set var" \
"/t { /{bin/,#value} r, }" \
"@{BAR}=bin/ \#value
/t { /@{BAR} r, }"
verify_binary_equality "'$p1'x'$p2' mount detached vs empty source" \
"/t { $p1 mount \"\" -> /destination, }" \
"/t { $p2 mount detached -> /destination, }"
# This can potentially fail as ideally it requires a better dfa comparison
# routine as it can generates hormomorphic dfas. The enumeration of the
@@ -895,6 +912,12 @@ verify_binary_equality "'$p1'x'$p2' mount specific deny doesn't affect non-overl
"/t { $p2 audit deny mount /s/** -> /**,
mount options=bind /e/ -> /**, }"
if [ $fails -ne 0 ] || [ $errors -ne 0 ]
then
printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 1>&2
exit $((fails + errors))
fi
## priority override equivalence tests
## compare single rule, to multi-rule profile where one rule overrides
@@ -1059,29 +1082,6 @@ run_tests()
"/t { /a r, }" \
"/t { priority=-1 audit deny /* rwxlk, /a r, }"
# Tests that do not use priority keywords at all
verify_binary_equality "attachment slash filtering" \
"/t /bin/foo { }" \
"/t /bin//foo { }" \
"@{BAR}=/bin/
/t @{BAR}/foo { }" \
"@{FOO}=/foo
/t /bin/@{FOO} { }" \
"@{BAR}=/bin/
@{FOO}=/foo
/t @{BAR}/@{FOO} { }"
# verify comment at end of variable assignment is not treated as a value
verify_binary_equality "comment at end of set var" \
"/t { /bin/ r, }" \
"@{BAR}=/bin/ #a tail comment
/t { @{BAR} r, }"
verify_binary_equality "value like comment at end of set var" \
"/t { /{bin/,#value} r, }" \
"@{BAR}=bin/ \#value
/t { /@{BAR} r, }"
# verify combinations of different priority levels
# for single rule comparisons, rules should keep same expected result
# even when the priorities are different.
@@ -1109,13 +1109,8 @@ run_tests()
done
[ -z "${verbose}" ] && printf "\n"
if [ $fails -ne 0 ] || [ $errors -ne 0 ]; then
printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 1>&2
exit $((fails + errors))
else
printf "PASS\n"
exit 0
fi
printf "PASS\n"
exit 0
}
@@ -1223,7 +1218,7 @@ done
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
if [ $# -eq 0 -o -z "$testtype" ] ; then
if [ $# -eq 0 -o -z $testtype] ; then
run_tests "$@"
exit $?
fi

View File

@@ -1,7 +0,0 @@
#
#=Description basic detached mount rule
#=EXRESULT PASS
#
/usr/bin/foo {
mount detached -> /foo,
}

View File

@@ -1,7 +0,0 @@
#
#=Description detached mount rule with options
#=EXRESULT PASS
#
/usr/bin/foo {
mount options=(ro) fstype=ext4 detached -> /destination,
}

Some files were not shown because too many files have changed in this diff Show More