Release: Bump revisions in preparation for 2.12.2 release

Signed-off-by: John Johansen <john.johansen@canonical.com>

.gitignore

@@ -4,31 +4,10 @@ binutils/aa-enabled
 binutils/aa-enabled.1
 binutils/aa-exec
 binutils/aa-exec.1
-binutils/aa-features-abi
-binutils/aa-features-abi.1
-binutils/aa-load
-binutils/aa-load.8
-binutils/aa-status
-binutils/aa-status.8
-binutils/cJSON.o
 binutils/po/*.mo
-changehat/mod_apparmor/.libs
-changehat/mod_apparmor/mod_apparmor.8
-changehat/mod_apparmor/mod_apparmor.8.html
-changehat/mod_apparmor/mod_apparmor.la
-changehat/mod_apparmor/mod_apparmor.lo
-changehat/mod_apparmor/mod_apparmor.slo
-changehat/mod_apparmor/mod_apparmor.so
-changehat/mod_apparmor/pod2htmd.tmp
-changehat/pam_apparmor/get_options.o
-changehat/pam_apparmor/pam_apparmor.o
-changehat/pam_apparmor/pam_apparmor.so
 parser/po/*.mo
 parser/af_names.h
 parser/cap_names.h
-parser/generated_cap_names.h
-parser/generated_af_names.h
-parser/errnos.h
 parser/tst_lib
 parser/tst_misc
 parser/tst_regex
@@ -40,9 +19,37 @@ parser/parser_version.h
 parser/parser_yacc.c
 parser/parser_yacc.h
 parser/pod2htm*.tmp
-parser/libapparmor_re/*.o
+parser/af_rule.o
+parser/af_unix.o
+parser/common_optarg.o
+parser/dbus.o
+parser/lib.o
+parser/libapparmor_re/aare_rules.o
+parser/libapparmor_re/chfa.o
+parser/libapparmor_re/expr-tree.o
+parser/libapparmor_re/hfa.o
 parser/libapparmor_re/libapparmor_re.a
-parser/*.o
+parser/libapparmor_re/parse.o
+parser/mount.o
+parser/network.o
+parser/parser_alias.o
+parser/parser_common.o
+parser/parser_include.o
+parser/parser_interface.o
+parser/parser_lex.o
+parser/parser_main.o
+parser/parser_merge.o
+parser/parser_misc.o
+parser/parser_policy.o
+parser/parser_regex.o
+parser/parser_symtab.o
+parser/parser_variable.o
+parser/parser_yacc.o
+parser/policy_cache.o
+parser/profile.o
+parser/ptrace.o
+parser/rule.o
+parser/signal.o
 parser/*.7
 parser/*.5
 parser/*.8
@@ -121,18 +128,6 @@ libraries/libapparmor/src/tst_aalogmisc
 libraries/libapparmor/src/tst_aalogmisc.log
 libraries/libapparmor/src/tst_aalogmisc.o
 libraries/libapparmor/src/tst_aalogmisc.trs
-libraries/libapparmor/src/tst_aalogparse_cpp
-libraries/libapparmor/src/tst_aalogparse_cpp.log
-libraries/libapparmor/src/tst_aalogparse_cpp.o
-libraries/libapparmor/src/tst_aalogparse_cpp.trs
-libraries/libapparmor/src/tst_aalogparse_reentrancy
-libraries/libapparmor/src/tst_aalogparse_reentrancy.log
-libraries/libapparmor/src/tst_aalogparse_reentrancy.o
-libraries/libapparmor/src/tst_aalogparse_reentrancy.trs
-libraries/libapparmor/src/tst_aalogparse_oldname
-libraries/libapparmor/src/tst_aalogparse_oldname.log
-libraries/libapparmor/src/tst_aalogparse_oldname.o
-libraries/libapparmor/src/tst_aalogparse_oldname.trs
 libraries/libapparmor/src/tst_features
 libraries/libapparmor/src/tst_features.log
 libraries/libapparmor/src/tst_features.o
@@ -157,7 +152,6 @@ libraries/libapparmor/swig/perl/libapparmor_wrap.c
 libraries/libapparmor/swig/perl/libapparmor_wrap.o
 libraries/libapparmor/swig/perl/pm_to_blib
 libraries/libapparmor/swig/python/LibAppArmor.py
-libraries/libapparmor/swig/python/LibAppArmor.egg-info/
 libraries/libapparmor/swig/python/build/
 libraries/libapparmor/swig/python/libapparmor_wrap.c
 libraries/libapparmor/swig/python/Makefile
@@ -169,14 +163,8 @@ libraries/libapparmor/swig/python/test/test-suite.log
 libraries/libapparmor/swig/python/test/test_python.py
 libraries/libapparmor/swig/python/test/test_python.py.log
 libraries/libapparmor/swig/python/test/test_python.py.trs
-libraries/libapparmor/swig/ruby/LibAppArmor.so
-libraries/libapparmor/swig/ruby/LibAppArmor_wrap.c
-libraries/libapparmor/swig/ruby/LibAppArmor_wrap.o
 libraries/libapparmor/swig/ruby/Makefile
 libraries/libapparmor/swig/ruby/Makefile.in
-libraries/libapparmor/swig/ruby/Makefile.bak
-libraries/libapparmor/swig/ruby/Makefile.ruby
-libraries/libapparmor/swig/ruby/mkmf.log
 libraries/libapparmor/testsuite/.deps
 libraries/libapparmor/testsuite/.libs
 libraries/libapparmor/testsuite/Makefile
@@ -193,6 +181,7 @@ libraries/libapparmor/testsuite/libaalogparse.test/Makefile
 libraries/libapparmor/testsuite/libaalogparse.test/Makefile.in
 libraries/libapparmor/testsuite/test_multi/out
 libraries/libapparmor/testsuite/test_multi_multi-test_multi.o
+changehat/mod_apparmor/.libs
 utils/*.8
 utils/*.8.html
 utils/*.5
@@ -201,22 +190,14 @@ utils/*.tmp
 utils/po/*.mo
 utils/apparmor/*.pyc
 utils/apparmor/rule/*.pyc
-utils/apparmor.egg-info/
-utils/build/
-utils/htmlcov/
 utils/test/common_test.pyc
 utils/test/.coverage
-utils/test/coverage-report.txt
 utils/test/htmlcov/
 utils/vim/apparmor.vim
 utils/vim/apparmor.vim.5
 utils/vim/apparmor.vim.5.html
 utils/vim/pod2htmd.tmp
-tests/regression/apparmor/*.o
-tests/regression/apparmor/aa_policy_cache
 tests/regression/apparmor/access
-tests/regression/apparmor/at_secure
-tests/regression/apparmor/attach_disconnected
 tests/regression/apparmor/changehat
 tests/regression/apparmor/changehat_fail
 tests/regression/apparmor/changehat_fork
@@ -231,11 +212,6 @@ tests/regression/apparmor/chgrp
 tests/regression/apparmor/chmod
 tests/regression/apparmor/chown
 tests/regression/apparmor/clone
-tests/regression/apparmor/complain
-tests/regression/apparmor/dbus_eavesdrop
-tests/regression/apparmor/dbus_message
-tests/regression/apparmor/dbus_service
-tests/regression/apparmor/dbus_unrequested_reply
 tests/regression/apparmor/deleted
 tests/regression/apparmor/env_check
 tests/regression/apparmor/environ
@@ -246,40 +222,26 @@ tests/regression/apparmor/fchdir
 tests/regression/apparmor/fchgrp
 tests/regression/apparmor/fchmod
 tests/regression/apparmor/fchown
-tests/regression/apparmor/fd_inheritance
-tests/regression/apparmor/fd_inheritor
 tests/regression/apparmor/fork
-tests/regression/apparmor/introspect
-tests/regression/apparmor/io_uring
 tests/regression/apparmor/link
 tests/regression/apparmor/link_subset
 tests/regression/apparmor/mkdir
 tests/regression/apparmor/mmap
 tests/regression/apparmor/mount
-tests/regression/apparmor/move_mount
 tests/regression/apparmor/named_pipe
-tests/regression/apparmor/net_inet_rcv
-tests/regression/apparmor/net_inet_snd
 tests/regression/apparmor/net_raw
 tests/regression/apparmor/open
 tests/regression/apparmor/openat
 tests/regression/apparmor/pipe
-tests/regression/apparmor/pivot_root
-tests/regression/apparmor/posix_mq_rcv
-tests/regression/apparmor/posix_mq_snd
 tests/regression/apparmor/ptrace
 tests/regression/apparmor/ptrace_helper
 tests/regression/apparmor/pwrite
-tests/regression/apparmor/query_label
 tests/regression/apparmor/readdir
 tests/regression/apparmor/rename
 tests/regression/apparmor/rw
-tests/regression/apparmor/socketpair
 tests/regression/apparmor/swap
 tests/regression/apparmor/symlink
 tests/regression/apparmor/syscall_chroot
-tests/regression/apparmor/syscall_ioperm
-tests/regression/apparmor/syscall_iopl
 tests/regression/apparmor/syscall_mknod
 tests/regression/apparmor/syscall_mlockall
 tests/regression/apparmor/syscall_ptrace
@@ -290,32 +252,11 @@ tests/regression/apparmor/syscall_setpriority
 tests/regression/apparmor/syscall_setscheduler
 tests/regression/apparmor/syscall_sysctl
 tests/regression/apparmor/sysctl_proc
-tests/regression/apparmor/sysv_mq_rcv
-tests/regression/apparmor/sysv_mq_snd
 tests/regression/apparmor/tcp
-tests/regression/apparmor/transition
 tests/regression/apparmor/unix_fd_client
 tests/regression/apparmor/unix_fd_server
-tests/regression/apparmor/unix_socket
-tests/regression/apparmor/unix_socket_client
 tests/regression/apparmor/unlink
-tests/regression/apparmor/userns
-tests/regression/apparmor/userns_setns
-tests/regression/apparmor/uservars.inc
 tests/regression/apparmor/xattrs
-tests/regression/apparmor/xattrs_profile
 tests/regression/apparmor/coredump
 **/__pycache__/
 *.orig
-
-# Patterns related to spread integration tests
-*.img
-*.iso
-*.lock
-*.log
-*.qcow2
-*.run
-.spread-reuse.yaml
-.spread-reuse.*.yaml
-spread-artifacts/
-spread-logs/

.gitlab-ci.yml

@@ -1,198 +0,0 @@
----
-image: ubuntu:latest
-
-# XXX - add a deploy stage to publish man pages, docs, and coverage
-# reports
-
-workflow:
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_COMMIT_TAG
-    - if: $CI_COMMIT_BRANCH
-
-stages:
-  - build
-  - test
-
-.ubuntu-common:
-  before_script:
-    # Install build-dependencies by loading the package list from the ubuntu/debian cloud-init profile.
-    - printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_deps "Installing dependencies..."
-    - apt-get update -qq
-    - apt-get install --yes yq make lsb-release
-    - |
-      printf 'include .image-garden.mk\n$(info $(UBUNTU_CLOUD_INIT_USER_DATA_TEMPLATE))\n.PHONY: nothing\nnothing:\n' \
-      | make -f - nothing \
-      | yq '.packages | .[]' \
-      | xargs apt-get install --yes --no-install-recommends
-    - printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_deps
-  after_script:
-    # Inspect the kernel and lsb-release.
-    - lsb_release -a
-    - uname -a
-
-build-all:
-  stage: build
-  extends:
-    - .ubuntu-common
-  script:
-    # Run the spread prepare section to build everything.
-    - yq -r '.prepare' <spread.yaml | SPREAD_PATH=. bash -xeu
-  artifacts:
-    name: ${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
-    expire_in: 30 days
-    untracked: true
-    paths:
-      - libraries/libapparmor/
-      - parser/
-      - binutils/
-      - utils/
-      - changehat/mod_apparmor/
-      - changehat/pam_apparmor/
-      - profiles/
-
-test-libapparmor:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # This is to touch the built files in the test stage to avoid needless rebuilding
-    - make -C libraries/libapparmor --touch
-    - make -C libraries/libapparmor check
-
-test-parser:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # This is to touch the built files in the test stage to avoid needless rebuilding
-    - make -C parser --touch
-    - make -C parser -j $(nproc) tst_binaries
-    - make -C parser check
-
-test-binutils:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    - make -C binutils check
-
-test-utils:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # This is to touch the built files in the test stage to avoid needless rebuilding
-    - make -C utils --touch
-
-    # TODO: move those to cloud-init list?
-    - printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
-    - apt-get install --no-install-recommends -y libc6-dev libjs-jquery libjs-jquery-throttle-debounce libjs-jquery-isonscreen libjs-jquery-tablesorter flake8 python3-coverage python3-notify2 python3-psutil python3-setuptools python3-tk python3-ttkthemes python3-gi
-    - printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
-
-    # See apparmor/apparmor#221
-    - make -C parser/tst gen_dbus
-    - make -C parser/tst gen_xtrans
-    - make -C utils check
-    - make -C utils/test coverage-regression
-  artifacts:
-    paths:
-      - utils/test/htmlcov/
-    when: always
-
-test-mod-apparmor:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # This is to touch the built files in the test stage to avoid needless rebuilding
-    - make -C changehat/mod_apparmor --touch
-    - make -C changehat/mod_apparmor check
-
-test-profiles:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # This is to touch the built files in the test stage to avoid needless rebuilding
-    - make -C profiles --touch
-    - make -C profiles check-parser
-    - make -C profiles check-abstractions.d
-    - make -C profiles check-local
-
-# Build the regression tests (don't run them because that needs kernel access)
-test-build-regression:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-common
-  script:
-    # Additional dependencies required by regression tests
-    - printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
-    - apt-get install --no-install-recommends -y attr fuse-overlayfs libdbus-1-dev liburing-dev
-    - printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
-    - make -C tests/regression/apparmor -j $(nproc)
-
-shellcheck:
-  stage: test
-  needs: []
-  extends:
-    - .ubuntu-common
-  script:
-    - printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
-    - apt-get install --no-install-recommends -y python3-minimal file shellcheck xmlstarlet
-    - printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
-    - shellcheck --version
-    - "./tests/bin/shellcheck-tree --format=checkstyle
-      | xmlstarlet tr tests/checkstyle2junit.xslt
-      > shellcheck.xml"
-  artifacts:
-    when: always
-    reports:
-      junit: shellcheck.xml
-
-# Disabled due to aa-logprof dependency on /sbin/apparmor_parser existing
-#   - make -C profiles check-profiles
-
-# test-pam_apparmor:
-#  - stage: test
-#  - script:
-#    - cd changehat/pam_apparmor && make check
-
-include:
-  - template: SAST.gitlab-ci.yml
-  - template: Secret-Detection.gitlab-ci.yml
-
-variables:
-  SAST_EXCLUDED_ANALYZERS: "eslint,flawfinder,semgrep,spotbugs"
-  SAST_BANDIT_EXCLUDED_PATHS: "*/tst/*, */test/*"
-
-coverity:
-  stage: .post
-  extends:
-    - .ubuntu-common
-  script:
-    - printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
-    - apt-get install --no-install-recommends -y curl git texlive-latex-recommended
-    - printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
-    - curl -o /tmp/cov-analysis-linux64.tgz https://scan.coverity.com/download/linux64
-      --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN
-    - tar xfz /tmp/cov-analysis-linux64.tgz
-    - COV_VERSION=$(ls -dt cov-analysis-linux64-* | head -1)
-    - PATH=$PATH:$(pwd)/$COV_VERSION/bin
-    - make coverity
-    - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
-      --form token=$COVERITY_SCAN_TOKEN --form email=$GITLAB_USER_EMAIL
-      --form file=@$(ls apparmor-*-cov-int.tar.gz) --form version="$(git describe --tags)"
-      --form description="$(git describe --tags) / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID"
-  artifacts:
-    paths:
-      - "apparmor-*.tar.gz"
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "apparmor/apparmor"

.image-garden.mk

@@ -1,110 +0,0 @@
-# This file is read by image-garden when spread is allocating test machines.
-# All the package installation happens through cloud-init profiles defined
-# below.
-
-# This is the cloud-init user-data profile for all Debian systems. Note that it
-# is an extension of the default profile necessary for operation of
-# image-garden.
-define DEBIAN_CLOUD_INIT_USER_DATA_TEMPLATE
-$(CLOUD_INIT_USER_DATA_TEMPLATE)
-packages:
-- apache2-dev
-- attr
-- autoconf
-- autoconf-archive
-- automake
-- bison
-- build-essential
-- dejagnu
-- dosfstools
-- flake8
-- flex
-- fuse-overlayfs
-- gdb
-- gettext
-- libdbus-1-dev
-- libpam0g-dev
-- libtool
-- liburing-dev
-- pkg-config
-- python3-all-dev
-- python3-gi
-- python3-notify2
-- python3-psutil
-- python3-setuptools
-- python3-tk
-- python3-ttkthemes
-- swig
-- toybox
-endef
-
-# Ubuntu shares cloud-init profile with Debian.
-UBUNTU_CLOUD_INIT_USER_DATA_TEMPLATE=$(DEBIAN_CLOUD_INIT_USER_DATA_TEMPLATE)
-
-# This is the cloud-init user-data profile for openSUSE Tumbleweed.
-define OPENSUSE_tumbleweed_CLOUD_INIT_USER_DATA_TEMPLATE
-$(CLOUD_INIT_USER_DATA_TEMPLATE)
-- sed -i -e 's/security=selinux/security=apparmor/g' /etc/default/grub
-- update-bootloader
-packages:
-- apache2-devel
-- attr
-- autoconf
-- autoconf-archive
-- automake
-- bison
-- dbus-1-devel
-- dejagnu
-- dosfstools
-- flex
-- fuse-overlayfs
-- gcc
-- gcc-c++
-- gdb
-- gettext
-- gobject-introspection
-- libtool
-- liburing2-devel
-- make
-- pam-devel
-- pkg-config
-- python3-devel
-- python3-flake8
-- python3-notify2
-- python3-psutil
-- python3-setuptools
-- python3-setuptools
-- python3-tk
-- python311
-- python311-devel
-- swig
-endef
-
-define FEDORA_CLOUD_INIT_USER_DATA_TEMPLATE
-$(CLOUD_INIT_USER_DATA_TEMPLATE)
-packages:
-- attr
-- autoconf
-- autoconf-archive
-- automake
-- bison
-- dbus-devel
-- dejagnu
-- dosfstools
-- flex
-- gdb
-- gettext
-- httpd-devel
-- libstdc++-static
-- libtool
-- liburing-devel
-- pam-devel
-- perl
-- pkg-config
-- python3-devel
-- python3-flake8
-- python3-gobject-base
-- python3-notify2
-- python3-tkinter
-- swig
-endef

.shellcheckrc

@@ -1,10 +0,0 @@
-# Don't follow source'd scripts
-disable=SC1090
-disable=SC1091
-
-# dash supports 'local'
-disable=SC2039
-disable=SC3043
-
-# dash supports 'echo -n'
-disable=SC3037

Makefile

@@ -19,7 +19,7 @@ DIRS=libraries/libapparmor \
 
 # with conversion to git, we don't export from the remote
 REPO_URL?=git@gitlab.com:apparmor/apparmor.git
-REPO_BRANCH?=master
+REPO_BRANCH?=apparmor-2.12
 
 COVERITY_DIR=cov-int
 RELEASE_DIR=apparmor-${VERSION}
@@ -54,12 +54,12 @@ snapshot: clean
 .PHONY: coverity
 coverity: snapshot
 	cd $(SNAPSHOT_NAME)/libraries/libapparmor && ./configure --with-python
+	$(foreach dir, $(filter-out utils profiles tests, $(DIRS)), \
+		cov-build --dir $(COVERITY_DIR) -- $(MAKE) -C $(SNAPSHOT_NAME)/$(dir); \
+		mv $(COVERITY_DIR)/build-log.txt $(COVERITY_DIR)/build-log-$(subst /,.,$(dir)).txt ;)
 	$(foreach dir, libraries/libapparmor utils, \
 		cov-build --dir $(COVERITY_DIR) --no-command --fs-capture-search $(SNAPSHOT_NAME)/$(dir); \
 		mv $(COVERITY_DIR)/build-log.txt $(COVERITY_DIR)/build-log-python-$(subst /,.,$(dir)).txt ;)
-	cov-build --dir $(COVERITY_DIR) -- sh -c \
-	"$(foreach dir, $(filter-out utils profiles tests, $(DIRS)), \
-		$(MAKE) -j $$(nproc) -C $(SNAPSHOT_NAME)/$(dir);) "
 	tar -cvzf $(SNAPSHOT_NAME)-$(COVERITY_DIR).tar.gz $(COVERITY_DIR)
 
 .PHONY: export_dir

README.md

@@ -35,33 +35,16 @@ and questions to the
 [AppArmor mailing list](https://lists.ubuntu.com/mailman/listinfo/apparmor).
 
 Bug reports can be filed against the AppArmor project on
-[GitLab](https://gitlab.com/apparmor/apparmor/-/issues) or reported to the mailing
+[launchpad](https://bugs.launchpad.net/apparmor) or reported to the mailing
 list directly for those who wish not to register for an account on
-GitLab. See the
+launchpad. See the
 [wiki page](https://gitlab.com/apparmor/apparmor/wikis/home#reporting-bugs)
 for more information.
 
-Security issues can be filed in GitLab by opening up a new [issue](https://gitlab.com/apparmor/apparmor/-/issues) and selecting the tick box ```This issue is confidential and should only be visible to team members with at least Reporter access.``` or directed to `security@apparmor.net`. Additional details can be found
+Security issues can be filed as security bugs on launchpad
+or directed to `security@apparmor.net`. Additional details can be found
 in the [wiki](https://gitlab.com/apparmor/apparmor/wikis/home#reporting-security-vulnerabilities).
 
-
---------------
-Privacy Policy
---------------
-
-The AppArmor security project respects users privacy and data and does not collect data from or on its users beyond what is required for a given component to function.
-
-The AppArmor kernel security module will log violations to the audit subsystem, and those will be logged/forwarded/recorded on the user's system(s) according to how the administrator has logging configured. Again this is not forwarded to or collected by the AppArmor project.
-
-The AppArmor userspace tools do not collect information on the system user beyond the logs and information needed to interact with the user. This is not forwarded to, nor collected by the AppArmor project.
-
-Users may submit information as part of an email, bug report or merge request, etc. and that will be recorded as part of the mailing list, bug/issue tracker, or code repository but only as part of a user initiated action.
-
-The AppArmor project does not collect information from contributors beyond their interactions with the AppArmor project, code, and community. However contributors are subject to the terms and conditions and privacy policy of the individual platforms (currently GitLab) should they choose to contribute through those platforms. And those platforms may collect data on the user that the AppArmor project does not.
-
-Currently GitLab requires a user account to submit patches or report bugs and issues. If a contributor does not wish to create an account for these platforms the mailing list is available. Membership in the list is not required. Content from non-list members will be sent to moderation, to ensure that it is on topic, so there may be a delay in choosing to interact in this way.
-
-
 -------------
 Source Layout
 -------------
@@ -111,21 +94,13 @@ $ export PYTHON_VERSION=3
 $ export PYTHON_VERSIONS=python3
 ```
 
-Note that, in general, the build steps can be run in parallel, while the test
-steps do not gain much speedup from being run in parallel. This is because the
-test steps spawn a handful of long-lived test runner processes that mostly
-run their tests sequentially and do not use `make`'s jobserver. Moreover,
-process spawning overhead constitutes a significant part of test runtime, so
-reworking the test harnesses to add parallelism (which would be a major undertaking
-for the harnesses that do not have it already) would not produce much of a speedup.
-
-### libapparmor:
+libapparmor:
 
 ```
 $ cd ./libraries/libapparmor
 $ sh ./autogen.sh
 $ sh ./configure --prefix=/usr --with-perl --with-python # see below
-$ make -j $(nproc)
+$ make
 $ make check
 $ make install
 ```
@@ -134,54 +109,53 @@ $ make install
 generate Ruby bindings to libapparmor.]
 
 
-### Binary Utilities:
+Binary Utilities:
 
 ```
 $ cd binutils
-$ make -j $(nproc)
+$ make
 $ make check
 $ make install
 ```
 
-### Parser:
+parser:
 
 ```
 $ cd parser
-$ make -j $(nproc)		# depends on libapparmor having been built first
-$ make -j $(nproc) tst_binaries		# a build step of make check that can be parallelized
+$ make		# depends on libapparmor having been built first
 $ make check
 $ make install
 ```
 
 
-### Utilities:
+Utilities:
 
 ```
 $ cd utils
-$ make -j $(nproc)
-$ make check PYFLAKES=/usr/bin/pyflakes3
+$ make
+$ make check
 $ make install
 ```
 
-### Apache mod_apparmor:
+Apache mod_apparmor:
 
 ```
 $ cd changehat/mod_apparmor
-$ make -j $(nproc)		# depends on libapparmor having been built first
+$ make		# depends on libapparmor having been built first
 $ make install
 ```
 
 
-### PAM AppArmor:
+PAM AppArmor:
 
 ```
 $ cd changehat/pam_apparmor
-$ make -j $(nproc)		# depends on libapparmor having been built first
+$ make		# depends on libapparmor having been built first
 $ make install
 ```
 
 
-### Profiles:
+Profiles:
 
 ```
 $ cd profiles
@@ -190,9 +164,6 @@ $ make check	# depends on the parser having been built first
 $ make install
 ```
 
-Note that the empty local/* profile sniplets no longer get created by default.
-If you want them, run `make local` before running `make check`.
-
 [Note that for the parser, binutils, and utils, if you only wish to build/use
  some of the locale languages, you can override the default by passing
  the LANGS arguments to make; e.g. make all install "LANGS=en_US fr".]
@@ -206,33 +177,6 @@ usage and how to update and add tests. Below is a quick overview of their
 location and how to run them.
 
 
-Using spread with local virtual machines
-----------------------------------------
-
-It may be convenient to use the spread tool to provision and run the test suite
-in an ephemeral virtual machine. This allows testing in isolation from the
-host, as well as testing across different commonly used distributions and their
-real kernels.
-
-```sh
-sudo apt install git golang whois ovmf genisoimage qemu-utils qemu-system
-go install github.com/snapcore/spread/cmd/spread@latest
-git clone https://gitlab.com/zygoon/image-garden
-make -C image-garden
-sudo make -C image-garden install
-image-garden make ubuntu-cloud-24.10.x86_64.run
-cd $APPARMOR_PATH
-git clean -xdf
-~/go/bin/spread -artifacts ./spread-artifacts -v ubuntu-cloud-24.10
-# or ~/go/bin/spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
-```
-
-Running the `run_spread.sh` script, with `spread` on `PATH` will run all the
-tests across several supported systems (Debian, Ubuntu and openSUSE).
-
-If you include a `bzImage` file in the root of the repository then that kernel
-will be used in the integration test. Please look at `spread.yaml` for details.
-
 Regression tests
 ----------------
 For details on structure and adding tests, see
@@ -240,23 +184,9 @@ tests/regression/apparmor/README.
 
 To run:
 
-### Regression tests - using apparmor userspace installed on host
 ```
 $ cd tests/regression/apparmor (requires root)
-$ make -j $(nproc) USE_SYSTEM=1
-$ sudo make tests USE_SYSTEM=1
-$ sudo bash open.sh -r	 # runs and saves the last testcase from open.sh
-```
-
-### Regression tests - using apparmor userspace from the tree.
-- [build libapparmor](#libapparmor)
-- [build binutils](#binary-utilities)
-- [build apparmor parser](#parser)
-- [build Pam apparmor](#pam-apparmor)
-
-```
-$ cd tests/regression/apparmor (requires root)
-$ make -j $(nproc)
+$ make
 $ sudo make tests
 $ sudo bash open.sh -r	 # runs and saves the last testcase from open.sh
 ```
@@ -384,19 +314,10 @@ The AppArmor userspace utilities are written with some assumptions about
 installed and available versions of other tools. This is a (possibly
 incomplete) list of known version dependencies:
 
-The Python utilities require a minimum of Python 3.3.
+The Python utilities require a minimum of Python 2.7 (deprecated) or Python 3.3.
+Python 3.x is recommended. Python 2.x support is deprecated since AppArmor 2.11.
 
-The aa-notify tool's Python dependencies can be satisfied by installing the
-following packages (Debian package names, other distros may vary):
-* python3-notify2
-* python3-psutil
-* python3-sqlite (part of the python3.NN-stdlib package)
-* python3-tk
-* python3-ttkthemes
-* python3-gi
-
-Perl is no longer needed since none of the utilities shipped to end users depend
-on it anymore.
+Some utilities (aa-exec, aa-notify and aa-decode) require Perl 5.10.1 or newer.
 
 Most shell scripts are written for POSIX-compatible sh. aa-decode expects
 bash, probably version 3.2 and higher.

binutils/Makefile

@@ -19,11 +19,11 @@ include $(COMMONDIR)/Make.rules
 
 DESTDIR=/
 BINDIR=${DESTDIR}/usr/bin
-SBINDIR=${DESTDIR}/usr/sbin
 LOCALEDIR=/usr/share/locale
-MANPAGES=aa-enabled.1 aa-exec.1 aa-features-abi.1 aa-load.8 aa-status.8
+MANPAGES=aa-enabled.1 aa-exec.1
 
 WARNINGS = -Wall
+EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
 CPP_WARNINGS =
 ifndef CFLAGS
 CFLAGS	= -g -O2 -pipe
@@ -36,7 +36,7 @@ CFLAGS = -g -pg -fprofile-arcs -ftest-coverage
 endif
 endif #CFLAGS
 
-EXTRA_CFLAGS = ${CFLAGS} ${CPPFLAGS} ${EXTRA_CXXFLAGS} ${CPP_WARNINGS} $(EXTRA_WARNINGS)
+EXTRA_CFLAGS = ${CFLAGS} ${CPPFLAGS} ${EXTRA_CXXFLAGS} ${CPP_WARNINGS}
 
 #INCLUDEDIR = /usr/src/linux/include
 INCLUDEDIR =
@@ -48,17 +48,12 @@ endif
 # Internationalization support. Define a package and a LOCALEDIR
 EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
 
-SRCS = aa_enabled.c aa_load.c
+SRCS = aa_enabled.c
 HDRS =
-BINTOOLS = aa-enabled aa-exec aa-features-abi
-SBINTOOLS = aa-status aa-load
+TOOLS = aa-enabled aa-exec
 
 AALIB = -Wl,-Bstatic -lapparmor  -Wl,-Bdynamic -lpthread
 
-ifdef WITH_LIBINTL
-	AALIB += -lintl
-endif
-
 ifdef USE_SYSTEM
   # Using the system libapparmor so Makefile dependencies can't be used
   LIBAPPARMOR_A =
@@ -98,7 +93,7 @@ po/%.pot: %.c
 
 # targets arranged this way so that people who don't want full docs can
 # pick specific targets they want.
-arch: 	$(BINTOOLS) $(SBINTOOLS)
+arch: 	$(TOOLS)
 
 manpages:	$(MANPAGES)
 
@@ -111,7 +106,7 @@ all:	arch indep
 
 .PHONY: coverage
 coverage:
-	$(MAKE) clean $(BINTOOLS) $(SBINTOOLS) COVERAGE=1
+	$(MAKE) clean $(TOOLS) COVERAGE=1
 
 ifndef USE_SYSTEM
 $(LIBAPPARMOR_A):
@@ -123,30 +118,18 @@ $(LIBAPPARMOR_A):
 	fi
 endif
 
-aa-features-abi: aa_features_abi.c $(LIBAPPARMOR_A)
-	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
-
-aa-load: aa_load.c $(LIBAPPARMOR_A)
-	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
-
 aa-enabled: aa_enabled.c $(LIBAPPARMOR_A)
 	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB) 
 
 aa-exec: aa_exec.c $(LIBAPPARMOR_A)
 	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
 
-aa-status: aa_status.c cJSON.o $(LIBAPPARMOR_A)
-	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB) cJSON.o
-
-cJSON.o: cJSON.c cJSON.h
-	$(CC) $(EXTRA_CFLAGS) -c -o $@ $<
-
 .SILENT: check
 .PHONY: check
 check: check_pod_files tests
 
 .SILENT: tests
-tests: $(BINTOOLS) $(SBINTOOLS) $(TESTS)
+tests: $(TOOLS) $(TESTS)
 	echo "no tests atm"
 
 .PHONY: install
@@ -155,16 +138,12 @@ install: install-indep install-arch
 .PHONY: install-arch
 install-arch: arch
 	install -m 755 -d ${BINDIR}
-	install -m 755 ${BINTOOLS} ${BINDIR}
-	install -m 755 -d ${SBINDIR}
-	ln -sf aa-status ${SBINDIR}/apparmor_status
-	install -m 755 ${SBINTOOLS} ${SBINDIR}
+	install -m 755 ${TOOLS} ${BINDIR}
 
 .PHONY: install-indep
 install-indep: indep
 	$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
 	$(MAKE) install_manpages DESTDIR=${DESTDIR}
-	ln -sf aa-status.8 ${DESTDIR}/${MANDIR}/man8/apparmor_status.8
 
 ifndef VERBOSE
 .SILENT: clean
@@ -173,6 +152,6 @@ endif
 clean: pod_clean
 	rm -f core core.* *.o *.s *.a *~ *.gcda *.gcno
 	rm -f gmon.out
-	rm -f $(BINTOOLS) $(SBINTOOLS) $(TESTS)
+	rm -f $(TOOLS) $(TESTS)
 	$(MAKE) -s -C po clean
 

binutils/aa-enabled.pod

@@ -48,11 +48,6 @@ Do not output anything to stdout. This option is intended to be used by
 scripts that simply want to use the exit code to determine if AppArmor is
 enabled.
 
-=item -x, --exclusive
-
-Require AppArmor to have exclusive access to shared LSM interfaces to
-be considered enabled.
-
 =back
 
 =head1 EXIT STATUS
@@ -81,10 +76,6 @@ if the AppArmor control files aren't available under /sys/kernel/security/.
 
 if B<aa-enabled> doesn't have enough privileges to read the apparmor control files.
 
-=item B<10>
-
-AppArmor is enabled but does not have access to shared LSM interfaces.
-
 =item B<64>
 
 if any unexpected error or condition is encountered.
@@ -94,7 +85,7 @@ if any unexpected error or condition is encountered.
 =head1 BUGS
 
 If you find any bugs, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

binutils/aa-exec.pod

@@ -83,7 +83,7 @@ aa-exec.
 =head1 BUGS
 
 If you find any bugs, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

binutils/aa-features-abi.pod

@@ -1,97 +0,0 @@
-# This publication is intellectual property of Canonical Ltd. Its contents
-# can be duplicated, either in part or in whole, provided that a copyright
-# label is visibly located on each copy.
-#
-# All information found in this book has been compiled with utmost
-# attention to detail. However, this does not guarantee complete accuracy.
-# Neither Canonical Ltd, the authors, nor the translators shall be held
-# liable for possible errors or the consequences thereof.
-#
-# Many of the software and hardware descriptions cited in this book
-# are registered trademarks. All trade names are subject to copyright
-# restrictions and may be registered trade marks. Canonical Ltd
-# essentially adheres to the manufacturer's spelling.
-#
-# Names of products and trademarks appearing in this book (with or without
-# specific notation) are likewise subject to trademark and trade protection
-# laws and may thus fall under copyright restrictions.
-#
-
-
-=pod
-
-=head1 NAME
-
-aa-features-abi - Extract, validate and manipulate AppArmor feature abis
-
-=head1 SYNOPSIS
-
-B<aa-features-abi> [OPTIONS] <SOURCE> [OUTPUT OPTIONS]
-
-=head1 DESCRIPTION
-
-B<aa-features-abi> is used to extract a features abi and output to
-either stdout or a specified file. A SOURCE_OPTION must be specified.
-If an output option is not specified the features abi is written to
-stdout.
-
-=head1 OPTIONS
-
-B<aa-features-abi> accepts the following arguments:
-
-=over 4
-
-=item -h, --help
-
-Display a brief usage guide.
-
-=item -d, --debug
-
-show messages with debugging information
-
-=item -v, --verbose
-
-show messages with stats
-
-=back
-
-=head1 SOURCE
-
-=over 4
-
-=item -x, --extract
-
-Extract the features abi for the kernel
-
-=item -f FILE, --file=FILE
-
-Load the features abi from FILE and send it to OUTPUT OPTIONS.
-
-=back
-
-=head1 OUTPUT OPTIONS
-
-=over 4
-
-=item --stdout
-
-Write the features abi to I<stdout>, this is the default if no output option
-is specified.
-
-=item -w FILE, --write FILE
-
-Write the features abi to I<FILE>.
-
-=back
-
-
-=head1 BUGS
-
-If you find any bugs, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
-
-=head1 SEE ALSO
-
-apparmor(7), apparmor.d(5), aa_features(3), and L<https://wiki.apparmor.net>.
-
-=cut

binutils/aa-load.pod

@@ -1,77 +0,0 @@
-# This publication is intellectual property of Canonical Ltd. Its contents
-# can be duplicated, either in part or in whole, provided that a copyright
-# label is visibly located on each copy.
-#
-# All information found in this book has been compiled with utmost
-# attention to detail. However, this does not guarantee complete accuracy.
-# Neither Canonical Ltd, the authors, nor the translators shall be held
-# liable for possible errors or the consequences thereof.
-#
-# Many of the software and hardware descriptions cited in this book
-# are registered trademarks. All trade names are subject to copyright
-# restrictions and may be registered trade marks. Canonical Ltd
-# essentially adheres to the manufacturer's spelling.
-#
-# Names of products and trademarks appearing in this book (with or without
-# specific notation) are likewise subject to trademark and trade protection
-# laws and may thus fall under copyright restrictions.
-#
-
-
-=pod
-
-=head1 NAME
-
-aa-load - load precompiled AppArmor policy from cache location(s)
-
-=head1 SYNOPSIS
-
-B<aa-load> [options] (cache file|cache dir|cache base dir)+
-
-=head1 DESCRIPTION
-
-B<aa-load> loads precompiled AppArmor policy from the specified locations.
-
-=head1 OPTIONS
-
-B<aa-load> accepts the following arguments:
-
-=over 4
-
-=item -f, --force
-
-Force B<aa-load> to load a policy even if its abi does not match the kernel abi.
-
-=item -d, --debug
-
-Display debug messages.
-
-=item -v, --verbose
-
-Display progress and error messages.
-
-=item -n, --dry-run
-
-Do not actually load the specified policy/policies into the kernel.
-
-=item -h, --help
-
-Display a brief usage guide.
-
-=back
-
-=head1 EXIT STATUS
-
-Upon exiting, B<aa-load> returns 0 upon success and 1 upon an error loading
-the precompiled policy.
-
-=head1 BUGS
-
-If you find any bugs, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
-
-=head1 SEE ALSO
-
-apparmor(7), apparmor.d(5), apparmor_parser(8), and L<https://wiki.apparmor.net>.
-
-=cut

binutils/aa_enabled.c

@@ -20,7 +20,6 @@ void print_help(const char *command)
 {
 	printf(_("%s: [options]\n"
 		 "  options:\n"
-		 "  -x | --exclusive    Shared interfaces must be available\n"
 		 "  -q | --quiet        Don't print out any messages\n"
 		 "  -h | --help         Print help\n"),
 	       command);
@@ -31,6 +30,8 @@ void print_help(const char *command)
 /* Exit statuses and meanings are documented in the aa-enabled.pod file */
 static void exit_with_error(int saved_errno, int quiet)
 {
+	int err;
+
 	switch(saved_errno) {
 	case ENOSYS:
 		if (!quiet)
@@ -49,11 +50,8 @@ static void exit_with_error(int saved_errno, int quiet)
 		if (!quiet)
 			printf(_("Maybe - insufficient permissions to determine availability.\n"));
 		exit(4);
-	case EBUSY:
-		if (!quiet)
-			printf(_("Partially - public shared interfaces are not available.\n"));
-		exit(10);
 	}
+
 	if (!quiet)
 		printf(_("Error - %s\n"), strerror(saved_errno));
 	exit(64);
@@ -61,27 +59,22 @@ static void exit_with_error(int saved_errno, int quiet)
 
 int main(int argc, char **argv)
 {
-	int i, enabled;
+	int enabled;
 	int quiet = 0;
-	int require_shared = 0;
 
 	setlocale(LC_MESSAGES, "");
 	bindtextdomain(PACKAGE, LOCALEDIR);
 	textdomain(PACKAGE);
 
-	if (argc > 3) {
+	if (argc > 2) {
 		printf(_("unknown or incompatible options\n"));
 		print_help(argv[0]);
-	}
-	for (i = 1; i < argc; i++) {
-		if (strcmp(argv[i], "--quiet") == 0 ||
-		    strcmp(argv[i], "-q") == 0) {
+	} else if (argc == 2) {
+		if (strcmp(argv[1], "--quiet") == 0 ||
+		    strcmp(argv[1], "-q") == 0) {
 			quiet = 1;
-		} else if (strcmp(argv[i], "--exclusive") == 0 ||
-		    strcmp(argv[i], "-x") == 0) {
-			require_shared = 1;
-		} else if (strcmp(argv[i], "--help") == 0 ||
-			   strcmp(argv[i], "-h") == 0) {
+		} else if (strcmp(argv[1], "--help") == 0 ||
+			   strcmp(argv[1], "-h") == 0) {
 			print_help(argv[0]);
 		} else {
 			printf(_("unknown option '%s'\n"), argv[1]);
@@ -90,10 +83,9 @@ int main(int argc, char **argv)
 	}
 
 	enabled = aa_is_enabled();
-	if (!enabled) {
-		if (require_shared || errno != EBUSY)
-			exit_with_error(errno, quiet);
-	}
+	if (!enabled)
+		exit_with_error(errno, quiet);
+
 	if (!quiet)
 		printf(_("Yes\n"));
 	exit(0);

binutils/aa_exec.c

@@ -25,7 +25,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/apparmor.h>
-#include <sys/types.h>
 #include <unistd.h>
 #define _(s) gettext(s)
 
@@ -34,7 +33,6 @@ static const char *opt_namespace = NULL;
 static bool opt_debug = false;
 static bool opt_immediate = false;
 static bool opt_verbose = false;
-static pid_t pid = 0;
 
 static void usage(const char *name, bool error)
 {
@@ -62,7 +60,7 @@ static void usage(const char *name, bool error)
 	exit(status);
 }
 
-#define error(fmt, args...) _error(_("[%ld] aa-exec: ERROR: " fmt "\n"), (long)pid, ## args)
+#define error(fmt, args...) _error(_("aa-exec: ERROR: " fmt "\n"), ## args)
 static void _error(const char *fmt, ...)
 {
 	va_list args;
@@ -73,7 +71,7 @@ static void _error(const char *fmt, ...)
 	exit(EXIT_FAILURE);
 }
 
-#define debug(fmt, args...) _debug(_("[%ld] aa-exec: DEBUG: " fmt "\n"), (long)pid, ## args)
+#define debug(fmt, args...) _debug(_("aa-exec: DEBUG: " fmt "\n"), ## args)
 static void _debug(const char *fmt, ...)
 {
 	va_list args;
@@ -86,7 +84,7 @@ static void _debug(const char *fmt, ...)
 	va_end(args);
 }
 
-#define verbose(fmt, args...) _verbose(_("[%ld] " fmt "\n"), (long)pid, ## args)
+#define verbose(fmt, args...) _verbose(_(fmt "\n"), ## args)
 static void _verbose(const char *fmt, ...)
 {
 	va_list args;
@@ -104,7 +102,7 @@ static void verbose_print_argv(char **argv)
 	if (!opt_verbose)
 		return;
 
-	fprintf(stderr, _("[%ld] exec"), (long)pid);
+	fprintf(stderr, _("exec"));
 	for (; *argv; argv++)
 		fprintf(stderr, " %s", *argv);
 	fprintf(stderr, "\n");
@@ -131,13 +129,9 @@ static char **parse_args(int argc, char **argv)
 			usage(argv[0], false);
 			break;
 		case 'p':
-			if (opt_profile)
-				error("Multiple -p/--profile parameters given");
 			opt_profile = optarg;
 			break;
 		case 'n':
-			if (opt_namespace)
-				error("Multiple -n/--namespace parameters given");
 			opt_namespace = optarg;
 			break;
 		case 'i':
@@ -189,11 +183,6 @@ int main(int argc, char **argv)
 	char name[PATH_MAX];
 	int rc = 0;
 
-	/* IMPORTANT: pid must be initialized before doing anything else since
-	 * it is used in a global context when printing messages
-	 */
-	pid = getpid();
-
 	argv = parse_args(argc, argv);
 
 	if (opt_namespace || opt_profile)
@@ -212,11 +201,8 @@ int main(int argc, char **argv)
 	}
 
 	if (rc) {
-		if (errno == ENOENT) {
-			error("%s '%s' does not exist",
-			      opt_profile ? "profile" : "namespace", name);
-		} else if (errno == EACCES) {
-			error("insufficient permissions to change to the %s '%s'",
+		if (errno == ENOENT || errno == EACCES) {
+			error("%s '%s' does not exist\n",
 			      opt_profile ? "profile" : "namespace", name);
 		} else if (errno == EINVAL) {
 			error("AppArmor interface not available");

binutils/aa_features_abi.c

@@ -1,207 +0,0 @@
-/*
- *   Copyright (c) 2020
- *   Canonical, Ltd. (All rights reserved)
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of version 2 of the GNU General Public
- *   License published by the Free Software Foundation.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   You should have received a copy of the GNU General Public License
- *   along with this program; if not, contact Canonical Ltd.
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <getopt.h>
-#include <libintl.h>
-#include <limits.h>
-#include <stdio.h>
-#include <stdarg.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/apparmor.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-#define _(s) gettext(s)
-
-#include "../libraries/libapparmor/src/private.h"
-
-static const char *progname = NULL;
-static const char *opt_file = NULL;
-static const char *opt_write = NULL;
-static bool opt_debug = false;
-static bool opt_verbose = false;
-static bool opt_extract = false;
-
-static void usage(const char *name, bool error)
-{
-	FILE *stream = stdout;
-	int status = EXIT_SUCCESS;
-
-	if (error) {
-		stream = stderr;
-		status = EXIT_FAILURE;
-	}
-
-	fprintf(stream,
-		_("USAGE: %s [OPTIONS] <SOURCE> [OUTPUT OPTIONS]\n"
-		  "\n"
-		  "Output AppArmor feature abi from SOURCE to OUTPUT"
-		  "\n"
-		  "OPTIONS:\n"
-#if 0
-		  "  -d, --debug      show messages with debugging information\n"
-		  "  -v, --verbose    show messages with stats\n"
-#endif
-		  "  -h, --help       display this help\n"
-		  "SOURCE:\n"
-		  "  -f F, --file=F   load features abi from file F\n"
-		  "  -x, --extract    extract features abi from the kernel\n"
-		  "OUTPUT OPTIONS:\n"
-		  "  --stdout         default, write features to stdout\n"
-		  "  -w F, --write=F  write features abi to the file F instead of stdout\n"
-		  "\n"), name);
-	exit(status);
-}
-
-#define error(fmt, args...) _error(_("%s: ERROR: " fmt " - %m\n"), progname, ## args)
-static void _error(const char *fmt, ...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-	exit(EXIT_FAILURE);
-}
-
-#if 0
-#define debug(fmt, args...) _debug(_("%s: DEBUG: " fmt "\n"), progname, ## args)
-static void _debug(const char *fmt, ...)
-{
-	va_list args;
-
-	if (!opt_debug)
-		return;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-
-#define verbose(fmt, args...) _verbose(_(fmt "\n"), ## args)
-static void _verbose(const char *fmt, ...)
-{
-	va_list args;
-
-	if (!opt_verbose)
-		return;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-#endif
-
-#define ARG_STDOUT 128
-
-static char **parse_args(int argc, char **argv)
-{
-	int opt;
-	struct option long_opts[] = {
-		{"debug", no_argument, 0, 'd'},
-		{"verbose", no_argument, 0, 'v'},
-		{"help", no_argument, 0, 'h'},
-		{"extract", no_argument, 0, 'x'},
-		{"file", required_argument, 0, 'f'},
-		{"write", required_argument, 0, 'w'},
-		{"stdout", no_argument, 0, ARG_STDOUT},
-	};
-
-	while ((opt = getopt_long(argc, argv, "+dvhxf:l:w:", long_opts, NULL)) != -1) {
-		switch (opt) {
-		case 'd':
-			opt_debug = true;
-			break;
-		case 'v':
-			opt_verbose = true;
-			break;
-		case 'h':
-			usage(argv[0], false);
-			break;
-		case 'x':
-			opt_extract = true;
-			break;
-		case 'f':
-			opt_file = optarg;
-			break;
-		case 'w':
-			opt_write = optarg;
-			break;
-		case ARG_STDOUT:
-			opt_write = NULL;
-			break;
-		default:
-			usage(argv[0], true);
-			break;
-		}
-	}
-
-	return argv + optind;
-}
-
-
-/* TODO: add features intersection and testing */
-
-int main(int argc, char **argv)
-{
-	struct aa_features *features;
-	autoclose int in = -1;
-	autoclose int out = -1;
-	int rc = 0;
-
-	progname = argv[0];
-
-	argv = parse_args(argc, argv);
-
-	if (!opt_extract && !opt_file)
-		usage(argv[0], true);
-	if (opt_extract && opt_file) {
-		error("options --extract and --file are mutually exclusive");
-	}
-	if (opt_extract) {
-		rc = aa_features_new_from_kernel(&features);
-		if (rc == -1)
-			error("failed to extract features abi from the kernel");
-	}
-	if (opt_file) {
-		in = open(opt_file, O_RDONLY);
-		if (in == -1)
-			error("failed to open file '%s'", opt_file);
-		rc = aa_features_new_from_file(&features, in);
-		if (rc == -1)
-			error("failed to load features abi from file '%s'", opt_file);
-	}
-	
-
-	if (opt_write) {
-		out = open(opt_write, O_WRONLY | O_CREAT, 00600);
-		if (out == -1)
-			error("failed to open output file '%s'", opt_write);
-	} else {
-		out = fileno(stdout);
-		if (out == -1)
-			error("failed to get stdout");
-	}	
-	rc = aa_features_write_to_fd(features, out);
-	if (rc == -1)
-		error("failed to write features abi");
-
-	return 0;
-}

binutils/aa_load.c

@@ -1,408 +0,0 @@
-/*
- *   Copyright (C) 2020 Canonical Ltd.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of version 2 of the GNU General Public
- *   License published by the Free Software Foundation.
- */
-
-#define _GNU_SOURCE /* for asprintf() */
-#include <stdio.h>
-#include <errno.h>
-#include <getopt.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <fcntl.h>
-#include <string.h>
-#include <dirent.h>
-
-#include <sys/types.h>
-#include <sys/stat.h>
-
-#include <sys/apparmor.h>
-
-#include <libintl.h>
-#define _(s) gettext(s)
-
-/* TODO: implement config locations - value can change */
-#define DEFAULT_CONFIG_LOCATIONS "/etc/apparmor/parser.conf"
-#define DEFAULT_POLICY_LOCATIONS "/var/cache/apparmor:/etc/apparmor.d/cache.d:/etc/apparmor.d/cache"
-#define CACHE_FEATURES_FILE ".features"
-
-bool opt_debug = false;
-bool opt_verbose = false;
-bool opt_dryrun = false;
-bool opt_force = false;
-bool opt_config = false;
-
-#define warning(fmt, args...) _error(_("aa-load: WARN: " fmt "\n"), ## args)
-#define error(fmt, args...) _error(_("aa-load: ERROR: " fmt "\n"), ## args)
-static void _error(const char *fmt, ...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-
-#define verbose(fmt, args...) _debug(opt_verbose, _(fmt "\n"), ## args)
-#define debug(fmt, args...) _debug(opt_debug, _("aa-load: DEBUG: " fmt "\n"), ## args)
-static void _debug(bool opt_displayit, const char *fmt, ...)
-{
-	va_list args;
-
-	if (!opt_displayit)
-		return;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-
-static int have_enough_privilege(const char *command)
-{
-	uid_t uid, euid;
-
-	uid = getuid();
-	euid = geteuid();
-
-	if (uid != 0 && euid != 0) {
-		error("%s: Sorry. You need root privileges to run this program.\n",
-		      command);
-		return EPERM;
-	}
-
-	if (uid != 0 && euid == 0) {
-		error("%s: Aborting! You've set this program setuid root.\n"
-		      "Anybody who can run this program can update "
-		      "your AppArmor profiles.\n", command);
-		exit(EXIT_FAILURE);
-	}
-
-	return 0;
-}
-
-
-static int load_config(const char *file)
-{
-	/* TODO */
-	return ENOENT;
-}
-
-/**
- * load a single policy cache file to the kernel
- */
-static int load_policy_file(const char *file)
-{
-	int rc = 0;
-
-	struct aa_kernel_interface *kernel_interface;
-
-	if (aa_kernel_interface_new(&kernel_interface, NULL, NULL)) {
-		rc = -errno;
-		error("Failed to open kernel interface '%s': %m", file);
-		return rc;
-	}
-	if (!opt_dryrun &&
-	    aa_kernel_interface_replace_policy_from_file(kernel_interface,
-							 AT_FDCWD, file)) {
-		rc = -errno;
-		error("Failed to load policy into kernel '%s': %m", file);
-	}
-	aa_kernel_interface_unref(kernel_interface);
-
-	return rc;
-}
-
-static void validate_features(const char *dir_path)
-{
-	aa_features *kernel_features;
-
-	if (aa_features_new_from_kernel(&kernel_features) == -1) {
-		error("Failed to obtain features: %m");
-		return;
-	}
-
-	if (aa_features_check(AT_FDCWD, dir_path, kernel_features) == -1) {
-		if (errno == ENOENT) {
-			/* features file does not exist
-			 * not an issue when loading cache policies from dir
-			 */
-		}
-		else if (errno == EEXIST) {
-			warning("Overlay features do not match kernel features");
-		}
-	}
-	aa_features_unref(kernel_features);
-}
-
-/**
- * load a directory of policy cache files to the kernel
- * This does not do a subdir search to find the kernel match but
- * tries to load the dir regardless of whether its features match
- *
- * The hierarchy looks like
- *
- * dir/
- *     .features
- *     profile1
- *     ...
- */
-
-static int load_policy_dir(const char *dir_path)
-{
-	DIR *d;
-	struct dirent *dir;
-	int rc = 0;
-	char *file;
-	size_t len;
-
-	validate_features(dir_path);
-
-	d = opendir(dir_path);
-	if (!d) {
-		rc = -errno;
-		error("Failed to open directory '%s': %m", dir_path);
-		return rc;
-	}
-
-	while ((dir = readdir(d)) != NULL) {
-		/* Only check regular files for now */
-		if (dir->d_type == DT_REG) {
-			/* As per POSIX dir->d_name has at most NAME_MAX characters */
-			len = strnlen(dir->d_name, NAME_MAX);
-			/* Ignores .features */
-			if (strncmp(dir->d_name, CACHE_FEATURES_FILE, len) == 0) {
-				continue;
-			}
-			if (asprintf(&file, "%s/%s", dir_path, dir->d_name) == -1) {
-				error("Failure allocating memory");
-				closedir(d);
-				return -1;
-			}
-			load_policy_file(file);
-			free(file);
-			file = NULL;
-		}
-	}
-	closedir(d);
-	return 0;
-}
-
-
-/**
- * load_hashed_policy - find policy hashed dir and load it
- *
- * load/replace all policy from a policy hierarchy directory
- *
- * Returns: 0 on success < -errno
- *
- * It will find the subdir that matches the kernel and load all
- * precompiled policy files from it.
- *
- * The hierarchy looks something like
- *
- * location/
- *          kernel_hash1.0/
- *                         .features
- *                         profile1
- *                         ...
- *          kernel_hash2.0/
- *                        .features
- *                        profile1
- *                        ...
- */
-static int load_policy_by_hash(const char *location)
-{
-	aa_policy_cache *policy_cache = NULL;
-	int rc;
-
-	if ((rc = aa_policy_cache_new(&policy_cache, NULL, AT_FDCWD, location, 0))) {
-		rc = -errno;
-		error("Failed to open policy cache '%s': %m", location);
-		return rc;
-	}
-
-	if (opt_debug) {
-		/* show hash directory under location that matches the
-		 * current kernel
-		 */
-		char *cache_loc = aa_policy_cache_dir_path_preview(NULL, AT_FDCWD, location);
-		if (!cache_loc) {
-			rc = -errno;
-			error("Failed to find cache location '%s': %m", location);
-			goto out;
-		}
-		debug("Loading cache from '%s'\n", cache_loc);
-		free(cache_loc);
-	}
-
-	if (!opt_dryrun) {
-		if ((rc = aa_policy_cache_replace_all(policy_cache, NULL)) < 0) {
-			error("Failed to load policy cache '%s': %m", location);
-		} else {
-			verbose("Success - Loaded policy cache '%s'", location);
-		}
-	}
-
-out:
-	aa_policy_cache_unref(policy_cache);
-
-	return rc;
-}
-
-/**
- * load_arg - calls specific load functions for files and directories
- *
- * load/replace all policy files/dir in arg
- *
- * Returns: 0 on success, 1 on failure.
- *
- * It will load by hash subtree first, and fallback to a cache dir
- * If not a directory, it will try to load it as a cache file
- */
-static int load_arg(char *arg)
-{
-	char **location = NULL;
-	int i, n, rc = 0;
-
-
-	/* arg can specify an overlay of multiple cache locations */
-	if ((n = aa_split_overlay_str(arg, &location, 0, true)) == -1) {
-		error("Failed to parse overlay locations: %m");
-		return 1;
-	}
-
-	for (i = 0; i < n; i++) {
-		struct stat st;
-		debug("Trying to open %s", location[i]);
-		if (stat(location[i], &st) == -1) {
-			error("Failed stat of '%s': %m", location[i]);
-			rc = 1;
-			continue;
-		}
-		if (S_ISDIR(st.st_mode)) {
-			/* try hash dir subtree first */
-			if (load_policy_by_hash(location[i]) < 0) {
-				error("Failed load policy by hash '%s': %m", location[i]);
-				rc = 1;
-			}
-			/* fall back to cache dir */
-			if (load_policy_dir(location[i]) < 0) {
-				error("Failed load policy by directory '%s': %m", location[i]);
-				rc = 1;
-			}
-
-		} else if (load_policy_file(location[i]) < 0) {
-			rc = 1;
-		}
-	}
-
-	for (i = 0; i < n; i++)
-		free(location[i]);
-	free(location);
-	return rc;
-}
-
-static void print_usage(const char *command)
-{
-	printf("Usage: %s [OPTIONS] (cache file|cache dir|cache base dir)+\n"
-	       "Load precompiled AppArmor policy from cache location(s)\n\n"
-	       "Options:\n"
-	       "  -f, --force     load policy even if abi does not match the kernel\n"
-	       "  -d, --debug     display debug messages\n"
-	       "  -v, --verbose   display progress and error messages\n"
-	       "  -n, --dry-run   do everything except actual load\n"
-	       "  -h, --help      this message\n",
-	       command);
-}
-
-static const char *short_options = "c:dfvnh";
-struct option long_options[] = {
-	{"config",	1, 0, 'c'},
-	{"debug",	0, 0, 'd'},
-	{"force",	0, 0, 'f'},
-	{"verbose",	0, 0, 'v'},
-	{"dry-run",	0, 0, 'n'},
-	{"help",	0, 0, 'h'},
-	{NULL, 0, 0, 0},
-};
-
-static int process_args(int argc, char **argv)
-{
-	int c, o;
-
-	opterr = 1;
-	while ((c = getopt_long(argc, argv, short_options, long_options, &o)) != -1) {
-		switch(c) {
-		case 0:
-			error("error in argument processing\n");
-			exit(1);
-			break;
-		case 'd':
-			opt_debug = true;
-			break;
-		case 'f':
-			opt_force = true;
-			break;
-		case 'v':
-			opt_verbose = true;
-			break;
-		case 'n':
-			opt_dryrun = true;
-			break;
-		case 'h':
-			print_usage(argv[0]);
-			exit(0);
-			break;
-		case 'c':
-			/* TODO: reserved config location,
-			 *  act as a bad arg for now, when added update usage
-			 */
-			//opt_config = true; uncomment when implemented
-			/* Fall through */
-		default:
-			error("unknown argument: '%s'\n\n", optarg);
-			print_usage(argv[1]);
-			exit(1);
-			break;
-		}
-	}
-
-	return optind;
-}
-
-int main(int argc, char **argv)
-{
-	int i, rc = 0;
-
-	optind = process_args(argc, argv);
-
-	if (!opt_dryrun && have_enough_privilege(argv[0]))
-		return 1;
-
-	/* if no location use the default one */
-	if (optind == argc) {
-		if (!opt_config && load_config(DEFAULT_CONFIG_LOCATIONS) == 0) {
-			verbose("Loaded policy config");
-		}
-		if ((rc = load_arg(DEFAULT_POLICY_LOCATIONS)))
-			verbose("Loading policy from default location '%s'", DEFAULT_POLICY_LOCATIONS);
-		else
-			debug("No policy specified, and no policy config or policy in default locations");
-	}
-	for (i = optind; i < argc; i++) {
-		/* Try to load all policy locations even if one fails
-		 * but always return an error if any fail
-		 */
-
-		int tmp = load_arg(argv[i]);
-		if (!rc)
-			rc = tmp;
-	}
-
-	return rc;
-}

binutils/cJSON.h

@@ -1,293 +0,0 @@
-/*
-  Copyright (c) 2009-2017 Dave Gamble and cJSON contributors
-
-  Permission is hereby granted, free of charge, to any person obtaining a copy
-  of this software and associated documentation files (the "Software"), to deal
-  in the Software without restriction, including without limitation the rights
-  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-  copies of the Software, and to permit persons to whom the Software is
-  furnished to do so, subject to the following conditions:
-
-  The above copyright notice and this permission notice shall be included in
-  all copies or substantial portions of the Software.
-
-  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-  THE SOFTWARE.
-*/
-
-#ifndef cJSON__h
-#define cJSON__h
-
-#ifdef __cplusplus
-extern "C"
-{
-#endif
-
-#if !defined(__WINDOWS__) && (defined(WIN32) || defined(WIN64) || defined(_MSC_VER) || defined(_WIN32))
-#define __WINDOWS__
-#endif
-
-#ifdef __WINDOWS__
-
-/* When compiling for windows, we specify a specific calling convention to avoid issues where we are being called from a project with a different default calling convention.  For windows you have 3 define options:
-
-CJSON_HIDE_SYMBOLS - Define this in the case where you don't want to ever dllexport symbols
-CJSON_EXPORT_SYMBOLS - Define this on library build when you want to dllexport symbols (default)
-CJSON_IMPORT_SYMBOLS - Define this if you want to dllimport symbol
-
-For *nix builds that support visibility attribute, you can define similar behavior by
-
-setting default visibility to hidden by adding
--fvisibility=hidden (for gcc)
-or
--xldscope=hidden (for sun cc)
-to CFLAGS
-
-then using the CJSON_API_VISIBILITY flag to "export" the same symbols the way CJSON_EXPORT_SYMBOLS does
-
-*/
-
-#define CJSON_CDECL __cdecl
-#define CJSON_STDCALL __stdcall
-
-/* export symbols by default, this is necessary for copy pasting the C and header file */
-#if !defined(CJSON_HIDE_SYMBOLS) && !defined(CJSON_IMPORT_SYMBOLS) && !defined(CJSON_EXPORT_SYMBOLS)
-#define CJSON_EXPORT_SYMBOLS
-#endif
-
-#if defined(CJSON_HIDE_SYMBOLS)
-#define CJSON_PUBLIC(type)   type CJSON_STDCALL
-#elif defined(CJSON_EXPORT_SYMBOLS)
-#define CJSON_PUBLIC(type)   __declspec(dllexport) type CJSON_STDCALL
-#elif defined(CJSON_IMPORT_SYMBOLS)
-#define CJSON_PUBLIC(type)   __declspec(dllimport) type CJSON_STDCALL
-#endif
-#else /* !__WINDOWS__ */
-#define CJSON_CDECL
-#define CJSON_STDCALL
-
-#if (defined(__GNUC__) || defined(__SUNPRO_CC) || defined (__SUNPRO_C)) && defined(CJSON_API_VISIBILITY)
-#define CJSON_PUBLIC(type)   __attribute__((visibility("default"))) type
-#else
-#define CJSON_PUBLIC(type) type
-#endif
-#endif
-
-/* project version */
-#define CJSON_VERSION_MAJOR 1
-#define CJSON_VERSION_MINOR 7
-#define CJSON_VERSION_PATCH 13
-
-#include <stddef.h>
-
-/* cJSON Types: */
-#define cJSON_Invalid (0)
-#define cJSON_False  (1 << 0)
-#define cJSON_True   (1 << 1)
-#define cJSON_NULL   (1 << 2)
-#define cJSON_Number (1 << 3)
-#define cJSON_String (1 << 4)
-#define cJSON_Array  (1 << 5)
-#define cJSON_Object (1 << 6)
-#define cJSON_Raw    (1 << 7) /* raw json */
-
-#define cJSON_IsReference 256
-#define cJSON_StringIsConst 512
-
-/* The cJSON structure: */
-typedef struct cJSON
-{
-    /* next/prev allow you to walk array/object chains. Alternatively, use GetArraySize/GetArrayItem/GetObjectItem */
-    struct cJSON *next;
-    struct cJSON *prev;
-    /* An array or object item will have a child pointer pointing to a chain of the items in the array/object. */
-    struct cJSON *child;
-
-    /* The type of the item, as above. */
-    int type;
-
-    /* The item's string, if type==cJSON_String  and type == cJSON_Raw */
-    char *valuestring;
-    /* writing to valueint is DEPRECATED, use cJSON_SetNumberValue instead */
-    int valueint;
-    /* The item's number, if type==cJSON_Number */
-    double valuedouble;
-
-    /* The item's name string, if this item is the child of, or is in the list of subitems of an object. */
-    char *string;
-} cJSON;
-
-typedef struct cJSON_Hooks
-{
-      /* malloc/free are CDECL on Windows regardless of the default calling convention of the compiler, so ensure the hooks allow passing those functions directly. */
-      void *(CJSON_CDECL *malloc_fn)(size_t sz);
-      void (CJSON_CDECL *free_fn)(void *ptr);
-} cJSON_Hooks;
-
-typedef int cJSON_bool;
-
-/* Limits how deeply nested arrays/objects can be before cJSON rejects to parse them.
- * This is to prevent stack overflows. */
-#ifndef CJSON_NESTING_LIMIT
-#define CJSON_NESTING_LIMIT 1000
-#endif
-
-/* returns the version of cJSON as a string */
-CJSON_PUBLIC(const char*) cJSON_Version(void);
-
-/* Supply malloc, realloc and free functions to cJSON */
-CJSON_PUBLIC(void) cJSON_InitHooks(cJSON_Hooks* hooks);
-
-/* Memory Management: the caller is always responsible to free the results from all variants of cJSON_Parse (with cJSON_Delete) and cJSON_Print (with stdlib free, cJSON_Hooks.free_fn, or cJSON_free as appropriate). The exception is cJSON_PrintPreallocated, where the caller has full responsibility of the buffer. */
-/* Supply a block of JSON, and this returns a cJSON object you can interrogate. */
-CJSON_PUBLIC(cJSON *) cJSON_Parse(const char *value);
-CJSON_PUBLIC(cJSON *) cJSON_ParseWithLength(const char *value, size_t buffer_length);
-/* ParseWithOpts allows you to require (and check) that the JSON is null terminated, and to retrieve the pointer to the final byte parsed. */
-/* If you supply a ptr in return_parse_end and parsing fails, then return_parse_end will contain a pointer to the error so will match cJSON_GetErrorPtr(). */
-CJSON_PUBLIC(cJSON *) cJSON_ParseWithOpts(const char *value, const char **return_parse_end, cJSON_bool require_null_terminated);
-CJSON_PUBLIC(cJSON *) cJSON_ParseWithLengthOpts(const char *value, size_t buffer_length, const char **return_parse_end, cJSON_bool require_null_terminated);
-
-/* Render a cJSON entity to text for transfer/storage. */
-CJSON_PUBLIC(char *) cJSON_Print(const cJSON *item);
-/* Render a cJSON entity to text for transfer/storage without any formatting. */
-CJSON_PUBLIC(char *) cJSON_PrintUnformatted(const cJSON *item);
-/* Render a cJSON entity to text using a buffered strategy. prebuffer is a guess at the final size. guessing well reduces reallocation. fmt=0 gives unformatted, =1 gives formatted */
-CJSON_PUBLIC(char *) cJSON_PrintBuffered(const cJSON *item, int prebuffer, cJSON_bool fmt);
-/* Render a cJSON entity to text using a buffer already allocated in memory with given length. Returns 1 on success and 0 on failure. */
-/* NOTE: cJSON is not always 100% accurate in estimating how much memory it will use, so to be safe allocate 5 bytes more than you actually need */
-CJSON_PUBLIC(cJSON_bool) cJSON_PrintPreallocated(cJSON *item, char *buffer, const int length, const cJSON_bool format);
-/* Delete a cJSON entity and all subentities. */
-CJSON_PUBLIC(void) cJSON_Delete(cJSON *item);
-
-/* Returns the number of items in an array (or object). */
-CJSON_PUBLIC(int) cJSON_GetArraySize(const cJSON *array);
-/* Retrieve item number "index" from array "array". Returns NULL if unsuccessful. */
-CJSON_PUBLIC(cJSON *) cJSON_GetArrayItem(const cJSON *array, int index);
-/* Get item "string" from object. Case insensitive. */
-CJSON_PUBLIC(cJSON *) cJSON_GetObjectItem(const cJSON * const object, const char * const string);
-CJSON_PUBLIC(cJSON *) cJSON_GetObjectItemCaseSensitive(const cJSON * const object, const char * const string);
-CJSON_PUBLIC(cJSON_bool) cJSON_HasObjectItem(const cJSON *object, const char *string);
-/* For analysing failed parses. This returns a pointer to the parse error. You'll probably need to look a few chars back to make sense of it. Defined when cJSON_Parse() returns 0. 0 when cJSON_Parse() succeeds. */
-CJSON_PUBLIC(const char *) cJSON_GetErrorPtr(void);
-
-/* Check item type and return its value */
-CJSON_PUBLIC(char *) cJSON_GetStringValue(cJSON *item);
-CJSON_PUBLIC(double) cJSON_GetNumberValue(cJSON *item);
-
-/* These functions check the type of an item */
-CJSON_PUBLIC(cJSON_bool) cJSON_IsInvalid(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsFalse(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsTrue(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsBool(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsNull(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsNumber(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsString(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsArray(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsObject(const cJSON * const item);
-CJSON_PUBLIC(cJSON_bool) cJSON_IsRaw(const cJSON * const item);
-
-/* These calls create a cJSON item of the appropriate type. */
-CJSON_PUBLIC(cJSON *) cJSON_CreateNull(void);
-CJSON_PUBLIC(cJSON *) cJSON_CreateTrue(void);
-CJSON_PUBLIC(cJSON *) cJSON_CreateFalse(void);
-CJSON_PUBLIC(cJSON *) cJSON_CreateBool(cJSON_bool boolean);
-CJSON_PUBLIC(cJSON *) cJSON_CreateNumber(double num);
-CJSON_PUBLIC(cJSON *) cJSON_CreateString(const char *string);
-/* raw json */
-CJSON_PUBLIC(cJSON *) cJSON_CreateRaw(const char *raw);
-CJSON_PUBLIC(cJSON *) cJSON_CreateArray(void);
-CJSON_PUBLIC(cJSON *) cJSON_CreateObject(void);
-
-/* Create a string where valuestring references a string so
- * it will not be freed by cJSON_Delete */
-CJSON_PUBLIC(cJSON *) cJSON_CreateStringReference(const char *string);
-/* Create an object/array that only references it's elements so
- * they will not be freed by cJSON_Delete */
-CJSON_PUBLIC(cJSON *) cJSON_CreateObjectReference(const cJSON *child);
-CJSON_PUBLIC(cJSON *) cJSON_CreateArrayReference(const cJSON *child);
-
-/* These utilities create an Array of count items.
- * The parameter count cannot be greater than the number of elements in the number array, otherwise array access will be out of bounds.*/
-CJSON_PUBLIC(cJSON *) cJSON_CreateIntArray(const int *numbers, int count);
-CJSON_PUBLIC(cJSON *) cJSON_CreateFloatArray(const float *numbers, int count);
-CJSON_PUBLIC(cJSON *) cJSON_CreateDoubleArray(const double *numbers, int count);
-CJSON_PUBLIC(cJSON *) cJSON_CreateStringArray(const char *const *strings, int count);
-
-/* Append item to the specified array/object. */
-CJSON_PUBLIC(cJSON_bool) cJSON_AddItemToArray(cJSON *array, cJSON *item);
-CJSON_PUBLIC(cJSON_bool) cJSON_AddItemToObject(cJSON *object, const char *string, cJSON *item);
-/* Use this when string is definitely const (i.e. a literal, or as good as), and will definitely survive the cJSON object.
- * WARNING: When this function was used, make sure to always check that (item->type & cJSON_StringIsConst) is zero before
- * writing to `item->string` */
-CJSON_PUBLIC(cJSON_bool) cJSON_AddItemToObjectCS(cJSON *object, const char *string, cJSON *item);
-/* Append reference to item to the specified array/object. Use this when you want to add an existing cJSON to a new cJSON, but don't want to corrupt your existing cJSON. */
-CJSON_PUBLIC(cJSON_bool) cJSON_AddItemReferenceToArray(cJSON *array, cJSON *item);
-CJSON_PUBLIC(cJSON_bool) cJSON_AddItemReferenceToObject(cJSON *object, const char *string, cJSON *item);
-
-/* Remove/Detach items from Arrays/Objects. */
-CJSON_PUBLIC(cJSON *) cJSON_DetachItemViaPointer(cJSON *parent, cJSON * const item);
-CJSON_PUBLIC(cJSON *) cJSON_DetachItemFromArray(cJSON *array, int which);
-CJSON_PUBLIC(void) cJSON_DeleteItemFromArray(cJSON *array, int which);
-CJSON_PUBLIC(cJSON *) cJSON_DetachItemFromObject(cJSON *object, const char *string);
-CJSON_PUBLIC(cJSON *) cJSON_DetachItemFromObjectCaseSensitive(cJSON *object, const char *string);
-CJSON_PUBLIC(void) cJSON_DeleteItemFromObject(cJSON *object, const char *string);
-CJSON_PUBLIC(void) cJSON_DeleteItemFromObjectCaseSensitive(cJSON *object, const char *string);
-
-/* Update array items. */
-CJSON_PUBLIC(cJSON_bool) cJSON_InsertItemInArray(cJSON *array, int which, cJSON *newitem); /* Shifts pre-existing items to the right. */
-CJSON_PUBLIC(cJSON_bool) cJSON_ReplaceItemViaPointer(cJSON * const parent, cJSON * const item, cJSON * replacement);
-CJSON_PUBLIC(cJSON_bool) cJSON_ReplaceItemInArray(cJSON *array, int which, cJSON *newitem);
-CJSON_PUBLIC(cJSON_bool) cJSON_ReplaceItemInObject(cJSON *object,const char *string,cJSON *newitem);
-CJSON_PUBLIC(cJSON_bool) cJSON_ReplaceItemInObjectCaseSensitive(cJSON *object,const char *string,cJSON *newitem);
-
-/* Duplicate a cJSON item */
-CJSON_PUBLIC(cJSON *) cJSON_Duplicate(const cJSON *item, cJSON_bool recurse);
-/* Duplicate will create a new, identical cJSON item to the one you pass, in new memory that will
- * need to be released. With recurse!=0, it will duplicate any children connected to the item.
- * The item->next and ->prev pointers are always zero on return from Duplicate. */
-/* Recursively compare two cJSON items for equality. If either a or b is NULL or invalid, they will be considered unequal.
- * case_sensitive determines if object keys are treated case sensitive (1) or case insensitive (0) */
-CJSON_PUBLIC(cJSON_bool) cJSON_Compare(const cJSON * const a, const cJSON * const b, const cJSON_bool case_sensitive);
-
-/* Minify a strings, remove blank characters(such as ' ', '\t', '\r', '\n') from strings.
- * The input pointer json cannot point to a read-only address area, such as a string constant, 
- * but should point to a readable and writable adress area. */
-CJSON_PUBLIC(void) cJSON_Minify(char *json);
-
-/* Helper functions for creating and adding items to an object at the same time.
- * They return the added item or NULL on failure. */
-CJSON_PUBLIC(cJSON*) cJSON_AddNullToObject(cJSON * const object, const char * const name);
-CJSON_PUBLIC(cJSON*) cJSON_AddTrueToObject(cJSON * const object, const char * const name);
-CJSON_PUBLIC(cJSON*) cJSON_AddFalseToObject(cJSON * const object, const char * const name);
-CJSON_PUBLIC(cJSON*) cJSON_AddBoolToObject(cJSON * const object, const char * const name, const cJSON_bool boolean);
-CJSON_PUBLIC(cJSON*) cJSON_AddNumberToObject(cJSON * const object, const char * const name, const double number);
-CJSON_PUBLIC(cJSON*) cJSON_AddStringToObject(cJSON * const object, const char * const name, const char * const string);
-CJSON_PUBLIC(cJSON*) cJSON_AddRawToObject(cJSON * const object, const char * const name, const char * const raw);
-CJSON_PUBLIC(cJSON*) cJSON_AddObjectToObject(cJSON * const object, const char * const name);
-CJSON_PUBLIC(cJSON*) cJSON_AddArrayToObject(cJSON * const object, const char * const name);
-
-/* When assigning an integer value, it needs to be propagated to valuedouble too. */
-#define cJSON_SetIntValue(object, number) ((object) ? (object)->valueint = (object)->valuedouble = (number) : (number))
-/* helper for the cJSON_SetNumberValue macro */
-CJSON_PUBLIC(double) cJSON_SetNumberHelper(cJSON *object, double number);
-#define cJSON_SetNumberValue(object, number) ((object != NULL) ? cJSON_SetNumberHelper(object, (double)number) : (number))
-/* Change the valuestring of a cJSON_String object, only takes effect when type of object is cJSON_String */
-CJSON_PUBLIC(char*) cJSON_SetValuestring(cJSON *object, const char *valuestring);
-
-/* Macro for iterating over an array or object */
-#define cJSON_ArrayForEach(element, array) for(element = (array != NULL) ? (array)->child : NULL; element != NULL; element = element->next)
-
-/* malloc/free objects using the malloc/free functions that have been set with cJSON_InitHooks */
-CJSON_PUBLIC(void *) cJSON_malloc(size_t size);
-CJSON_PUBLIC(void) cJSON_free(void *object);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif

binutils/po/aa_enabled.pot

@@ -1,73 +0,0 @@
-# Translations for aa_enabled
-# Copyright (C) 2024 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2020.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2024-08-31 15:59-0700\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_enabled.c:21
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -x | --exclusive    Shared interfaces must be available\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-
-#: ../aa_enabled.c:37
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr ""
-
-#: ../aa_enabled.c:41
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr ""
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr ""
-
-#: ../aa_enabled.c:50
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-
-#: ../aa_enabled.c:54
-#, c-format
-msgid "Partially - public shared interfaces are not available.\n"
-msgstr ""
-
-#: ../aa_enabled.c:58
-#, c-format
-msgid "Error - %s\n"
-msgstr ""
-
-#: ../aa_enabled.c:73
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr ""
-
-#: ../aa_enabled.c:87
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr ""
-
-#: ../aa_enabled.c:98
-#, c-format
-msgid "Yes\n"
-msgstr ""

binutils/po/aa_exec.pot

@@ -1,55 +0,0 @@
-# Translations for aa_exec
-# Copyright (C) 2024 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2020.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2024-08-31 15:59-0700\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_exec.c:50
-#, c-format
-msgid ""
-"USAGE: %s [OPTIONS] <prog> <args>\n"
-"\n"
-"Confine <prog> with the specified PROFILE.\n"
-"\n"
-"OPTIONS:\n"
-"  -p PROFILE, --profile=PROFILE\t\tPROFILE to confine <prog> with\n"
-"  -n NAMESPACE, --namespace=NAMESPACE\tNAMESPACE to confine <prog> in\n"
-"  -d, --debug\t\t\t\tshow messages with debugging information\n"
-"  -i, --immediate\t\t\tchange profile immediately instead of at exec\n"
-"  -v, --verbose\t\t\t\tshow messages with stats\n"
-"  -h, --help\t\t\t\tdisplay this help\n"
-"\n"
-msgstr ""
-
-#: ../aa_exec.c:65
-#, c-format
-msgid "[%ld] aa-exec: ERROR: "
-msgstr ""
-
-#: ../aa_exec.c:76
-#, c-format
-msgid "[%ld] aa-exec: DEBUG: "
-msgstr ""
-
-#: ../aa_exec.c:89
-#, c-format
-msgid "[%ld] "
-msgstr ""
-
-#: ../aa_exec.c:107
-#, c-format
-msgid "[%ld] exec"
-msgstr ""

binutils/po/aa_features_abi.pot

@@ -1,51 +0,0 @@
-# Translations for aa_features_abi
-# Copyright (C) 2024 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2011.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2024-08-31 15:59-0700\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_features_abi.c:53
-#, c-format
-msgid ""
-"USAGE: %s [OPTIONS] <SOURCE> [OUTPUT OPTIONS]\n"
-"\n"
-"Output AppArmor feature abi from SOURCE to OUTPUT\n"
-"OPTIONS:\n"
-"  -d, --debug      show messages with debugging information\n"
-"  -v, --verbose    show messages with stats\n"
-"  -h, --help       display this help\n"
-"SOURCE:\n"
-"  -f F, --file=F   load features abi from file F\n"
-"  -x, --extract    extract features abi from the kernel\n"
-"OUTPUT OPTIONS:\n"
-"  --stdout         default, write features to stdout\n"
-"  -w F, --write=F  write features abi to the file F instead of stdout\n"
-"\n"
-msgstr ""
-
-#: ../aa_features_abi.c:73
-#, c-format
-msgid "%s: ERROR: "
-msgstr ""
-
-#: ../aa_features_abi.c:85
-#, c-format
-msgid "%s: DEBUG: "
-msgstr ""
-
-#: ../aa_features_abi.c:98
-msgid "\n"
-msgstr ""

binutils/po/aa_load.pot

@@ -1,34 +0,0 @@
-# Translations for aa_load
-# Copyright (C) 2024 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2020.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2024-08-31 15:59-0700\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_load.c:40
-msgid "aa-load: WARN: "
-msgstr ""
-
-#: ../aa_load.c:41
-msgid "aa-load: ERROR: "
-msgstr ""
-
-#: ../aa_load.c:51
-msgid "\n"
-msgstr ""
-
-#: ../aa_load.c:52
-msgid "aa-load: DEBUG: "
-msgstr ""

binutils/po/aa_status.pot

@@ -1,165 +0,0 @@
-# Translations for aa_status
-# Copyright (C) 2024 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2024.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2024-08-31 17:49-0700\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_status.c:161
-msgid "apparmor not present.\n"
-msgstr ""
-
-#: ../aa_status.c:164
-msgid "apparmor module is loaded.\n"
-msgstr ""
-
-#: ../aa_status.c:168
-msgid "apparmor filesystem is not mounted.\n"
-msgstr ""
-
-#: ../aa_status.c:181
-msgid "You do not have enough privilege to read the profile set.\n"
-msgstr ""
-
-#: ../aa_status.c:183
-#, c-format
-msgid "Could not open %s: %s"
-msgstr ""
-
-#: ../aa_status.c:356 ../aa_status.c:379
-msgid "ERROR: Failed to allocate memory\n"
-msgstr ""
-
-#: ../aa_status.c:587 ../aa_status.c:653
-#, c-format
-msgid "Error: failed to compile sub filter '%s'\n"
-msgstr ""
-
-#: ../aa_status.c:715
-#, c-format
-msgid ""
-"Usage: %s [OPTIONS]\n"
-"Legacy options and their equivalent command\n"
-"  --profiled             --count --profiles\n"
-"  --enforced             --count --profiles --mode=enforced\n"
-"  --complaining          --count --profiles --mode=complain\n"
-"  --kill                 --count --profiles --mode=kill\n"
-"  --prompt               --count --profiles --mode=prompt\n"
-"  --special-unconfined   --count --profiles --mode=unconfined\n"
-"  --process-mixed        --count --ps --mode=mixed\n"
-msgstr ""
-
-#: ../aa_status.c:734
-#, c-format
-msgid ""
-"Usage of filters\n"
-"Filters are used to reduce the output of information to only\n"
-"those entries that will match the filter. Filters use posix\n"
-"regular expression syntax. The possible values for exes that\n"
-"support filters are below\n"
-"\n"
-"  --filter.mode: regular expression to match the profile "
-"mode                 modes: enforce, complain, kill, unconfined, mixed\n"
-"  --filter.profiles: regular expression to match displayed profile names\n"
-"  --filter.pid:  regular expression to match displayed processes pids\n"
-"  --filter.exe:  regular expression to match executable\n"
-msgstr ""
-
-#: ../aa_status.c:762
-#, c-format
-msgid ""
-"Usage: %s [OPTIONS]\n"
-"Displays various information about the currently loaded AppArmor policy.\n"
-"Default if no options given\n"
-"  --show=all\n"
-"\n"
-"OPTIONS (one only):\n"
-"  --enabled       returns error code if AppArmor not enabled\n"
-"  --show=X        What information to show. {profiles,processes,all}\n"
-"  --count         print the number of entries. Implies --quiet\n"
-"  --filter.mode=filter      see filters\n"
-"  --filter.profiles=filter  see filters\n"
-"  --filter.pid=filter       see filters\n"
-"  --filter.exe=filter       see filters\n"
-"  --json          displays multiple data points in machine-readable JSON "
-"format\n"
-"  --pretty-json   same data as --json, formatted for human consumption as "
-"well\n"
-"  --verbose       (default) displays data points about loaded policy set\n"
-"  --quiet         don't output error messages\n"
-"  -h[(legacy|filters)]      this message, or info on the specified option\n"
-"  --help[=(legacy|filters)] this message, or info on the specified option\n"
-msgstr ""
-
-#: ../aa_status.c:856
-#, c-format
-msgid "Error: Invalid --help option '%s'.\n"
-msgstr ""
-
-#: ../aa_status.c:924
-#, c-format
-msgid "Error: Invalid --show option '%s'.\n"
-msgstr ""
-
-#: ../aa_status.c:946
-msgid "Error: Invalid command.\n"
-msgstr ""
-
-#: ../aa_status.c:971
-msgid "Error: Unknown options.\n"
-msgstr ""
-
-#: ../aa_status.c:983
-#, c-format
-msgid "Error: failed to compile mode filter '%s'\n"
-msgstr ""
-
-#: ../aa_status.c:988
-#, c-format
-msgid "Error: failed to compile profiles filter '%s'\n"
-msgstr ""
-
-#: ../aa_status.c:994
-#, c-format
-msgid "Error: failed to compile ps filter '%s'\n"
-msgstr ""
-
-#: ../aa_status.c:1000
-#, c-format
-msgid "Error: failed to compile exe filter '%s'\n"
-msgstr ""
-
-#: ../aa_status.c:1015
-#, c-format
-msgid "Failed to open memstream: %m\n"
-msgstr ""
-
-#: ../aa_status.c:1026
-#, c-format
-msgid "Failed to get profiles: %d....\n"
-msgstr ""
-
-#: ../aa_status.c:1050
-#, c-format
-msgid "Failed to get processes: %d....\n"
-msgstr ""
-
-#: ../aa_status.c:1076
-msgid "Failed to parse json output"
-msgstr ""
-
-#: ../aa_status.c:1083
-msgid "Failed to print pretty json"
-msgstr ""

binutils/po/af.po

@@ -1,71 +0,0 @@
-# Afrikaans translation for apparmor
-# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2020-03-04 17:55+0000\n"
-"Last-Translator: bernard stafford <Unknown>\n"
-"Language-Team: Afrikaans <af@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2020-03-05 05:40+0000\n"
-"X-Generator: Launchpad (build e0878392dc799b267dea80578fa65500a5d74155)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [opsies]\n"
-"  opsies:\n"
-"  -q | --quiet Moenie druk uit enige boodskappe\n"
-"  -h | --help Afdruk hulp\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "onbekende of onversoenbare opsies\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "onbekende opsie '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Ja\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "Geen - nie beskikbaar op hierdie stelsel.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "Nee - gestremde by stewel.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Miskien - beleid koppelvlak nie beskikbaar.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr "Miskien - onvoldoende toestemmings om beskikbaarheid te bepaal.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Fout - '%s'\n"

binutils/po/de.po

@@ -8,14 +8,14 @@ msgstr ""
 "Project-Id-Version: apparmor\n"
 "Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
 "POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2018-02-09 23:55+0000\n"
-"Last-Translator: Tobias Bannert <tobannert@gmail.com>\n"
+"PO-Revision-Date: 2017-12-21 12:20+0000\n"
+"Last-Translator: Christian Boltz <Unknown>\n"
 "Language-Team: German <de@li.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
+"X-Launchpad-Export-Date: 2017-12-22 05:12+0000\n"
+"X-Generator: Launchpad (build 18521)\n"
 "Language: de\n"
 
 #: ../aa_enabled.c:26
@@ -59,15 +59,15 @@ msgstr "Nein – beim Start deaktiviert.\n"
 #: ../aa_enabled.c:77
 #, c-format
 msgid "Maybe - policy interface not available.\n"
-msgstr "Vielleicht – Richtlinienschnittstelle nicht verfügbar.\n"
+msgstr ""
 
 #: ../aa_enabled.c:81
 #, c-format
 msgid "Maybe - insufficient permissions to determine availability.\n"
 msgstr ""
-"Vielleicht – ungenügende Berechtigungen, um die Verfügbarkeit zu prüfen\n"
+"Vielleicht - ungenügende Berechtigungen, um die Verfügbarkeit zu prüfen\n"
 
 #: ../aa_enabled.c:84
 #, c-format
 msgid "Error - '%s'\n"
-msgstr "Fehler – »%s«\n"
+msgstr "Fehler - »%s«\n"

binutils/po/en_GB.po

@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
+"X-Launchpad-Export-Date: 2016-06-01 05:15+0000\n"
+"X-Generator: Launchpad (build 18053)\n"
 "Language: en_GB\n"
 
 #: ../aa_enabled.c:26

binutils/po/es.po

@@ -1,71 +0,0 @@
-# Spanish translation for apparmor
-# Copyright (c) 2019 Rosetta Contributors and Canonical Ltd 2019
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2019.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2019-06-09 14:01+0000\n"
-"Last-Translator: Adolfo Jayme <fitoschido@gmail.com>\n"
-"Language-Team: Spanish <es@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-06-10 04:32+0000\n"
-"X-Generator: Launchpad (build 18978)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [opciones]\n"
-"  opciones:\n"
-"  -q | --quiet        No emitir ningún mensaje\n"
-"  -h | --help         Mostrar la ayuda\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "opciones desconocidas o incompatibles\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "se desconoce la opción «%s»\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Sí\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "No; no disponible en este sistema.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "No; desactivado durante el arranque.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Quizá; interfaz de directiva no disponible.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr "Quizá; permisos insuficientes para determinar disponibilidad.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Error: «%s»\n"

binutils/po/fa.po

@@ -1,67 +0,0 @@
-# Persian translation for apparmor
-# Copyright (c) 2019 Rosetta Contributors and Canonical Ltd 2019
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2019.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2019-12-27 08:16+0000\n"
-"Last-Translator: VahidNameni <Unknown>\n"
-"Language-Team: Persian <fa@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-12-28 05:38+0000\n"
-"X-Generator: Launchpad (build bceb5ef013b87ef7aafe0755545ceb689ca7ac60)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "تنظیم نامعلوم یا ناسازگار\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "تنظیم  '%s' ناشناخته است\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "بله\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "خیر- در این سیستم موجود نیست.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "خیر - غیرفعال در زمان boot.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "شاید - رابط سیاست گذاری در دسترس نیست.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr "شاید - دسترسی ناکافی جهت شناسایی در دسترس پذیری.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "خطا - '%s'\n"

binutils/po/fi.po

@@ -1,67 +0,0 @@
-# Finnish translation for apparmor
-# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2020-01-29 07:44+0000\n"
-"Last-Translator: Jiri Grönroos <Unknown>\n"
-"Language-Team: Finnish <fi@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2020-01-30 05:40+0000\n"
-"X-Generator: Launchpad (build b8d1327fd820d6bf500589d6da587d5037c7d88e)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "tuntemattomat tai yhteensopimattomat valinnat\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "tuntematon valinta '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Kyllä\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "Ei - ei käytettävissä tässä järjestelmässä.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "Ei - poistettu käytöstä käynnistyksen yhteydessä.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr ""
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Virhe - '%s'\n"

binutils/po/id.po

@@ -14,8 +14,8 @@ msgstr ""
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
+"X-Launchpad-Export-Date: 2016-06-01 05:15+0000\n"
+"X-Generator: Launchpad (build 18053)\n"
 "Language: id\n"
 
 #: ../aa_enabled.c:26

binutils/po/pt.po

@@ -9,13 +9,13 @@ msgstr ""
 "Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
 "POT-Creation-Date: 2015-11-28 10:23-0800\n"
 "PO-Revision-Date: 2016-03-03 08:34+0000\n"
-"Last-Translator: Ivo Xavier <ivofernandes12@gmail.com>\n"
+"Last-Translator: Ivo Xavier <ivoxavier.8@gmail.com>\n"
 "Language-Team: Portuguese <pt@li.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
+"X-Launchpad-Export-Date: 2016-06-01 05:15+0000\n"
+"X-Generator: Launchpad (build 18053)\n"
 "Language: pt\n"
 
 #: ../aa_enabled.c:26

binutils/po/ro.po

@@ -1,72 +0,0 @@
-# Romanian translation for apparmor
-# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2020-02-20 21:47+0000\n"
-"Last-Translator: Daniel Slavu <Unknown>\n"
-"Language-Team: Romanian <ro@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2020-02-21 05:39+0000\n"
-"X-Generator: Launchpad (build 19413b719a8df7423ab1390528edadce9e0e4aca)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [opțiuni]\n"
-"  opțiuni:\n"
-"  -q | --calm Nu imprima niciun mesaj\n"
-"  -h | - ajutor Imprimare ajutor\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "opțiuni necunoscute sau incompatibile\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "opțiune necunoscută '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Da\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "Nu - nu este disponibil pe acest sistem.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "Nu - dezactivat la pornire.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Poate - interfața politică nu este disponibilă.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-"Poate - permisiuni insuficiente pentru a determina disponibilitatea.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Eroare - '%s'\n"

binutils/po/ru.po

@@ -9,13 +9,13 @@ msgstr ""
 "Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
 "POT-Creation-Date: 2015-11-28 10:23-0800\n"
 "PO-Revision-Date: 2016-03-29 14:46+0000\n"
-"Last-Translator: Eugene Roskin <Unknown>\n"
+"Last-Translator: Eugene Marshal <Unknown>\n"
 "Language-Team: Russian <ru@li.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
+"X-Launchpad-Export-Date: 2016-06-01 05:15+0000\n"
+"X-Generator: Launchpad (build 18053)\n"
 "Language: ru\n"
 
 #: ../aa_enabled.c:26

binutils/po/sv.po

@@ -1,72 +0,0 @@
-# Swedish translation for apparmor
-# Copyright (c) 2018 Rosetta Contributors and Canonical Ltd 2018
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2018.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2018-09-08 03:51+0000\n"
-"Last-Translator: Jonatan Nyberg <Unknown>\n"
-"Language-Team: Swedish <sv@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [options]\n"
-"  flaggor:\n"
-"  -q | --quiet        Skriv inte ut några meddelanden\n"
-"  -h | --help         Skriv ut hjälp\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "okända eller inkompatibla flaggor\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "okänd flagga '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Ja\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "Nej - inte tillgänglig på detta system.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "Nej - inaktiverad vid uppstart.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Kanske - policy gränssnitt inte tillgängliga.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-"Kanske - otillräckliga behörigheter för att bestämma tillgängligheten.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Fel - '%s'\n"

binutils/po/sw.po

@@ -1,71 +0,0 @@
-# Swahili translation for apparmor
-# Copyright (c) 2019 Rosetta Contributors and Canonical Ltd 2019
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2019.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2019-11-14 12:33+0000\n"
-"Last-Translator: Swahilinux Administration <admin@swahilinux.org>\n"
-"Language-Team: Swahili <sw@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-11-15 04:30+0000\n"
-"X-Generator: Launchpad (build c597c3229eb023b1e626162d5947141bf7befb13)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [chaguzi]\n"
-"  chaguzi:\n"
-"  -q | --quiet Usichapishe jumbe yoyote\n"
-"  -h | --help Chapisha msaada\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "chaguo lisilojulikana au lisilofaa\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "chaguo lisilojulikana '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Ndio\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "La - haipo kwenye mfumo huu.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "La - ilizimwa kwenye washi.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Labda - kiolesura cha faragha hakipo.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr "Labda - hamna ruhusa ya kutosha ili kuamua kama ipo.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Dosari - '%s'\n"

binutils/po/tr.po

@@ -1,72 +0,0 @@
-# Turkish translation for apparmor
-# Copyright (c) 2018 Rosetta Contributors and Canonical Ltd 2018
-# This file is distributed under the same license as the apparmor package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2018.
-#
-msgid ""
-msgstr ""
-"Project-Id-Version: apparmor\n"
-"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: 2018-05-19 23:10+0000\n"
-"Last-Translator: Kudret EMRE <kudretemre@hotmail.com>\n"
-"Language-Team: Turkish <tr@li.org>\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
-"X-Generator: Launchpad (build 18928)\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-"%s: [seçenekler]\n"
-"  seçenekler:\n"
-"  -q | --quiet        Hiçbir mesajı gösterme\n"
-"  -h | --help         Yardımı görüntüler\n"
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr "bilinmeyen veya uyumsuz seçenekler\n"
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr "bilinmeyen seçenek '%s'\n"
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr "Evet\n"
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr "Hayır - Bu sistemde kullanılabilir değil.\n"
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr "Hayır - önyüklemede devredışı bırakıldı.\n"
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr "Belki - policy arayüzü kullanılabilir değil.\n"
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-"Belki - kullanılabilir olup olmadığını denetlemek için yetersiz yetki.\n"
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr "Hata - '%s'\n"

changehat/mod_apparmor/Makefile

@@ -70,8 +70,6 @@ libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
   LDLIBS = -lapparmor
 endif
 
-APXS_CFLAGS="-Wc,$(EXTRA_WARNINGS)"
-
 .PHONY: libapparmor_check
 .SILENT: libapparmor_check
 libapparmor_check: ; $(ERROR_MESSAGE)
@@ -82,7 +80,7 @@ all: libapparmor_check $(TARGET) docs
 docs: ${MANPAGES} ${HTMLMANPAGES}
 
 %.so: %.c
-	${APXS} ${LIBAPPARMOR_FLAGS} ${APXS_CFLAGS} -c $< ${LDLIBS}
+	${APXS} ${LIBAPPARMOR_FLAGS} -c $< ${LDLIBS}
 	mv .libs/$@ .
 
 .PHONY: install

changehat/mod_apparmor/mod_apparmor.c

@@ -30,10 +30,6 @@
 
 /* #define DEBUG */
 
-#ifndef unused_
-#define unused_ __attribute__ ((unused))
-#endif
-
 /* should the following be configurable? */
 #define DEFAULT_HAT "HANDLING_UNTRUSTED_INPUT"
 #define DEFAULT_URI_HAT "DEFAULT_URI"
@@ -69,7 +65,7 @@ typedef struct {
  * memory will be wiped out, and the magic_token will be lost, so apache
  * wouldn't be able to change_hat back out. */
 static int
-aa_init(apr_pool_t *p, unused_ apr_pool_t *plog, unused_ apr_pool_t *ptemp, unused_ server_rec *s)
+aa_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
 {
     apr_file_t *file;
     apr_size_t size = sizeof(magic_token);
@@ -93,7 +89,7 @@ aa_init(apr_pool_t *p, unused_ apr_pool_t *plog, unused_ apr_pool_t *ptemp, unus
  * to protect ourselves from bugs in parsing network input, but before
  * we change_hat to the uri specific hat. */
 static void
-aa_child_init(unused_ apr_pool_t *p, unused_ server_rec *s)
+aa_child_init(apr_pool_t *p, server_rec *s)
 {
     int ret;
 
@@ -264,7 +260,7 @@ aa_exit_hat(request_rec *r)
 }
 
 static const char *
-aa_cmd_ch_path(unused_ cmd_parms *cmd, unused_ void *mconfig, const char *parm1)
+aa_cmd_ch_path(cmd_parms *cmd, void *mconfig, const char *parm1)
 {
     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, "directory config change hat %s",
                  parm1 ? parm1 : "DEFAULT");
@@ -291,7 +287,7 @@ immunix_cmd_ch_path(cmd_parms *cmd, void *mconfig, const char *parm1)
 }
 
 static const char *
-aa_cmd_ch_srv(cmd_parms *cmd, unused_ void *mconfig, const char *parm1)
+aa_cmd_ch_srv(cmd_parms *cmd, void *mconfig, const char *parm1)
 {
     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, "server config change hat %s",
                             parm1 ? parm1 : "DEFAULT");
@@ -351,7 +347,7 @@ aa_merge_dir_config(apr_pool_t *p, void *parent, void *child)
 */
 
 static void *
-aa_create_srv_config(apr_pool_t *p, unused_ server_rec *srv)
+aa_create_srv_config(apr_pool_t *p, server_rec *srv)
 {
     apparmor_srv_cfg *newcfg = (apparmor_srv_cfg *) apr_pcalloc(p, sizeof(*newcfg));
 
@@ -401,7 +397,7 @@ static const command_rec mod_apparmor_cmds[] = {
 };
 
 static void
-register_hooks(unused_ apr_pool_t *p)
+register_hooks(apr_pool_t *p)
 {
     ap_hook_post_config(aa_init, NULL, NULL, APR_HOOK_MIDDLE);
     ap_hook_child_init(aa_child_init, NULL, NULL, APR_HOOK_MIDDLE);
@@ -412,7 +408,7 @@ register_hooks(unused_ apr_pool_t *p)
 
 module AP_MODULE_DECLARE_DATA apparmor_module = {
     STANDARD20_MODULE_STUFF,
-    aa_create_dir_config,        /* dir config creator */
+    aa_create_dir_config,        /* dir config creater */
     NULL,                        /* dir merger --- default is to override */
     /* immunix_merge_dir_config, */        /* dir merger --- default is to override */
     aa_create_srv_config,        /* server config */

changehat/mod_apparmor/mod_apparmor.pod

@@ -135,11 +135,11 @@ may not work correctly. For Apache 2.4 users, you should enable the mpm_prefork
 module.
 
 There are likely other bugs lurking about; if you find any, please report
-them at L<https://gitlab.com/apparmor/apparmor/-/issues>.
+them at L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 
-apparmor(7), apparmor_parser(8), aa_change_hat(2) and
+apparmor(7), subdomain.conf(5), apparmor_parser(8), aa_change_hat(2) and
 L<https://wiki.apparmor.net>.
 
 =cut

changehat/pam_apparmor/Makefile

@@ -54,7 +54,7 @@ libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
   AA_LINK_FLAGS = -L$(LIBAPPARMOR_PATH)
   AA_LDLIBS = -lapparmor
 endif
-EXTRA_CFLAGS=$(CFLAGS) $(CPPFLAGS) -fPIC -shared -Wall $(EXTRA_WARNINGS) $(LIBAPPARMOR_INCLUDE)
+EXTRA_CFLAGS=$(CFLAGS) $(CPPFLAGS) -fPIC -shared -Wall $(LIBAPPARMOR_INCLUDE)
 LINK_FLAGS=-Xlinker -x $(AA_LINK_FLAGS) $(LDFLAGS)
 LIBS=-lpam $(AA_LDLIBS)
 OBJECTS=${NAME}.o get_options.o
@@ -82,7 +82,7 @@ SECDIR ?= ${DESTDIR}/lib/security
 .PHONY: install
 install: $(NAME).so
 	install -m 755 -d $(SECDIR)
-	install -m 755 $(NAME).so $(SECDIR)/
+	install -m 555 $(NAME).so $(SECDIR)/
 	
 .PHONY: clean
 clean:

changehat/pam_apparmor/README

@@ -67,10 +67,10 @@ to syslog.
 References
 ----------
 Project webpage:
-https://apparmor.net/
+http://developer.novell.com/wiki/index.php/Novell_AppArmor
 
 To provide feedback or ask questions please contact the
-apparmor@lists.ubuntu.com mail list. This is the development list
+apparmor-dev@forge.novell.com mail list. This is the development list
 for the AppArmor team.
 
 See also: change_hat(3), and the Linux-PAM online documentation at

changehat/pam_apparmor/pam_apparmor.c

@@ -45,10 +45,6 @@
 
 int debug_flag = 0;
 
-#ifndef unused_
-#define unused_ __attribute__ ((unused))
-#endif
-
 static struct config default_config = {
 	.hat_type[0] = eGroupname,
 	.hat_type[1] = eDefault,
@@ -58,14 +54,14 @@ static struct config default_config = {
 /* --- session management functions (only) --- */
 
 PAM_EXTERN int
-pam_sm_close_session (unused_ pam_handle_t *pamh, unused_ int flags,
-		      unused_ int argc, unused_ const char **argv)
+pam_sm_close_session (pam_handle_t *pamh, int flags,
+		      int argc, const char **argv)
 {
 	return PAM_IGNORE;
 }
 
 PAM_EXTERN
-int pam_sm_open_session(pam_handle_t *pamh, unused_ int flags,
+int pam_sm_open_session(pam_handle_t *pamh, int flags,
 			int argc, const char **argv)
 {
 	int fd, retval, pam_retval = PAM_SUCCESS;

changehat/tomcat_apparmor/tomcat_5_0/README.tomcat_apparmor

@@ -66,8 +66,8 @@ under src/jni_src.
   cp dist/libJNIChangeHat.so /usr/lib
 
   [Note: you must ensure that the target directory is passed to tomcat via the
-   java.library.path property. This can be accomplished by setting the JAVA_OPTS
-   environment variable, export JAVA_OPTS=-Djava.library.path, or set via the
+   java.library.path propert. This can be accomplished by setting the JAVA_OPTS
+   enviroment variable, export JAVA_OPTS=-Djava.library.path, or set via the 
    env variable LD_LIBRARY_PATH to include this directory so that tomcat can 
    find this library at startup]
 
@@ -108,13 +108,13 @@ under src/jni_src.
 Once the installation steps above have been started you are ready to begin 
 creating a profile for your application. The profile creation tool genprof will
 guide you through generating a profile and its support for change_hat will 
-prompt you create discrete hats as requested by the changeHatValve during
+prompt you create discrete hats as requested byt the changeHatValve during 
 tomcat execution.
 
   1. Create a basic profile for the tomcat server.
 
      - Run the command "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then stop tomcat
+     - In a seperate window start tomcat and then stop tomcat
      - In the genprof window press "S" to scan for events
      - Answer the questions about the initial profile for tomcat
 
@@ -124,7 +124,7 @@ tomcat execution.
      - Stop the tomcat server
      - Deploy your WAR file or equivalent files under the container. 
      - execute "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then exercise your web application
+     - In a seperate window start tomcat and then exercise your web application
      - In the genprof window press "S" to scan for events
        During the prompting you will be asked questions similar to:
   
@@ -180,7 +180,7 @@ all subsequent resource requests will be mediated in this hew hat (or security
 context).        
 If you choose to use the default hat: genprof will mediate all resource 
 requests in the default hat for the duration of processing this request.
-When the request processing is complete the valve will change_hat back to the
+When the request processng is complete the valve will change_hat back to the 
 parent context.
 
 
@@ -188,9 +188,10 @@ parent context.
 8. Feedback/Resources
    -----------------
 
-Project webpage:
-https://apparmor.net/
+To provide feedback or ask questions please contact the 
+apparmor-dev@forge.novell.com mail list. This is the development list for the 
+AppArmor team.
+
+
+
 
-To provide feedback or ask questions please contact the
-apparmor@lists.ubuntu.com mail list. This is the development list
-for the AppArmor team.

changehat/tomcat_apparmor/tomcat_5_5/README.tomcat_apparmor

@@ -66,8 +66,8 @@ under src/jni_src.
   cp dist/libJNIChangeHat.so /usr/lib
 
   [Note: you must ensure that the target directory is passed to tomcat via the
-   java.library.path property. This can be accomplished by setting the JAVA_OPTS
-   environment variable, export JAVA_OPTS=-Djava.library.path, or set via the
+   java.library.path propert. This can be accomplished by setting the JAVA_OPTS
+   enviroment variable, export JAVA_OPTS=-Djava.library.path, or set via the 
    env variable LD_LIBRARY_PATH to include this directory so that tomcat can 
    find this library at startup]
 
@@ -108,13 +108,13 @@ under src/jni_src.
 Once the installation steps above have been started you are ready to begin 
 creating a profile for your application. The profile creation tool genprof will
 guide you through generating a profile and its support for change_hat will 
-prompt you create discrete hats as requested by the changeHatValve during
+prompt you create discrete hats as requested byt the changeHatValve during 
 tomcat execution.
 
   1. Create a basic profile for the tomcat server.
 
      - Run the command "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then stop tomcat
+     - In a seperate window start tomcat and then stop tomcat
      - In the genprof window press "S" to scan for events
      - Answer the questions about the initial profile for tomcat
 
@@ -124,7 +124,7 @@ tomcat execution.
      - Stop the tomcat server
      - Deploy your WAR file or equivalent files under the container. 
      - execute "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then exercise your web application
+     - In a seperate window start tomcat and then exercise your web application
      - In the genprof window press "S" to scan for events
        During the prompting you will be asked questions similar to:
   
@@ -180,7 +180,7 @@ all subsequent resource requests will be mediated in this hew hat (or security
 context).        
 If you choose to use the default hat: genprof will mediate all resource 
 requests in the default hat for the duration of processing this request.
-When the request processing is complete the valve will change_hat back to the
+When the request processng is complete the valve will change_hat back to the 
 parent context.
 
 
@@ -188,9 +188,10 @@ parent context.
 8. Feedback/Resources
    -----------------
 
-Project webpage:
-https://apparmor.net/
+To provide feedback or ask questions please contact the 
+apparmor-dev@forge.novell.com mail list. This is the development list for the 
+AppArmor team.
+
+
+
 
-To provide feedback or ask questions please contact the
-apparmor@lists.ubuntu.com mail list. This is the development list
-for the AppArmor team.

common/Make.rules

@@ -35,17 +35,19 @@ VERSION=$(shell cat $(COMMONDIR)/Version)
 pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH)))))
 map = $(foreach a,$(2),$(call $(1),$(a)))
 
-AWK?=$(or $(shell command -v awk),$(error awk utility required for build but not available))
+AWK:=$(shell which awk)
+ifndef AWK
+$(error awk utility required for build but not available)
+endif
 
 define nl
 
-
 endef
 
 REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || awk '{ print $2 }' common/.stamp_rev
 
 ifndef PYTHON_VERSIONS
-PYTHON_VERSIONS = $(call map, pathsearch, python3)
+PYTHON_VERSIONS = $(call map, pathsearch, python2 python3)
 endif
 
 ifndef PYTHON
@@ -55,18 +57,6 @@ endif
 #Helper function to be used with $(call pyalldo, run_test_with_all.py)
 pyalldo=set -e; $(foreach py, $(PYTHON_VERSIONS), $(py) $(1);)
 
-# Common set of compiler warnings
-_EXTRA_WARNINGS = -Wall -Wsign-compare -Wmissing-field-initializers -Wformat -Wformat-security -Wunused-parameter -Wimplicit-fallthrough
-EXTRA_WARNINGS := $(shell for warning in ${_EXTRA_WARNINGS} ; do \
-			if ${CC} $${warning} -S -o /dev/null -xc /dev/null >/dev/null 2>&1; then \
-				echo "$${warning}"; \
-			else \
-				echo "***" >&2 ; \
-				echo "WARNING: unable to use $${warning} with ${CC}, dropping" >&2 ; \
-				echo "***" >&2 ; \
-			fi ; \
-		    done)
-
 .PHONY: version
 .SILENT: version
 version:
@@ -84,6 +74,40 @@ endif
 pod_clean:
 	-rm -f ${MANPAGES} *.[0-9].gz ${HTMLMANPAGES} pod2htm*.tmp
 
+# =====================
+# generate list of capabilities based on
+# /usr/include/linux/capabilities.h for use in multiple locations in
+# the source tree
+# =====================
+
+# emits defined capabilities in a simple list, e.g. "CAP_NAME CAP_NAME2"
+CAPABILITIES=$(shell echo "\#include <linux/capability.h>" | cpp -dM | LC_ALL=C sed -n -e '/CAP_EMPTY_SET/d' -e 's/^\#define[ \t]\+CAP_\([A-Z0-9_]\+\)[ \t]\+\([0-9xa-f]\+\)\(.*\)$$/CAP_\1/p' | LC_ALL=C sort)
+
+.PHONY: list_capabilities
+list_capabilities: /usr/include/linux/capability.h
+	@echo "$(CAPABILITIES)"
+
+# =====================
+# generate list of network protocols based on
+# sys/socket.h for use in multiple locations in
+# the source tree
+# =====================
+
+# These are the families that it doesn't make sense for apparmor
+# to mediate. We use PF_ here since that is what is required in
+# bits/socket.h, but we will rewrite these as AF_.
+
+FILTER_FAMILIES=PF_UNIX
+
+__FILTER=$(shell echo $(strip $(FILTER_FAMILIES)) | sed -e 's/ /\\\|/g')
+
+# emits the AF names in a "AF_NAME NUMBER," pattern
+AF_NAMES=$(shell echo "\#include <sys/socket.h>" | cpp -dM | LC_ALL=C sed -n -e '/$(__FILTER)/d' -e 's/PF_LOCAL/PF_UNIX/' -e 's/^\#define[ \t]\+PF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\).*$$/AF_\1 \2,/p' | sort -n -k2)
+
+.PHONY: list_af_names
+list_af_names:
+	@echo "$(AF_NAMES)"
+
 # =====================
 # manpages
 # =====================

common/Version

@@ -1 +1 @@
-4.1.0~beta1
+2.12.2

common/list_af_names.sh

@@ -1,19 +0,0 @@
-#!/bin/bash -e
-
-# =====================
-# generate list of network protocols based on
-# sys/socket.h for use in multiple locations in
-# the source tree
-# =====================
-
-# It doesn't make sense for AppArmor to mediate PF_UNIX, filter it out. Search
-# for "PF_" constants since that is what is required in bits/socket.h, but
-# rewrite as "AF_".
-
-echo "#include <sys/socket.h>" | \
-  cpp -dM | \
-  LC_ALL=C sed -n \
-    -e '/PF_UNIX/d' \
-    -e 's/PF_LOCAL/PF_UNIX/' \
-    -e 's/^#define[ \t]\+PF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\).*$/AF_\1 \2,/p' | \
-  sort -n -k2

common/list_capabilities.sh

@@ -1,14 +0,0 @@
-#!/bin/bash -e
-
-# =====================
-# generate list of capabilities based on
-# /usr/include/linux/capabilities.h for use in multiple locations in
-# the source tree
-# =====================
-
-echo "#include <linux/capability.h>" | \
-  cpp -dM | \
-  LC_ALL=C sed -n \
-    -e '/CAP_EMPTY_SET/d' \
-    -e 's/^\#define[ \t]\+CAP_\([A-Z0-9_]\+\)[ \t]\+\([0-9xa-f]\+\)\(.*\)$/CAP_\1/p' | \
-  LC_ALL=C sort

deprecated/rc.aaeventd.redhat

@@ -0,0 +1,137 @@
+#!/bin/sh
+# ----------------------------------------------------------------------
+#    Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
+#    NOVELL (All rights reserved)
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+# ----------------------------------------------------------------------
+# rc.apparmor by Steve Beattie
+#
+# /etc/init.d/aaeventd
+#   and its symbolic link
+# /sbin/rcaaeventd
+#
+# chkconfig: 2345 01 99
+# description: AppArmor Notification and Reporting daemon
+#
+### BEGIN INIT INFO
+# Provides: aaeventd
+# Required-Start: apparmor
+# Required-Stop:
+# Default-Start: 2 3 5
+# Default-Stop:
+# Short-Description: AppArmor Notification and Reporting
+# Description: AppArmor Notification and Reporting daemon
+### END INIT INFO
+APPARMOR_FUNCTIONS=/lib/apparmor/rc.apparmor.functions
+
+# source function library
+if [ -f /etc/init.d/functions ]; then
+        . /etc/init.d/functions
+elif [ -f /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+elif [ -f /lib/lsb/init-functions ]; then
+	. /lib/lsb/init-functions
+else
+	exit 0
+fi
+
+sd_log_success_msg() {
+	echo -n "$*"
+	success
+	echo
+}
+
+sd_log_warning_msg() {
+	echo -n "$*"
+	warning
+	echo
+}
+
+sd_log_skipped_msg() {
+	echo -n "$*"
+	warning
+	echo
+}
+
+sd_log_failure_msg() {
+	echo -n "$*"
+	failure
+	echo
+}
+
+sd_action() {
+	STRING=$1
+	shift
+	action "${STRING} " "$@"
+	return $?
+}
+
+start_aa_event() {
+	if [ -x "$AA_EV_BIN" -a "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ] ; then
+		sd_action "Starting AppArmor Event daemon" daemon --pidfile $AA_EV_PIDFILE $AA_EV_BIN -p $AA_EV_PIDFILE
+	elif [ -x "$SD_EV_BIN" -a "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ] ; then
+		sd_action "Starting AppArmor Event daemon" daemon --pidfile $SD_EV_PIDFILE $SD_EV_BIN -p $SD_EV_PIDFILE
+	fi
+}
+
+stop_aa_event() {
+	if [ -x "$AA_EV_BIN" -a -f "$AA_EV_PIDFILE" ] ; then
+		sd_action "Shutting down AppArmor Event daemon" killproc -p $AA_EV_PIDFILE -INT $AA_EV_BIN
+	fi
+	if [ -f "$SD_EV_PIDFILE" ] ; then
+		sd_action "Shutting down AppArmor Event daemon" killproc -p $SD_EV_PIDFILE -INT $SD_EV_BIN
+	fi
+}
+
+usage() {
+    echo "Usage: $0 {start|stop|restart|try-restart|reload|force-reload|status}"
+}
+
+# source apparmor function library
+if [ -f "${APPARMOR_FUNCTIONS}" ]; then
+	. ${APPARMOR_FUNCTIONS}
+else
+	sd_log_failure_msg "Unable to find AppArmor initscript functions"
+	exit 1
+fi
+
+case "$1" in
+	start)
+		start_aa_event
+		rc=$?
+		;;
+	stop)
+		stop_aa_event
+		rc=$?
+		;;
+	restart|reload|force-reload|try-restart)
+		stop_aa_event
+		start_aa_event
+		rc=$?
+		;;
+	status)
+        	echo -n "Checking for service AppArmor Event daemon:"
+		if [ "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ]; then
+			/sbin/checkproc -p $AA_EV_PIDFILE $AA_EV_BIN
+			rc_status -v
+		else
+			rc_status -u
+		fi
+		;;
+	*)
+		usage
+		exit 1
+		;;
+esac
+exit $rc

deprecated/rc.aaeventd.suse

@@ -0,0 +1,133 @@
+#!/bin/sh
+# ----------------------------------------------------------------------
+#    Copyright (c) 1999, 2000, 2001, 2002, 2003 2004, 2005, 2006, 2007
+#    NOVELL (All rights reserved)
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+# ----------------------------------------------------------------------
+# rc.apparmor by Steve Beattie
+#
+# /etc/init.d/aaeventd
+#   and its symbolic link
+# /sbin/rcaaeventd
+#
+# chkconfig: 2345 01 99
+# description: AppArmor Notification and Reporting daemon
+#
+### BEGIN INIT INFO
+# Provides: aaeventd
+# Required-Start: apparmor
+# Required-Stop: $null
+# Default-Start: 2 3 5
+# Default-Stop:
+# Short-Description: AppArmor Notification and Reporting
+# Description: AppArmor Notification and Reporting daemon
+### END INIT INFO
+APPARMOR_FUNCTIONS=/lib/apparmor/rc.apparmor.functions
+
+# source function library
+if [ -f /etc/init.d/functions ]; then
+        . /etc/init.d/functions
+elif [ -f /etc/rc.d/init.d/functions ]; then
+	. /etc/rc.d/init.d/functions
+elif [ -f /lib/lsb/init-functions ]; then
+	. /lib/lsb/init-functions
+else
+	exit 0
+fi
+
+# Ugh, SUSE doesn't implement action
+sd_action() {
+	STRING=$1
+	shift
+	"$@"
+	rc=$?
+	if [ $rc -eq 0 ] ; then
+		log_success_msg $"$STRING "
+	else
+		log_failure_msg $"$STRING "
+	fi
+	return $rc
+}
+
+sd_log_success_msg() {
+	log_success_msg $*
+}
+
+sd_log_warning_msg() {
+	log_warning_msg $*
+}
+
+sd_log_failure_msg() {
+	log_failure_msg $*
+}
+
+usage() {
+    echo "Usage: $0 {start|stop|restart|try-restart|reload|force-reload|status}"
+}
+
+start_aa_event() {
+	if [ -x "$AA_EV_BIN" -a "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ] ; then
+		sd_action "Starting AppArmor Event daemon" startproc -p $AA_EV_PIDFILE $AA_EV_BIN -p $AA_EV_PIDFILE
+	elif [ -x "$SD_EV_BIN" -a "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ] ; then
+		sd_action "Starting AppArmor Event daemon" startproc -p $SD_EV_PIDFILE $SD_EV_BIN -p $SD_EV_PIDFILE
+	fi
+}
+
+stop_aa_event() {
+	if [ -x "$AA_EV_BIN" -a -f "$AA_EV_PIDFILE" ] ; then
+		sd_action "Shutting down AppArmor Event daemon" killproc -G -p $AA_EV_PIDFILE -INT $AA_EV_BIN
+	fi
+	if [ -f "$SD_EV_PIDFILE" ] ; then
+		sd_action "Shutting down AppArmor Event daemon" killproc -G -p $SD_EV_PIDFILE -INT $SD_EV_BIN
+	fi
+}
+
+# source apparmor function library
+if [ -f "${APPARMOR_FUNCTIONS}" ]; then
+	. ${APPARMOR_FUNCTIONS}
+else
+	sd_log_failure_msg "Unable to find AppArmor initscript functions"
+	exit 1
+fi
+
+case "$1" in
+	start)
+		start_aa_event
+		rc=$?
+		;;
+	stop)
+		stop_aa_event
+		rc=$?
+		;;
+	restart|reload|force-reload|try-restart)
+		stop_aa_event
+		start_aa_event
+		rc=$?
+		;;
+	status)
+        	echo -n "Checking for service AppArmor Event daemon:"
+		if [ "${APPARMOR_ENABLE_AAEVENTD}" = "yes" ]; then
+			/sbin/checkproc -p $AA_EV_PIDFILE $AA_EV_BIN
+			rc_status -v
+		else
+			rc_status -u
+		fi
+		;;
+	*)
+		usage
+		exit 1
+		;;
+esac
+exit $rc
+

deprecated/utils/Immunix/Config.pm

@@ -0,0 +1,124 @@
+# ----------------------------------------------------------------------
+#    Copyright (c) 2006 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+package Immunix::Config;
+
+use strict;
+use warnings;
+
+use Carp;
+use Cwd qw(cwd realpath);
+use File::Basename;
+use File::Temp qw/ tempfile tempdir /;
+use Data::Dumper;
+use Locale::gettext;
+use POSIX;
+
+require Exporter;
+our @ISA    = qw(Exporter);
+our @EXPORT = qw(
+    read_config
+    write_config
+    find_first_file
+    find_first_dir
+);
+
+our $confdir = "/etc/apparmor";
+
+# config vars
+our $cfg;
+our $repo_cfg;
+
+sub read_config {
+    my $filename = shift;
+    my $config;
+
+    if (open(CONF, "$confdir/$filename")) {
+        my $which;
+        while (<CONF>) {
+            chomp;
+            # ignore comments
+            next if /^\s*#/;
+            if (m/^\[(\S+)\]/) {
+                $which = $1;
+            } elsif (m/^\s*(\S+)\s*=\s*(.*)\s*$/) {
+                my ($key, $value) = ($1, $2);
+                $config->{$which}{$key} = $value;
+            }
+        }
+        close(CONF);
+    }
+
+    # LP: #692406
+    # Explicitly disable the repository until there is an alternative, since
+    # the OpenSUSE site went away
+    if ($filename eq "repository.conf") {
+        $config->{repository}{enabled} = "no";
+    }
+
+    return $config;
+}
+
+sub write_config {
+    my ($filename, $config) = @_;
+    if (open(my $CONF, ">$confdir/$filename")) {
+        for my $section (sort keys %$config) {
+            print $CONF "[$section]\n";
+
+            for my $key (sort keys %{$config->{$section}}) {
+                print $CONF "  $key = $config->{$section}{$key}\n"
+                    if ($config->{$section}{$key});
+            }
+        }
+        chmod(0600, $CONF);
+        close($CONF);
+    } else {
+        die "Can't write config file $filename: $!";
+    }
+}
+
+sub find_first_file {
+    my $list = shift;
+    return if ( not defined $list );
+    my $filename;
+    for my $f (split(/\s+/, $list)) {
+        if (-f $f) {
+            $filename = $f;
+            last;
+        }
+    }
+
+    return $filename;
+}
+
+sub find_first_dir {
+    my $list = shift;
+    return if ( not defined $list );
+    my $dirname;
+    for my $f (split(/\s+/, $list)) {
+        if (-d $f) {
+            $dirname = $f;
+            last;
+        }
+    }
+
+    return $dirname;
+}
+
+1;

deprecated/utils/Immunix/Repository.pm

@@ -0,0 +1,354 @@
+# ----------------------------------------------------------------------
+#    Copyright (c) 2008 Dominic Reynolds
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#
+# ----------------------------------------------------------------------
+
+package Immunix::Repository;
+
+use strict;
+use warnings;
+
+use Carp;
+use Cwd qw(cwd realpath);
+use Data::Dumper;
+use File::Basename;
+use File::Temp qw/ tempfile tempdir /;
+use Immunix::Config;
+use Locale::gettext;
+use POSIX;
+use RPC::XML;
+use RPC::XML::Client;
+
+
+require Exporter;
+our @ISA    = qw(Exporter);
+our @EXPORT = qw(
+    get_repo_client
+    did_result_succeed
+    get_result_error
+    user_login
+    user_register
+    upload_profile
+    fetch_profile_by_id
+    fetch_profiles_by_user
+    fetch_profiles_by_name
+    fetch_profiles_by_name_and_user
+    fetch_newer_profile
+    get_repo_config
+    set_repo_config
+);
+
+our %clients;
+our %uid2login;
+our $DEBUGGING = 0;
+our $repo_cfg;
+our $aa_cfg;
+
+sub get_repo_client ($) {
+    my $repo_url = shift;
+    unless ( $clients{$repo_url} ) {
+        $clients{$repo_url} = new RPC::XML::Client $repo_url;
+    }
+    return $clients{$repo_url};
+}
+
+sub did_result_succeed {
+    my $result = shift;
+
+    my $ref = ref $result;
+    return ($ref && $ref ne "RPC::XML::fault") ? 1 : 0;
+}
+
+sub get_result_error {
+    my $result = shift;
+
+    if (ref $result) {
+        if (ref $result eq "RPC::XML::fault") {
+            $result = $result->string;
+        } else {
+            $result = $$result;
+        }
+    }
+    return $result;
+}
+
+sub user_login ($$$) {
+    my ($repo_url,$user,$pass) = @_;
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    if ( $repo_client ) {
+        my $res = $repo_client->send_request('LoginConfirm', $user, $pass);
+        if (did_result_succeed($res)) {
+            $status = 1;
+            $detail = "";
+        } else {
+            $status = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+
+sub user_register ($$$$) {
+    my ($repo_url,$user,$pass,$email) = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my ($status,$detail);
+    if ( $repo_client ) {
+        my $res = $repo_client->send_request('Signup', $user, $pass, $email);
+        if (did_result_succeed($res)) {
+            $status = 1;
+            $detail = "";
+        } else {
+            $status  = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+sub upload_profile ($$$$$$$) {
+    my ($repo_url,$user,$pass,$distro,$pname,$profile,$changelog) = @_;
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    my $res = $repo_client->send_request( 'Create', $user, $pass, $distro,
+                                          $pname, $profile, $changelog);
+    if (did_result_succeed($res)) {
+       $detail = $res->value;
+       $status  = 1;
+    } else {
+       $detail = get_result_error($res);
+       $status  = 0;
+    }
+    return $status,$detail;
+}
+
+sub fetch_profile_by_id ($$) {
+    my ($repo_url,$id) = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my $repo_profile;
+    my ($status,$detail);
+    my $res = $repo_client->send_request('Show', $id);
+    if (did_result_succeed($res)) {
+        $status = 1;
+        $detail = $res->value();
+    } else {
+        $status  = 0;
+        $detail = get_result_error($res);
+    }
+
+    return $status, $detail;
+}
+
+
+sub fetch_profiles ($$$$) {
+    my ($repo_url,$distro,$username,$fqdn) = @_;
+    my $p_hash = {};
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    my $res =
+      $repo_client->send_request('FindProfiles', $distro, $fqdn, $username);
+    if (did_result_succeed($res)) {
+        $status = 1;
+        for my $p ( @$res ) {
+            my $p_repo = $p->{profile}->value();
+            $p_repo =~ s/flags=\(complain\)// if ( $p_repo );  #strip complain flag
+            $p->{profile}             = $p_repo;
+            $p->{user_id}             = $p->{user_id}->value();
+            $p->{id}                  = $p->{id}->value();
+            $p->{name}                = $p->{name}->value();
+            $p->{created_at}          = $p->{created_at}->value();
+            $p->{downloaded_count}    = $p->{downloaded_count}->value();
+        }
+        $detail = $res;
+    } else {
+        $status = 0;
+        $detail = get_result_error($res);
+    }
+    return $status,$detail;
+}
+
+sub fetch_profiles_by_user ($$$) {
+    my ($repo_url,$distro,$username) = @_;
+    my $p_hash = {};
+    my ($status,$detail) = fetch_profiles( $repo_url, $distro, $username, "" );
+    if ( $status ) {
+        for my $p ( @$detail ) {
+            my $p_repo = $p->{profile};
+            if ($p_repo ne "") {
+                $p->{username} = $username;
+                $p_hash->{$p->{name}} = $p;
+            }
+        }
+    } else {
+        return ($status,$detail);
+    }
+    return($status,$p_hash);
+}
+
+
+sub fetch_profiles_by_name_and_user ($$$$) {
+    my ($repo_url,$distro,$fqdbin, $username) = @_;
+    my $p_hash = {};
+    my ($status,$detail) = fetch_profiles( $repo_url, $distro, $username, $fqdbin );
+    if ( $status ) {
+        for my $p ( @$detail ) {
+            my $p_repo = $p->{profile}?$p->{profile}:"";
+            $p_hash->{$p->{name}} = $p if ($p_repo ne "");
+        }
+    } else {
+        return ($status,$detail);
+    }
+    return($status,$p_hash);
+}
+
+
+sub fetch_profiles_by_name ($$$) {
+    my ($repo_url,$distro,$fqdbin) = @_;
+    my ($status,$detail,$data);
+    $detail = {};
+    ($status,$data) = fetch_profiles( $repo_url, $distro, "", $fqdbin);
+    if ($status) {
+        my @uids;
+        for my $p (@$data) {
+            push @uids, $p->{user_id};
+        }
+        my ($status_unames,$unames) = fetch_usernames_from_uids($repo_url, @uids);
+        if ( $status_unames ) {
+            for my $p (@$data) {
+                if ( $unames->{$p->{user_id}} ) {
+                    $p->{username} = $unames->{$p->{user_id}};
+                } else {
+                    $p->{username} = "unkown-" . $p->{user_id};
+                }
+            }
+
+        } else {
+            print STDOUT "ERROR UID\n";
+        }
+        for my $p (@$data) {
+            $p->{profile_type} = "REPOSITORY";
+            $detail->{$p->{username}} = $p;
+        }
+    } else {
+        $detail = $data;
+    }
+    return $status,$detail;
+}
+
+
+sub fetch_newer_profile ($$$$$) {
+    my ($repo_url,$distro,$user,$id,$profile)  = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my $p;
+    my ($status,$detail);
+
+    if ($repo_client) {
+        my $res =
+          $repo_client->send_request('FindProfiles', $distro, $profile, $user);
+        if (did_result_succeed($res)) {
+            my @profiles;
+            my @profile_list = @{$res->value};
+            $status = 1;
+
+            if (@profile_list) {
+                if ($profile_list[0]->{id} > $id) {
+                    $p = $profile_list[0];
+                }
+            }
+            $detail = $p;
+        } else {
+            $status = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+sub fetch_usernames_from_uids ($) {
+    my ($repo_url,@searchuids) = @_;
+    my ($status,$result) = (1,{});
+    my @uids;
+
+    for my $uid ( @searchuids ) {
+        if ( $uid2login{$uid} ) {
+            $result->{$uid} = $uid2login{$uid};
+        } else {
+            push @uids, $uid;
+        }
+    }
+    if (@uids) {
+        my $repo_client = get_repo_client( $repo_url );
+	#RPC::XML will serialize the array into XML with the is_utf8 flag set
+	#which causes, HTTP:Message to fail.  Looping on the array elements
+	#stops this from happening, and since these are all numbers it
+	#will not cause problems.
+	for my $foo (@uids) {
+	    Encode::_utf8_off($foo);
+	}
+        my $res = $repo_client->send_request('LoginNamesFromUserIds', [@uids]);
+        if (did_result_succeed($res)) {
+            my @usernames = @{ $res->value };
+            for my $uid (@uids) {
+                my $username = shift @usernames;
+                $uid2login{$uid} = $username;
+                $result->{$uid} = $uid2login{$uid};
+            }
+        } else {
+            $status = 0;
+            $result = get_result_error($res);
+        }
+    }
+    return $status,$result;
+}
+
+sub get_repo_config {
+    unless ( $repo_cfg ) {
+       $repo_cfg = Immunix::Config::read_config("repository.conf");
+    }
+    unless ( $aa_cfg ) {
+       $aa_cfg = Immunix::Config::read_config("logprof.conf");
+    }
+    return {
+              "url"      => $aa_cfg->{repository}{url},
+              "distro"   => $aa_cfg->{repository}{distro},
+              "enabled"  => $repo_cfg->{repository}{enabled},
+              "upload"   => $repo_cfg->{repository}{upload},
+              "user"     => $repo_cfg->{repository}{user},
+              "password" => $repo_cfg->{repository}{pass},
+              "email"    => $repo_cfg->{repository}{email}
+            };
+}
+
+sub set_repo_config ($) {
+    my $cfg = shift;
+    my ($url,$distro,$enabled,$upload,$user,$pass);
+    unless ( $repo_cfg ) {
+       $repo_cfg = Immunix::Config::read_config("repository.conf");
+    }
+    unless ( $aa_cfg ) {
+       $aa_cfg = Immunix::Config::read_config("logprof.conf");
+    }
+    $repo_cfg->{repository}{enabled} = $cfg->{enabled} if ( $cfg->{enabled} );
+    $repo_cfg->{repository}{upload}  = $cfg->{upload}  if ( $cfg->{upload} );
+    $repo_cfg->{repository}{user}    = $cfg->{user}    if ( $cfg->{user} );
+    $repo_cfg->{repository}{pass}    = $cfg->{password}if ( $cfg->{password} );
+    $repo_cfg->{repository}{email}   = $cfg->{email}   if ( $cfg->{email} );
+    $aa_cfg->{repository}{distro}    = $cfg->{distro}  if ( $cfg->{distro} );
+    $aa_cfg->{repository}{url}       = $cfg->{url}     if ( $cfg->{url} );
+    write_config("repository.conf", $repo_cfg);
+    write_config("logprof.conf", $aa_cfg);
+}
+
+
+1;

deprecated/utils/Immunix/Severity.pm

@@ -0,0 +1,221 @@
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2005-2006 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+package Immunix::Severity;
+use strict;
+use Data::Dumper;
+
+my ($debug) = 0;
+
+sub debug {
+    print @_ if $debug;
+}
+
+sub new {
+    my $self = {};
+    $self->{DATABASENAME} = undef;
+    $self->{CAPABILITIES} = {};
+    $self->{FILES}        = {};
+    $self->{REGEXPS}      = {};
+    $self->{DEFAULT_RANK} = 10;
+    bless($self);
+    shift;
+    $self->init(@_) if @_;
+    return $self;
+}
+
+sub init ($;$) {
+    my ($self, $resource, $read, $write, $execute, $severity);
+    $self = shift;
+    $self->{DATABASENAME} = shift;
+    $self->{DEFAULT_RANK} = shift if defined $_[0];
+    open(DATABASE, $self->{DATABASENAME})
+      or die "Could not open severity db $self->{DATABASENAME}: $!\n";
+    while (<DATABASE>) {
+        chomp();
+        next if m/^\s*#/;
+        next if m/^\s*$/;
+
+        # leading whitespace is fine; maybe it shouldn't be?
+        if (/^\s*\/(\S+)\s+(\d+)\s+(\d+)\s+(\d+)\s*$/) {
+            my ($path, $read, $write, $execute) = ($1, $2, $3, $4);
+
+            if (index($path, "*") == -1) {
+
+                $self->{FILES}{$path} = {
+                    r => $read,
+                    w => $write,
+                    x => $execute
+                };
+
+            } else {
+
+                my $ptr = $self->{REGEXPS};
+                my @pieces = split(/\//, $path);
+
+                while (my $piece = shift @pieces) {
+                    if (index($piece, "*") != -1) {
+                        my $path = join("/", $piece, @pieces);
+                        my $regexp = convert_regexp($path);
+                        $ptr->{$regexp}{SD_RANK} = {
+                            r => $read,
+                            w => $write,
+                            x => $execute
+                        };
+                        last;
+                    } else {
+                        $ptr->{$piece} = {} unless exists $ptr->{$piece};
+                        $ptr = $ptr->{$piece};
+                    }
+                }
+            }
+        } elsif (m|^\s*CAP|) {
+            ($resource, $severity) = split;
+            $self->{CAPABILITIES}{$resource} = $severity;
+        } else {
+            print "unexpected database line: $_\n";
+        }
+    }
+    close(DATABASE);
+    debug Dumper($self);
+    return $self;
+}
+
+#rank:
+# handle capability
+# handle file
+#
+# handle capability
+#   if the name is in the database, return it
+#   otherwise, send a diagnostic message to stderr and return the default
+#
+# handle file
+#   initialize the current return value to 0
+#   loop over each entry in the database;
+#     find the max() value for each mode that matches and set a 'found' flag
+#   if the found flag has not been set, return the default;
+#   otherwise, return the maximum from the database
+
+sub handle_capability ($) {
+    my ($self, $resource) = @_;
+
+    my $ret = $self->{CAPABILITIES}{$resource};
+    if (!defined($ret)) {
+        return "unexpected capability rank input: $resource\n";
+    }
+    return $ret;
+}
+
+sub check_subtree {
+    my ($tree, $mode, $sev, $first, @rest) = @_;
+
+    # reassemble the remaining path from this directory level
+    my $path = join("/", $first, @rest);
+
+    # first check if we have a literal directory match to descend into
+    if ($tree->{$first}) {
+        $sev = check_subtree($tree->{$first}, $mode, $sev, @rest);
+    }
+
+    # if we didn't get a severity already, check for matching globs
+    unless ($sev) {
+
+        # check each glob at this directory level
+        for my $chunk (grep { index($_, "*") != -1 } keys %{$tree}) {
+
+            # does it match the rest of our path?
+            if ($path =~ /^$chunk$/) {
+
+                # if we've got a ranking, check if it's higher than
+                # current one, if any
+                if ($tree->{$chunk}->{SD_RANK}) {
+                    for my $m (split(//, $mode)) {
+                        if ((!defined $sev)
+                            || $tree->{$chunk}->{SD_RANK}->{$m} > $sev)
+                        {
+                            $sev = $tree->{$chunk}->{SD_RANK}->{$m};
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    return $sev;
+}
+
+sub handle_file ($$) {
+    my ($self, $resource, $mode) = @_;
+
+    # strip off the initial / from the path we're checking
+    $resource = substr($resource, 1);
+
+    # break the path into directory-level chunks
+    my @pieces = split(/\//, $resource);
+
+    my $sev;
+
+    # if there's a exact match for this path in the db, use that instead of
+    # checking the globs
+    if ($self->{FILES}{$resource}) {
+
+        # check each piece of the passed mode against the db entry
+        for my $m (split(//, $mode)) {
+            if ((!defined $sev) || $self->{FILES}{$resource}{$m} > $sev) {
+                $sev = $self->{FILES}{$resource}{$m};
+            }
+        }
+
+    } else {
+
+        # descend into the regexp tree looking for matches
+        $sev = check_subtree($self->{REGEXPS}, $mode, $sev, @pieces);
+
+    }
+
+    return (defined $sev) ? $sev : $self->{DEFAULT_RANK};
+}
+
+sub rank ($;$) {
+    my ($self, $resource, $mode) = @_;
+
+    if (substr($resource, 0, 1) eq "/") {
+        return $self->handle_file($resource, $mode);
+    } elsif (substr($resource, 0, 3) eq "CAP") {
+        return $self->handle_capability($resource);
+    } else {
+        return "unexpected rank input: $resource\n";
+    }
+}
+
+sub convert_regexp ($) {
+    my ($input) = shift;
+
+    # we need to convert subdomain regexps to perl regexps
+    my $regexp = $input;
+
+    # escape + . [ and ] characters
+    $regexp =~ s/(\+|\.|\[|\])/\\$1/g;
+
+    # convert ** globs to match anything
+    $regexp =~ s/\*\*/.SDPROF_INTERNAL_GLOB/g;
+
+    # convert * globs to match anything at current path level
+    $regexp =~ s/\*/[^\/]SDPROF_INTERNAL_GLOB/g;
+
+    # convert {foo,baz} to (foo|baz)
+    $regexp =~ y/\{\}\,/\(\)\|/ if $regexp =~ /\{.*\,.*\}/;
+
+    # twiddle the escaped * chars back
+    $regexp =~ s/SDPROF_INTERNAL_GLOB/\*/g;
+    return $regexp;
+}
+
+1;    # so the require or use succeeds

deprecated/utils/Makefile

@@ -0,0 +1,62 @@
+# ----------------------------------------------------------------------
+#    Copyright (c) 1999, 2004-2009 NOVELL (All rights reserved)
+#    Copyright (c) 2010-2011, 2014 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+# ----------------------------------------------------------------------
+
+# NOTE: this Makefile has been adjusted from the original to assist in
+# the installation of the Immunix perl modules, if they're still needed
+# by users. Because the utilities conflict with their replacments, make
+# install *will* *not* install them.
+
+NAME 		= apparmor-utils
+all:
+COMMONDIR=../../common/
+
+include $(COMMONDIR)/Make.rules
+
+MODDIR = Immunix
+PERLTOOLS = aa-genprof aa-logprof aa-autodep aa-audit aa-complain aa-enforce \
+	aa-unconfined aa-disable
+MODULES = ${MODDIR}/AppArmor.pm ${MODDIR}/Repository.pm \
+	${MODDIR}/Config.pm ${MODDIR}/Severity.pm
+
+all:
+
+# need some better way of determining this
+DESTDIR=/
+BINDIR=${DESTDIR}/usr/sbin
+CONFDIR=${DESTDIR}/etc/apparmor
+VENDOR_PERL=$(shell perl -e 'use Config; print $$Config{"vendorlib"};')
+PERLDIR=${DESTDIR}${VENDOR_PERL}/${MODDIR}
+
+.PHONY: install
+install:
+	install -d ${PERLDIR}
+	install -m 644 ${MODULES} ${PERLDIR}
+
+.PHONY: clean
+ifndef VERBOSE
+.SILENT: clean
+endif
+clean: pod_clean
+	rm -f core core.* *.o *.s *.a *~
+	rm -rf staging/ build/
+
+.PHONY: check
+.SILENT: check
+check:
+	for i in ${MODULES} ${PERLTOOLS} ; do \
+		perl -c $$i || exit 1; \
+	done

deprecated/utils/aa-audit

@@ -0,0 +1,132 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString("Please enter the program to switch to audit mode: ", ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to audit mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "audit");
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to audit mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-autodep

@@ -0,0 +1,122 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help  = '';
+my $force = undef;
+
+GetOptions(
+    'force'   => \$force,
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+my $sd_mountpoint = check_for_subdomain();
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important(sprintf(gettext('Can\'t find AppArmor profiles in %s.'), $profiledir));
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to create a profile for: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+            my $which = which($profiling);
+            if ($which) {
+                $fqdbin = get_full_path($which);
+            }
+        }
+    }
+
+    # make sure that the app they're requesting to profile is not marked as
+    # not allowed to have it's own profile
+    if ($qualifiers{$fqdbin}) {
+        unless ($qualifiers{$fqdbin} =~ /p/) {
+            UI_Info(sprintf(gettext('%s is currently marked as a program that should not have it\'s own profile.  Usually, programs are marked this way if creating a profile for them is likely to break the rest of the system.  If you know what you\'re doing and are certain you want to create a profile for this program, edit the corresponding entry in the [qualifiers] section in /etc/apparmor/logprof.conf.'), $fqdbin));
+            exit 1;
+        }
+    }
+
+    if (-e $fqdbin) {
+        if (-e getprofilefilename($fqdbin) && !$force) {
+            UI_Info(sprintf(gettext('Profile for %s already exists - skipping.'), $fqdbin));
+        } else {
+            autodep($fqdbin);
+            reload($fqdbin) if $sd_mountpoint;
+        }
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info("usage: $0 [ --force ] [ -d /path/to/profiles ]");
+    exit 0;
+}
+

deprecated/utils/aa-complain

@@ -0,0 +1,131 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to switch to complain mode: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to complain mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "complain");
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to complain mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-disable

@@ -0,0 +1,152 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005-2010 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Canonical, Inc.
+#
+#    To contact Canonical about this file by physical or electronic mail,
+#    you may find current contact information at www.canonical.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+use File::Basename;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+my $disabledir = "$profiledir/disable";
+unless (-d $disabledir) {
+    UI_Important("Can't find AppArmor disable directory '$disabledir'.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program whose profile should be disabled: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip package manager backup files
+        next if isSkippableFile($filename);
+
+        my ($bname, $dname, $suffix) = File::Basename::fileparse($filename);
+        if ($bname eq "") {
+            UI_Info(sprintf(gettext('Could not find basename for %s.'), $filename));
+            exit 1;
+        }
+
+        printf(gettext('Disabling %s.'), $fqdbin);
+        print "\n";
+
+        my $link = "$disabledir/$bname";
+        if (! -e $link) {
+            if (symlink($filename, $link) != 1) {
+                UI_Info(sprintf(gettext('Could not create %s symlink.'), $link));
+                exit 1;
+            }
+        }
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -R 2>&1 1>/dev/null);
+        if ($? != 0) {
+            UI_Info($cmd_info);
+            exit $?;
+        }
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to have profile disabled ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-enforce

@@ -0,0 +1,142 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to switch to enforce mode: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+            	    my $which = which($profiling);
+            	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	    }
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to enforce mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "");
+
+        # remove symlink in $profiledir/force-complain as well
+        my $complainlink = $filename;
+        $complainlink =~ s/^$profiledir/$profiledir\/force-complain/;
+        -e $complainlink and unlink($complainlink);
+
+        # remove symlink in $profiledir/disable as well
+        my $disablelink = $filename;
+        $disablelink =~ s/^$profiledir/$profiledir\/disable/;
+        -e $disablelink and unlink($disablelink);
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to enforce mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-eventd

@@ -0,0 +1,940 @@
+#!/usr/bin/perl -w
+
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+
+use Data::Dumper;
+use DBI;
+use Fcntl;
+use File::Temp qw(tempfile);
+use Getopt::Long;
+use POSIX 'setsid';
+use Time::Local;
+use File::Tail;
+
+use Immunix::Severity;
+require LibAppArmor;
+
+##########################################################################
+# locations
+
+my $productname = "apparmor";
+
+my $cfgdir = "/etc/$productname";
+my $dbdir  = "/var/log/$productname";
+
+my $cfgfile = "$cfgdir/notify.cfg";
+my $errlog  = "$dbdir/event-dispatch.log";
+
+my $logfile    = "/var/log/audit/audit.log";
+my $syslogfile = "/var/log/messages";
+
+##########################################################################
+
+# options variables
+my $pidfile = '';
+
+GetOptions('pidfile|p=s' => \$pidfile);
+
+my $DEBUG = 0;
+
+my $config;
+
+my $verbose = { last_notify => 0 };
+my $summary = { last_notify => 0 };
+my $terse   = { last_notify => 0 };
+
+# we don't want to call str2time on every line and also batch up event dbs
+# a month at a time, so we need to keep track of a few extra things
+my $timestamp = 0;
+my $lasttime  = "";
+my $counter   = 0;
+my $thismonth = 0;
+my $nextmonth = 0;
+
+# pop open a connection to the severity database
+my $sevdb = new Immunix::Severity("$cfgdir/severity.db", -1);
+
+my $REdate = '\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}';
+
+my $last_inserted_time;
+my $last_inserted_counter;
+
+##########################################################################
+
+# commit how often?
+my $timeout = 5;
+
+# keep track of when we commited last
+my $last_flush_time = 0;
+
+# keep track of some statistics
+my $max     = 0;
+my $inserts = 0;
+my $total   = 0;
+
+my @commit_buffer;
+my @debug_buffer;
+
+my @verbose_buffer;
+my @summary_buffer;
+my @terse_buffer;
+
+my $date_module = "None";
+
+my %templates = (
+    "path"                => "(time,counter,type,op,profile,sdmode,mode_req,mode_deny,resource,prog,pid,severity) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)",
+    "link"                => "(time,counter,type,op,profile,sdmode,resource,target,prog,pid,severity)    VALUES(?,?,?,?,?,?,?,?,?,?,?)",
+    "chattr"              => "(time,counter,type,op,profile,sdmode,resource,mode_req,mode_deny,prog,pid,severity) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)",
+    "capability"          => "(time,counter,type,op,profile,sdmode,resource,prog,pid,severity)           VALUES(?,?,?,?,?,?,?,?,?,?)",
+    "capable"             => "(time,counter,type,op,prog,pid,profile)                                    VALUES(?,?,?,?,?,?,?)",
+    "unknown_hat"         => "(time,counter,type,op,profile,sdmode,resource,pid)                         VALUES(?,?,?,?,?,?,?,?)",
+    "fork"                => "(time,counter,type,op,profile,sdmode,pid,resource)                         VALUES(?,?,?,?,?,?,?,?)",
+    "changing_profile"    => "(time,counter,type,op,profile,sdmode,pid)                                  VALUES(?,?,?,?,?,?,?)",
+    "profile_replacement" => "(time,counter,type,op,profile,sdmode,prog,pid,severity)                    VALUES(?,?,?,?,?,?,?,?,?)",
+	"net"                 => "(time,counter,type,op,net_family,net_socktype,net_proto,pid,profile)       VALUES(?,?,?,?,?,?,?,?,?)",
+    "removed"             => "(time,counter,type,op,severity)                                            VALUES(?,?,?,?,?)",
+    "initialized"         => "(time,counter,type,op,resource,severity)                                   VALUES(?,?,?,?,?,?)",
+    "ctrl_var"            => "(time,counter,type,op,resource,mode_req,mode_deny,severity)                         VALUES(?,?,?,?,?,?,?,?)",
+	"profile_load"        => "(time,counter,type,op,resource,prog,pid)                                   VALUES(?,?,?,?,?,?,?)",
+);
+
+##########################################################################
+# generic functions
+
+sub errlog ($) {
+    my $mesg = shift;
+    my $localtime = localtime(time);
+    print ERRLOG "[$localtime] $mesg\n";
+}
+
+sub readconfig () {
+    my $cfg = {};
+
+    # record when we read the config file
+    $cfg->{load_time} = time;
+
+    if (open(CFG, $cfgfile)) {
+
+        # yank in the values we need
+        while (<CFG>) {
+            $cfg->{$1} = $2 if /^(\S+)\s+(.+)\s*$/;
+        }
+        close(CFG);
+    }
+
+    return $cfg;
+}
+
+sub daemonize {
+    chdir '/' or die "Can't chdir to /: $!";
+    open STDIN,  '/dev/null'  or die "Can't read /dev/null: $!";
+    open STDOUT, '>/dev/null' or die "Can't write to /dev/null: $!";
+    defined(my $pid = fork) or die "Can't fork: $!";
+    exit if $pid;
+    setsid or die "Can't start a new session: $!";
+    open STDERR, '>&STDOUT' or die "Can't dup stdout: $!";
+}
+
+sub parsedate ($) {
+    my $time      = shift;
+    my $timestamp = 0;
+    if ($date_module eq 'TimeDate') {
+        $timestamp = Date::Parse::str2time($time);
+    } elsif ($date_module eq 'DateManip') {
+        $timestamp = Date::Manip::UnixDate(Date::Manip::ParseDateString($time), '%s');
+    } else {
+        errlog "No date module found, exiing";
+        kill HUP => -$$;
+    }
+
+    return $timestamp;
+}
+
+##########################################################################
+# database handling functions
+
+sub connect_database ($) {
+    my $dbdir = shift;
+
+    my $dbh = DBI->connect("dbi:SQLite:dbname=$dbdir/events.db", "", "", {RaiseError=>1});
+
+    # we'll do the commits ourselves so performance doesn't suck
+    $dbh->{AutoCommit} = 0;
+
+    # bump up our cache size a little
+    $dbh->do("PRAGMA cache_size = 20000;");
+
+    # figure out if the tables already exist or not
+    my %existing_tables;
+    my $sth = $dbh->prepare("SELECT name FROM sqlite_master WHERE type='table' ORDER BY name;");
+    $sth->execute;
+    while (my @row = $sth->fetchrow_array) {
+        $existing_tables{ $row[0] } = 1;
+    }
+    $sth->finish;
+
+    # create the info table and fill in the appropriate values for this db
+    unless ($existing_tables{info}) {
+
+        my $host = `hostname -f`;
+        chomp $host;
+
+        $dbh->do("CREATE TABLE info (name,value)");
+        $sth = $dbh->prepare("INSERT INTO info(name,value) VALUES(?,?)");
+        $sth->execute("version", "0.2");
+        $sth->execute("host",    "$host");
+    }
+
+	# create the events table
+    unless ($existing_tables{events}) {
+        $dbh->do(
+            "CREATE TABLE events (
+                id       INTEGER PRIMARY KEY AUTOINCREMENT,
+                time     INTEGER NOT NULL,
+                counter  INTEGER NOT NULL,
+                op,
+                pid,
+                sdmode,
+                type,
+                mode_deny,
+                mode_req,
+                resource,
+                target,
+                profile,
+                prog,
+                name_alt,
+                attr,
+                parent,
+                active_hat,
+                net_family,
+                net_proto,
+                net_socktype,
+                severity INTEGER
+             )"
+        );
+
+        # set up the indexes we want
+        #my @indexes = qw(time type sdmode mode resource profile prog severity);
+        my @indexes = qw(time type op sdmode mode_req mode_deny resource profile prog severity);
+        for my $index (@indexes) {
+            $dbh->do("CREATE INDEX " . $index . "_idx ON events($index)");
+        }
+    }
+    # make sure our changes actually get saved
+    $dbh->commit || errlog "Error commiting changes: $!";
+
+    # mark the db as up to date as of now
+    $last_flush_time = time;
+
+    return $dbh;
+}
+
+##########################################################################
+
+sub verbose_notify_handler {
+    my ($email, $file, $last, $level, $unknown) = @_;
+
+    $last = localtime($last);
+
+    my $now = time;
+
+    my $host = `hostname -f`;
+    chomp $host;
+
+    my $subj = "Verbose Security Report for $host.";
+    my $mesg = "The following security events occured since $last:\n\n";
+
+    my @events;
+    if (open(V, $file)) {
+        while (<V>) {
+            chomp;
+            if (/^(\d+) (\d+) (.+)$/) {
+                my ($timestamp, $counter, $logmsg) = ($1, $2, $3);
+                push @events, [ $timestamp, $counter ];
+                $mesg .= "$logmsg\n";
+            }
+        }
+        close(V);
+
+        if (@events) {
+            if ($DEBUG) {
+                my $count = scalar @events;
+                errlog "[$count events] sending verbose notification to $email.";
+            }
+
+            # actually send out the notification...
+            open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email");
+            print MAIL "To: $email\n";
+            print MAIL "Subject: $subj\n\n";
+            print MAIL "$mesg\n";
+            print MAIL ".\n";
+            close(MAIL);
+        }
+
+        # delete the verbose notification logfile once we've processed it
+        unlink($file);
+    }
+}
+
+sub summary_notify_handler {
+    my ($email, $file, $last, $level, $unknown) = @_;
+
+    $last = localtime($last);
+
+    my $now = time;
+
+    my $host = `hostname -f`;
+    chomp $host;
+
+    my $subj = "Summary Security Report for $host.";
+    my $mesg = "The following security events occured since $last:\n\n";
+
+    my @events;
+    if (open(V, $file)) {
+        while (<V>) {
+            chomp;
+            if (/^(\d+) (\d+) (.+)$/) {
+                my ($timestamp, $counter, $logmsg) = ($1, $2, $3);
+                push @events, [ $timestamp, $counter ];
+                $mesg .= "$logmsg\n";
+            }
+        }
+        close(V);
+
+        if (@events) {
+            if ($DEBUG) {
+                my $count = scalar @events;
+                errlog "[$count events] sending summary notification to $email.";
+            }
+
+            # actually send out the notification...
+            open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email");
+            print MAIL "To: $email\n";
+            print MAIL "Subject: $subj\n\n";
+            print MAIL "$mesg\n";
+            print MAIL ".\n";
+            close(MAIL);
+        }
+
+        # delete the verbose notification logfile once we've processed it
+        unlink($file);
+    }
+}
+
+sub terse_notify_handler {
+    my ($email, $file, $last, $level, $unknown) = @_;
+
+    $last = localtime($last);
+
+    my $now = time;
+
+    my $host = `hostname -f`;
+    chomp $host;
+
+    my @events;
+    my $count = 0;
+    if (open(V, $file)) {
+        while (<V>) {
+            chomp;
+            if (/^(\d+) (\d+) (.+)$/) {
+                my ($timestamp, $counter, $logmsg) = ($1, $2, $3);
+                push @events, [ $timestamp, $counter ];
+                $count++;
+            }
+        }
+        close(V);
+
+        if ($count) {
+            if ($DEBUG) {
+                errlog "[$count events] sending terse notification to $email.";
+            }
+            my $subj = "Security Report for $host.";
+            my $mesg = "$host has had $count security events since $last.";
+
+            # actually send out the notification...
+            open(MAIL, "| sendmail -F 'AppArmor Security Notification' $email");
+            print MAIL "To: $email\n";
+            print MAIL "Subject: $subj\n\n";
+            print MAIL "$mesg\n";
+            print MAIL ".\n";
+            close(MAIL);
+        }
+
+        # delete the terse notification logfile once we've processed it
+        unlink($file);
+    }
+}
+
+sub fork_into_background {
+    my ($name, $func, @args) = @_;
+
+    my $pid = fork;
+
+    if (not defined $pid) {
+
+        # something bad happened, just log it...
+        errlog "couldn't fork for \"$name\": $!"
+
+    } elsif ($pid == 0) {
+
+        # we're in the child process now...
+
+        # set our process name
+        $0 = $name;
+
+        # call our subroutine
+        my $ret = &$func(@args);
+
+        exit($ret);
+    }
+
+    return $pid;
+}
+
+##########################################################################
+# Parse event record into key-value pairs
+sub parseEvent($) {
+
+    my %ev = ();
+    my $msg = shift;
+	chomp($msg);
+
+    my $event = LibAppArmor::parse_record($msg);
+
+    # resource is an alternate term for 'name1' below
+    # mode is an alternate term for 'mode_deny' below
+    $ev{'time'} = LibAppArmor::aa_log_record::swig_epoch_get($event);
+    $ev{'op'} = LibAppArmor::aa_log_record::swig_operation_get($event);
+    $ev{'pid'} = LibAppArmor::aa_log_record::swig_pid_get($event);
+    $ev{'mode_deny'} = LibAppArmor::aa_log_record::swig_denied_mask_get($event);
+    $ev{'mode_req'} = LibAppArmor::aa_log_record::swig_requested_mask_get($event);
+    $ev{'profile'}= LibAppArmor::aa_log_record::swig_profile_get($event);
+    $ev{'prog'} = LibAppArmor::aa_log_record::swig_name_get($event);
+    $ev{'name2'} = LibAppArmor::aa_log_record::swig_name2_get($event);
+    $ev{'attr'} = LibAppArmor::aa_log_record::swig_attribute_get($event);
+    $ev{'parent'} = LibAppArmor::aa_log_record::swig_parent_get($event);
+    $ev{'magic_token'} = LibAppArmor::aa_log_record::swig_magic_token_get($event);
+    $ev{'resource'} = LibAppArmor::aa_log_record::swig_info_get($event);
+    $ev{'active_hat'} = LibAppArmor::aa_log_record::swig_active_hat_get($event);
+    $ev{'sdmode'} = LibAppArmor::aa_log_record::swig_event_get($event);
+
+	# NetDomain 
+	if ( $ev{'op'} && $ev{'op'} =~ /socket/ ) {
+		next if $ev{'op'} =~ /create/;
+		$ev{'net_family'} = LibAppArmor::aa_log_record::swig_net_family_get($event);
+		$ev{'net_proto'} = LibAppArmor::aa_log_record::swig_net_protocol_get($event);
+		$ev{'net_socktype'} = LibAppArmor::aa_log_record::swig_net_sock_type_get($event);
+	}
+
+    LibAppArmor::free_record($event);
+
+    if ( ! $ev{'time'} ) { $ev{'time'} = time; }
+
+    # remove null responses
+    for (keys(%ev)) {
+		if ( ! $ev{$_} || $ev{$_} !~ /\w+/) {delete($ev{$_}); }
+		#errlog "EVENT:  $_ is $ev{$_}";
+    }
+
+    if ( $ev{'sdmode'} ) {
+        #0 = invalid, 1 = error, 2 = AUDIT, 3 = ALLOW/PERMIT,
+        #4 = DENIED/REJECTED, 5 = HINT, 6 = STATUS/config change
+        if    ( $ev{'sdmode'} == 2 ) { $ev{'sdmode'} = "AUDITING"; }
+        elsif ( $ev{'sdmode'} == 3 ) { $ev{'sdmode'} = "PERMITING"; }
+        elsif ( $ev{'sdmode'} == 4 ) { $ev{'sdmode'} = "REJECTING"; }
+        else  { delete($ev{'sdmode'}); }
+    }
+
+    return \%ev;
+}
+
+sub process_event ($$) {
+
+    my $dbh    = shift;
+    my $logmsg = shift;
+    my $sth;
+    my $severity = "";
+	my @eventList = ();
+	my $type = undef;
+	my $time = undef;
+
+	return unless $logmsg && $logmsg =~ /APPARMOR/;
+	my $ev = parseEvent($logmsg);
+
+    # skip logprof hints
+    if ( ! $ev->{'op'} || $ev->{'op'} eq 'clone') { return; }
+
+	$time = time;		# XXX - do we want current time or $ev->{'time'}?
+
+    if ($time ne $lasttime) {
+        $counter   = 0;
+        $timestamp = $time;
+        $lasttime  = $time;
+    }
+
+    $counter++;
+
+    # some statistics...
+    $max = $counter if $counter > $max;
+
+    # if we already have events in the db, make sure we don't try to re-enter
+    # duplicates if we start up again and parse the same logfile over again
+    if ($last_inserted_time) {
+        return if $timestamp < $last_inserted_time;
+
+        if ($timestamp == $last_inserted_time) {
+            return if $counter <= $last_inserted_counter;
+        }
+
+        $last_inserted_time = undef;
+    }
+
+    if ( $ev->{'sdmode'} && $ev->{'sdmode'} eq "REJECTING") {
+        $severity = $sevdb->rank($ev->{'prog'}, $ev->{'mode_req'});
+		if ( ! $severity ) { $severity = "-1"; }
+
+        # we only do notification for enforce mode events
+        if ($config->{verbose_freq}) {
+            if (   ($severity >= $config->{verbose_level})
+                || (($severity == -1) && $config->{verbose_unknown}))
+            {
+                push @verbose_buffer, [ $timestamp, $counter, $logmsg ];
+            }
+        }
+
+        if ($config->{summary_freq}) {
+            if (   ($severity >= $config->{summary_level})
+                || (($severity == -1) && $config->{summary_unknown}))
+            {
+                push @summary_buffer, [ $timestamp, $counter, "path",
+					$ev->{'prog'}, $ev->{'mode_req'}, $ev->{'resource'} ];
+            }
+        }
+
+        if ($config->{terse_freq}) {
+            if (   ($severity >= $config->{terse_level})
+                || (($severity == -1) && $config->{terse_unknown}))
+            {
+                push @terse_buffer, [ $timestamp, $counter, "dummy" ];
+            }
+        }
+
+    }
+
+	unless ( $ev->{'op'} ) {
+		my $errmsg = "ERROR: No operation found: ";
+		for my $k (sort keys(%$ev)) {
+			$errmsg .= "$k is $ev->{$k}, ";
+		}
+		errlog("$errmsg\n");
+		return;
+	}
+
+    # Format the message to match the db template 
+    if ($ev->{'op'} eq 'link' ) {
+		$type = 'link';
+        push(@eventList, [$time,$counter,$type,$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'resource'},$ev->{'target'},$ev->{'prog'},$ev->{'pid'},$severity]); 
+    } elsif ($ev->{'op'} eq 'attribute') {
+		$type = 'chattr';
+        push(@eventList, []);
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'resource'},$ev->{'mode_req'},$ev->{'mode_deny'},$ev->{'prog'},
+			$ev->{'pid'},$severity]); 
+    } elsif ($ev->{'op'} eq 'capability') {
+		$type = 'capability';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'resource'},$ev->{'prog'},$ev->{'pid'},$severity]); 
+    } elsif ($ev->{'op'} eq 'capable') {
+		$type = 'capable';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'prog'},
+			$ev->{'profile'},$ev->{'pid'}]); 
+    } elsif ($ev->{'op'} =~ /ontrol variable/ ) {
+        $type = 'ctrl_var';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'resource'},
+			$ev->{'mode_req'},$ev->{'mode_deny'},$severity]); 
+	} elsif ($ev->{'op'} eq 'unknown_hat') {
+		$type = 'unknown_hat';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'resource'},$ev->{'pid'},$severity]); 
+	} elsif ($ev->{'op'} eq 'fork') {
+		$type = 'fork';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'pid'},$ev->{'resource'}]); 
+	} elsif ($ev->{'op'} eq 'changing_profile') {
+		$type = 'changing_profile';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'pid'}]); 
+	} elsif ($ev->{'op'} eq 'profile_load') {
+		$type = 'profile_load';
+		push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'resource'},
+			$ev->{'prog'},$ev->{'pid'}]);
+	} elsif ($ev->{'op'} eq 'profile_replace') {
+		$type = 'profile_replacement';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},$ev->{'sdmode'},
+			$ev->{'prog'},$ev->{'pid'},$severity]); 
+	} elsif ($ev->{'op'} eq 'removed') {
+	    $type = 'removed';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$severity]); 
+	} elsif ($ev->{'op'} eq 'initialized') {
+		$type = 'initialized';
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'resource'},$severity]); 
+	} elsif ( $ev->{'op'} =~ /socket/) {
+		$type = 'net';
+		push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'net_family'},
+			$ev->{'net_sock_type'},$ev->{'net_proto'},$ev->{'pid'},$ev->{'profile'}]);
+    } else {
+        $type = 'path';
+		if ( ! $ev->{'prog'} ) { $ev->{'prog'} = "NIL"; }
+        push(@eventList, [$time,$counter,$type,$ev->{'op'},$ev->{'profile'},
+			$ev->{'sdmode'},$ev->{'mode_req'},$ev->{'mode_deny'},$ev->{'resource'},
+			$ev->{'prog'},$ev->{'pid'},$severity]); 
+    }
+
+    push(@commit_buffer, @eventList);
+    $inserts++;
+
+}
+
+sub dump_events {
+    my ($which, @events) = @_;
+
+    if ($DEBUG) {
+        my $count = scalar @events;
+        errlog "dumping $count events to $which db.";
+    }
+
+    if (open(F, ">>$dbdir/$which.db")) {
+        for my $event (@events) {
+            my @event = @$event;
+            print F "@event\n";
+        }
+        close(F);
+    } else {
+        errlog "can't write to $dbdir/$which.db: $!";
+    }
+}
+
+sub check_timers ($) {
+    my $dbh = shift;
+
+    # what time is it right... NOW
+    my $now = time;
+
+    # make sure we commit periodically
+    if (($inserts > 10000) || ($now >= ($last_flush_time + $timeout))) {
+
+        my $last_prepare = "";
+        my $sth;
+
+        for my $event (sort { $a->[0] cmp $b->[0] } @commit_buffer) {
+            my @event = @{$event};
+
+            #my $type  = shift @event;
+            my $type  = $event[2];
+
+		    eval {
+		        if ($type ne $last_prepare) {
+		            $sth          = $dbh->prepare("INSERT INTO events $templates{$type}");
+		            $last_prepare = $type;
+		        }
+
+		        $sth->execute(@event);
+		    };
+
+		    if ($@) {
+		        print ERRLOG "DBI Execution failed: $DBI::errstr\n";
+		    }
+
+            #$sth->execute(@event);
+        }
+
+        $dbh->commit || errlog "Error commiting changes: $!";
+
+        # need to get the time again to include how much time it takes to
+        # actually write all this crap to the db
+        $now = time;
+
+        if ($DEBUG && $inserts) {
+            $total += $inserts;
+            my $delta = $now - $last_flush_time;
+            my $rate  = int($inserts / $delta);
+            errlog "$rate/s  $inserts in ${delta}s  total=$total  max=$max";
+        }
+
+        $last_flush_time = $now;
+
+        @commit_buffer = ();
+
+        $max     = 0;
+        $inserts = 0;
+
+        if (@verbose_buffer) {
+
+            # if we've got verbose events, dump them
+            dump_events("verbose", @verbose_buffer);
+
+            # and clear out our buffer
+            @verbose_buffer = ();
+        }
+
+        if (@terse_buffer) {
+
+            # if we've got terse events, dump them
+            dump_events("terse", @terse_buffer);
+
+            # and clear out our buffer
+            @terse_buffer = ();
+        }
+
+        # bail out if we don't have notification configured
+        return unless -f $cfgfile;
+
+        # what time did we last read the config file?
+        my $load_time = $config->{load_time};
+
+        # check when the config file was last modified...
+        my $mtime = (stat($cfgfile))[9];
+
+        # if it's been changed since we last read the config file, we need to
+        # load the new settings
+        if ($load_time < $mtime) {
+            errlog "Reloading changed config file.";
+            $config = readconfig();
+        }
+
+    }
+
+    # bail out if we don't have notification configured
+    return unless -f $cfgfile;
+
+    if ($config->{terse_freq}) {
+        if (($terse->{last_notify} + $config->{terse_freq}) <= $now) {
+            if (-f "$dbdir/terse.db") {
+                $DEBUG && errlog "doing terse notification...";
+
+                # get a temporary filename...
+                my ($fh, $filename) = tempfile("terseXXXXXX", DIR => $dbdir);
+
+                # overwrite the temp file we just created...
+                rename("$dbdir/terse.db", $filename);
+
+                if ($DEBUG) {
+                    errlog "terse file is $filename";
+                }
+
+                # do the actual notification in the background
+                fork_into_background("terse-notification",
+                                     \&terse_notify_handler,
+                                     $config->{terse_email},
+                                     $filename,
+                                     $terse->{last_notify},
+                                     $config->{terse_level},
+                                     $config->{terse_unknown});
+
+                # ...keep track of when we last sent out a notify
+                $terse->{last_notify} = $now;
+            }
+        }
+    }
+
+    if ($config->{summary_freq}) {
+        if (($summary->{last_notify} + $config->{summary_freq}) <= $now) {
+            if (-f "$dbdir/summary.db") {
+                $DEBUG && errlog "doing summary notification...";
+
+                # get a temporary filename...
+                my ($fh, $filename) = tempfile("summaryXXXXXX", DIR => $dbdir);
+
+                # overwrite the temp file we just created...
+                rename("$dbdir/summary.db", $filename);
+
+                # do the actual notification in the background
+                fork_into_background("summary-notification",
+                                     \&summary_notify_handler,
+                                     $config->{summary_email},
+                                     $filename,
+                                     $summary->{last_notify},
+                                     $config->{summary_level},
+                                     $config->{summary_unknown});
+
+                # ...keep track of when we last sent out a notify
+                $summary->{last_notify} = $now;
+            }
+        }
+    }
+
+    if ($config->{verbose_freq}) {
+        if (($verbose->{last_notify} + $config->{verbose_freq}) <= $now) {
+            if (-f "$dbdir/verbose.db") {
+                $DEBUG && errlog "doing verbose notification...";
+
+                # get a temporary filename...
+                my ($fh, $filename) = tempfile("verboseXXXXXX", DIR => $dbdir);
+
+                # overwrite the temp file we just created...
+                rename("$dbdir/verbose.db", $filename);
+
+                if ($DEBUG) {
+                    errlog "verbose file is $filename";
+                }
+
+                # do the actual notification in the background
+                fork_into_background("verbose-notification",
+                                     \&verbose_notify_handler,
+                                     $config->{verbose_email},
+                                     $filename,
+                                     $verbose->{last_notify},
+                                     $config->{verbose_level},
+                                     $config->{verbose_unknown});
+
+                # ...keep track of when we last sent out a notify
+                $verbose->{last_notify} = $now;
+            }
+        }
+    }
+
+}
+
+sub get_last_event {
+    my $dbh = shift;
+
+    my ($time, $counter);
+
+    # get the oldest timestamp...
+    my $sth = $dbh->prepare('SELECT MAX(time) FROM events');
+    $sth->execute;
+    my @row = $sth->fetchrow_array || (0);
+    $time = $row[0];
+    if ($time) {
+
+        # get the highest counter for this timestamp...
+        $sth = $dbh->prepare("SELECT MAX(counter) FROM events WHERE time = $time");
+        $sth->execute;
+        @row = $sth->fetchrow_array || (0);
+        $counter = $row[0];
+    }
+
+    return ($time, $counter);
+}
+
+##########################################################################
+# start the real magic...
+
+my $finished;
+
+# make sure we exit if someone sends us the right signal
+sub sig_handler {
+    my $signame = shift;
+
+    errlog("Caught signal '$signame'.  Exiting...");
+    $finished = 1;
+}
+
+# set up our error log without buffering
+open(ERRLOG, ">>$dbdir/event-dispatch.log");
+my $oldfd = select(ERRLOG);
+$| = 1;
+select($oldfd);
+
+$config = readconfig();
+
+# fork off into the background.  we need to do this before we connect to
+# the db, otherwise, we'll get an ugly error about rolling back a
+# connection that's being destroyed
+daemonize;
+
+# automagically reap child processes
+$SIG{INT}  = \&sig_handler;
+$SIG{TERM} = \&sig_handler;
+$SIG{CHLD} = 'IGNORE';
+
+# Sigh, portable dates in perl sucks
+eval "use Date::Parse";
+if (!$@) {
+    $date_module = 'TimeDate';
+} else {
+    eval "use Date::Manip";
+    if (!$@) {
+        $date_module = 'DateManip';
+    } else {
+        errlog "Unable to load Date module; use either TimeDate or Date::Manip";
+        $finished = 1;
+    }
+}
+
+# if they want us to write a pid, do it
+if ($pidfile) {
+    if (open(PIDFILE, ">$pidfile")) {
+        print PIDFILE "$$\n";
+        close(PIDFILE);
+    }
+}
+
+my $dbh = connect_database($dbdir);
+
+($last_inserted_time, $last_inserted_counter) = get_last_event($dbh);
+
+my $auditlog = File::Tail->new(
+    name              => $logfile,
+    debug             => 1,
+    tail              => -1,
+    interval          => 1,
+    maxinterval       => 5,
+    adjustafter       => 20,
+    errmode           => "return",
+    ignore_noexistant => 1
+);
+my $syslog = File::Tail->new(
+    name              => $syslogfile,
+    debug             => 1,
+    tail              => -1,
+    interval          => 1,
+    maxinterval       => 5,
+    adjustafter       => 20,
+    errmode           => "return",
+    ignore_noexistant => 1
+);
+my $line = '';
+
+# process complete lines from the buffer...
+while (not $finished) {
+    my ($nfound, $timeleft, @pending) = File::Tail::select(undef, undef, undef, $timeout, ($auditlog, $syslog));
+
+    foreach (@pending) {
+        process_event($dbh, $_->read);
+    }
+
+    # see if we should flush pending entries to disk and/or do notification
+    check_timers($dbh);
+}
+
+# make sure we don't exit with any pending events not written to the db
+$dbh->commit     || errlog "Error commiting changes: $!";
+$dbh->disconnect || errlog "Error disconnecting from db: $!";
+
+# close our error/debugging log file
+close(ERRLOG);
+
+unlink($pidfile) if $pidfile;
+
+exit 0;

deprecated/utils/aa-genprof

@@ -0,0 +1,216 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+sub sysctl_read($) {
+    my $path = shift;
+    my $value = undef;
+    if (open(SYSCTL, "<$path")) {
+        $value = int(<SYSCTL>);
+    }
+    close(SYSCTL);
+    return $value;
+}
+
+sub sysctl_write($$) {
+    my $path = shift;
+    my $value = shift;
+    return if (!defined($value));
+    if (open(SYSCTL, ">$path")) {
+        print SYSCTL $value;
+        close(SYSCTl);
+    }
+}
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'file|f=s' => \$filename,
+    'dir|d=s'  => \$profiledir,
+    'help|h'   => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+my $sd_mountpoint = check_for_subdomain();
+unless ($sd_mountpoint) {
+    fatal_error(gettext("AppArmor does not appear to be started. Please enable AppArmor and try again."));
+}
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    fatal_error "Can't find AppArmor profiles in $profiledir.";
+}
+
+# what are we profiling?
+my $profiling = shift;
+
+unless ($profiling) {
+    $profiling = UI_GetString(gettext("Please enter the program to profile: "), "")
+      || exit 0;
+}
+
+my $fqdbin;
+if (-e $profiling) {
+    $fqdbin = get_full_path($profiling);
+    chomp($fqdbin);
+} else {
+    if ($profiling !~ /\//) {
+        my $which = which($profiling);
+        if ($which) {
+            $fqdbin = get_full_path($which);
+        }
+    }
+}
+
+unless ($fqdbin && -e $fqdbin) {
+    if ($profiling =~ /^[^\/]+$/) {
+        fatal_error(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' in the other window in order to find the fully-qualified path.'), $profiling, $profiling));
+    } else {
+        fatal_error(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+    }
+}
+
+
+# make sure that the app they're requesting to profile is not marked as
+# not allowed to have it's own profile
+check_qualifiers($fqdbin);
+
+# load all the include files
+loadincludes();
+
+my $profilefilename = getprofilefilename($fqdbin);
+if (-e $profilefilename) {
+    $helpers{$fqdbin} = getprofileflags($profilefilename) || "enforce";
+} else {
+    autodep($fqdbin);
+    $helpers{$fqdbin} = "enforce";
+}
+
+if ($helpers{$fqdbin} eq "enforce") {
+    complain($fqdbin);
+    reload($fqdbin);
+}
+
+# When reading from syslog, it is possible to hit the default kernel
+# printk ratelimit. This will result in audit entries getting skipped,
+# making profile generation inaccurate. When using genprof, disable
+# the printk ratelimit, and restore it on exit.
+my $ratelimit_sysctl = "/proc/sys/kernel/printk_ratelimit";
+my $ratelimit_saved = sysctl_read($ratelimit_sysctl);
+END { sysctl_write($ratelimit_sysctl, $ratelimit_saved); }
+sysctl_write($ratelimit_sysctl, 0);
+
+UI_Info(gettext("\nBefore you begin, you may wish to check if a\nprofile already exists for the application you\nwish to confine. See the following wiki page for\nmore information:\nhttps://gitlab.com/apparmor/apparmor/wikis/Profiles"));
+
+UI_Important(gettext("Please start the application to be profiled in \nanother window and exercise its functionality now.\n\nOnce completed, select the \"Scan\" button below in \norder to scan the system logs for AppArmor events.  \n\nFor each AppArmor event, you will be given the  \nopportunity to choose whether the access should be  \nallowed or denied."));
+
+my $syslog         = 1;
+my $logmark        = "";
+my $done_profiling = 0;
+
+$syslog = 0 if (-e "/var/log/audit/audit.log");
+
+while (not $done_profiling) {
+    if ($syslog) {
+        $logmark = `date | md5sum`;
+        chomp $logmark;
+        $logmark = $1 if $logmark =~ /^([0-9a-f]+)/;
+        system("$logger -p kern.warn 'GenProf: $logmark'");
+    } else {
+        $logmark = last_audit_entry_time();
+    }
+    eval {
+
+        my $q = {};
+        $q->{headers} = [ gettext("Profiling"), $fqdbin ];
+        $q->{functions} = [ "CMD_SCAN", "CMD_FINISHED" ];
+        $q->{default} = "CMD_SCAN";
+
+        my ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_SCAN") {
+
+            my $lp_ret = do_logprof_pass($logmark);
+
+            $done_profiling = 1 if $lp_ret eq "FINISHED";
+
+        } else {
+
+            $done_profiling = 1;
+
+        }
+    };
+    if ($@) {
+        if ($@ =~ /FINISHING/) {
+            $done_profiling = 1;
+        } else {
+            die $@;
+        }
+    }
+}
+
+for my $p (sort keys %helpers) {
+    if ($helpers{$p} eq "enforce") {
+        enforce($p);
+        reload($p);
+    }
+}
+
+UI_Info(gettext("Reloaded AppArmor profiles in enforce mode."));
+UI_Info(gettext("\nPlease consider contributing your new profile! See\nthe following wiki page for more information:\nhttps://gitlab.com/apparmor/apparmor/wikis/Profiles\n"));
+UI_Info(sprintf(gettext('Finished generating profile for %s.'), $fqdbin));
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ -f /path/to/logfile ] [ program to profile ]"), $0));
+    exit 0;
+}
+
+sub last_audit_entry_time {
+    local $_ = `tail -1 /var/log/audit/audit.log`;
+    my $logmark;
+    if (/^*msg\=audit\((\d+\.\d+\:\d+).*\).*$/) {
+        $logmark = $1;
+    } else {
+        $logmark = "";
+    }
+    return $logmark;
+}

deprecated/utils/aa-logprof

@@ -0,0 +1,72 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use Data::Dumper;
+use Getopt::Long;
+use Locale::gettext;
+use POSIX;
+
+use Immunix::AppArmor;
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+setup_yast();
+
+# options variables
+my $help = '';
+my $logmark;
+
+GetOptions(
+    'file|f=s'    => \$filename,
+    'dir|d=s'     => \$profiledir,
+    'logmark|m=s' => \$logmark,
+    'help|h'      => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    fatal_error "Can't find AppArmor profiles in $profiledir.";
+}
+
+# load all the include files
+loadincludes();
+
+do_logprof_pass($logmark);
+
+shutdown_yast();
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ -f /path/to/logfile ] [ -m \"mark in log to start processing after\""), $0));
+    exit 0;
+}
+

deprecated/utils/aa-repo.pl

@@ -0,0 +1,821 @@
+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2008 Dominic Reynolds. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#
+# ----------------------------------------------------------------------
+
+# ----------------------------------------------------------------------
+#
+my $usage =
+"aa-repo.pl --command args\n";
+
+my $usage_search =
+"    --search [author=XXX] [prog=XXX] [id=XXX]
+             Search the repository for profiles matching the search criteria
+             and return the results.
+             NOTE: One --search switch per option
+
+    --verbose|v
+             Verbosity level. Supply either one or two switches. Two switches
+             adds full profile text in returned search results.\n";
+
+my $usage_push =
+
+"    --push   [--profile=XXX|all] [--changelog=XXX]
+             Push local profiles to repository, uses configured user and upon
+             overwrite of an existing profile in the repository then prompt
+             user with a diff for confirmation XXX the name of the application
+             whose profile should be uploaded or \"all\"  to upload all
+             profiles.  Multiple --profile switches may be passed to supply
+             multiple profile names
+
+             e.g.  --push --profile /usr/sbin/mdnsd --profile /usr/sbin/ftp
+             e.g.  --push --profile all\n";
+
+my $usage_pull =
+"    --pull   [--author=XXX] [--profile=XXX] or [--id=XXX] [--mode=complain]
+             pull remote profiles and install on local system
+             If operation will change local profiles then prompt user with
+             diff for confirmation
+             NOTE: One --pull switch per option and there are three acceptable
+                   combinations
+
+             --pull --author=XXX
+               * pull all profiles in the repo for the author
+
+             --pull --author=XXX  --profile=XXXX
+               * pull the profile for prog owned by author
+
+             --pull --id=XXXX
+               * pull the profile with id
+
+             --pull --mode=complain
+               * set the profile(s) to complain mode when installed
+
+             Profiles are checked for conflicts with currently installed
+             profiles and presented as a list to the user to confirm and view.\n";
+
+
+my $usage_sync =
+"    --sync   [--up] [--down] [--noconfirm]
+             Synchronize local profile set with the repository - showing
+             changes and allowing prompting the user with the diffs and
+             suggest the newest version to be activated. If the --all option
+             is passed then treat profiles not marked as remote as new
+             profiles that will be uploaded to the repository.\n";
+
+my $usage_stat =
+"    --status
+             Show the current status of the local profile set. This operation
+             is similar to sync but does not prompt the user to up|down load
+             changes\n";
+
+my $usage_getconfig =
+"    --getconfig|c
+             Print the current configuration for the repsository\n";
+
+
+my $usage_setconfig =
+"    --setconfig [url=xxx] [username=xxxx] [password=xxxx] [enabled=(yes|no)]
+                [upload=(yes|no)]
+              Set the configuration options for the repository.
+              NOTE: One --setconfig switch per option\n";
+
+my $usage_bottom =
+"    --quiet|q Don't prompt user - assume that all changes should be made.
+
+    ISSUES:
+      o Should changes made to the system be recorded somehow? An audit event?
+      o Should the tool allow a repo/distro to be passed for each operation?
+
+";
+
+use strict;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+use Immunix::Repository;
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+# options variables
+my $help = '';
+my $verbose = '';
+
+my ( $id, $author, $mode, %search, $sync, $getconfig, $push,
+     $pull, %setconfig, @profiles, $all, $changelog, $stat );
+
+GetOptions(
+    'search=s%'    => \%search,
+    'sync=s'       => \$sync,
+    'status'       => \$stat,
+    'getconfig|c'  => \$getconfig,
+    'setconfig=s%' => \%setconfig,
+    'push'         => \$push,
+    'id=s'         => \$id,
+    'author=s'     => \$author,
+    'profile=s'    => \@profiles,
+    'changelog=s'  => \$changelog,
+    'pull'         => \$pull,
+    'all|a'        => \$all,
+    'help|h'       => \$help,
+    'verbose|v+'   => \$verbose
+);
+
+#
+# Root privs required to run the repo tool
+#
+if ( geteuid() != 0 ) {
+    print STDERR gettext(
+"You must be logged in with root user privileges to use this program.\n"
+                        );
+    exit;
+}
+
+# --help
+# tell 'em how to use it...
+&usage && exit if $help;
+
+my $config = get_repo_config();
+
+#
+# --getconfig operation
+#
+&config && exit if $getconfig;
+
+my $sd_mountpoint = check_for_subdomain();
+unless ($sd_mountpoint) {
+    fatal_error(gettext(
+"AppArmor does not appear to be started.  Please enable AppArmor and try again."
+                       )
+               );
+}
+
+#
+# --setconfig operation
+#
+if ( keys %setconfig ) {
+   $config->{url}      = $setconfig{url}      if ( $setconfig{url} );
+   $config->{distro}   = $setconfig{distro}   if ( $setconfig{distro} );
+   $config->{enabled}  = $setconfig{enabled}  if ( $setconfig{enabled} );
+   $config->{email}    = $setconfig{email}    if ( $setconfig{email} );
+   $config->{user}     = $setconfig{username} if ( $setconfig{username} );
+   $config->{password} = $setconfig{password} if ( $setconfig{password} );
+   $config->{upload}   = $setconfig{upload}   if ( $setconfig{upload} );
+   set_repo_config( $config );
+}
+
+#
+# --push operation
+#
+if ( $push ) {
+    my ($conflicts, $repo_profiles, $local_profiles, @overrides);
+    if ( ! @profiles ) {
+       print STDERR gettext(
+"Must supply at least one profile using \"--profile XXX\" to --push\n"
+                           );
+       exit 1;
+    } else {
+       print STDERR Data::Dumper->Dump([@profiles], [qw(*profiles)]);
+    }
+    my $changelog = $changelog?$changelog:"none";
+    push_profiles( \@profiles, $changelog, 1 );
+}
+
+
+#
+#  --pull operation
+#
+if ( $pull ) {
+    my $type = "";
+    if ( $id ) {
+        if ( $author || @profiles ) {
+            print STDERR gettext(
+"Option --id=XX is only allowed by itself and not in combination to
+other options for the --pull command.\n"
+                                );
+            exit 1;
+       }
+       $type = "id";
+    }
+    if ( @profiles && ! $author ) {
+        print STDERR gettext(
+"Option --profile=XX requires that the --author=XX option be supplied
+to distinguish a specific profile.\n"
+                            );
+        exit 1;
+    } else {
+        $type = "profile";
+    }
+
+    my $mode = $mode eq "complain"?1:0;
+    pull_profiles( \@profiles, $type, $mode, 1 );
+}
+
+#
+#  --search operation
+#
+if ( keys %search ) {
+    if ( $search{id} ) {
+        my($status,$result) = fetch_profile_by_id( $config->{url},
+                                                   $search{id} );
+        if ($status) {
+            my $title = sprintf(gettext( "Profile ID %s\n"), $search{id});
+            console_print_search_results( $title,
+                                          "profile",
+                                          { $result->{name} => $result }
+                                        );
+
+        } else {
+            print STDERR "ERROR $result\n";
+        }
+    } elsif ( $search{author} && $search{prog} ) {
+        my($status,$result) =
+            fetch_profiles_by_name_and_user( $config->{url},
+                                             $config->{distro},
+                                             $search{prog},
+                                             $search{author}
+                                           );
+        if ( $status ) {
+            my $title =
+                sprintf(gettext("Profiles matching user: %s and program: %s\n"),
+                        $search{author},
+                        $search{prog}
+                       );
+            console_print_search_results( $title, "profile", $result );
+        } else {
+            print STDERR "ERROR $result\n";
+        }
+    } elsif ( $search{author} ) {
+        my($status,$result) = fetch_profiles_by_user( $config->{url},
+                                                      $config->{distro},
+                                                      $search{author}
+                                                    );
+        if ( $status ) {
+            my $title = sprintf(gettext( "Profiles for %s\n"), $search{author});
+            console_print_search_results( $title, "profile", $result );
+        } else {
+            print STDERR "ERROR $result\n";
+        }
+    } elsif ( $search{prog} ) {
+        my($status,$result) = fetch_profiles_by_name( $config->{url},
+                                                      $config->{distro},
+                                                      $search{prog},
+                                                    );
+        if ( $status ) {
+            my $title = sprintf(gettext("Profiles matching program: %s\n"),
+                                $search{prog});
+            console_print_search_results( $title, "user", $result );
+        } else {
+            print STDERR "ERROR $result\n";
+        }
+    } else  {
+        print STDERR
+"Unsupported search criteria. Please specify at least one of
+author=XXX prog=XXX id=XXX\n";
+    }
+}
+
+if ( $stat ) {
+    my ( $local_profiles, $remote_profiles );
+    my $msg =
+" The following profiles are stored in the repository but
+ are not synchronized with the copy in the repository\n";
+
+    my ($status, $result) = fetch_profiles_by_user( $config->{url},
+                                                    $config->{distro},
+                                                    $config->{user}
+                                                  );
+    if ( $status ) {
+        $remote_profiles = $result;
+    } else {
+        print STDERR sprintf(gettext("ERROR connecting to repository: %s\n"),
+                             $result);
+        exit;
+    }
+
+    readprofiles();
+    $local_profiles = serialize_local_profiles( \%sd );
+    my ($local_only,$unsynched,$synched,$conflicts) = ({}, {}, {});
+    $unsynched = find_profile_conflicts($remote_profiles, $local_profiles);
+    for my $p ( keys %$local_profiles ) {
+        if ( ! $remote_profiles->{$p} ) {
+            $local_only->{$p} = $local_profiles->{$p};
+        }
+    }
+
+    for my $p ( keys %$remote_profiles ) {
+        $synched->{$p} =
+            $remote_profiles->{$p}->{profile} if ( ! %$unsynched->{$p} );
+    }
+    UI_status($synched, $unsynched, $local_only);
+}
+
+######################
+# Helper functions
+######################
+
+#
+# Compare the local profile set with the remote profile set.
+# Return a list of the conflicting profiles as a list
+#  { PROFILE_NAME =>  [LOCAL_PROFILE, REMOTE_PROFILE] ]
+#
+#
+# remote_profiles = repository profiles as returned by one of the
+#                   Immunix::Repository::fetch... functions
+# local_profiles  = hash ref containing
+#                    {  name => serialized local profile }
+#
+#
+
+sub find_profile_conflicts ($$) {
+    my ($remote_profiles,$local_profiles) = @_;
+    my $conflicts = {};
+    for my $p ( keys(%$local_profiles) ) {
+        if ( $local_profiles->{$p} and $remote_profiles->{$p} ) {
+            my $p_local  = $local_profiles->{$p};
+            my $p_remote = $remote_profiles->{$p}->{profile};
+            chomp($p_local);
+            chomp($p_remote);
+            if ( $p_remote ne $p_local ) {
+                $conflicts->{$p} = [ $p_local, $p_remote ];
+            }
+        }
+    }
+   return( $conflicts );
+}
+
+sub serialize_local_profiles ($) {
+   my $profiles = shift;
+   my $local_profiles = {};
+   for my $p ( keys %$profiles ) {
+       my $serialize_opts = {};
+       $serialize_opts->{NO_FLAGS} = 1;
+       my $p_local = serialize_profile( $profiles->{$p},
+                                        $p,
+                                        $serialize_opts );
+       $local_profiles->{$p} = $p_local;
+   }
+   return $local_profiles;
+}
+
+
+sub console_print_search_results ($$$) {
+    my ($title, $type,$result) = @_;
+    open(PAGER, "| less") or die "Can't open pager";
+    print PAGER $title;
+    print PAGER "Found " . values(%$result) . " profiles \n";
+    for my $p ( values(%$result) ) {
+        if ( $verbose ) {
+            if ( $type eq "user" ) {
+                print PAGER " Author    [ " . $p->{username} . " ]\n";
+            } elsif ( $type eq "profile" ) {
+                print PAGER " Name      [ " . $p->{name} . " ]\n";
+            }
+            print PAGER " Created   [ " . $p->{created_at} . " ]\n";
+            print PAGER " Downloads [ " . $p->{downloaded_count} . " ]\n";
+            print PAGER " ID        [ " . $p->{id} . " ]\n";
+            if ( $verbose > 1 ) {
+                print PAGER " Profile   [ \n" . $p->{profile} . " ]\n\n";
+            } else {
+                print PAGER "\n";
+            }
+        } else {
+            my $data =  $type eq "user"?$p->{username}:$p->{name};
+            print PAGER " " . $data . "\n";
+        }
+    }
+    close PAGER;
+}
+
+sub UI_resolve_profile_conflicts {
+
+    my ($explanation, $conflict_hash) = @_;
+    my $url = $config->{url};
+    my @conflicts = map { [ $_,
+                            $conflict_hash->{$_}->[0],
+                            $conflict_hash->{$_}->[1]
+                          ] }
+                          keys %$conflict_hash;
+    my @commits = [];
+    my $title = "Profile conflicts";
+    my %resolution = ();
+    my $q = {};
+    $q->{title} = $title;
+    $q->{headers} = [ "Repository", $url, ];
+
+    $q->{explanation} = $explanation;
+
+    $q->{functions} = [ "CMD_OVERWRITE",
+                        "CMD_KEEP",
+                        "CMD_VIEW_CHANGES",
+                        "CMD_ABORT",
+                        "CMD_CONTINUE", ];
+
+    $q->{default} = "CMD_OVERWRITE";
+    $q->{options} = [ map { $_->[0] } @conflicts ];
+    $q->{selected} = 0;
+
+    my ($ans, $arg);
+    do {
+        ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_VIEW_CHANGES") {
+            display_changes($conflicts[$arg]->[2], $conflicts[$arg]->[1]);
+        }
+        if ( $ans eq "CMD_OVERWRITE") {
+           $q->{options} =
+             [ map { $_ =~ /$conflicts[$arg]->[0](  K|  O)?$/?
+                           $conflicts[$arg]->[0] . "  O":
+                           $_ }
+                   @{$q->{options}}
+             ];
+             $resolution{$conflicts[$arg]->[0]} = "O";
+        }
+        if ( $ans eq "CMD_KEEP") {
+           $q->{options} =
+             [ map { $_ =~ /$conflicts[$arg]->[0](  K|  O)?$/?
+                           $conflicts[$arg]->[0] . "  K":
+                           $_ }
+                   @{$q->{options}}
+             ];
+             $resolution{$conflicts[$arg]->[0]} = "K";
+        }
+        $q->{selected} = ($arg+1) % @conflicts;
+    } until $ans =~ /^CMD_CONTINUE/;
+    if ($ans eq "CMD_CONTINUE") {
+        my @results = ();
+        for my $p ( keys %resolution ) {
+            if ( $resolution{$p} eq "O" ) {
+                 push @results, $p;
+            }
+        }
+        return @results;
+    }
+}
+
+sub UI_display_profiles {
+    my ($explanation, $profile_hash) = @_;
+    my $url = $config->{url};
+    my @profiles = map { [ $_, $profile_hash->{$_} ] } keys %$profile_hash;
+    my $title = gettext("Profiles");
+    my $q = {};
+    $q->{title} = $title;
+    $q->{headers} = [ "Repository", $url, ];
+
+    $q->{explanation} = $explanation;
+
+    $q->{functions} = [ "CMD_VIEW",
+                        "CMD_CONTINUE", ];
+
+    $q->{default} = "CMD_CONTINUE";
+    $q->{options} = [ map { $_->[0] } @profiles ];
+    $q->{selected} = 0;
+
+    my ($ans, $arg);
+    do {
+        ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_VIEW") {
+            my $pager = get_pager();
+            open ( PAGER, "| $pager" ) or die "Can't open $pager";
+            print PAGER gettext("Profile: ") . $profiles[$arg]->[0] . "\n";
+            print PAGER $profiles[$arg]->[1];
+            close PAGER;
+        }
+        $q->{selected} = ($arg+1) % @profiles;
+    } until $ans =~ /^CMD_CONTINUE/;
+    return;
+}
+
+sub UI_display_profile_conflicts {
+    my ($explanation, $conflict_hash) = @_;
+    my $url = $config->{url};
+    my @conflicts = map { [ $_,
+                            $conflict_hash->{$_}->[0],
+                            $conflict_hash->{$_}->[1]
+                          ] }
+                          keys %$conflict_hash;
+    my @commits = [];
+    my $title = gettext("Profile conflicts");
+    my $q = {};
+    $q->{title} = $title;
+    $q->{headers} = [ "Repository", $url, ];
+
+    $q->{explanation} = $explanation;
+
+    $q->{functions} = [ "CMD_VIEW_CHANGES",
+                        "CMD_CONTINUE", ];
+
+    $q->{default} = "CMD_CONTINUE";
+    $q->{options} = [ map { $_->[0] } @conflicts ];
+    $q->{selected} = 0;
+
+    my ($ans, $arg);
+    do {
+        ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_VIEW_CHANGES") {
+            display_changes($conflicts[$arg]->[2], $conflicts[$arg]->[1]);
+        }
+        $q->{selected} = ($arg+1) % @conflicts;
+    } until $ans =~ /^CMD_CONTINUE/;
+    return;
+}
+
+sub usage {
+    if ( $help eq "push" ) {
+        print STDERR $usage . $usage_push ."\n";
+    } elsif ( $help eq "pull" ) {
+        print STDERR $usage . $usage_pull ."\n";
+    } elsif ( $help eq "sync" ) {
+        print STDERR $usage . $usage_sync ."\n";
+    } elsif ( $help eq "getconfig" ) {
+        print STDERR $usage . $usage_getconfig ."\n";
+    } elsif ( $help eq "setconfig" ) {
+        print STDERR $usage . $usage_setconfig ."\n";
+    } elsif ( $help eq "status" ) {
+        print STDERR $usage . $usage_stat ."\n";
+    } elsif ( $help eq "search" ) {
+        print STDERR $usage . $usage_search ."\n";
+    } else {
+     open(PAGER, "| less") or die "Can't open pager";
+     print PAGER $usage .
+                 $usage_search .
+                 $usage_push .
+                 $usage_pull .
+                 $usage_sync .
+                 $usage_stat .
+                 $usage_setconfig .
+                 $usage_getconfig .
+                 $usage_bottom . "\n";
+     close PAGER;
+   }
+}
+
+#
+# --getconfig helper function
+#
+sub config {
+    my $configstr = gettext("Current config\n");
+    my $config = get_repo_config();
+    $configstr .= "\turl:\t\t$config->{url}\n";
+    $configstr .= "\tdistro:\t\t$config->{distro}\n";
+    $configstr .= "\tenabled:\t$config->{enabled}\n";
+    $configstr .= "\temail:\t\t$config->{email}\n";
+    $configstr .= "\tusername:\t$config->{user}\n";
+    $configstr .= "\tpassword:\t$config->{password}\n";
+    $configstr .= "\tupload:\t\t$config->{upload}\n";
+    print STDERR $configstr . "\n";
+}
+
+#
+#  helper function to push profiles to the repository
+#  used by --push and --sync options
+#
+sub push_profiles($$$) {
+    my ( $p_ref, $changelog, $confirm ) = @_;
+    my ( $conflicts, $remote_profiles, $local_profiles, @overrides );
+    my @profiles = @$p_ref;
+
+    my $conflict_msg =
+" The following profile(s) selected for upload conflicts with a profile already
+ stored in the repository for your account. Please choose whether to keep the
+ current version or overwrite it.\n";
+    $all = 0;
+
+    readprofiles();
+    my ($status, $result) = fetch_profiles_by_user( $config->{url},
+                                                    $config->{distro},
+                                                    $config->{user}
+                                                  );
+    if ( $status ) {
+        $remote_profiles = $result;
+    } else {
+        print STDERR sprintf(gettext("ERROR connecting to repository: %s\n"),
+                             $result);
+        exit;
+    }
+
+    $all = 1 if ( grep(/^all$/, @profiles) );
+
+    if ( $all ) {
+        $local_profiles = serialize_local_profiles( \%sd );
+    } else {
+        my $local_sd = {};
+        for my $p ( @profiles ) {
+            if ( !$sd{$p} ) {
+                print STDERR
+                    sprintf(gettext("Profile for [%s] does not exist\n"), $p);
+                exit;
+            }
+            $local_sd->{$p} = $sd{$p};
+        }
+        $local_profiles = serialize_local_profiles( $local_sd );
+    }
+
+    $conflicts = find_profile_conflicts($remote_profiles, $local_profiles);
+
+    if ( keys %$conflicts ) {
+        @overrides = UI_resolve_profile_conflicts( $conflict_msg, $conflicts );
+    }
+
+    if ( $local_profiles ) {
+        my @uploads;
+        for my $p ( keys %$local_profiles ) {
+            unless ( $conflicts->{$p} and !grep(/^$p$/, @overrides) ) {
+                print STDERR gettext("Uploading ") .  $p . "... ";
+                my ($status,$result) = upload_profile( $config->{url},
+                                                       $config->{user},
+                                                       $config->{password},
+                                                       $config->{distro},
+                                                       $p,
+                                                       $local_profiles->{$p},
+                                                       $changelog
+                                                     );
+                print STDERR gettext("done") . "\n";
+            }
+            if ( $status ) {
+               push @uploads, $p;
+            } else {
+              print STDERR gettext("Error uploading") . "$p: $result\n";
+            }
+        }
+        if ( @uploads ) {
+            #
+            # Currently the upload API with the repository returns the
+            # the current users profile set before the update so we have
+            # to refetch to obtain the metadata to update the local profiles
+            #
+            my $repo_p = [];
+            print STDERR gettext("Updating local profile metedata....\n");
+            my ($status,$result) = fetch_profiles_by_user( $config->{url},
+                                                           $config->{distro},
+                                                           $config->{user} );
+            if ( $status ) {
+                for my $p ( @uploads ) {
+                   push( @$repo_p, [$p, $result->{$p}] ) if ( $result->{$p} );
+                }
+                activate_repo_profiles( $config->{url}, $repo_p, 0 );
+                print STDERR gettext(" done\n");
+            } else {
+                print STDERR gettext(
+"Failed to retrieve updated profiles from the repository. Error: "
+                                    ) . $result . "\n";
+            }
+        }
+    }
+}
+
+#
+# Helper function for pulling profiles from the repository
+# used by --pull and --sync options
+#
+sub pull_profiles($$$$) {
+    my ( $p_ref, $mode, $confirm, $opts ) = @_;
+    my @profiles = @$p_ref;
+    my ( $conflicts, $commit_list, $remote_profiles,
+         $local_profiles, @overrides );
+
+    my $conflict_msg =
+"  The following profiles selected for download conflict with profiles
+  already deployed on the system. Please choose whether to keep the local
+  version or overwrite with the version from the repository\n";
+
+    readprofiles();
+
+    if ( $opts->{id} ) {
+        my ($status,$newp) = fetch_profile_by_id( $config->{url}, $opts->{id} );
+        if ( ! $status ) {
+            print STDERR gettext(
+                             sprintf("Error occured during operation\n\t[%s]\n",
+                                     $newp
+                                    )
+                                );
+            exit 1;
+        } else {
+            $remote_profiles = { $newp->{name} => $newp->{profile} };
+        }
+    } elsif ( @profiles && $opts->{author} ) {
+        $remote_profiles = {};
+        for my $p ( @profiles ) {
+            my ($status,$profiles) =
+                fetch_profiles_by_name_and_user( $config->{url},
+                                                 $config->{distro},
+                                                 $p,
+                                                 $opts->{author} );
+            if ( ! $status ) {
+                print STDERR gettext(sprintf(
+                                     "Error occured during operation\n\t[%s]\n",
+                                             $profiles
+                                            )
+                                    );
+                exit 1;
+            } else {
+                $remote_profiles->{$p} = $profiles->{$p};
+            }
+        }
+    } elsif ( $opts->{author} ) {
+        my ($status,$profiles) = fetch_profiles_by_user( $config->{url},
+                                                         $config->{distro},
+                                                         $opts->{author} );
+        if ( ! $status ) {
+            print STDERR gettext(sprintf(
+                                     "Error occured during operation\n\t[%s]\n",
+                                         $profiles
+                                        )
+                                );
+            exit 1;
+        } else {
+            $remote_profiles = $profiles;
+        }
+    }
+    $local_profiles = serialize_local_profiles( \%sd );
+    $conflicts = find_profile_conflicts( $remote_profiles, $local_profiles );
+    if ( keys %$conflicts ) {
+        @overrides = UI_resolve_profile_conflicts( $conflict_msg, $conflicts );
+    }
+    for my $p ( keys %$remote_profiles ) {
+        unless ( $conflicts->{$p} and !grep(/^$p$/, @overrides) ) {
+            $remote_profiles->{$p}->{username} = $opts->{author};
+            push @$commit_list, [$p, $remote_profiles->{$p}];
+        }
+    }
+
+    if ( $commit_list and @$commit_list ) {
+        activate_repo_profiles( $config->{url}, $commit_list, $mode );
+        system("rcapparmor reload");
+    } else {
+        UI_Info(gettext("No changes to make"));
+    }
+}
+
+sub UI_status {
+
+    my ($synched, $unsynched, $local) = @_;
+    my $url = $config->{url};
+    my $synched_text   = gettext("Synchronized repository profiles:\t\t") .
+                                 keys %$synched;
+    my $unsynched_text = gettext("Unsynchronized repository profiles:\t") .
+                                 keys %$unsynched;
+    my $local_text     = gettext("Local only profiles :\t\t\t") . keys %$local;
+    my $options        = [ $synched_text, $unsynched_text, $local_text ];
+    my $title          = gettext("Profile Status");
+    my $explanation    = gettext(
+" This is the current status of active profiles on the system.
+ To view the profiles or unsyncronized changes select VIEW\n"
+    );
+    my $q = {};
+    $q->{title} = $title;
+    $q->{headers} = [ "Repository", $url, ];
+    $q->{explanation} = $explanation;
+    $q->{functions} = [ "CMD_VIEW", "CMD_FINISHED", ];
+    $q->{default} = "CMD_FINISHED";
+    $q->{options} = $options;
+    $q->{selected} = 0;
+
+    my ($ans, $arg);
+    do {
+        ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_VIEW") {
+            if ( $arg == 0 ) {
+                UI_display_profiles(
+                    gettext("Profiles stored in the repository"),
+                    $synched
+                );
+            } elsif ( $arg == 1 ) {
+                UI_display_profile_conflicts(
+                                      gettext("Unsyncronised profile changes"),
+                                      $unsynched
+                                            );
+            } elsif ( $arg == 2 ) {
+                UI_display_profiles(
+                    gettext("Profiles stored in the repository"),
+                    $local
+                );
+            }
+        }
+    } until $ans =~ /^CMD_FINSHED/;
+}
+
+

deprecated/utils/aa-status

@@ -0,0 +1,218 @@
+#!/usr/bin/perl -w
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2005-2006 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+
+use strict;
+use Getopt::Long;
+use Cwd 'abs_path';
+
+my $confdir = "/etc/apparmor";
+my $sd_mountpoint;
+my $check_enabled = 0;
+my $count_enforced = 0;
+my $count_profiled = 0;
+my $count_complain = 0;
+my $verbose = 0;
+my $help;
+
+GetOptions(
+  'complaining'		=> \$count_complain,
+  'enabled'		=> \$check_enabled,
+  'enforced'		=> \$count_enforced,
+  'profiled'		=> \$count_profiled,
+  'verbose|v'		=> \$verbose,
+  'help|h'		=> \$help,
+) or usage();
+
+sub usage {
+  print "Usage: $0 [OPTIONS]\n";
+  print "Displays various information about the currently loaded AppArmor policy.\n";
+  print "OPTIONS (one only):\n";
+  print "  --enabled       returns error code if subdomain not enabled\n";
+  print "  --profiled      prints the number of loaded policies\n";
+  print "  --enforced      prints the number of loaded enforcing policies\n";
+  print "  --complaining   prints the number of loaded non-enforcing policies\n";
+  print "  --verbose       (default) displays multiple data points about loaded policy set\n";
+  print "  --help          this message\n";
+  exit;
+}
+
+$verbose = 1 if ($count_complain + $check_enabled + $count_enforced + $count_profiled == 0);
+usage() if $help or ($count_complain + $check_enabled + $count_enforced + $count_profiled + $verbose > 1);
+
+sub is_subdomain_loaded() {
+  return 1 if (-d "/sys/module/apparmor");
+  if(open(MODULES, "/proc/modules")) {
+    while(<MODULES>) {
+      return 1 if m/^(subdomain|apparmor)\s+/;
+    }
+  }
+
+  return 0;
+}
+
+sub find_subdomainfs() {
+
+  my $sd_mountpoint;
+  if(open(MOUNTS, "/proc/mounts")) {
+    while(<MOUNTS>) {
+      $sd_mountpoint = "$1/apparmor" if m/^\S+\s+(\S+)\s+securityfs\s/ && -e "$1/apparmor";
+      $sd_mountpoint = "$1/subdomain" if m/^\S+\s+(\S+)\s+securityfs\s/ && -e "$1/subdomain";
+      $sd_mountpoint = $1 if m/^\S+\s+(\S+)\s+subdomainfs\s/ && -e "$1";
+    }
+    close(MOUNTS);
+  }
+
+  return $sd_mountpoint;
+}
+
+sub get_profiles {
+  my $mountpoint = shift;
+  my %profiles = ();
+
+  if (open(PROFILES, "$mountpoint/profiles")) {
+    while(<PROFILES>) {
+      $profiles{$1} = $2 if m/^([^\(]+)\s+\((\w+)\)$/;
+    }
+    close(PROFILES);
+  }
+  return (%profiles);
+}
+
+sub get_processes {
+  my %profiles = @_;
+  my %processes = ();
+  if (opendir(PROC, "/proc")) {
+    my $file;
+    while (defined($file = readdir(PROC))) {
+      if ($file =~ m/^\d+/) {
+        if (open(CURRENT, "/proc/$file/attr/current")) {
+          while (<CURRENT>) {
+            if (m/^([^\(]+)\s+\((\w+)\)$/) {
+              $processes{$file}{'profile'} = $1;
+              $processes{$file}{'mode'} = $2;
+            } elsif (grep(abs_path("/proc/$file/exe") eq $_ , keys(%profiles))) {
+              # keep only unconfined processes that have a profile defined
+              $processes{$file}{'profile'} = abs_path("/proc/$file/exe");
+              $processes{$file}{'mode'} = 'unconfined';
+            }
+          }
+          close(CURRENT);
+        }
+      }
+    }
+    closedir(PROC);
+  }
+  return (%processes);
+}
+
+my $is_loaded = is_subdomain_loaded();
+
+if (!$is_loaded) {
+  print STDERR "apparmor module is not loaded.\n" if $verbose;
+  exit 1;
+}
+
+print "apparmor module is loaded.\n" if $verbose;
+
+$sd_mountpoint = find_subdomainfs();
+if (!$sd_mountpoint) {
+  print STDERR "apparmor filesystem is not mounted.\n" if $verbose;
+  exit 3;
+}
+
+if (! -r "$sd_mountpoint/profiles") {
+  print STDERR "You do not have enough privilege to read the profile set.\n" if $verbose;
+  exit 4;
+}
+
+#print "subdomainfs is at $sd_mountpoint.\n" if $verbose;
+
+# processes is a hash table :
+#   * keys : processes pid
+#   * values : hash containing information about the running process:
+#       * 'profile' : name of the profile applied to the running process
+#       * 'mode' : mode of the profile applied to the running process
+my %processes = ();
+my %enforced_processes = ();
+my %complain_processes = ();
+my %unconfined_processes = ();
+
+# profiles is a hash table :
+#  * keys : profile name
+#  * value : profile mode
+my %profiles;
+my @enforced_profiles = ();
+my @complain_profiles = ();
+
+%profiles = get_profiles($sd_mountpoint);
+@enforced_profiles = grep { $profiles{$_} eq 'enforce' } keys %profiles;
+@complain_profiles = grep { $profiles{$_} eq 'complain' } keys %profiles;
+
+# we consider the case where no profiles are loaded to be "disabled" as well
+my $rc = (keys(%profiles) == 0) ? 2 : 0;
+
+if ($check_enabled) {
+  exit $rc;
+}
+
+if ($count_profiled) {
+  print scalar(keys(%profiles)). "\n";
+  exit $rc;
+}
+
+if ($count_enforced) {
+  print $#enforced_profiles + 1 . "\n";
+  exit $rc;
+}
+
+if ($count_complain) {
+  print $#complain_profiles + 1 . "\n";
+  exit $rc;
+}
+
+
+if ($verbose) {
+  print keys(%profiles) . " profiles are loaded.\n";
+  print $#enforced_profiles + 1 . " profiles are in enforce mode.\n";
+  for (sort(@enforced_profiles)) {
+    print "   " . $_ . "\n";
+  }
+  print $#complain_profiles + 1 . " profiles are in complain mode.\n";
+  for (sort(@complain_profiles)) {
+    print "   " . $_ . "\n";
+  }
+}
+
+%processes = get_processes(%profiles);
+if ($verbose) {
+  for (keys(%processes)) {
+    $enforced_processes{$_} = $processes{$_} if $processes{$_}{'mode'} eq 'enforce';
+    $complain_processes{$_} = $processes{$_} if $processes{$_}{'mode'} eq 'complain';
+    # some early code uses unconfined instead of unconfined.
+    $unconfined_processes{$_} = $processes{$_} if $processes{$_}{'mode'} =~ /uncon(fi|strai)ned/;
+  }
+  print keys(%processes) . " processes have profiles defined.\n";
+  print keys(%enforced_processes) . " processes are in enforce mode :\n";
+  for (sort { $enforced_processes{$a}{'profile'} cmp $enforced_processes{$b}{'profile'} } keys(%enforced_processes)) {
+    print "   " . $enforced_processes{$_}{'profile'} . " ($_) \n";
+  }
+  print keys(%complain_processes) . " processes are in complain mode.\n";
+  for (sort { $complain_processes{$a}{'profile'} cmp $complain_processes{$b}{'profile'} } keys(%complain_processes)) {
+    print "   " . $complain_processes{$_}{'profile'} . " ($_) \n";
+  }
+  print keys(%unconfined_processes) . " processes are unconfined but have a profile defined.\n";
+  for (sort { $unconfined_processes{$a}{'profile'} cmp $unconfined_processes{$b}{'profile'} } keys(%unconfined_processes)) {
+    print "   " . $unconfined_processes{$_}{'profile'} . " ($_) \n";
+  }
+}
+
+exit $rc;

deprecated/utils/aa-unconfined

@@ -0,0 +1,113 @@
+#!/usr/bin/perl -w
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+#
+#  unconfined -
+#    audit local system for processes listening on network connections
+#    that are not currently running with a profile.
+
+use strict;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+use Locale::gettext;
+use POSIX;
+
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+# options variables
+my $paranoid = '';
+my $help     = '';
+
+GetOptions(
+    'paranoid' => \$paranoid,
+    'help|h'   => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+sub usage {
+    printf(gettext("Usage: %s [ --paranoid ]\n"), $0);
+    exit 0;
+}
+
+my $subdomainfs = check_for_subdomain();
+
+die gettext("AppArmor does not appear to be started. Please enable AppArmor and try again.") . "\n"
+  unless $subdomainfs;
+
+my @pids;
+if ($paranoid) {
+    opendir(PROC, "/proc") or die gettext("Can't read /proc\n");
+    @pids = grep { /^\d+$/ } readdir(PROC);
+    closedir(PROC);
+} else {
+    if (open(NETSTAT, "LANG=C /bin/netstat -nlp |")) {
+        while (<NETSTAT>) {
+            chomp;
+            push @pids, $5
+              if /^(tcp|udp)\s+\d+\s+\d+\s+\S+\:(\d+)\s+\S+\:(\*|\d+)\s+(LISTEN|\s+)\s+(\d+)\/(\S+)/;
+        }
+        close(NETSTAT);
+    }
+}
+
+for my $pid (sort { $a <=> $b } @pids) {
+    my $prog = readlink "/proc/$pid/exe" or next;
+    my $attr;
+    if (open(CURRENT, "/proc/$pid/attr/current")) {
+        while (<CURRENT>) {
+            chomp;
+            $attr = $_ if (/^\// || /^null/);
+        }
+        close(CURRENT);
+    }
+    my $cmdline = `cat /proc/$pid/cmdline`;
+    my $pname = (split(/\0/, $cmdline))[0];
+    if ($pname =~ /\// && !($pname eq $prog)) {
+	$pname = "($pname) ";
+    } else {
+	$pname = "";
+    }
+    if (not $attr) {
+        if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) {
+
+            #my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1];
+            $cmdline =~ s/\0/ /g;
+            $cmdline =~ s/\s+$//;
+            chomp $cmdline;
+            print "$pid $prog ($cmdline) " . gettext("not confined\n");
+        } else {
+            print "$pid $prog $pname" . gettext("not confined\n");
+        }
+    } else {
+        if ($prog =~ m/^(\/usr\/bin\/python|\/usr\/bin\/perl|\/bin\/bash)$/) {
+
+            #my $scriptname = (split(/\0/, `cat /proc/$pid/cmdline`))[1];
+            $cmdline =~ s/\0/ /g;
+            $cmdline =~ s/\s+$//;
+            chomp $cmdline;
+            print "$pid $prog ($cmdline) " . gettext("confined by") . " '$attr'\n";
+        } else {
+            print "$pid $prog $pname" . gettext("confined by") . " '$attr'\n";
+        }
+    }
+}

deprecated/utils/convert-profile.pl

@@ -0,0 +1,135 @@
+#! /usr/bin/perl -w
+
+# Very simple script to try converting AppArmor profiles to the new
+# profile syntax as of April 2007.
+#
+# Copyright (C) 2007 Andreas Gruenbacher <agruen@suse.de>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of version 2 of the GNU General Public
+# License published by the Free Software Foundation.
+#  
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+use FileHandle;
+use File::Temp;
+use Getopt::Std;
+use strict;
+
+sub match($) {
+    my ($str) = @_;
+    my @fields;
+
+    @fields = ($str =~ /^(\s*)([@\/]\S*)(\s.*,)$/);
+    if (!@fields) {
+	@fields = ($str =~ /^(\s*")((?:[^"]|\\")*)("\s.*,)$/);
+    }
+
+    return @fields;
+}
+
+sub alterations($) {
+    my ($str) = @_;
+
+    if ($str =~ /^([^{]*){([^}]*,[^}]*)}(.*)$/) {
+	my @strs = map { "$1$_$3" } split(/,/, $2);
+	return map { alterations($_) } @strs;
+    } else {
+	return ($str);
+    }
+}
+
+my %known_dirs;
+
+sub remember_pathname($) {
+    my ($str) = @_;
+    my $pathname;
+
+    for (split /(\/)/, $str) {
+	if ($_ eq '/' && $pathname ne '') {
+	    #print "<<>> $pathname\n";
+	    $known_dirs{$pathname} = 1;
+	}
+	$pathname .= $_;
+    }
+}
+
+sub add_slash($$) {
+    my ($str, $perms) = @_;
+
+    return exists $known_dirs{$str} || -d $str;
+}
+
+sub never_add_slash($$) {
+    my ($str, $perms) = @_;
+
+    return $perms =~ /[lmx]/ || $str =~ /\.(so|cf|db|conf|config|log|pid|so\*)$/ ||
+	   $str =~ /(\*\*|\/)$/ || (-e $str && ! -d $str);
+
+}
+
+our($opt_i);
+getopts('i');
+
+foreach my $filename (@ARGV) {
+    my $fh_in;
+    
+    $fh_in = new FileHandle("< $filename")
+	or die "$filename: $!\n";
+
+    while (<$fh_in>) {
+	    if (my @fields = match($_)) {
+		for my $x (alterations($fields[1])) {
+		    remember_pathname($x);
+		}
+	    }
+    }
+}
+
+if (@ARGV == 0) {
+    print "Usage: $0 profile ...\n";
+    print "Tries to convert the profile to the new profile syntax, and\n" .
+	  "prints the result to standard output. The result may need" .
+	  "further review.\n";
+    exit 0;
+}
+
+foreach my $filename (@ARGV) {
+    my ($fh_in, $fh_out, $tmpname);
+
+    $fh_in = new FileHandle("< $filename")
+	or die "$filename: $!\n";
+
+    if ($opt_i) {
+	($fh_out, $tmpname) = mkstemp("$filename.XXXXXX")
+	    or die "$!\n";
+	*STDOUT = $fh_out;
+    }
+
+    while (<$fh_in>) {
+	    if (my @fields = match($_)) {
+		for my $x (alterations($fields[1])) {
+		    if (never_add_slash($x, $fields[2])) {
+			print $_;
+		    } elsif (add_slash($x, $fields[2])) {
+			print "$fields[0]$x/$fields[2]	# (dir)\n";
+		    } else {
+			print "$fields[0]$x/$fields[2]	# (maybe-dir)\n";
+			print $_;
+		    }
+		}
+	    } else {
+		print $_;
+	    }
+    }
+
+    if ($opt_i) {
+	rename $tmpname, $filename
+	    or die "$filename: $!\n";
+    }
+}
+
+# vim: smartindent softtabstop=4 shiftwidth=4

deprecated/utils/repair_obsolete_profiles

@@ -0,0 +1,201 @@
+#!/usr/bin/perl -wi
+# automatically repair apparmor profiles that have had their supporting
+# infrastructure refactored out from underneath them
+
+# note -i in shebang line -- this program will modify in-place
+# profiles or #include chunks specified on the command line without
+# backups. Please make some yourself and inspect the changes made by
+# this tool to ensure they look correct.
+
+# It'll try to fix up #include files (supplied by SUSE/Immunix) that have
+# moved; it will also inspect many #include files that exist solely
+# for netdomain rule separation, and either remove the #include line
+# from profiles/includes or suck in the contents of the specific file,
+# depending if there was any non-netdomain content.
+
+# If you haven't modified any of the files listed in the @useless array,
+# you probably don't have to concern yourself with the complicated part
+# of the previous paragraph. If you did modify any of those files, this
+# tool will inspect those for changes, try to update any lines in those
+# files for correctness, and insert those lines directly into the
+# referencing profiles.
+
+our %count_cache;
+
+# count the number of 'interesting' lines in the file
+sub numlines ($) {
+  my $name = $_[0];
+
+  return $count_cache{$name} if $count_cache{$name};
+
+  open FH, $name or return 1; # can't tell -> not empty
+
+  my $linecount=0;
+  while(<FH>) {
+    if (m/^[^#]*#include/) {
+      $linecount++;
+    } elsif (m/^\s*#/) {
+      # just a comment, skip it
+    } elsif (m/\s*tcp_/) {
+      # netdomain rules are unenforced, skip it
+    } elsif (m/\s*udp_/) {
+      # netdomain rules are unenforced, skip it
+    } elsif (m/\S+/) {
+      $linecount++;
+    }
+  }
+  close FH;
+
+  $count_cache{$name} = $linecount;
+
+  return $linecount;
+}
+
+# given a single line from a profile, perform some search/replace
+# operations to reflect new locations for old files.
+#
+# change #include lines that reference files in the @useless array:
+# don't print the #include any more, and either suck in the contents of
+# the referenced file (calling itself recursively to fix up _those_
+# files) or just leave well enough alone, if the file had no
+# 'interesting' lines as defined above.
+
+%transforms = (
+  # renamed around SuSE 9.3
+  "abstractions/kde3"            => "abstractions/kde",
+  "abstractions/user-GTK"        => "abstractions/gnome",
+  "abstractions/user-Xauthority" => "abstractions/X",
+  
+  # user-custom -> program-chunks around SHASS 1.1, but these changed dirs
+  "user-custom/fonts"           => "abstractions/fonts",
+  "user-custom/kde3"            => "abstractions/kde",
+  "user-custom/user-GTK"        => "abstractions/gnome",
+  "user-custom/user-mail"       => "abstractions/user-mail",
+  "user-custom/user-manpages"   => "abstractions/user-manpages",
+  "user-custom/user-Xauthority" => "abstractions/X",
+  "user-custom/user-tmp"        => "abstractions/user-tmp",
+  
+  # try to forget the -files
+  "program-chunks/base-files"          => "abstractions/base",
+  "program-chunks/nameservice-files"   => "abstractions/nameservice",
+  "immunix-standard/base-files"        => "abstractions/base",
+  "immunix-standard/nameservice-files" => "abstractions/nameservice",
+  
+  # immunix-standard -> program-chunks
+  "immunix-standard/postfix-bounce"     => "program-chunks/postfix-bounce",
+  "immunix-standard/postfix-cleanup"    => "program-chunks/postfix-cleanup",
+  "immunix-standard/postfix-common"     => "program-chunks/postfix-common",
+  "immunix-standard/postfix-flush"      => "program-chunks/postfix-flush",
+  "immunix-standard/postfix-local"      => "program-chunks/postfix-local",
+  "immunix-standard/postfix-master"     => "program-chunks/postfix-master",
+  "immunix-standard/postfix-nqmgr"      => "program-chunks/postfix-nqmgr",
+  "immunix-standard/postfix-pickup"     => "program-chunks/postfix-pickup",
+  "immunix-standard/postfix-proxymap"   => "program-chunks/postfix-proxymap",
+  "immunix-standard/postfix-qmgr"       => "program-chunks/postfix-qmgr",
+  "immunix-standard/postfix-showq"      => "program-chunks/postfix-showq",
+  "immunix-standard/postfix-smtp"       => "program-chunks/postfix-smtp",
+  "immunix-standard/postfix-smtpd"      => "program-chunks/postfix-smtpd",
+  "immunix-standard/postfix-trivial-rewrite" => "program-chunks/postfix-trivial-rewrite",
+  "immunix-standard/apache-default-uri" => "program-chunks/apache-default-uri",
+  "immunix-standard/at"                 => "program-chunks/at",
+);
+
+# chunks that immunix tools never populated -- lets remove the ones that
+# don't have any useful information
+my @useless = qw{
+  program-chunks/base-nd
+  program-chunks/portmap-nd
+  program-chunks/postfix-local-nd
+  program-chunks/postfix-master-nd
+  program-chunks/postfix-proxymap-nd
+  program-chunks/postfix-smtpd-nd
+  program-chunks/postfix-smtp-nd
+  user-custom/base-nd
+  user-custom/portmap-nd
+  user-custom/postfix-local-nd
+  user-custom/postfix-master-nd
+  user-custom/postfix-proxymap-nd
+  user-custom/postfix-smtpd-nd
+  user-custom/postfix-smtp-nd
+  immunix-standard/base-nd
+  immunix-standard/portmap-nd
+  immunix-standard/postfix-local-nd
+  immunix-standard/postfix-master-nd
+  immunix-standard/postfix-proxymap-nd
+  immunix-standard/postfix-smtpd-nd
+  immunix-standard/postfix-smtp-nd
+  program-chunks/at
+  program-chunks/fam
+  program-chunks/httpd
+  program-chunks/identd
+  program-chunks/imapd
+  program-chunks/ipop2d
+  program-chunks/ipop3d
+  program-chunks/lpd
+  program-chunks/mutt
+  program-chunks/named
+  program-chunks/nmbd
+  program-chunks/ntalkd
+  program-chunks/ntpd
+  program-chunks/postgres
+  program-chunks/rpc.lockd
+  program-chunks/rpc.nfsd
+  program-chunks/rpc.statd
+  program-chunks/samba
+  program-chunks/sendmail.sendmail
+  program-chunks/shells
+  program-chunks/slocate
+  program-chunks/snmpd
+  program-chunks/spamc
+  program-chunks/sshd
+  program-chunks/swat
+  program-chunks/syslogd
+  program-chunks/talk
+  program-chunks/xfs
+};
+
+# create an alternation to speed up the regexp below
+my $useless = join('|', @useless);
+
+sub fixup ($) {
+  $line = $_[0];
+
+  $line =~ s/#include\s+<([^>]+)>/$i = (exists $transforms{$1}) ? $transforms{$1} : "$1"; "#include <$i>"/e;
+
+  if ($line =~ m/\s*#include\s+<($useless)>/) {
+    my $file = $1;
+    if (numlines("/etc/subdomain.d/$file") > 0) {
+      my $succ = open INC, "/etc/subdomain.d/$file";
+      if (not $succ) {
+        print STDERR "Error opening /etc/subdomain.d/$file\n";
+      } else {
+        while(my $included_line = <INC>) {
+          print fixup_loop($included_line);
+        }
+        close INC;
+      }
+    }
+    $line = ""; # this line has been handled by the file
+  }
+
+  return $line;
+}
+
+# call fixup on a single entry repeatedly -- this way, we can encode
+# 'small' changes in the fixup routine when they are made, rather than
+# encoding all possible starting points and which specific end point
+# they should go to.
+sub fixup_loop ($) {
+  my $line = $_[0];
+  my $saved;
+  do {
+    $saved = $line;
+    $line = fixup($saved);
+  } until ($line eq $saved);
+  return $line;
+}
+
+# main entry point; fix each line in every file in argv.
+while(<>) {
+  print fixup_loop($_);
+}

documentation/logo/README

@@ -1,25 +0,0 @@
-The apparmor logo (logo-default-red.svg) was created by Noah Davis and
-released under the LGPL (licence included below).
-
-Logo variants and uses:
-
-logo-default-red.svg - default logo and coloration used for the apparmor
-                       project. Created for larger (64x64) uses.
-		       Not optimized for small 16x16 tiles.
-
-
-
-License
- * Copyright (c) 2018 Noah Davis <noahadvs@gmail.com>
- *
- * The appaprmor logo is licensed under the terms of the GNU
- * Lesser General Public License, version 2.1. Please see the file
- * COPYING.LGPL.
- *
- * This logo file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.

documentation/logo/logo-default-red.svg

@@ -1 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg height="64" width="64" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" gradientUnits="userSpaceOnUse" x1="55" x2="55" xlink:href="#j" y1="54" y2="9"/><linearGradient id="b"><stop offset="0" stop-color="#bf4231"/><stop offset="1" stop-color="#e05e4c"/></linearGradient><linearGradient id="c" gradientUnits="userSpaceOnUse" x1="32" x2="32" y1="58" y2="6"><stop offset="0" stop-color="#173f4f"/><stop offset="1" stop-color="#2f5361"/></linearGradient><linearGradient id="d" gradientUnits="userSpaceOnUse" x1="55" x2="55" xlink:href="#b" y1="54" y2="9"/><linearGradient id="e" gradientUnits="userSpaceOnUse" x1="20" x2="45" xlink:href="#k" y1="22" y2="47"/><linearGradient id="f" gradientUnits="userSpaceOnUse" x1="37" x2="37" y1="46" y2="38"><stop offset="0" stop-color="#be4434"/><stop offset=".25" stop-color="#c44837"/><stop offset="1" stop-color="#cb4c3b"/></linearGradient><linearGradient id="g" gradientUnits="userSpaceOnUse" x1="26" x2="50" xlink:href="#k" y1="16" y2="40"/><linearGradient id="h" gradientUnits="userSpaceOnUse" x1="40" x2="47" xlink:href="#k" y1="38" y2="45"/><linearGradient id="i" gradientUnits="userSpaceOnUse" x1="43" x2="46" xlink:href="#k" y1="44" y2="47"/><linearGradient id="j"><stop offset="0" stop-color="#eff0f1"/><stop offset="1" stop-color="#fcfcfc"/></linearGradient><linearGradient id="k"><stop offset="0" stop-color="#292c2f"/><stop offset="1" stop-opacity="0"/></linearGradient><linearGradient id="l" gradientUnits="userSpaceOnUse" x1="32" x2="32" xlink:href="#j" y1="54" y2="9"/><linearGradient id="m" gradientUnits="userSpaceOnUse" x1="32" x2="32" xlink:href="#b" y1="54" y2="9"/><path d="m32 6c-6.33333 3.35447-12.66667 4.72491-19 6v25.001953c0 7 10.26331 16.561337 19 20.998047 8.73669-4.43671 19-13.998047 19-20.998047v-25.001953c-6.33333-1.27509-12.66667-2.64553-19-6z" fill="url(#c)" stroke-linecap="square" stroke-width="2"/><path d="m13 36.001953v1c0 7 10.26331 16.561337 19 20.998047 8.73669-4.43671 19-13.998047 19-20.998047v-1c0 7-10.26331 16.561337-19 20.998047-8.73669-4.43671-19-13.998047-19-20.998047z" fill="#292c2f" opacity=".2" stroke-linecap="square" stroke-width="2"/><path d="m48 14-26.304688 32.304688 11.208985 11.208984c8.525508-4.614773 18.095703-13.751033 18.095703-20.511719v-20.001953z" fill="url(#i)" opacity=".2"/><path d="m40.824219 12.349609-17.617188 35.238282c2.735569 2.548653 5.806349 4.895376 8.792969 6.412109 7.392765-3.754157 16-12.076982 16-18v-22c-2.403402-.483885-4.789398-1.006952-7.175781-1.650391z" fill="url(#d)"/><path d="m32 9c-5.358808 2.838395-10.64102 3.921074-16 5v22c0 3.530034 3.17163 7.828219 7.207031 11.587891l17.617188-35.238282c-2.934573-.791246-5.868718-1.784199-8.824219-3.349609z" fill="url(#a)"/><path d="m24 14-8 16 20.935547 20.935547c1.522034-1.10756 3.001377-2.336903 4.361328-3.638672l-1.296875-1.296875-7-14z" fill="url(#e)" opacity=".2"/><path d="m28 14 12 32 8-16h-4z" fill="url(#g)" opacity=".2"/><g stroke-width="1.857143"><path d="m24 14 16 32 8-16h-4l-1 2h-6l-9-18zm14 20h4l-2 4z" fill="url(#l)"/><path d="m24 14-8 16h4l1-2h6l8.5 17.000001h4zm0 8 2 4h-4z" fill="url(#m)"/><path d="m32 38 4 8h4l-4-8z" fill="url(#f)"/></g><path d="m48 30-8 16 3.617188 3.617188c4.013144-3.887728 7.018045-8.222958 7.351562-11.9375.019301-.229864.03125-.456776.03125-.677735v-4.001953z" fill="url(#h)" opacity=".2"/></svg>

kernel-patches/v4.14/0001-UBUNTU-SAUCE-apparmor-af_unix-mediation.patch

@@ -1,13 +1,12 @@
-From 2e7f6d0dc0f1d3642950f529b451af73fa1baf9c Mon Sep 17 00:00:00 2001
+From a3b0cb6676a04cdad5cc357bc422d0398083b435 Mon Sep 17 00:00:00 2001
 From: John Johansen <john.johansen@canonical.com>
 Date: Tue, 18 Jul 2017 23:27:23 -0700
-Subject: [PATCH 2/2] apparmor: af_unix mediation
+Subject: [PATCH 17/17] UBUNTU: SAUCE: apparmor: af_unix mediation
 
 af_socket mediation did not make it into 4.14 so add remaining out
 of tree patch
 
 Signed-off-by: John Johansen <john.johansen@canonical.com>
-Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
 ---
  security/apparmor/Makefile          |   3 +-
  security/apparmor/af_unix.c         | 651 ++++++++++++++++++++++++++++++++++++
@@ -24,10 +23,10 @@ Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
  create mode 100644 security/apparmor/include/af_unix.h
 
 diff --git a/security/apparmor/Makefile b/security/apparmor/Makefile
-index e7ff2183532a..90c118f39e13 100644
+index dafdd387d42b..ef39226ff4aa 100644
 --- a/security/apparmor/Makefile
 +++ b/security/apparmor/Makefile
-@@ -5,7 +5,8 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
+@@ -4,7 +4,8 @@ obj-$(CONFIG_SECURITY_APPARMOR) += apparmor.o
  
  apparmor-y := apparmorfs.o audit.o capability.o context.o ipc.o lib.o match.o \
                path.o domain.o policy.o policy_unpack.o procattr.o lsm.o \
@@ -695,7 +694,7 @@ index 000000000000..c6876db2dbde
 +	return error;
 +}
 diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
-index 518d5928661b..63a8a462fc96 100644
+index 125dad5c3fde..20cdb1c4b266 100644
 --- a/security/apparmor/apparmorfs.c
 +++ b/security/apparmor/apparmorfs.c
 @@ -2187,6 +2187,11 @@ static struct aa_sfs_entry aa_sfs_entry_ns[] = {
@@ -921,7 +920,7 @@ index 4364088a0b9e..26660a1a50b0 100644
  	if (!state)
  		return 0;
 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index 72b915dfcaf7..5533d2f1d9de 100644
+index cc5ab23a2d84..0ede66d80a53 100644
 --- a/security/apparmor/lsm.c
 +++ b/security/apparmor/lsm.c
 @@ -26,6 +26,7 @@
@@ -1391,5 +1390,5 @@ index 33d54435f8d6..dd1953b08e58 100644
 +			 aa_label_sk_perm(label, op, request, sock->sk));
  }
 -- 
-2.14.1
+2.11.0
 

kernel-patches/v4.14/README

@@ -1,4 +1,4 @@
-This is based on v4.14 final
+This series is based on what is currently in linux-next scheduled for
+inclusion in 4.14
 
-base socket mediation and af_unix-mediation are the last two remaining
-patches that are out of tree
+af_unix-mediation is the last remaining patch that is out of tree

kernel-patches/v4.17/0001-apparmor-patch-to-provide-compatibility-with-v2.x-ne.patch

@@ -1,249 +0,0 @@
-From 02e2bc1b330f7e15dba671547a256a6f900f6e5d Mon Sep 17 00:00:00 2001
-From: John Johansen <john.johansen@canonical.com>
-Date: Sun, 17 Jun 2018 03:56:25 -0700
-Subject: [PATCH 1/3] apparmor: patch to provide compatibility with v2.x net
- rules
-
-The networking rules upstreamed in 4.17 have a deliberate abi break
-with the older 2.x network rules.
-
-This patch provides compatibility with the older rules for those
-still using an apparmor 2.x userspace and still want network rules
-to work on a newer kernel.
-
-Signed-off-by: John Johansen <john.johansen@canonical.com>
----
- security/apparmor/apparmorfs.c       |  1 +
- security/apparmor/include/apparmor.h |  2 +-
- security/apparmor/include/net.h      | 11 ++++++++
- security/apparmor/include/policy.h   |  2 ++
- security/apparmor/net.c              | 31 ++++++++++++++++-----
- security/apparmor/policy.c           |  1 +
- security/apparmor/policy_unpack.c    | 54 ++++++++++++++++++++++++++++++++++--
- 7 files changed, 92 insertions(+), 10 deletions(-)
-
-diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
-index 1fdcc7d5a977..32f0e660ffd0 100644
---- a/security/apparmor/apparmorfs.c
-+++ b/security/apparmor/apparmorfs.c
-@@ -2272,6 +2272,7 @@ static struct aa_sfs_entry aa_sfs_entry_features[] = {
- 	AA_SFS_DIR("domain",			aa_sfs_entry_domain),
- 	AA_SFS_DIR("file",			aa_sfs_entry_file),
- 	AA_SFS_DIR("network_v8",		aa_sfs_entry_network),
-+	AA_SFS_DIR("network",			aa_sfs_entry_network_compat),
- 	AA_SFS_DIR("mount",			aa_sfs_entry_mount),
- 	AA_SFS_DIR("namespaces",		aa_sfs_entry_ns),
- 	AA_SFS_FILE_U64("capability",		VFS_CAP_FLAGS_MASK),
-diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
-index 73d63b58d875..17d89f3badc6 100644
---- a/security/apparmor/include/apparmor.h
-+++ b/security/apparmor/include/apparmor.h
-@@ -24,7 +24,7 @@
- #define AA_CLASS_UNKNOWN	1
- #define AA_CLASS_FILE		2
- #define AA_CLASS_CAP		3
--#define AA_CLASS_DEPRECATED	4
-+#define AA_CLASS_NET_COMPAT	4
- #define AA_CLASS_RLIMITS	5
- #define AA_CLASS_DOMAIN		6
- #define AA_CLASS_MOUNT		7
-diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h
-index ec7228e857a9..579b59a40ea4 100644
---- a/security/apparmor/include/net.h
-+++ b/security/apparmor/include/net.h
-@@ -72,6 +72,16 @@ struct aa_sk_ctx {
- 	DEFINE_AUDIT_NET(NAME, OP, SK, (SK)->sk_family, (SK)->sk_type,	\
- 			 (SK)->sk_protocol)
- 
-+/* struct aa_net - network confinement data
-+ * @allow: basic network families permissions
-+ * @audit: which network permissions to force audit
-+ * @quiet: which network permissions to quiet rejects
-+ */
-+struct aa_net_compat {
-+	u16 allow[AF_MAX];
-+	u16 audit[AF_MAX];
-+	u16 quiet[AF_MAX];
-+};
- 
- #define af_select(FAMILY, FN, DEF_FN)		\
- ({						\
-@@ -84,6 +94,7 @@ struct aa_sk_ctx {
- })
- 
- extern struct aa_sfs_entry aa_sfs_entry_network[];
-+extern struct aa_sfs_entry aa_sfs_entry_network_compat[];
- 
- void audit_net_cb(struct audit_buffer *ab, void *va);
- int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
-diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h
-index 6c93e62383e6..4006fa9fc9f1 100644
---- a/security/apparmor/include/policy.h
-+++ b/security/apparmor/include/policy.h
-@@ -112,6 +112,7 @@ struct aa_data {
-  * @policy: general match rules governing policy
-  * @file: The set of rules governing basic file access and domain transitions
-  * @caps: capabilities for the profile
-+ * @net_compat: v2 compat network controls for the profile
-  * @rlimits: rlimits for the profile
-  *
-  * @dents: dentries for the profiles file entries in apparmorfs
-@@ -149,6 +150,7 @@ struct aa_profile {
- 	struct aa_policydb policy;
- 	struct aa_file_rules file;
- 	struct aa_caps caps;
-+	struct aa_net_compat *net_compat;
- 
- 	int xattr_count;
- 	char **xattrs;
-diff --git a/security/apparmor/net.c b/security/apparmor/net.c
-index bb24cfa0a164..bf6aaefc3a5f 100644
---- a/security/apparmor/net.c
-+++ b/security/apparmor/net.c
-@@ -27,6 +27,11 @@ struct aa_sfs_entry aa_sfs_entry_network[] = {
- 	{ }
- };
- 
-+struct aa_sfs_entry aa_sfs_entry_network_compat[] = {
-+	AA_SFS_FILE_STRING("af_mask",	AA_SFS_AF_MASK),
-+	{ }
-+};
-+
- static const char * const net_mask_names[] = {
- 	"unknown",
- 	"send",
-@@ -119,14 +124,26 @@ int aa_profile_af_perm(struct aa_profile *profile, struct common_audit_data *sa,
- 	if (profile_unconfined(profile))
- 		return 0;
- 	state = PROFILE_MEDIATES(profile, AA_CLASS_NET);
--	if (!state)
-+	if (state) {
-+		if (!state)
-+			return 0;
-+		buffer[0] = cpu_to_be16(family);
-+		buffer[1] = cpu_to_be16((u16) type);
-+		state = aa_dfa_match_len(profile->policy.dfa, state,
-+					 (char *) &buffer, 4);
-+		aa_compute_perms(profile->policy.dfa, state, &perms);
-+	} else if (profile->net_compat) {
-+		/* 2.x socket mediation compat */
-+		perms.allow = (profile->net_compat->allow[family] & (1 << type)) ?
-+			ALL_PERMS_MASK : 0;
-+		perms.audit = (profile->net_compat->audit[family] & (1 << type)) ?
-+			ALL_PERMS_MASK : 0;
-+		perms.quiet = (profile->net_compat->quiet[family] & (1 << type)) ?
-+			ALL_PERMS_MASK : 0;
-+
-+	} else {
- 		return 0;
--
--	buffer[0] = cpu_to_be16(family);
--	buffer[1] = cpu_to_be16((u16) type);
--	state = aa_dfa_match_len(profile->policy.dfa, state, (char *) &buffer,
--				 4);
--	aa_compute_perms(profile->policy.dfa, state, &perms);
-+	}
- 	aa_apply_modes_to_perms(profile, &perms);
- 
- 	return aa_check_perms(profile, &perms, request, sa, audit_net_cb);
-diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
-index c07493ce2376..d1a869699040 100644
---- a/security/apparmor/policy.c
-+++ b/security/apparmor/policy.c
-@@ -227,6 +227,7 @@ void aa_free_profile(struct aa_profile *profile)
- 	aa_free_file_rules(&profile->file);
- 	aa_free_cap_rules(&profile->caps);
- 	aa_free_rlimit_rules(&profile->rlimits);
-+	kzfree(profile->net_compat);
- 
- 	for (i = 0; i < profile->xattr_count; i++)
- 		kzfree(profile->xattrs[i]);
-diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
-index b9e6b2cafa69..a1b07e6c163d 100644
---- a/security/apparmor/policy_unpack.c
-+++ b/security/apparmor/policy_unpack.c
-@@ -37,7 +37,7 @@
- 
- #define v5	5	/* base version */
- #define v6	6	/* per entry policydb mediation check */
--#define v7	7
-+#define v7	7	/* v2 compat networking */
- #define v8	8	/* full network masking */
- 
- /*
-@@ -292,6 +292,19 @@ static bool unpack_nameX(struct aa_ext *e, enum aa_code code, const char *name)
- 	return 0;
- }
- 
-+static bool unpack_u16(struct aa_ext *e, u16 *data, const char *name)
-+{
-+	if (unpack_nameX(e, AA_U16, name)) {
-+		if (!inbounds(e, sizeof(u16)))
-+			return 0;
-+		if (data)
-+			*data = le16_to_cpu(get_unaligned((__le16 *) e->pos));
-+		e->pos += sizeof(u16);
-+		return 1;
-+	}
-+	return 0;
-+}
-+
- static bool unpack_u32(struct aa_ext *e, u32 *data, const char *name)
- {
- 	if (unpack_nameX(e, AA_U32, name)) {
-@@ -621,7 +634,7 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
- 	struct aa_profile *profile = NULL;
- 	const char *tmpname, *tmpns = NULL, *name = NULL;
- 	const char *info = "failed to unpack profile";
--	size_t ns_len;
-+	size_t size = 0, ns_len;
- 	struct rhashtable_params params = { 0 };
- 	char *key = NULL;
- 	struct aa_data *data;
-@@ -759,6 +772,43 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
- 		goto fail;
- 	}
- 
-+	size = unpack_array(e, "net_allowed_af");
-+	if (size || VERSION_LT(e->version, v8)) {
-+		profile->net_compat = kzalloc(sizeof(struct aa_net_compat), GFP_KERNEL);
-+		if (!profile->net_compat) {
-+			info = "out of memory";
-+			goto fail;
-+		}
-+		for (i = 0; i < size; i++) {
-+			/* discard extraneous rules that this kernel will
-+			 * never request
-+			 */
-+			if (i >= AF_MAX) {
-+				u16 tmp;
-+
-+				if (!unpack_u16(e, &tmp, NULL) ||
-+				    !unpack_u16(e, &tmp, NULL) ||
-+				    !unpack_u16(e, &tmp, NULL))
-+					goto fail;
-+				continue;
-+			}
-+			if (!unpack_u16(e, &profile->net_compat->allow[i], NULL))
-+				goto fail;
-+			if (!unpack_u16(e, &profile->net_compat->audit[i], NULL))
-+				goto fail;
-+			if (!unpack_u16(e, &profile->net_compat->quiet[i], NULL))
-+				goto fail;
-+		}
-+		if (size && !unpack_nameX(e, AA_ARRAYEND, NULL))
-+			goto fail;
-+		if (VERSION_LT(e->version, v7)) {
-+			/* pre v7 policy always allowed these */
-+			profile->net_compat->allow[AF_UNIX] = 0xffff;
-+			profile->net_compat->allow[AF_NETLINK] = 0xffff;
-+		}
-+	}
-+
-+
- 	if (unpack_nameX(e, AA_STRUCT, "policydb")) {
- 		/* generic policy dfa - optional and may be NULL */
- 		info = "failed to unpack policydb";
--- 
-2.14.1
-

kernel-patches/v4.17/0003-apparmor-fix-use-after-free-in-sk_peer_label.patch

@@ -1,57 +0,0 @@
-From 45ff74bd5a009ab8f9648531fa11fce55b9a67fd Mon Sep 17 00:00:00 2001
-From: John Johansen <john.johansen@canonical.com>
-Date: Tue, 26 Jun 2018 20:19:19 -0700
-Subject: [PATCH 3/3] apparmor: fix use after free in sk_peer_label
-
-BugLink: http://bugs.launchpad.net/bugs/1778646
-Signed-off-by: John Johansen <john.johansen@canonical.com>
----
- security/apparmor/lsm.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
-diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index 7a6b1bd8e046..0d2925389947 100644
---- a/security/apparmor/lsm.c
-+++ b/security/apparmor/lsm.c
-@@ -1125,9 +1125,10 @@ static struct aa_label *sk_peer_label(struct sock *sk)
- {
- 	struct sock *peer_sk;
- 	struct aa_sk_ctx *ctx = SK_CTX(sk);
-+	struct aa_label *label = ERR_PTR(-ENOPROTOOPT);
- 
- 	if (ctx->peer)
--		return ctx->peer;
-+		return aa_get_label(ctx->peer);
- 
- 	if (sk->sk_family != PF_UNIX)
- 		return ERR_PTR(-ENOPROTOOPT);
-@@ -1135,14 +1136,15 @@ static struct aa_label *sk_peer_label(struct sock *sk)
- 	/* check for sockpair peering which does not go through
- 	 * security_unix_stream_connect
- 	 */
--	peer_sk = unix_peer(sk);
-+	peer_sk = unix_peer_get(sk);
- 	if (peer_sk) {
- 		ctx = SK_CTX(peer_sk);
- 		if (ctx->label)
--			return ctx->label;
-+			label = aa_get_label(ctx->label);
-+		sock_put(peer_sk);
- 	}
- 
--	return ERR_PTR(-ENOPROTOOPT);
-+	return label;
- }
- 
- /**
-@@ -1186,6 +1188,7 @@ static int apparmor_socket_getpeersec_stream(struct socket *sock,
- 
- 	}
- 
-+	aa_put_label(peer);
- done:
- 	end_current_label_crit_section(label);
- 
--- 
-2.14.1
-

libraries/libapparmor/README

@@ -1,3 +1,3 @@
-What little documentation exists is in include/aalogparse.h.
+What little documentation exists is in src/aalogparse.h.
 
-Please file bugs using https://gitlab.com/apparmor/apparmor/-/issues
+Please file bugs using https://bugs.launchpad.net/apparmor/+filebug

libraries/libapparmor/configure.ac

@@ -42,11 +42,11 @@ AC_ARG_WITH(python,
 [AC_MSG_RESULT($withval)], [AC_MSG_RESULT(no)])
 if test "$with_python" = "yes"; then
    test -z "$SWIG" && AC_MSG_ERROR([swig is required when enabling python bindings])
-   AC_PATH_PROG(PYTHON, python3)
+   AC_PATH_PROG(PYTHON, python)
    test -z "$PYTHON" && AC_MSG_ERROR([python is required when enabling python bindings])
    sinclude(m4/ac_python_devel.m4)
    AC_PYTHON_DEVEL
-   AM_PATH_PYTHON([3.0])
+   AM_PATH_PYTHON
 fi
 
 AC_MSG_CHECKING([whether perl bindings are enabled])
@@ -58,7 +58,7 @@ if test "$with_perl" = "yes"; then
    AC_PATH_PROG(PERL, perl)
    test -z "$PERL" && AC_MSG_ERROR([perl is required when enabling perl bindings])
    perl_includedir="`$PERL -e 'use Config; print $Config{archlib}'`/CORE"
-   AS_IF([test -e "$perl_includedir/perl.h"], enable_perl=yes, enable_perl=no)
+   AC_CHECK_FILE($perl_includedir/perl.h, enable_perl=yes, enable_perl=no)
 fi
 
 
@@ -81,7 +81,7 @@ AM_CONDITIONAL(HAVE_RUBY, test x$with_ruby = xyes)
 AC_HEADER_STDC
 AC_CHECK_HEADERS(unistd.h stdint.h syslog.h)
 
-AC_CHECK_FUNCS([asprintf __secure_getenv secure_getenv reallocarray])
+AC_CHECK_FUNCS([asprintf __secure_getenv secure_getenv])
 
 AM_PROG_CC_C_O
 AC_C_CONST
@@ -92,17 +92,6 @@ if test "$ac_cv_prog_cc_c99" = "no"; then
   AC_MSG_ERROR([C99 mode is required to build libapparmor])
 fi
 
-AC_PROG_CXX
-
-m4_ifndef([AX_CHECK_COMPILE_FLAG], [AC_MSG_ERROR(['autoconf-archive' missing])])
-EXTRA_CFLAGS="-Wall $EXTRA_WARNINGS -fPIC"
-AX_CHECK_COMPILE_FLAG([-flto-partition=none], , , [-Werror])
-AS_VAR_IF([ax_cv_check_cflags__Werror__flto_partition_none], [yes],
-	[EXTRA_CFLAGS="$EXTRA_CFLAGS -flto-partition=none"]
-	,)
-AC_SUBST([AM_CFLAGS], ["$EXTRA_CFLAGS"])
-AC_SUBST([AM_CXXFLAGS], ["$EXTRA_CFLAGS"])
-
 AC_OUTPUT(
 Makefile
 doc/Makefile

libraries/libapparmor/doc/aa_change_hat.pod

@@ -22,15 +22,15 @@
 
 =head1 NAME
 
-aa_change_hat - change to or from a "hat" within a AppArmor profile
+aa_change_hat  - change to or from a "hat" within a AppArmor profile
 
 =head1 SYNOPSIS
 
 B<#include E<lt>sys/apparmor.hE<gt>>
 
-B<int aa_change_hat (const char *subprofile, unsigned long magic_token);>
+B<int aa_change_hat (char *subprofile, unsigned long magic_token);>
 
-B<int aa_change_hatv (const char *subprofiles[], unsigned long magic_token);>
+B<int aa_change_hatv (char *subprofiles[], unsigned long magic_token);>
 
 B<int aa_change_hat_vargs (unsigned long magic_token, ...);>
 
@@ -137,11 +137,11 @@ First, a simple high-level overview of aa_change_hat() use:
 
  void foo (void) {
  	unsigned long magic_token;
-
+  
  	/* get a random magic token value
  	from our huge entropy pool */
  	magic_token = random_function();
-
+ 
  	/* change into the subprofile while
  	 * we do stuff we don't trust */
  	aa_change_hat("stuff_we_dont_trust", magic_token);
@@ -166,20 +166,20 @@ aren't accessible after an aa_change_hat() call:
  #include <fcntl.h>
  #include <stdio.h>
  #include <unistd.h>
-
-
+ 
+ 
  int main(int argc, char *argv[]) {
         int fd;
         unsigned long tok;
         char buf[10];
-
+ 
         /* random() is a poor choice */
         tok = random();
-
+ 
         /* open /etc/passwd outside of any hat */
         if ((fd=open("/etc/passwd", O_RDONLY)) < 0)
                 perror("Failure opening /etc/passwd");
-
+ 
         /* confirm for ourselves that we can really read /etc/passwd */
         memset(&buf, 0, 10);
         if (read(fd, &buf, 10) == -1) {
@@ -188,7 +188,7 @@ aren't accessible after an aa_change_hat() call:
         }
         buf[9] = '\0';
         printf("/etc/passwd: %s\n", buf);
-
+ 
         /* change hat to the "hat" subprofile, which should not have
          * read access to /etc/passwd -- even though we have a valid
          * file descriptor at the time of the aa_change_hat() call. */
@@ -196,7 +196,7 @@ aren't accessible after an aa_change_hat() call:
                 perror("Failure changing hat -- aborting");
                 _exit(1);
         }
-
+ 
         /* confirm that we cannot read /etc/passwd */
         lseek(fd,0,SEEK_SET);
         memset(&buf, 0, 10);
@@ -204,7 +204,7 @@ aren't accessible after an aa_change_hat() call:
                 perror("Failure reading /etc/passwd post-hat");
         buf[9] = '\0';
         printf("/etc/passwd: %s\n", buf);
-
+ 
         return 0;
  }
 
@@ -248,7 +248,7 @@ The output when run:
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>. Note that
+L<https://bugs.launchpad.net/apparmor/+filebug>. Note that
 aa_change_hat(2) provides no memory barriers between different areas of a
 program; if address space separation is required, then separate processes
 should be used.

libraries/libapparmor/doc/aa_change_profile.pod

@@ -22,7 +22,7 @@
 
 =head1 NAME
 
-aa_change_profile, aa_change_onexec - change a task's profile
+aa_change_profile, aa_change_onexec - change a tasks profile
 
 =head1 SYNOPSIS
 
@@ -58,8 +58,8 @@ The aa_change_onexec() function is like the aa_change_profile() function
 except it specifies that the profile transition should take place on the
 next exec instead of immediately.  The delayed profile change takes
 precedence over any exec transition rules within the confining profile.
-Delaying the profile boundary has a couple of advantages: it removes the
-need for stub transition profiles, and the exec boundary is a natural security
+Delaying the profile boundary has a couple of advantages, it removes the
+need for stub transition profiles and the exec boundary is a natural security
 layer where potentially sensitive memory is unmapped.
 
 =head1 RETURN VALUE
@@ -196,7 +196,7 @@ used (in addition to the one for 'i_cant_be_trusted_anymore', above):
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>. Note that using
+L<https://bugs.launchpad.net/apparmor/+filebug>. Note that using
 aa_change_profile(2) without execve(2) provides no memory barriers between
 different areas of a program; if address space separation is required, then
 separate processes should be used.

libraries/libapparmor/doc/aa_features.pod

@@ -34,18 +34,12 @@ aa_features_ref - increments the ref count of an aa_features object
 
 aa_features_unref - decrements the ref count and frees the aa_features object when 0
 
-aa_features_write_to_fd - write a string representation of an aa_features object to a file descriptor
-
 aa_features_write_to_file - write a string representation of an aa_features object to a file
 
 aa_features_is_equal - equality test for two aa_features objects
 
 aa_features_supports - provides aa_features object support status
 
-aa_features_id - provides unique identifier for an aa_features object
-
-aa_features_value - the value associated with a given feature.
-
 =head1 SYNOPSIS
 
 B<#include E<lt>sys/apparmor.hE<gt>>
@@ -54,8 +48,6 @@ B<typedef struct aa_features aa_features;>
 
 B<int aa_features_new(aa_features **features, int dirfd, const char *path);>
 
-B<int aa_features_new_from_file(aa_features **features, int file);>
-
 B<int aa_features_new_from_string(aa_features **features, const char *string, size_t size);>
 
 B<int aa_features_new_from_kernel(aa_features **features);>
@@ -64,18 +56,12 @@ B<aa_features *aa_features_ref(aa_features *features);>
 
 B<void aa_features_unref(aa_features *features);>
 
-B<int aa_features_write_to_fd(aa_features *features, int fd);>
-
 B<int aa_features_write_to_file(aa_features *features, int dirfd, const char *path);>
 
 B<bool aa_features_is_equal(aa_features *features1, aa_features *features2);>
 
 B<bool aa_features_supports(aa_features *features, const char *str);>
 
-B<char *aa_features_id(aa_features *features);>
-
-B<char *aa_features_value(aa_features *features, const char *str, size_t *len);>
-
 Link with B<-lapparmor> when compiling.
 
 =head1 DESCRIPTION
@@ -92,10 +78,6 @@ directory file descriptor and path. The I<path> can point to a file or
 directory. See the openat(2) man page for examples of I<dirfd> and I<path>. The
 allocated I<features> object must be freed using aa_features_unref().
 
-The aa_features_new_from_file() function is similar except that it
-accepts an open file as the argument. The allocated I<features> object
-must be freed using aa_features_unref().
-
 The aa_features_new_from_string() function is similar except that it accepts a
 NUL-terminated string representation of the AppArmor features as the I<string>
 argument. The length of the features string, not counting the NUL-terminator,
@@ -111,9 +93,6 @@ aa_features_ref() increments the reference count on the I<features> object.
 aa_features_unref() decrements the reference count on the I<features> object
 and releases all corresponding resources when the reference count reaches zero.
 
-The aa_features_write_to_fd() function writes a string representation of the
-I<features> object to the file descriptor specified by the I<fd>.
-
 The aa_features_write_to_file() function writes a string representation of the
 I<features> object to the file specified by the I<dirfd> and I<path>
 combination.
@@ -129,12 +108,6 @@ the path, relative to the "apparmor/features/" directory of securityfs, of the
 feature to query. For example, to test if policy version 6 is supported, I<str>
 would be "policy/versions/v6".
 
-The aa_features_id() function returns a string representation of an
-identifier that can be used to uniquely identify an I<aa_features> object.
-The mechanism for generating the string representation is internal to
-libapparmor and subject to change but an example implementation is
-applying a hash function to the features string.
-
 =head1 RETURN VALUE
 
 The aa_features_new() family of functions return 0 on success and I<*features>
@@ -153,25 +126,15 @@ and false if they are not equal.
 aa_features_supports() returns true if the feature represented by I<str> is
 supported and false if it is not supported.
 
-aa_features_id() returns a string identifying I<features> which must be
-freed by the caller. NULL is returned on error, with errno set
-appropriately.
-
-aa_features_value() returns a null terminated string with is
-associated length which must be freed by the caller. NULL is returned
-on error, with errno set to ENOENT if the feature was not found,
-ENODIR if the specified feature does not resolve to a leaf feature.
-
 =head1 ERRORS
 
 The errno value will be set according to the underlying error in the
-I<aa_features> family of functions that return -1 or NULL on error.
+I<aa_features> family of functions that return -1 on error.
 
 =head1 NOTES
 
-The aa_features_id() function can be found in libapparmor version
-2.13. All the other aa_feature functions described above are present
-in libapparmor version 2.10.
+All aa_features functions described above are present in libapparmor version
+2.10 and newer.
 
 aa_features_unref() saves the value of errno when called and restores errno
 before exiting in libapparmor version 2.12 and newer.
@@ -179,10 +142,10 @@ before exiting in libapparmor version 2.12 and newer.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 
-openat(2), aa-features-abi(1) and L<https://wiki.apparmor.net>.
+openat(2) and L<https://wiki.apparmor.net>.
 
 =cut

libraries/libapparmor/doc/aa_find_mountpoint.pod

@@ -58,9 +58,6 @@ appropriately.
 
 =head1 ERRORS
 
-# podchecker warns about duplicate link targets for EACCES, EBUSY, ENOENT,
-# and ENOMEM, but this is a warning that is safe to ignore.
-
 B<aa_is_enabled>
 
 =over 4
@@ -73,10 +70,6 @@ AppArmor extensions to the system are not available.
 
 AppArmor is available on the system but has been disabled at boot.
 
-=item B<EBUSY>
-
-AppArmor is available but only via private interfaces.
-
 =item B<ENOENT>
 
 AppArmor is available (and maybe even enforcing policy) but the interface is
@@ -94,11 +87,6 @@ Did not have sufficient permissions to determine if AppArmor is enabled.
 
 Did not have sufficient permissions to determine if AppArmor is enabled.
 
-=item B<EBUSY>
-
-AppArmor is enabled but does not have access to shared interfaces, and
-only private interfaces are available.
-
 =back
 
 B<aa_find_mountpoint>
@@ -122,7 +110,7 @@ The apparmor filesystem mount could not be found
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_getcon.pod

@@ -116,14 +116,6 @@ The specified I<file/task> does not exist or is not visible.
 
 The confinement data is too large to fit in the supplied buffer.
 
-=item B<ENOPROTOOPT>
-
-The kernel doesn't support the SO_PEERLABEL option in sockets. This happens
-mainly when the kernel lacks 'fine grained unix mediation' support. It also
-can happen on LSM stacking kernels where another LSM has claimed this
-interface and decides to return this error, although this is really a
-corner case.
-
 =back
 
 =head1 NOTES
@@ -135,7 +127,7 @@ confinement data.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_kernel_interface.pod

@@ -156,7 +156,7 @@ errno before exiting in libapparmor version 2.12 and newer.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_policy_cache.pod

@@ -34,10 +34,6 @@ aa_policy_cache_remove - removes all policy cache files under a path
 
 aa_policy_cache_replace_all - performs a kernel policy replacement of all cached policies
 
-aa_policy_cache_dir_path - returns the path to the aa_policy_cache directory
-
-aa_policy_cache_dir_path_preview - returns a preview of the path to the aa_policy_cache directory without an existing aa_policy_cache object
-
 =head1 SYNOPSIS
 
 B<#include E<lt>sys/apparmor.hE<gt>>
@@ -46,8 +42,6 @@ B<typedef struct aa_policy_cache aa_policy_cache;>
 
 B<int aa_policy_cache_new(aa_policy_cache **policy_cache, aa_features *kernel_features, int dirfd, const char *path, uint16_t max_caches);>
 
-B<int aa_policy_cache_add_ro_dir(aa_policy_cache *policy_cache, int dirfd, const char *path);>
-
 B<aa_policy_cache *aa_policy_cache_ref(aa_policy_cache *policy_cache);>
 
 B<void aa_policy_cache_unref(aa_policy_cache *policy_cache);>
@@ -56,10 +50,6 @@ B<int aa_policy_cache_remove(int dirfd, const char *path);>
 
 B<int aa_policy_cache_replace_all(aa_policy_cache *policy_cache, aa_kernel_interface *kernel_interface);>
 
-B<char *aa_policy_cache_dir_path(aa_policy_cache *policy_cache, int level);>
-
-B<char *aa_policy_cache_dir_path_preview(aa_features *kernel_features, int dirfd, const char *path);>
-
 Link with B<-lapparmor> when compiling.
 
 =head1 DESCRIPTION
@@ -69,35 +59,19 @@ policy cache files. The policy cache files are the binary representation of a
 human-readable AppArmor profile. The binary representation is the form that is
 loaded into the kernel.
 
-The aa_policy_cache_new() function creates an I<aa_policy_cache>
-object based upon a directory file descriptor and path. See the
-openat(2) man page for examples of I<dirfd> and I<path>. The I<path>
-must point to a directory and it will be used as the basis for the
-location of policy cache files. See I<aa_policy_cache_dir_path> to
-find out which directory will be used to store the binary policy cache
-files. If additional overlay cache directories are used (see
-I<aa_policy_cache_add_ro_dir>) the directory specified in
-I<aa_policy_cache_new> is the first directory searched and is the
-writable overlay. If I<kernel_features> is NULL, then the features of
-the current kernel are used. When specifying a valid
-I<kernel_features> object, it must be compatible with the features
-of the kernel of interest.  The value of I<max_caches> should be equal
-to the number of caches that should be allowed before old caches are
-automatically reaped. The definition of what is considered to be an
-old cache is private to libapparmor. Specifying 0 means that no new
-caches should be created and only existing, valid caches may be used.
-Specifying UINT16_MAX means that a new cache may be created and that
-the reaping of old caches is disabled. The allocated
-I<aa_policy_cache> object must be freed using aa_policy_cache_unref().
-
-The aa_policy_cache_add_ro_dir() function adds an existing cache directory
-to the policy cache, as a readonly layer under the primary directory
-the cache was created with. When the cache is searched for an existing
-cache file the primary directory will be searched and then the readonly
-directories in the order that they were added to the policy cache.
-This allows the policy cache to be seeded with precompiled policy
-that can be updated by overlaying the read only cache file with one
-written to the primary cache dir.
+The aa_policy_cache_new() function creates an I<aa_policy_cache> object based
+upon a directory file descriptor and path. The I<path> must point to a
+directory. See the openat(2) man page for examples of I<dirfd> and I<path>. If
+I<kernel_features> is NULL, then the features of the current kernel are used.
+When specifying a valid I<kernel_features> object, it must be the compatible
+with the features of the kernel of interest. The value of I<max_caches> should
+be equal to the number of caches that should be allowed before old caches are
+automatically reaped. The definition of what is considered to be an old cache
+is private to libapparmor. Specifying 0 means that no new caches should be
+created and only existing, valid caches may be used. Specifying UINT16_MAX
+means that a new cache may be created and that the reaping of old caches is
+disabled. The allocated I<aa_policy_cache> object must be freed using
+aa_policy_cache_unref().
 
 aa_policy_cache_ref() increments the reference count on the I<policy_cache>
 object.
@@ -116,18 +90,6 @@ the I<policy_cache> object. If I<kernel_interface> is NULL, then the current
 kernel interface is used. When specifying a valid I<kernel_interface> object,
 it must be the interface of the currently running kernel.
 
-The aa_policy_cache_dir_path() function provides the path to the cache
-directory for a I<policy_cache> object at I<level> in the policy cache
-overlay of cache directories. A I<level> of 0 will always be present
-and is the first directory to search in an overlay of cache
-directories, and will also be the writable cache directory
-layer. Binary policy cache files will be located in the directory
-returned by this function.
-
-The aa_policy_cache_dir_levels() function provides access to the number
-of directories that are being overlaid to create the policy cache.
-
-
 =head1 RETURN VALUE
 
 The aa_policy_cache_new() function returns 0 on success and I<*policy_cache>
@@ -140,29 +102,15 @@ aa_policy_cache_ref() returns the value of I<policy_cache>.
 aa_policy_cache_remove() and aa_policy_cache_replace_all() return 0 on success.
 -1 is returned on error, with errno set appropriately.
 
-aa_policy_cache_dir_path() returns a path string which must be freed by the
-caller. NULL is returned on error, with errno set appropriately.
-
-aa_policy_cache_dir_levels() returns a number indicating the number of
-directory levels there are associated with the I<policy_cache>.
-
-aa_policy_cache_dir_path_preview() is the same as
-aa_policy_cache_dir_path() except that it doesn't require an existing
-I<aa_policy_cache> object. This is useful if the calling program cannot
-create an I<aa_policy_cache> object due to lack of privileges needed to
-create the cache directory.
-
 =head1 ERRORS
 
 The errno value will be set according to the underlying error in the
-I<aa_policy_cache> family of functions that return -1 or NULL on error.
+I<aa_policy_cache> family of functions that return -1 on error.
 
 =head1 NOTES
 
-All aa_policy_cache functions described above, except for the
-aa_policy_cache_dir_path() function was added in libapparmor version
-2.13. All the other aa_policy_cache functions described above are
-present in libapparmor version 2.10.
+All aa_policy_cache functions described above are present in libapparmor
+version 2.10 and newer.
 
 aa_policy_cache_unref() saves the value of errno when called and restores errno
 before exiting in libapparmor version 2.12 and newer.
@@ -170,7 +118,7 @@ before exiting in libapparmor version 2.12 and newer.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_query_label.pod

@@ -123,7 +123,7 @@ query and can change at any point in the future.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_splitcon.pod

@@ -63,7 +63,7 @@ on error.
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>.
+L<https://bugs.launchpad.net/apparmor/+filebug>.
 
 =head1 SEE ALSO
 

libraries/libapparmor/doc/aa_stack_profile.pod

@@ -41,7 +41,7 @@ result is an intersection of all profiles which are stacked. Stacking profiles
 together is desirable when wanting to ensure that confinement will never become
 more permissive. When changing between two profiles, as performed with
 aa_change_profile(2), there is always the possibility that the new profile is
-more permissive than the old profile, but that possibility is eliminated when
+more permissive than the old profile but that possibility is eliminated when
 using aa_stack_profile().
 
 To stack a profile with the current confinement context, a task can use the
@@ -68,7 +68,7 @@ The aa_stack_onexec() function is like the aa_stack_profile() function
 except it specifies that the stacking should take place on the next exec
 instead of immediately. The delayed profile change takes precedence over any
 exec transition rules within the confining profile. Delaying the stacking
-boundary has a couple of advantages: it removes the need for stub transition
+boundary has a couple of advantages, it removes the need for stub transition
 profiles and the exec boundary is a natural security layer where potentially
 sensitive memory is unmapped.
 
@@ -109,12 +109,12 @@ To immediately stack a profile named "profile_a", as performed with
 aa_stack_profile("profile_a"), the equivalent of this shell command can be
 used:
 
- $ echo -n "stack profile_a" > /proc/self/attr/current
+ $ echo -n "stackprofile profile_a" > /proc/self/attr/current
 
 To stack a profile named "profile_a" at the next exec, as performed with
 aa_stack_onexec("profile_a"), the equivalent of this shell command can be used:
 
- $ echo -n "stack profile_a" > /proc/self/attr/exec
+ $ echo -n "stackexec profile_a" > /proc/self/attr/exec
 
 These raw AppArmor filesystem operations must only be used when using
 libapparmor is not a viable option.
@@ -137,12 +137,12 @@ aa_stack_profile().
  {
          int fd;
          char buf[10];
-
+ 
          if ((fd=open("/etc/passwd", O_RDONLY)) < 0) {
                 perror("Failure opening /etc/passwd");
                 _exit(1);
          }
-
+ 
          /* Verify that we can read /etc/passwd */
          memset(&buf, 0, 10);
          if (read(fd, &buf, 10) == -1) {
@@ -153,19 +153,19 @@ aa_stack_profile().
          printf("/etc/passwd: %s\n", buf);
          close(fd);
  }
-
+ 
  int main(int argc, char * argv[])
  {
          printf("Before aa_stack_profile():\n");
          read_passwd();
-
+ 
          /* stack the "i_cant_be_trusted_anymore" profile, which
           * should not have read access to /etc/passwd. */
          if (aa_stack_profile("i_cant_be_trusted_anymore") < 0) {
              perror("Failure changing profile -- aborting");
              _exit(1);
          }
-
+ 
          printf("After aa_stack_profile():\n");
          read_passwd();
          _exit(0);
@@ -184,7 +184,6 @@ with apparmor_parser(8):
      /etc/passwd               r,
 
      # Needed for aa_stack_profile()
-     change-profile -> &i_cant_be_trusted_anymore,
      /usr/lib/libapparmor*.so* mr,
      /proc/[0-9]*/attr/current w,
  }
@@ -209,7 +208,7 @@ The output when run:
 =head1 BUGS
 
 None known. If you find any, please report them at
-L<https://gitlab.com/apparmor/apparmor/-/issues>. Note that using
+L<https://bugs.launchpad.net/apparmor/+filebug>. Note that using
 aa_stack_profile(2) without execve(2) provides no memory barriers between
 different areas of a program; if address space separation is required, then
 separate processes should be used.

libraries/libapparmor/include/aalogparse.h

@@ -19,10 +19,6 @@
 #ifndef __LIBAALOGPARSE_H_
 #define __LIBAALOGPARSE_H_
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #define AA_RECORD_EXEC_MMAP	1
 #define AA_RECORD_READ		2
 #define AA_RECORD_WRITE		4
@@ -30,10 +26,10 @@ extern "C" {
 #define AA_RECORD_LINK		16
 
 /**
- * Enum representing which syntax version the log entry used.
- * Support for V1 parsing was completely removed in 2011 and that enum entry
- * is only still there for API compatibility reasons.
+ * This is just for convenience now that we have two 
+ * wildly different grammars.
  */
+
 typedef enum
 {
 	AA_RECORD_SYNTAX_V1,
@@ -52,23 +48,70 @@ typedef enum
 	AA_RECORD_STATUS	/* Configuration change */
 } aa_record_event_type;
 
-/*
- * Use this preprocessor dance to maintain backcompat for field names
- * This will break C code that used the C++ reserved keywords "namespace"
- * and "class" as identifiers, but this is bad practice anyways, and we
- * hope that we are the only ones in a given C file that messed up this way
+/**
+ * With the sole exception of active_hat, this is a 1:1
+ * mapping from the keys that the new syntax uses.
  *
- * TODO: document this in a man page for aalogparse?
- */
-#if defined(SWIG) && defined(__cplusplus)
-#error "SWIG and __cplusplus are defined together"
-#elif !defined(SWIG) && !defined(__cplusplus)
-/* Use SWIG's %rename feature to preserve backcompat */
-#define class rule_class
-#define namespace aa_namespace
-#endif
+ * Some examples of the old syntax and how they're mapped with the aa_log_record struct:
+ *
+ * "PERMITTING r access to /path (program_name(12345) profile /profile active hat)"
+ * - operation: access
+ * - requested_mask: r
+ * - pid: 12345
+ * - profile: /profile
+ * - name: /path
+ * - info: program_name
+ * - active_hat: hat
+ *
+ * "REJECTING mkdir on /path/to/something (bash(23415) profile /bin/freak-aa-out active /bin/freak-aa-out"
+ * - operation: mkdir
+ * - name: /path/to/something
+ * - info: bash
+ * - pid: 23415
+ * - profile: /bin/freak-aa-out 
+ * - active_hat: /bin/freak-aa-out 
+ * 
+ * "REJECTING xattr set on /path/to/something (bash(23415) profile /bin/freak-aa-out active /bin/freak-aa-out)"
+ * - operation: xattr
+ * - attribute: set
+ * - name: /path/to/something
+ * - info: bash
+ * - pid: 23415
+ * - profile: /bin/freak-aa-out
+ * - active_hat: /bin/freak-aa-out
+ *
+ * "PERMITTING attribute (something) change to /else (bash(23415) profile /bin/freak-aa-out active /bin/freak-aa-out)"
+ * - operation: setattr
+ * - attribute: something
+ * - name: /else
+ * - info: bash
+ * - pid: 23415
+ * - profile: /bin/freak-aa-out
+ * - active_hat: /bin/freak-aa-out
+ * 
+ * "PERMITTING access to capability 'cap' (bash(23415) profile /bin/freak-aa-out active /bin/freak-aa-out)"
+ * - operation: capability
+ * - name: cap
+ * - info: bash
+ * - pid: 23415
+ * - profile: /bin/freak-aa-out
+ * - active_hat: /bin/freak-aa-out
+ * 
+ * "LOGPROF-HINT unknown_hat TESTHAT pid=27764 profile=/change_hat_test/test_hat active=/change_hat_test/test_hat"
+ * - operation: change_hat
+ * - name: TESTHAT
+ * - info: unknown_hat
+ * - pid: 27764
+ * - profile: /change_hat_test/test_hat
+ * - active_hat: /change_hat_test/test_hat
+ *
+ * "LOGPROF-HINT fork pid=27764 child=38229"
+ * - operation: clone
+ * - task: 38229
+ * - pid: 27764
+ **/
 
-typedef struct aa_log_record
+typedef struct
 {
 	aa_record_syntax_version version;
 	aa_record_event_type event;	/* Event type */
@@ -91,7 +134,7 @@ typedef struct aa_log_record
 	char *comm;			/* Command that triggered msg */
 	char *name;
 	char *name2;
-	char *aa_namespace;
+	char *namespace;
 	char *attribute;
 	unsigned long parent;	
 	char *info;
@@ -105,7 +148,6 @@ typedef struct aa_log_record
 	unsigned long net_local_port;
 	char *net_foreign_addr;
 	unsigned long net_foreign_port;
-
 	char *dbus_bus;
 	char *dbus_path;
 	char *dbus_interface;
@@ -117,12 +159,6 @@ typedef struct aa_log_record
 	char *fs_type;
 	char *flags;
 	char *src_name;
-
-	char *rule_class;
-
-	char *net_addr;
-	char *peer_addr;
-	char *execpath;
 } aa_log_record;
 
 /**
@@ -133,7 +169,7 @@ typedef struct aa_log_record
  * @return Parsed data.
  */
 aa_log_record *
-parse_record(const char *str);
+parse_record(char *str);
 
 /**
  * Frees all struct data.
@@ -142,9 +178,5 @@ parse_record(const char *str);
 void
 free_record(aa_log_record *record);
 
-#ifdef __cplusplus
-}
-#endif
-
 #endif
 

libraries/libapparmor/include/sys/apparmor.h

@@ -20,8 +20,6 @@
 
 #include <stdbool.h>
 #include <stdint.h>
-#include <unistd.h>
-#include <sys/socket.h>
 #include <sys/types.h>
 
 #ifdef __cplusplus
@@ -95,7 +93,7 @@ extern int aa_getprocattr(pid_t tid, const char *attr, char **label,
 			  char **mode);
 extern int aa_gettaskcon(pid_t target, char **label, char **mode);
 extern int aa_getcon(char **label, char **mode);
-extern int aa_getpeercon_raw(int fd, char *buf, socklen_t *len, char **mode);
+extern int aa_getpeercon_raw(int fd, char *buf, int *len, char **mode);
 extern int aa_getpeercon(int fd, char **label, char **mode);
 
 /* A NUL character is used to separate the query command prefix string from the
@@ -105,8 +103,8 @@ extern int aa_getpeercon(int fd, char **label, char **mode);
 #define AA_QUERY_CMD_LABEL		"label"
 #define AA_QUERY_CMD_LABEL_SIZE		sizeof(AA_QUERY_CMD_LABEL)
 
-extern int aa_query_label(uint32_t mask, char *query, size_t size, int *allowed,
-			  int *audited);
+extern int aa_query_label(uint32_t mask, char *query, size_t size, int *allow,
+			  int *audit);
 extern int aa_query_file_path_len(uint32_t mask, const char *label,
 				  size_t label_len, const char *path,
 				  size_t path_len, int *allowed, int *audited);
@@ -145,23 +143,17 @@ extern int aa_query_link_path(const char *label, const char *target,
 
 typedef struct aa_features aa_features;
 extern int aa_features_new(aa_features **features, int dirfd, const char *path);
-extern int aa_features_new_from_file(aa_features **features, int file);
 extern int aa_features_new_from_string(aa_features **features,
 				       const char *string, size_t size);
 extern int aa_features_new_from_kernel(aa_features **features);
 extern aa_features *aa_features_ref(aa_features *features);
 extern void aa_features_unref(aa_features *features);
 
-extern int aa_features_write_to_fd(aa_features *features, int fd);
 extern int aa_features_write_to_file(aa_features *features,
 				     int dirfd, const char *path);
 extern bool aa_features_is_equal(aa_features *features1,
 				 aa_features *features2);
-extern int aa_features_check(int dirfd, const char *path,
-			     aa_features *features);
 extern bool aa_features_supports(aa_features *features, const char *str);
-extern char *aa_features_id(aa_features *features);
-extern char *aa_features_value(aa_features *features, const char *str, size_t *len);
 
 typedef struct aa_kernel_interface aa_kernel_interface;
 extern int aa_kernel_interface_new(aa_kernel_interface **kernel_interface,
@@ -194,24 +186,12 @@ extern int aa_policy_cache_new(aa_policy_cache **policy_cache,
 			       aa_features *kernel_features,
 			       int dirfd, const char *path,
 			       uint16_t max_caches);
-extern int aa_policy_cache_add_ro_dir(aa_policy_cache *policy_cache, int dirfd,
-				      const char *path);
 extern aa_policy_cache *aa_policy_cache_ref(aa_policy_cache *policy_cache);
 extern void aa_policy_cache_unref(aa_policy_cache *policy_cache);
 
 extern int aa_policy_cache_remove(int dirfd, const char *path);
 extern int aa_policy_cache_replace_all(aa_policy_cache *policy_cache,
 				       aa_kernel_interface *kernel_interface);
-extern int aa_policy_cache_no_dirs(aa_policy_cache *policy_cache);
-extern char *aa_policy_cache_dir_path(aa_policy_cache *policy_cache, int n);
-extern int aa_policy_cache_dirfd(aa_policy_cache *policy_cache, int dir);
-extern int aa_policy_cache_open(aa_policy_cache *policy_cache, const char *name,
-				int flags);
-extern char *aa_policy_cache_filename(aa_policy_cache *policy_cache, const char *name);
-extern char *aa_policy_cache_dir_path_preview(aa_features *kernel_features,
-					      int dirfd, const char *path);
-
-extern int aa_split_overlay_str(char *str, char ***vec, size_t max_size, bool immutable);
 
 #ifdef __cplusplus
 }

libraries/libapparmor/include/sys/apparmor_private.h

@@ -34,8 +34,6 @@ int _aa_asprintf(char **strp, const char *fmt, ...);
 
 int _aa_dirat_for_each(int dirfd, const char *name, void *data,
 		       int (* cb)(int, const char *, struct stat *, void *));
-int _aa_overlaydirat_for_each(int dirfd[], int n, void *data,
-			int (* cb)(int, const char *, struct stat *, void *));
 
 #ifdef __cplusplus
 }

libraries/libapparmor/m4/ac_python_devel.m4

@@ -13,11 +13,6 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
            PYTHON_VERSION=""
         fi
 
-        AC_PATH_TOOL([PYTHON_CONFIG],[`basename [$PYTHON]-config`])
-        if test -z "$PYTHON_CONFIG"; then
-           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION-config in your system path])
-        fi
-
         #
         # Check for a version of Python >= 2.1.0
         #
@@ -66,17 +61,17 @@ variable to configure. See ``configure --help'' for reference.
         fi
 
         #
-        # Check if you have setuptools, else fail
+        # Check if you have distutils, else fail
         #
-        AC_MSG_CHECKING([for the setuptools Python package])
-        ac_setuptools_result=`$PYTHON -c "import setuptools" 2>&1`
-        if test -z "$ac_setuptools_result"; then
+        AC_MSG_CHECKING([for the distutils Python package])
+        ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
+        if test -z "$ac_distutils_result"; then
                 AC_MSG_RESULT([yes])
         else
                 AC_MSG_RESULT([no])
-                AC_MSG_ERROR([cannot import Python module "setuptools".
+                AC_MSG_ERROR([cannot import Python module "distutils".
 Please check your Python installation. The error was:
-$ac_setuptools_result])
+$ac_distutils_result])
                 PYTHON_VERSION=""
         fi
 
@@ -84,12 +79,12 @@ $ac_setuptools_result])
         # Check for Python include path
         #
         AC_MSG_CHECKING([for Python include path])
-        if type $PYTHON_CONFIG; then
-                PYTHON_CPPFLAGS=`$PYTHON_CONFIG --includes`
+        if type $PYTHON-config; then
+                PYTHON_CPPFLAGS=`$PYTHON-config --includes`
         fi
         if test -z "$PYTHON_CPPFLAGS"; then
-                python_path=`$PYTHON -c "import sys; import sysconfig;\
-sys.stdout.write('%s\n' % sysconfig.get_path('include'));"`
+                python_path=`$PYTHON -c "import sys; import distutils.sysconfig;\
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_inc());"`
                 if test -n "${python_path}"; then
                         python_path="-I$python_path"
                 fi
@@ -102,14 +97,14 @@ sys.stdout.write('%s\n' % sysconfig.get_path('include'));"`
         # Check for Python library path
         #
         AC_MSG_CHECKING([for Python library path])
-        if type $PYTHON_CONFIG; then
-                PYTHON_LDFLAGS=`$PYTHON_CONFIG --ldflags`
+        if type $PYTHON-config; then
+                PYTHON_LDFLAGS=`$PYTHON-config --ldflags`
         fi
         if test -z "$PYTHON_LDFLAGS"; then
                 # (makes two attempts to ensure we've got a version number
                 # from the interpreter)
-                py_version=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('%s\n' % ''.join(sysconfig.get_config_vars('VERSION')))"`
+                py_version=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('%s\n' % ''.join(get_config_vars('VERSION')))"`
                 if test "$py_version" == "[None]"; then
                         if test -n "$PYTHON_VERSION"; then
                                 py_version=$PYTHON_VERSION
@@ -119,8 +114,8 @@ sys.stdout.write("%s\n" % sys.version[[:3]])"`
                         fi
                 fi
 
-                PYTHON_LDFLAGS=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('-L' + sysconfig.get_path('stdlib') + ' -lpython\n')"`$py_version`$PYTHON -c \
+                PYTHON_LDFLAGS=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('-L' + get_python_lib(0,1) + ' -lpython\n')"`$py_version`$PYTHON -c \
 "import sys; sys.stdout.write('%s' % getattr(sys,'abiflags',''))"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
@@ -131,8 +126,8 @@ sys.stdout.write('-L' + sysconfig.get_path('stdlib') + ' -lpython\n')"`$py_versi
         #
         AC_MSG_CHECKING([for Python site-packages path])
         if test -z "$PYTHON_SITE_PKG"; then
-                PYTHON_SITE_PKG=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('%s\n' % sysconfig.get_path('purelib'));"`
+                PYTHON_SITE_PKG=`$PYTHON -c "import sys; import distutils.sysconfig; \
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_lib(0,0));"`
         fi
         AC_MSG_RESULT([$PYTHON_SITE_PKG])
         AC_SUBST([PYTHON_SITE_PKG])
@@ -141,14 +136,10 @@ sys.stdout.write('%s\n' % sysconfig.get_path('purelib'));"`
         # libraries which must be linked in when embedding
         #
         AC_MSG_CHECKING(python extra libraries)
-        if type $PYTHON_CONFIG; then
-                PYTHON_EXTRA_LIBS=`$PYTHON_CONFIG --libs --embed` || \
-                        PYTHON_EXTRA_LIBS=''
-        fi
         if test -z "$PYTHON_EXTRA_LIBS"; then
-           PYTHON_EXTRA_LIBS=`$PYTHON -c "import sys; import sysconfig; \
-conf = sysconfig.get_config_var; \
-sys.stdout.write('%s %s %s\n' % (conf('BLDLIBRARY'), conf('LOCALMODLIBS'), conf('LIBS')))"`
+           PYTHON_EXTRA_LIBS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
+sys.stdout.write('%s %s\n' % (conf('LOCALMODLIBS'), conf('LIBS')))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
         AC_SUBST(PYTHON_EXTRA_LIBS)
@@ -157,13 +148,9 @@ sys.stdout.write('%s %s %s\n' % (conf('BLDLIBRARY'), conf('LOCALMODLIBS'), conf(
         # linking flags needed when embedding
         #
         AC_MSG_CHECKING(python extra linking flags)
-        if type $PYTHON_CONFIG; then
-                PYTHON_EXTRA_LDFLAGS=`$PYTHON_CONFIG --ldflags --embed` || \
-                        PYTHON_EXTRA_LDFLAGS=''
-        fi
         if test -z "$PYTHON_EXTRA_LDFLAGS"; then
-                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import sys; import sysconfig; \
-conf = sysconfig.get_config_var; \
+                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
 sys.stdout.write('%s\n' % conf('LINKFORSHARED'))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])
@@ -177,7 +164,7 @@ sys.stdout.write('%s\n' % conf('LINKFORSHARED'))"`
         # save current global flags
         ac_save_LIBS="$LIBS"
         ac_save_CPPFLAGS="$CPPFLAGS"
-        LIBS="$ac_save_LIBS $PYTHON_EXTRA_LIBS $PYTHON_LDFLAGS"
+        LIBS="$ac_save_LIBS $PYTHON_LDFLAGS"
         CPPFLAGS="$ac_save_CPPFLAGS $PYTHON_CPPFLAGS"
         AC_TRY_LINK([
                 #include <Python.h>

libraries/libapparmor/src/Makefile.am

@@ -11,13 +11,9 @@ INCLUDES = $(all_includes)
 # 3. If any interfaces have been added, removed, or changed since the last
 #    update,
 #    - increment AA_LIB_CURRENT
-#      - by 1 if bugfix release
-#      - by 5 on larger releases. This gives room to fix library interface
-#        problems in the unlikely event where an interface has to break.
 #    - set AA_LIB_REVISION to 0.
 # 4. If any interfaces have been added since the last public release, then
-#    - increment AA_LIB_AGE by the same amount that AA_LIB_CURRENT was
-#      incremented.
+#    - increment AA_LIB_AGE.
 # 5. If any interfaces have been removed or changed since the last public
 #    release, then
 #    - set AA_LIB_AGE to 0.
@@ -30,35 +26,30 @@ INCLUDES = $(all_includes)
 # For more information, see:
 # http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
 #
-# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
-
-AA_LIB_CURRENT = 20
-AA_LIB_REVISION = 0
-AA_LIB_AGE = 19
-EXPECTED_SO_NAME = libapparmor.so.1.19.0
+AA_LIB_CURRENT = 5
+AA_LIB_REVISION = 2
+AA_LIB_AGE = 4
 
 SUFFIXES = .pc.in .pc
 
-COMMONDIR=$(top_srcdir)/../../common/
-include $(COMMONDIR)/Make.rules
-
 BUILT_SOURCES = grammar.h scanner.h af_protos.h
 AM_LFLAGS = -v
-AM_YFLAGS = -Wno-yacc -d -p aalogparse_
+AM_YFLAGS = -d -p aalogparse_
+AM_CFLAGS = -Wall
 AM_CPPFLAGS = -D_GNU_SOURCE -I$(top_srcdir)/include/
 scanner.h: scanner.l
 	$(LEX) -v $<
 
 scanner.c: scanner.l
 
-af_protos.h:
-	 echo '#include <netinet/in.h>' | $(CC) $(CPPFLAGS) -E -dD - | LC_ALL=C  sed  -n -e "/IPPROTO_MAX/d"  -e "s/^\#define[ \\t]\\+IPPROTO_\\([A-Z0-9_]\\+\\)\\(.*\\)$$/AA_GEN_PROTO_ENT(\\UIPPROTO_\\1, \"\\L\\1\")/p" > $@
+af_protos.h: /usr/include/netinet/in.h
+	 LC_ALL=C  sed  -n -e "/IPPROTO_MAX/d"  -e "s/^\#define[ \\t]\\+IPPROTO_\\([A-Z0-9_]\\+\\)\\(.*\\)$$/AA_GEN_PROTO_ENT(\\UIPPROTO_\\1, \"\\L\\1\")/p" $< > $@
 
 lib_LTLIBRARIES = libapparmor.la
-noinst_HEADERS = grammar.h parser.h scanner.h af_protos.h private.h PMurHash.h
+noinst_HEADERS = grammar.h parser.h scanner.h af_protos.h private.h
 
-libapparmor_la_SOURCES = grammar.y libaalogparse.c kernel.c scanner.c private.c features.c kernel_interface.c policy_cache.c PMurHash.c
-libapparmor_la_LDFLAGS = -version-info $(AA_LIB_CURRENT):$(AA_LIB_REVISION):$(AA_LIB_AGE) -XCClinker -Bdynamic -pthread \
+libapparmor_la_SOURCES = grammar.y libaalogparse.c kernel.c scanner.c private.c features.c kernel_interface.c policy_cache.c
+libapparmor_la_LDFLAGS = -version-info $(AA_LIB_CURRENT):$(AA_LIB_REVISION):$(AA_LIB_AGE) -XCClinker -dynamic -pthread \
 	-Wl,--version-script=$(top_srcdir)/src/libapparmor.map
 
 pkgconfigdir = $(libdir)/pkgconfig
@@ -73,16 +64,6 @@ CLEANFILES = libapparmor.pc
 tst_aalogmisc_SOURCES = tst_aalogmisc.c
 tst_aalogmisc_LDADD = .libs/libapparmor.a
 
-tst_aalogparse_cpp_SOURCES = tst_aalogparse_cpp.cpp
-tst_aalogparse_cpp_LDADD = .libs/libapparmor.a
-
-tst_aalogparse_oldname_SOURCES = tst_aalogparse_oldname.c
-tst_aalogparse_oldname_LDADD = .libs/libapparmor.a
-
-tst_aalogparse_reentrancy_SOURCES = tst_aalogparse_reentrancy.c
-tst_aalogparse_reentrancy_LDADD = .libs/libapparmor.a
-tst_aalogparse_reentrancy_LDFLAGS = -pthread
-
 tst_features_SOURCES = tst_features.c
 tst_features_LDADD = .libs/libapparmor.a
 
@@ -90,11 +71,7 @@ tst_kernel_SOURCES = tst_kernel.c
 tst_kernel_LDADD = .libs/libapparmor.a
 tst_kernel_LDFLAGS = -pthread
 
-check_PROGRAMS = tst_aalogmisc tst_aalogparse_cpp tst_aalogparse_reentrancy tst_aalogparse_oldname tst_features tst_kernel
+check_PROGRAMS = tst_aalogmisc tst_features tst_kernel
 TESTS = $(check_PROGRAMS)
 
-.PHONY: check-local
-check-local:
-	test -f ./.libs/$(EXPECTED_SO_NAME) || { echo '*** unexpected .so name/number for libapparmor (expected $(EXPECTED_SO_NAME), the actual filename is shown below) ***' ; ls -l ./.libs/libapparmor.so.*.* ; exit 1; }
-
 EXTRA_DIST = grammar.y scanner.l libapparmor.map libapparmor.pc