2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-09-01 14:55:10 +00:00

Compare commits

..

475 Commits

Author SHA1 Message Date
John Johansen
6f83b3491a Preoarse for AppArmor 4.1.1 release
- update version file

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:45:29 -07:00
Ryan Lee
9cc2931d1b parser: set progname explicitly for tst_regex
Otherwise tst_regex would log as being from parser_common.c instead of
being from the actual source of parser_regex.c

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 6e643a1dab)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
20544e0f74 ci: build test images explicitly when requested
The recent change to make CI pipeline build test images on a manual
trigger masks the outcome of the pipeline. Let's use the new inputs [1]
feature to allow manually triggering the pipeline with an explicitly
built image instead.

[1] https://docs.gitlab.com/ci/inputs/

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 5aed9e8a50)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
65f5f2a28d ci: document the GitLab cache hack
We rely on a hack that avoids compressing and pushing the cache if it
has not really changed but it's worth adding links.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit f9ba11a91e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
9d9ef3f977 ci: allow building the spread in master
The current logic will only build spread images, for master (which uses
protected cache), when the .image-garden.mk or .gitlab-ci.yml files
change as compared to master. This is great IF they change and WHEN the
cache is hot but right now it seems that this is not the case and master
just has no protected cache.

Add a manual knob to run the one-off cache job whenever we want to.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 272ad36df8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
b6bb081738 ci: optimise image-* job to skip cache upload if unchanged
This relies on a documented hack that makes GitLab cache machinery
skip the upload if all of the cached files are missing in the tree.

This saves about a minute per pull request CI/CD run times the number of
images required for testing.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 81c1b86373)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
5d4cbeea5e ci: git restore-mtime .image-garden.mk
This fixes the long standing issue affecting caching of the image
between the image-* jobs and the spread-* jobs.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit d2d0f36244)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
51cc3748fc ci: make all jobs interruptible
This way they can be automatically cancelled by GitLab when a new commit is pushed
to a merge request, this providing feedback to the tip of the branch or pull request
more rapidly.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 50734c9689)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Zygmunt Krynicki
7b6e1a45d6 ci: exclude generated content from spread copy
This allows having a locally-built apparmor tree while using spread to
test against other distributions.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit a5bae11cfd)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
vlefebvre
104d601657 unix-chkpwd: Add read capability to profile
Following the Security Technical Implementation Guide, it is better to
set the permissions to 0000 for the shadow file.
However, since PAM version 1.6.0, after this change [0], unix-chkpwd
will unconditionnaly read the shadow file. And with the previous
restriction, the binary has an access denied to the shadow which
blocks user authentications. Moreover the PAM changes is needed to fix
the CVE-2024-10041.
Giving the read caability to the unix-chkpwd profile allows it to
function properly. See bug report [1].

[0] - https://github.com/linux-pam/linux-pam/pull/686
[1] - https://bugzilla.suse.com/show_bug.cgi?id=1241678

Signed-off-by: vlefebvre <valentin.lefebvre@suse.com>
(cherry picked from commit 556396a172)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-06-09 15:39:14 -07:00
Christian Boltz
b50ee98352 Merge libapparmor/test: avoid writing __pycache__
Having a `__pycache__` on check can result in all kinds of weird issues.
Notaby, the test environment is currently clearing all environment variables,
including those responsible for keeping a reproducible build.
This is not immediately a problem for functionality,
but complicates downstream distribution in systems such as nix, where it is considered a bug [1].

It might also be possible to force determinism by exporting env vars instead:
```
  DETERMINISTIC_BUILD=1
  PYTHONHASHSEED=0
```
This forces a special mode on the pycache, where instead of a `moddate`,
it will then store a hash of the outputs [2].
This would be an alternative fix, but considering apparmor upstream does
not (yet) test for bit-reproducibility, it is likely too fragile here.

[1] https://github.com/NixOS/nixpkgs/issues/409032
[2] https://peps.python.org/pep-0552/

I understand AppArmor might or might not care about deterministic builds.
I was writing this patch for nixpkgs anyways, so I might as well try to
contribute it - whether it gets merged or not.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1697
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 9fabe25a9f)

f584505a libapparmor/test: avoid writing __pycache__

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-05-21 16:45:21 +00:00
John Johansen
951c683dfa Merge parser: enable create perm when label is defined
Due to how labeling is implemented, during the creation it is not yet
defined, so we need to grant create permissions without attaching the
label yet. Also, adjust tests to pass when label support is
implemented in the kernel.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1623
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit d94ff137ef)
2025-05-12 01:09:32 -07:00
Georgia Garcia
60025a8479 tests: detect if label is supported in the kernel
When label is detected in the kernel, the tests pass.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit c25f2d3407)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-12 01:09:32 -07:00
Georgia Garcia
392257c1e5 parser: add label to mqueue debug output
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit b718c53b97)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-12 01:09:32 -07:00
Georgia Garcia
5a82779c4c parser: enable create perm when label is defined
Due to how labeling is implemented, during the creation it is not yet
defined, so we need to grant create permissions without attaching the
label yet.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 306b656ba2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-12 01:09:32 -07:00
John Johansen
99680f3086 Merge parser: fix handling of norelatime mount rule flag
Specifying norelatime should set the corresponding MS_RELATIME flag clear
bit. Instead, it ORed in MS_NORELATIME, which expands to 0. Properly set
the clear bit by using MS_RELATIME.

Fixes: c9e31b7f "Add mount rules"

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1679
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e6bedaac1d)
2025-05-08 05:42:21 -07:00
Ryan Lee
0ae13d8e4a parser: fix handling of norelatime mount rule flag
Specifying norelatime should set the corresponding MS_RELATIME flag clear
bit. Instead, it ORed in MS_NORELATIME, which expands to 0. Properly set
the clear bit by using MS_RELATIME.

Fixes: c9e31b7f "Add mount rules"

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 711bbac5eb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-08 05:42:21 -07:00
John Johansen
a2ef5d48c5 Merge abstractions/mesa: more radv_builtin_shaders files
reported by darix

The initial radv_builtin_shaders rule was added in 4.1, therefore I propose this patch for at least 4.1 and master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1677
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 3f37b671c3)
2025-05-08 05:40:30 -07:00
Christian Boltz
a23b0ec4a0 abstractions/mesa: more radv_builtin_shaders files
reported by darix

(cherry picked from commit 521a81ebfb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-08 05:40:30 -07:00
John Johansen
2df16cc5a2 Merge abstractions/wutmp: allow access to lastlog2.db
Reported by darix, seen with comm="sshd-session"

I propose this for master and 4.x (optionally also 3.x even if it's less likely that systems using these branches already use lastlog2)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1676
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit b1097077f5)
2025-05-08 05:40:07 -07:00
Christian Boltz
662f4ef8af abstractions/wutmp: allow access to lastlog2.db
Reported by darix, seen with comm="sshd-session"

(cherry picked from commit f8532f2d20)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-08 05:40:07 -07:00
John Johansen
25642d1c71 Merge binutils: Fix missing include limits.h
For NAME_MAX

Fixes 322a98c8 ("Fix incorrect strnlen length in aa_load.c load_policy_dir")

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1666
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e56751cec0)
2025-05-07 15:47:04 -07:00
fossdd
bac4844329 binutils: Fix missing include limits.h
For NAME_MAX

Fixes 322a98c8 ("Fix incorrect strnlen length in aa_load.c load_policy_dir")

(cherry picked from commit 02b7e41ef3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-07 15:47:04 -07:00
John Johansen
ad4c0b9567 Merge parser: fix failure to properly apply deny clearing in perms accumulation
The internal permission accumulation is currently broken in that
the ordering of rules matter to whether deny is clearing accumulated
perms.

If a deny node comes before an allow node the deny bits will get set
but the following allow bits won't get cleared by the deny node.

This isn't currently an actual issue for mediation as the deny
bit will be applied at one of
  1. apply_and_clear_deny
  2. permission remapping
  3. run time mediation

but it does result in the internal state having sometimes having both
allow and deny bits set, dependent on order of computation, resulting
in state machines with different sizes because minimization
partitioning is based on the internal permissions.

This means that dfa minimization may not result in a truly minimal
state machine, and even worse can cause inconsistenty and failure in
tests that rely on internal state like the equality and minimization
test, as seen in https://gitlab.com/apparmor/apparmor/-/issues/513

The failure was due to musl stl sets implementation producing a
different ordering of the nodes than glibc. So when the permissions
where accumulated the internal set of permissions were different.

Fix this by giving the different node classes their own internal priority.
This will ensure the bits are properly cleared for that priority before
accumulating.

Note: other ways of fixing.

1. Fixup internal accumulation to use accumulating perms of "higher"
   priority as part of the mask (deny and allow mask prompt).
2. Do a hard masking apply at the end after all bits have been accumulated
   (ie, in accept_perms after the for loop).

the priority route was chosen because it is a little smaller and
scales better if we get new Node types we have to deal with
(eg. planned complain node).

BugLink: https://gitlab.com/apparmor/apparmor/-/issues/513
Fixes: 1ebd99115 ("parser: change priority so that it accumulates based on permissions")
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1655
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 648336489e)
2025-05-07 02:27:14 -07:00
John Johansen
981b08e9f9 parser: fix failure to properly apply deny clearing in perms accumulation
The internal permission accumulation is currently broken in that
the ordering of rules matter to whether deny is clearing accumulated
perms.

If a deny node comes before an allow node the deny bits will get set
but the following allow bits won't get cleared by the deny node.

This isn't currently an actual issue for mediation as the deny
bit will be applied at one of
  1. apply_and_clear_deny
  2. permission remapping
  3. run time mediation

but it does result in the internal state having sometimes having both
allow and deny bits set, dependent on order of computation, resulting
in state machines with different sizes because minimization
partitioning is based on the internal permissions.

This means that dfa minimization may not result in a truly minimal
state machine, and even worse can cause inconsistenty and failure in
tests that rely on internal state like the equality and minimization
test, as seen in https://gitlab.com/apparmor/apparmor/-/issues/513

The failure was due to musl stl sets implementation producing a
different ordering of the nodes than glibc. So when the permissions
where accumulated the internal set of permissions were different.

Fix this by giving the different node classes their own internal priority.
This will ensure the bits are properly cleared for that priority before
accumulating.

Note: other ways of fixing.

1. Fixup internal accumulation to use accumulating perms of "higher"
   priority as part of the mask (deny and allow mask prompt).
2. Do a hard masking apply at the end after all bits have been accumulated
   (ie, in accept_perms after the for loop).

the priority route was chosen because it is a little smaller and
scales better if we get new Node types we have to deal with
(eg. planned complain node).

BugLink: https://gitlab.com/apparmor/apparmor/-/issues/513
Fixes: 1ebd99115 ("parser: change priority so that it accumulates based on permissions")
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 06e349345e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-07 02:27:14 -07:00
John Johansen
67f51a4502 Merge utils: add support for priority rule prefix
Add basic support for the priority rules prefix. This patch does not\
allow the utils to set or suggest priorities. It allows parsing and\
retaining of the priority prefix if it already exists on rules and\
checking if it's in the supported range.

Note that this MR is supposed to replace WIP MR https://gitlab.com/apparmor/apparmor/-/merge_requests/1531

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1636
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 71ea87966a84b9ffadf49b789bf37bdce33da67d')
Signed-off-by: John Johansen <john.johansen@canonical.com>

Merge branch 'cherry-pick-71ea87966a84b9ffadf49b789bf37bdce33da67d' into apparmor-4.1
2025-05-07 02:23:29 -07:00
John Johansen
5c39009b23 utils: add support for priority rule prefix
Add basic support for the priority rules prefix. This patch does not
allow the utils to set or suggest priorities. It allows parsing and
retaining of the priority prefix if it already exists on rules and
checking if it's in the supported range.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit c0fcd1698b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-07 02:21:25 -07:00
Georgia Garcia
ab44dddba9 utils: add allow keyword to list of unsupported modifiers
Some classes don't support modifiers like audit and deny. Only rlimit
has been checking for the allow keyword, but the others shouldn't
support it as well. Since they all do the same check, refactor them
into a method from BaseRule in case more modifiers are added.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 3389230437)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-05-07 02:15:18 -07:00
Christian Boltz
3d14d51253 Merge parser: fix if condition at the bottom of equality.sh
The lack of a space after $testtype is a syntax error and was causing the
equality tests on Ubuntu Xenial to be silently skipped and marked PASS.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1670
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit bd46a02e47)

17ee87ad parser: fix if condition at the bottom of equality.sh

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-05-05 19:03:50 +00:00
John Johansen
e026d4a95d Merge [cherry-pick] binutils/aa-status: don't exit if no profiles are loaded
Downstream report: https://github.com/NixOS/nixpkgs/issues/347490

Output of `aa-status` is nondescriptive if no profiles are loaded.

Worse yet, the json output isn't even valid json. It would make sense to just return a json object with no entries, instead of returning a non-json `eprint` to stderr.

**Ideally** output of non-json would be more descriptive.

Currently:

```
apparmor module is loaded.
Failed to get profiles: 2....
```

What i would prefer:

```
apparmor module is loaded.
Failed to get profiles: No policies loaded
```

However, i am unfamiliar with how the translation framework works, and thus not confident to do this change blindly. I am happy to add a commit doing so if i know where to change all that.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1652
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 6f480cb819)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1656
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
2025-04-30 08:01:56 +00:00
Grimmauld
699ef083a6 binutils/aa-status: don't exit if no profiles are loaded
Downstream report: https://github.com/NixOS/nixpkgs/issues/347490

Output of `aa-status` is nondescriptive if no profiles are loaded.

Worse yet, the json output isn't even valid json.
It would make sense to just return a json object with no entries,
instead of returning a non-json `eprint` to stderr.
2025-04-28 09:16:53 +02:00
Steve Beattie
c0f6085952 Merge parser: fix rlimit ofile when built on musl libc
glibc defines bsd's rlimit ofile as nofile, however musl does not define
rlimit ofile at all.

Instead of just dropping ofile which would be bad for policy portability
make sure it is defined to be nofile.

This is a partial fie for
https://gitlab.com/apparmor/apparmor/-/issues/513

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1648
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
(cherry picked from commit 887ff42043)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-23 00:47:54 -07:00
John Johansen
1dba775f1d Merge make AMD GPUs work better
Proposed by darix

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1642
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 7702b40359)
2025-04-21 12:31:09 -07:00
Christian Boltz
6ca0353efd make AMD GPUs work better
Proposed by darix

(cherry picked from commit 5d71e19753)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-21 12:31:09 -07:00
John Johansen
d8bacb87b4 Merge abstractions/nameservice: allow kanidm-unixd
If kanidm is configured in nsswitch.conf(5), access to the kanidm-unixd
configuration is needed for applications to resolve entries.

For example:

```
type=AVC apparmor="DENIED" operation="open" class="file" profile="php-fpm"
name="/etc/kanidm/unixd" comm="php-fpm" requested_mask="r" denied_mask="r"
```

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1638
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8504cda668)
2025-04-21 12:30:07 -07:00
Georg Pfuetzenreuter
955d302fec abstractions/nameservice: allow kanidm-unixd
If kanidm is configured in nsswitch.conf(5), access to the kanidm-unixd
configuration is needed for applications to resolve entries.

For example:

```
type=AVC apparmor="DENIED" operation="open" class="file" profile="php-fpm"
name="/etc/kanidm/unixd" comm="php-fpm" requested_mask="r" denied_mask="r"
```

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
(cherry picked from commit 675a99ac7b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-21 12:30:07 -07:00
John Johansen
1da593aa2e Merge add path for plasmashell with qt6 based QtWebEngineProcess in debian derivatives
we are using this path in a local profile shipped with plasma-workspace in KDE neon

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1633
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit ee08bfbc90)
2025-04-21 12:27:58 -07:00
carlosdem
97d64497f1 fix typo
(cherry picked from commit d8ddd665fc)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-21 12:27:58 -07:00
carlosdem
dd9485b5be add path for plasmashell with qt6 based QtWebEngineProcess in debian derivatives
(cherry picked from commit 393444b7ba)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-21 12:27:58 -07:00
Christian Boltz
1e95e32252 Merge utils: fix unix qualifier clean rule generation
The wrong clean rule is generated when unix rules contain qualifiers,
with the order inverted with the rule name.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/511
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #511
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1639
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit c5642f9d43)

8c84b36b utils: fix unix qualifier clean rule generation

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-04-18 19:11:55 +00:00
John Johansen
4d76854372 Merge unprivileged_userns profile: Allow full file system access
Fixes https://gitlab.com/apparmor/apparmor/-/issues/505

The profile previously permitted access to `/**`, which excludes the root
directory (`/`). This commit also gives `/` access, aligning with the
intended behavior.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

Closes #505
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1626
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8138bc60d1)
2025-04-12 02:21:12 -07:00
Maxime Bélair
29f6ac644f unprivileged_userns profile: Allow full file system access
Fixes https://gitlab.com/apparmor/apparmor/-/issues/505

The profile previously permitted access to `/**`, which excludes the root
directory (`/`). This commit also gives `/` access, aligning with the
intended behavior.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
(cherry picked from commit 182db98c2a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-12 02:21:12 -07:00
John Johansen
53074bb906 Preoarse for AppArmor 4.1 release
- update version file
- bump library version

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 09:20:05 -07:00
John Johansen
62aeb03d99 Merge tests: regressions: fix unix_socket_pathname.sh for upstream kernels
FS based unix sockets have a complicatd interaction with socket
mediation some of the mediation happens in file hooks while other
parts happen in network hooks.

When the kernel doesn't have the unix socket mediation patches the
interactions become largely mediated through the network hooks, as
unix rules get downgraded to socket rules. However some filesystem
operations are needed, and some hooks like bind may be called
differently based on the unix socket type, and not just the address.
Without the kernel patches these variations are not taken into
account.

Changes in the parser networking permission mappings have also
affected the downgrade path, as the parser now supports permissions on
socket rules, downgrades can use permissions and be more faithful to
the original rule but this can also break tests that didn't add all
the permissions needed for the downgrade case.

update unix_socket_pathname.sh to detect whether rule downgrades are
being used, and adjust permissions and expectations based on this.

Fixes: 7ce768244 ("tests: regression: fix regression test for upstream kernels")

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1622
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit d9ecaf60bc)
2025-04-08 09:06:24 -07:00
John Johansen
cb67e865cf tests: regression: increase unix socket test timeout
The tests on slower systems are occassionally timing out leading to
inconsistent pass/fail runs. The time out failure depending on which
test it occurs in can result in false passes, or failres.

Double the timeout, which hopefully will be enough to avoid the
timeout issue without making the tests wait too long.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2c784709b2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 09:06:24 -07:00
John Johansen
3cc7bf844e tests: regressions: fix unix_socket_pathname.sh for upstream kernels
FS based unix sockets have a complicatd interaction with socket
mediation some of the mediation happens in file hooks while other
parts happen in network hooks.

When the kernel doesn't have the unix socket mediation patches the
interactions become largely mediated through the network hooks, as
unix rules get downgraded to socket rules. However some filesystem
operations are needed, and some hooks like bind may be called
differently based on the unix socket type, and not just the address.
Without the kernel patches these variations are not taken into
account.

Changes in the parser networking permission mappings have also
affected the downgrade path, as the parser now supports permissions on
socket rules, downgrades can use permissions and be more faithful to
the original rule but this can also break tests that didn't add all
the permissions needed for the downgrade case.

update unix_socket_pathname.sh to detect whether rule downgrades are
being used, and adjust permissions and expectations based on this.

Fixes: 7ce768244 ("tests: regression: fix regression test for upstream kernels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 08f9466d1c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 09:06:24 -07:00
Zygmunt Krynicki
fff99a1c6a Add support for running image-garden as a snap
The new image-garden snap offers a one-stop-shop for integration
testing, bundling qemu, spread and image-garden build recipes.

Extend the documentation, the run-spread.sh helper script as well as
spread.yaml to support this new method.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit bd500e2391)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 05:57:02 -07:00
Christian Boltz
3023e6cd09 Check for mount rules with multiple 'fstype'
... and adjust the tools to raise an exception if such a rule is found.
While this is not nice, it's better than the previous behaviour where
only the last 'fstype' was kept, and the others were lost when writing
the rule.

(cherry picked from commit b5894687ed)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 05:55:53 -07:00
Christian Boltz
9178bfc444 Check for mount rules with multiple 'options'
... and adjust the tools to raise an exception if such a rule is found.
While this is not nice, it's better than the previous behaviour where
only the last 'options' was kept, and the others were lost when writing
the rule.

(cherry picked from commit 171e0b1fa9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-08 05:55:53 -07:00
John Johansen
959b1e0405 Merge tests: regression: fix regression test for upstream kernels
The attach_disconnected.sh and deleted.sh tests added expanded their
testing by using unix sockets. This however ever needs support of
unix socket mediation.

Provide a minimal fix by setting bailouts for the the tests if the
requirement is not present. Long term it would be better if the
expected/needed permissions sets could be tweaked to take into
account the permissions required by the use of unix sockets.

The fix f47d5c70a fix af_unix tests for v8 networking, was never
correct, though it worked and was closer before support for fine
grained inet mediation landed. Before finegrained inet mediation
landed unix rules would allow specifying the permission but inet would
not only allowing coarse socket mediation rules. While the backend
supported finegrained permissions in v8 socket mediation the parser
did not.

If af_unix mediation was not supported by the kernel the af_unix
mediation rule would be downgrade to a network rule. All network
socket rules allowed full permission because the parser didn't
support permissions on socket rules. So the "unix create," rule
was being downgraded to a "unix," rule. Thus the "unix create",
rule was enough permissions, in the downgrade even though it
actually wasn't enough permissions.

With support for fine grained inet permissions, support for permissions
on socket rules also landed. When this happend "unix create," was not
enough permissions any more because it was not downgraded to "unix,",
this resulted in failed mediation.

Fixes: cb4a397b1 ("tests: add attach_disconnected tests")
Fixes: f47d5c70a ("fix af_unix tests for v8 networking")

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1621
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0a13a56f5c)
2025-04-07 18:19:22 -07:00
John Johansen
67dc25ac6d tests: regression: fix regression test for upstream kernels
The attach_disconnected.sh and deleted.sh tests added expanded their
testing by using unix sockets. This however ever needs support of
unix socket mediation.

Provide a minimal fix by setting bailouts for the the tests if the
requirement is not present. Long term it would be better if the
expected/needed permissions sets could be tweaked to take into
account the permissions required by the use of unix sockets.

The fix f47d5c70a fix af_unix tests for v8 networking, was never
correct, though it worked and was closer before support for fine
grained inet mediation landed. Before finegrained inet mediation
landed unix rules would allow specifying the permission but inet would
not only allowing coarse socket mediation rules. While the backend
supported finegrained permissions in v8 socket mediation the parser
did not.

If af_unix mediation was not supported by the kernel the af_unix
mediation rule would be downgrade to a network rule. All network
socket rules allowed full permission because the parser didn't
support permissions on socket rules. So the "unix create," rule
was being downgraded to a "unix," rule. Thus the "unix create",
rule was enough permissions, in the downgrade even though it
actually wasn't enough permissions.

With support for fine grained inet permissions, support for permissions
on socket rules also landed. When this happend "unix create," was not
enough permissions any more because it was not downgraded to "unix,",
this resulted in failed mediation.

Fixes: cb4a397b1 ("tests: add attach_disconnected tests")
Fixes: f47d5c70a ("fix af_unix tests for v8 networking")

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 7ce768244d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-07 18:19:22 -07:00
John Johansen
a974ad85fc Merge parser: Fix special casing for detached move mounts
MR: 1561 Added the ability to specify special a keyword to allow
detached mounts. Unfortunately it updated remount to use the device
and devbuffer when remounts current encoding doesn't support it.

This caused the mount.sh regression test to fail in the following
way.

```
$ sudo bash mount.sh
[sudo] password for jj:
    using mount rules ...
Error: mount failed. Test 'MOUNT (confined cap bind mount remount rprivate conflict)' was expected to 'pass'. Reason for failure 'FAIL: mount /tmp/sdtest.358520-12403-ASaOnn/mountpoint2 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
    not supported by parser - skipping mount options=(nodirsync),
Error: mount failed. Test 'MOUNT (confined cap mount remount option)' was expected to 'pass'. Reason for failure 'FAIL: mount /dev/loop40 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
Error: mount failed. Test 'MOUNT (confined cap mount remount)' was expected to 'pass'. Reason for failure 'FAIL: mount /dev/loop40 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
Error: mount passed. Test 'MOUNT (confined cap mount remount deny option)' was expected to 'fail'
```

Revert the change to remount. This fixes the regression failure.
fa0746f2e parser: add special casing for detached move mounts
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1618
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 90938de5c4)
2025-04-07 05:22:57 -07:00
John Johansen
99fd58ee09 parser: Fix special casing for detached move mounts
MR: 1561 Added the ability to specify special a keyword to allow
detached mounts. Unfortunately it updated remount to use the device
and devbuffer when remounts current encoding doesn't support it.

This caused the mount.sh regression test to fail in the following
way.

```
$ sudo bash mount.sh
[sudo] password for jj:
    using mount rules ...
Error: mount failed. Test 'MOUNT (confined cap bind mount remount rprivate conflict)' was expected to 'pass'. Reason for failure 'FAIL: mount /tmp/sdtest.358520-12403-ASaOnn/mountpoint2 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
    not supported by parser - skipping mount options=(nodirsync),
Error: mount failed. Test 'MOUNT (confined cap mount remount option)' was expected to 'pass'. Reason for failure 'FAIL: mount /dev/loop40 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
Error: mount failed. Test 'MOUNT (confined cap mount remount)' was expected to 'pass'. Reason for failure 'FAIL: mount /dev/loop40 on /tmp/sdtest.358520-12403-ASaOnn/mountpoint failed - Permission denied'
Error: mount passed. Test 'MOUNT (confined cap mount remount deny option)' was expected to 'fail'
```

Revert the change to remount. This fixes the regression failure.
fa0746f2e parser: add special casing for detached move mounts
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 89e8fe9c1c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-07 05:22:57 -07:00
John Johansen
8252aa572b utils: tests: fixup: bad merge conflict resolutin of test mount/ok_opt_86.sd
The picking of 31569f9f7 ("mount: accept fstype and options in any order")
to apparmor-4.1 had a merge conflict, and unfortunately the
mount/ok_opt_86.sd being removed from syntax_failure got dropped.
Remove it.

Since this was already pushed ot the publc tree this is being handled
as a fixup patch instead of revising the original pick as should
normally be done.

Fixes: 31569f9f7 ("mount: accept fstype and options in any order")
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 20:09:53 -07:00
John Johansen
adbe66f118 Merge mount: accept fstype and options in any order
Note: If multiple fstype= or options= are given, this is not detected as
an error (to keep the regex simpler). When writing back such a rule,
only one fstype and options will "survive".

Adjust the exclude list in test-parser-simple-tests.py accordingly:
- several valid mount rules no longer fail
- two invalid mount rules which so far accidentally raised an exception
  because of the fstype/options order no longer raise this exception
  (conflicting mount options, which are the real reason why these rules
  are invalid, are not detected in the tools)

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/501

I propose this fix for 4.0, 4.1 and master. (Note: excluding
`mount/ok_opt_86.sd` was added in !1561, so we either need to also
backport this, or have to slightly adjust this MR for backporting.)

Closes #501
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1616
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 37666dd736)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:20:57 -07:00
Christian Boltz
31569f9f7d mount: accept fstype and options in any order
Note: If multiple fstype= or options= are given, this is not detected as
an error (to keep the regex simpler). When writing back such a rule,
only one fstype and options will "survive".

Adjust the exclude list in test-parser-simple-tests.py accordingly:
- several valid mount rules no longer fail
- two invalid mount rules which so far accidentally raised an exception
  because of the fstype/options order no longer raise this exception
  (conflicting mount options, which are the real reason why these rules
  are invalid, are not detected in the tools)

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/501
(cherry picked from commit 7726c86b79)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:20:30 -07:00
John Johansen
f70e8998ba Merge parser: add special casing for detached move mounts
upsteam move_mount mediation now allows for a detached (disconnected)
mount to be move mounted into a namespace.

Add support for this by detecting 'detached' as a keyword for the
source/device and using it to create a null match. Because existing
mount encoding using a null separator between the mount terms null
match followed by the null seperator will separate detached mounts
within the existing encoding.

```
Eg.
  mount detached -> /destination,
  mount options=(ro) fstype=ext4 detached -> /destination,
```

This is functionally equivalent to using
```
  mount "" -> /destination,
```

However using ```""``` does not provide any context that about what
the rule is allowing or why so the ```detached``` form is preferred.

This is not a perfect solution, but is what can be currently supported
by the kernel without more LSM hooks.

On kernels that don't support detached mount detection, rules using
the detached source conditional will be ignored (never matched).

This encoding also allows the existing

```
  mount,
  mount options=(move),
  mount options=(move) -> /destination,
```

to continue to work with both detached and regular mounts on kernels
that support the move_mount() syscall.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1561
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 2df4bbd39b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:14:08 -07:00
John Johansen
a8c45527f1 utils: tests: mark detached mount as tools wrong
The tools are wrong in parsing the detached mount test.

Until that can be fixed, mark the tools as wrong.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2b9f2d2cb7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:13:22 -07:00
Ryan Lee
40d7eeec32 parser: add a detached mount equality test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 63857a7972)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:11:12 -07:00
Ryan Lee
17adb705a9 parser: add detached move mounts to simple tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 315d999013)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:11:12 -07:00
Ryan Lee
18245d5e3a regression: uncomment the detached keyword mount tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit d4f75cec2b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:11:12 -07:00
John Johansen
20aa4a3ee2 parser: add special casing for detached move mounts
upsteam move_mount mediation now allows for a detached (disconnected)
mount to be move mounted into a namespace.

Add support for this by detecting 'detached' as a keyword for the
source/device and using it to create a null match. Because existing
mount encoding using a null separator between the mount terms null
match followed by the null seperator will separate detached mounts
within the existing encoding.

Eg.
  mount detached -> /destination,
  mount options=(ro) fstype=ext4 detached -> /destination,

This is functionally equivalent to using

  mount "" -> /destination,

However using "" does not provide any context that about what the rule is allowing or why so the 'detached' form is preferred.

This is not a perfect solution, but is what can be currently supported
by the kernel without more LSM hooks.

On kernels that don't support detached mount detection, rules using
the detached souce conditional will be ignored (never matched).

This encoding also allows the existing

  mount,
  mount options=(move),
  mount options=(move) -> /destination,

to continue to work with both detached and regular mounts on kernels
that support the move_mount() syscall.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit fa0746f2e2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:11:12 -07:00
John Johansen
b4b6e8103a Merge util: enhance AARE file path validation
Fixes https://bugs.launchpad.net/apparmor/+bug/2106033

Improve the validation of AARE file paths by introducing a new regex
that supports paths starting with '{' (e.g. '{/,/org/freedesktop/DBus}').
These paths are notably used in snap.lxd.* profiles.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1607
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 3b3dada5d9)
2025-04-06 14:06:55 -07:00
Maxime Bélair
e6c9371a2a util: enhance AARE file path validation
Fixes https://bugs.launchpad.net/apparmor/+bug/2106033

Improve the validation of AARE file paths by introducing a new regex
that supports paths starting with '{' (e.g. '{/,/org/freedesktop/DBus}').
These paths are notably used in snap.lxd.* profiles.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
(cherry picked from commit dbf4c27154)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 14:06:54 -07:00
John Johansen
ef74bce3b6 Merge Use the $(AWK) variable for the awk binary in the Makefiles
Followup that replaces !1576.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1581
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit f11c2032da)
2025-04-06 13:45:12 -07:00
Ryan Lee
14e03dcf40 Use the $(AWK) variable for the awk binary in the Makefiles
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 8beac326a5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 13:45:12 -07:00
John Johansen
f9c90d57af Merge Fix typo in aa-exec manpage
Follow-up of https://gitlab.com/apparmor/apparmor/-/merge_requests/1570, which was merged without fixing this.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1583
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit a3d3a96ec5)
2025-04-06 13:43:38 -07:00
Christian Boltz
204cce791f Fix typo in aa-exec manpage
(cherry picked from commit 8c12d358b0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 13:43:38 -07:00
John Johansen
262743cdc5 Merge utils/test/test-aa-notify.py: update last cmd for lxd VMs
When doing testing via LXD VMs and in particular when using "lxc exec" to run
commands in the VM, there is no controlling tty and so the output of last is
missing this column of data. Instead try even harder to parse the timestamp from
the output of "last".

Signed-off-by: Alex Murray <alex.murray@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1582
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e030ff7ea9)
2025-04-06 04:36:02 -07:00
Alex Murray
d7563e745d utils/test/test-aa-notify.py: update last cmd for lxd VMs
When doing testing via LXD VMs and in particular when using "lxc exec" to run
commands in the VM, there is no controlling tty and so the output of last is
missing this column of data. Instead try even harder to parse the timestamp from
the output of "last".

Signed-off-by: Alex Murray <alex.murray@canonical.com>
(cherry picked from commit b6654416b0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 04:36:02 -07:00
John Johansen
2af2fb935b Merge: Merge Add ncurses abstraction with terminfo paths
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1550
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Ryan Lee <rlee287@yahoo.com>
(cherry picked from commit a82b16f059)
Signed-off-by: John Johansen <john.johansen@canonical.com>

Merge branch 'cherry-pick-a82b16f05928a565fc07141630f452ee3921a99b' into apparmor-4.1
2025-04-06 04:28:41 -07:00
Ryan Lee
953d384691 Replace terminfo lines in profiles with the terminfo abstraction
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1b87b7be5e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 04:25:46 -07:00
Ryan Lee
13d6779c0b Add terminfo abstraction with terminfo paths searched by ncurses
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c45ce5502e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 04:24:58 -07:00
John Johansen
1e5adc354b Merge utils: don't skip disabled profiles for aa-enforce
When running aa-disable and then aa-enforce passing the binary path as
the argument, aa-enforce fails to enforce the profile with the error:

$ sudo aa-disable /home/foo/test
skipping disabled profile test
Profile for /home/foo/test not found, skipping

According to the man page for aa-enforce, it should work for disabled
profiles.

Note that this does not happen when passing the profile directly to
the tools, so there's a workaround for this issue:

$ sudo /aa-enforce /etc/apparmor.d/test
Setting /etc/apparmor.d/test to enforce mode.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1579
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 819802cdb3)
2025-04-06 03:49:59 -07:00
Georgia Garcia
2a78af408a utils: don't skip disabled profiles for aa-enforce
When running aa-disable and then aa-enforce passing the binary path as
the argument, aa-enforce fails to enforce the profile with the error:

$ sudo aa-disable /home/foo/test
skipping disabled profile test
Profile for /home/foo/test not found, skipping

According to the man page for aa-enforce, it should work for disabled
profiles.

Note that this does not happen when passing the profile directly to
the tools, so there's a workaround for this issue:

$ sudo /aa-enforce /etc/apparmor.d/test
Setting /etc/apparmor.d/test to enforce mode.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit b0b45b01c0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:49:59 -07:00
John Johansen
970a035e86 Merge utils: Improve regex for mount source and target
* Make glob_pattern more readable
    - replace filename and variable regex parts with RE_PROFILE_PATH_OR_VAR
    - split to multiline string

* Move `[\w-]+` into inner match group by removing/moving the ')' after the empty source.

* Prepare source_fileglob_pattern and dest_fileglob_pattern to be customizable by moving adding the closing ')))' into each of them.

* Allow empty source and any word only in mount source

See the individual commits for details.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1574
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e065dfb35a)
2025-04-06 03:48:35 -07:00
Christian Boltz
1b2f46ab11 Allow empty source and any word only in mount source
(cherry picked from commit ae20b62c31)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:48:34 -07:00
Christian Boltz
2362f00ca6 Move [\w-]+ into inner match group
... by removing/moving the ')' after the empty source.

Also prepare source_fileglob_pattern and dest_fileglob_pattern to be
customizable by moving adding the closing ')))' into each of them.

(cherry picked from commit 537fec8b36)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:48:34 -07:00
Christian Boltz
5019810f4e Make glob_pattern more readable
- replace filename and variable regex parts with RE_PROFILE_PATH_OR_VAR
- split to multiline string

(cherry picked from commit 2843c0f155)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:48:34 -07:00
John Johansen
81d98c432b Merge profiles: allow sanitized_helper to run snap applications
This allows evince to share the document to a program running as a snap,
e.g. mail via firefox. Given that /usr/bin/snap itself is not confined
I chose to use ux, rather than pux.

Tested locally on Ubuntu 24.04 by sharing a document from evince to
firefox.

Fixes: https://bugs.launchpad.net/apparmor/+bug/2095872
Jira: https://bugs.launchpad.net/apparmor/+bug/2095872

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1572
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 791935b9f8)
2025-04-06 03:45:54 -07:00
Zygmunt Krynicki
1f5ee23edb profiles: allow sanitized_helper to run snap applications
This allows evince to share the document to a program running as a snap,
e.g. mail via firefox. Given that /usr/bin/snap itself is not confined
I chose to use ux, rather than pux.

Tested locally on Ubuntu 24.04 by sharing a document from evince to
firefox.

Fixes: https://bugs.launchpad.net/apparmor/+bug/2095872
Jira: https://bugs.launchpad.net/apparmor/+bug/2095872

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 2fe23fef17)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:45:54 -07:00
John Johansen
bce038054e Merge binutils: aa-exec: add basic documentation on stacking and namespaces
The aa-exec man page makes reference to aa-stack(8) and aa-namespace(8)
manpages that don't exist. For now just remove those references and
add a short blurb on using aa-exec with stacking and namespaces.

Proper full manpages for stacking and namespaces need to be added
but that is beyound the scope of this fix.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/496
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1570
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8ed0bddcc9)
2025-04-06 03:42:06 -07:00
John Johansen
7d93f0620a binutils: aa-exec: add basic documentation on stacking and namespaces
The aa-exec man page makes reference to aa-stack(8) and aa-namespace(8)
manpages that don't exist. For now just remove those references and
add a short blurb on using aa-exec with stacking and namespaces.

Proper full manpages for stacking and namespaces need to be added
but that is beyound the scope of this fix.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/496
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit e64bd1ccdf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:42:06 -07:00
John Johansen
e70e5f880d Merge usr.bin.passwd profile fixes
* passwd -e LOGIN was failing
* Allow execution of /usr/sbin/nscd
  See: bee77ffc29/lib/nscd.c (L23-L27)
* Allow pam_passwdqc to read /etc/passwdqc.conf and passwdqc filter
  files (see https://www.openwall.com/passwdqc/)
* Allow setuid & fsetid capabilities
* Allow locking with /etc/shadow.PID & /etc/shadow.lock
* Allow shadow backup /etc/shadow- and whatever /etc/shadow+ is used for

Example failures:

```
type=AVC msg=audit(1740926750.381:99876): apparmor="DENIED" operation="capable" profile="/usr/bin/passwd" pid=16139 comm="passwd" capability=4  capname="fsetid"
type=AVC msg=audit(1740926025.892:99797): apparmor="DENIED" operation="capable" profile="/usr/bin/passwd" pid=14443 comm="passwd" capability=7  capname="setuid"
type=AVC msg=audit(1740926673.852:99871): apparmor="DENIED" operation="link" profile="/usr/bin/passwd" name="/etc/shadow.lock" pid=15961 comm="passwd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 target="/etc/shadow.15961"FSUID="root" OUID="root"
type=AVC msg=audit(1740926025.892:99798): apparmor="DENIED" operation="mknod" profile="/usr/bin/passwd" name="/etc/shadow.14443" pid=14443 comm="passwd" requested_mask="c" denied_mask="c" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1740926502.637:99859): apparmor="DENIED" operation="open" profile="/usr/bin/passwd" name="/etc/shadow-" pid=15555 comm="passwd" requested_mask="wc" denied_mask="wc" fsuid=0 ouid=0FSUID="root" OUID="root"
type=AVC msg=audit(1740926820.608:99882): apparmor="DENIED" operation="rename_src" profile="/usr/bin/passwd" name="/etc/shadow+" pid=16275 comm="passwd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root"
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1566
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0d6e447d24)
2025-04-06 03:39:59 -07:00
pyllyukko
851cb626f8 usr.bin.passwd profile fixes
* passwd -e LOGIN was failing
* Allow execution of /usr/sbin/nscd
  See: bee77ffc29/lib/nscd.c (L23-L27)
* Allow pam_passwdqc to read /etc/passwdqc.conf and passwdqc filter
  files (see https://www.openwall.com/passwdqc/)
* Allow setuid & fsetid capabilities
* Allow locking with /etc/shadow.PID & /etc/shadow.lock
* Allow shadow backup /etc/shadow- and whatever /etc/shadow+ is used for

(cherry picked from commit ab1a455f05)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:39:59 -07:00
John Johansen
b8fc2b7ea0 Merge profiles: fix sbuild to work with the unprivileged_unshare profile
sbuild is an unconfined profile allowing it to bypass the unprivlieged
user namespace restriction.

unconfined profiles use a pix transition which means that when the
unprivileged_unshare profile is enabled, the binaries in an unconfined
profile calling unshare will cause a transition to the unprivileged_unshare
profile.

This will break sbuild because it needs capabilities within the
user namespace.

However we cannot just add a x transition rule to unconfined profiles, as
the transitions won't be respected. Instead, we have to make the profile
a default allow profile and add a transition that will override
the default pix transition of allow all.

We have to add the attached_disconnected and mediated_deleted flags
because sbuild is manipulating mounts.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1555
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 472181ae75)
2025-04-06 03:08:42 -07:00
John Johansen
65ac6983c5 profiles: fix sbuild to work with the unprivileged_unshare profile
sbuild is an unconfined profile allowing it to by-pass the unprivlieged
user namespace restritction.

unconfined profiles us a pix transition which means when the
unprivileged_unshare profile is enabled, the binaries in an unconfined
profile calls unshare it will transition to the unprivileged_unshare
profile.

This will break sbuild because it needs capabilities within the
user namespace.

However we can not just add a x transition rule to unconfined profiles,
the transitions won't be respected. Instead we have to make the profile
a default allow profile, and add a transition that will override
the default pix transition of allow all.

We have to add the attached_disconnected and mediated_deleted flags
because sbuild is manipulating mounts.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 7abfc1baf7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 03:08:42 -07:00
John Johansen
98eb4032f4 Merge rule_ents from conditional block are dropped
In the following policy, "ptrace" would be dropped during merging:
```
$FOO=true
/bin/true {
  if $FOO {
      ptrace,
  }
}
```

Current behavior:
```
----- Debugging built structures -----
Name:		/bin/true
Local To:	<NULL>
Mode:
```

With patch:
```
----- Debugging built structures -----
Name:		/bin/true
Local To:	<NULL>
Mode:
ptrace,
```

I am quite new to the AA code base, so please let me know if I'm missing something obvious and this is intended behavior :)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1551
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 46335d58cf)
2025-04-06 02:28:40 -07:00
doublez13
33b953b160 rule_ents from conditional block are dropped
In the following policy, "ptrace" would be dropped during merging:

$FOO=true
/bin/true {
  if $FOO {
      ptrace,
  }
}

Current behavior:
----- Debugging built structures -----
Name:		/bin/true
Local To:	<NULL>
Mode:

With patch:
----- Debugging built structures -----
Name:		/bin/true
Local To:	<NULL>
Mode:
ptrace,

(cherry picked from commit dad66f663b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-04-06 02:28:40 -07:00
John Johansen
b7b2fe6605 Merge libapparmor: fix feature matching for aa_feature_supports
The feature matching done in aa_feature_supports calls walk_one to
traverse the features string. This function is supposed to match on
the feature and return, but it matches the feature based on the length
of the feature to check. If the feature to check shorter, then it
would return as if the feature was not present - which was the case
for the following example:

feature_file contains (shortened for example purposes):

```
network_v9 {af_unix {yes
}
}
network_v8 {af_inet {yes
}
}
network {af_unix {yes
}
}
```

if the feature to be checked was simply "network", then walk_one would
return that the feature was not present.

Fix this by restarting the matching if there was not a full match at
the end of the feaure to check.

Fixes: https://bugs.launchpad.net/apparmor/+bug/2105986

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1608
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 69355d41f7)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-04-03 19:06:08 -03:00
Ryan Lee
37f792377c Merge utils: skip user config reading in aa-notify when --configdir is given
--configdir is meant for testing and should override all other configs,
instead of being combined with them. Config combination causes aa-notify
test failures if e.g. the user-local config sets filtering options.

Also supply a notify.conf file for exclusive use during testing.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1610
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit abe588cea4)
2025-04-03 14:54:10 -07:00
Ryan Lee
739fea2ece utils: supply a notify.conf for aa-notify tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e949653b1a)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-03 14:54:10 -07:00
Ryan Lee
27748237f1 utils: skip user config reading in aa-notify when --configdir is given
--configdir is meant for testing and should override all other configs,
instead of being combined with them. Config combination causes aa-notify
test failures if e.g. the user-local config sets filtering options.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 096c8df52b)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-03 14:54:10 -07:00
Ryan Lee
3cd419eab5 utils: add unprivileged_userns to aa-notify list of special profiles
Both the unconfined profile and unprivileged_userns are part of the
default notify.conf, so the default fallback when no configurations are
present should also match this default.

MR: !1609
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 4623da695e)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-03 14:53:29 -07:00
Ryan Lee
9c2385d2b3 logprof: add /usr prefixed kernel module path to config for /usr merge
MR: !1598
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 372dcc8250)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-02 16:33:23 -07:00
Ryan Lee
500d8af648 Merge parser: equality test fixups
The original location of the error count checks in the middle of the priority function helper was completely nonsensical. We can instead do this check just once after running all the tests.

In addition, some tests in the priority helper don't use the priority variables at all, and are moved out of the helper to avoid repeating the exact same sequence of tests 16 times.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1604
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit a54e4e2cf9)
2025-04-02 15:08:51 -07:00
Ryan Lee
4d488c8d73 parser: move equality tests not using priorities outside of priority helper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 6da10ef98f)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-02 15:08:51 -07:00
Ryan Lee
7e9ea2d7d5 parser: move error count print of equality tesets to run_tests end
The original location in the middle of the priority function helper was
completely nonsensical. We can instead do this check just once after
running all the tests.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1f32c1175e)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-04-02 15:08:51 -07:00
Ryan Lee
80de221cb9 Merge [4.1] Fix attach_disconnected typo in docs
This is the 4.1 version of https://gitlab.com/apparmor/apparmor/-/merge_requests/1599 / b398ec61c9

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1600
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>
2025-03-28 08:41:38 -07:00
Christian Boltz
6ae7ce4cb5 [4.1] Fix attach_disconnected typo in docs
This is the 4.1 version of https://gitlab.com/apparmor/apparmor/-/merge_requests/1599 / b398ec61c9
2025-03-28 13:35:16 +01:00
Zygmunt Krynicki
13deab75c2 ci: upgrade all packages in CI
We are seeing some test failures caused by the fact that a fixed kernel,
while available, is not installed the CI image. Since cloud-init does
not itself offer a way to express precise dependency on a package
version we may use a crude replacement of upgrading all the packages at
image construction time.

The next time this happens all we need is to touch the .image-garden.mk
file, so that it is more recent than the image kept in CI cache for the
re-generation to occur.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit f43221d945)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-26 10:36:57 -07:00
Ryan Lee
a6224455df regression: skip move_mount tests when move_mount binary is unavailable
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 5edca7f64f)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-26 10:36:57 -07:00
Ryan Lee
5698a624ea spread: add which to openSUSE Tumbleweek image-garden package list
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit af936812ee)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-26 10:36:57 -07:00
Ryan Lee
b216d9860f regression: replace command -v with which in Makefile
The command shell builtin is not recognized by older versions of make, so
switch back to using the which binary instead.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 52fc40a9cb)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-26 10:36:56 -07:00
Ryan Lee
bf23be40b9 regression: skip move_mount test if linux/mount.h is not found
linux/mount.h is only used in the move_mount test, which exercises the
move_mount syscall that was introduced sometime in 2018 or later. Older
systems without the header also lack the syscall, so we can just skip the
test in those cases.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 765d5b87ef)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-26 10:36:56 -07:00
Georgia Garcia
89db7e16e0 Merge apparmor-4.1: utils: fix profile and hat header generation
The header was being generated incorrectly in 2 cases: When the
profile or hat contained the parent profile in its name, as in

profile firefox//dash {
hat ^firefox//dash {

and in the unit tests, the child profile or hat was being named as the
parent profile. This was not caught by the general case because the
code has not yet been fully adapted to handle multiple nested child
profiles.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/493

(backported from MR apparmor/apparmor!1592)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1593
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-03-26 14:28:51 -03:00
Georgia Garcia
1f414ce6ba utils: fix profile and hat header generation
The header was being generated incorrectly in 2 cases:
When the profile/hat contained the parent profile in its name, as in

profile firefox//dash {
hat ^firefox//dash {

and in the unit tests, the child profile or hat was being named as the
parent profile. This was not caught by the general case because the
code has not yet been fully adapted to handle multiple nested child
profiles.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/493

(backported from MR https://gitlab.com/apparmor/apparmor/-/merge_requests/1592)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-03-26 09:56:12 -03:00
Christian Boltz
2bf37edcaa Merge apparmor-4.1 - Merge aa-logprof/aa-genprof: allow ignoring executions
Fixes the CI in the apparmor-4.1 branch

fixes https://gitlab.com/apparmor/apparmor/-/issues/302

Closes #302
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1543
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(backported from commit 71282550bb)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1594
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>
2025-03-25 22:10:58 +00:00
John Johansen
5c13f8b5b8 utils: genprof/logprof - fix missing newline nit in MR1543
This is a trivial fix for
  MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1543

instead of waiting longer for the auther to fix, the MR was merged
and this manual fixup done.

Fixes: dfe9d713f ("aa-logprof/aa-genprof: allow ignoring executions")
Signed-off-by: John Johansen <john.johansen@canonical.com>
(backported from commit 125ef7a8cb)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-03-25 16:03:31 -03:00
John Johansen
ca71a83a62 Merge aa-logprof/aa-genprof: allow ignoring executions
fixes https://gitlab.com/apparmor/apparmor/-/issues/302

Closes #302
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1543
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 71282550bb)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-03-25 15:52:50 -03:00
Scarlett Moore
8645cff654 Add qt6 abstractions for qt6 to fix KDE application crashes.
(cherry picked from commit 7f12ccf695)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-03-20 09:34:44 -07:00
Christian Boltz
f4f43271e2 Merge add support for writing quoted mount source and mountpoints
Add quotes if a mount source or mountpoint includes whitespace.
Also explicitely handle empty mount source (known from
1f33fc9b29)

As usual, some tests can't hurt ;-)

I propose this fix for 4.0..master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1573
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>


(cherry picked from commit 2fb0fa9964)

d0626085 add support for writing quoted mount source and mountpoints

Co-authored-by: John Johansen <john@jjmx.net>
2025-03-18 21:29:25 +00:00
Christian Boltz
c90d9b9288 Merge UnixRule: allow comma as separator in peer=
... and add some tests for it

I propose this fix for master and 4.1.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1580
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit df5060c3d7)

1ff9306c UnixRule: allow comma as separator in peer=

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-03-13 17:18:57 +00:00
Christian Boltz
cb7b61210c Merge utils: Fix mount rule handling for revokefs-fuse
First expand nested `(...)` in glob_pattern. This duplicates a few bytes, but makes the regex easier to read.

With that done, allow `-` in glob_pattern.

One of the possible matches in glob_pattern was `\w+` which matched for example `none`.

However, it doesn't match `revokefs-fuse` because of the `-`. Therefore change `\w+` to [\w-]+.

While on it, add two more tests - one for `none` with some options, and one with `revokefs-fuse`.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1565
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 2afdf1b214)

c1712c88 Expand nested (...) in glob_pattern
ce87b44b glob_pattern: allow `-`

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-03-10 20:36:19 +00:00
John Johansen
ecb246ec2f Merge Increase timeout for test_allow_all
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1567
Approved-by: intrigeri <intrigeri@riseup.net>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 6faa8950ed)
2025-03-04 14:25:42 -08:00
Bo YU
a7ab4b1561 Increase timeout for test_allow_all
(cherry picked from commit ca0afa1afb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-03-04 14:25:42 -08:00
John Johansen
518ccaf861 Merge utils: tests: cleanups and allow profile skipping in test-logprof and test-minitools
The utils cannot parse some profile constructs yet, so allow some profiles to be ignored in those tests.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1563
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit bf2054d963)
2025-03-04 14:25:23 -08:00
Ryan Lee
b438043963 utils: test: expand mechanism for ignoring profiles in tests
The utils cannot parse some of the newer profile constructs yet, so
generalize a pre-existing mechanism for skipping profiles to use that mechanism in the other tests that need it

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit df0358062d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-03-04 14:25:23 -08:00
John Johansen
fd7bc07f38 Merge Add a test for aa-autodep
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1398
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit c6edb65fc1)
2025-03-04 14:24:43 -08:00
Christian Boltz
da1848338f Add a test for aa-autodep
(cherry picked from commit 1f8227e671)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-03-04 14:24:43 -08:00
John Johansen
7aa4547c29 Merge test-translations: include "ignore" in exec prompts + make debugging hotkey conflicts easier
This is a follow-up of adding the "ignore" option to exec prompts in
https://gitlab.com/apparmor/apparmor/-/merge_requests/1543

To make future handling of hotkey conflicts easier,
- display all hotkey conflicts at once instead of erroring out at the first conflict.
- display all options involved in a hotkey conflict to make fixing it easier.

Since 1543 was picked into 4.1, I propose the same for this MR.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1557
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0e8377cde9)
2025-02-24 22:06:58 -08:00
Christian Boltz
662d3dd610 test-translations: include "ignore" in exec prompts
This is a follow-up of adding the "ignore" option to exec prompts in
https://gitlab.com/apparmor/apparmor/-/merge_requests/1543

(cherry picked from commit db7e3109cc)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-24 22:06:58 -08:00
Christian Boltz
1302746049 test-translations: display all hotkey conflicts at once
... instead of erroring out at the first conflict.

Also display all options involved in a hotkey conflict to make fixing it
easier.

(cherry picked from commit 3e7e9bf01f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-24 22:06:58 -08:00
John Johansen
33b2e12c12 Merge Avoid blhc "CPPFLAGS missing" false positive
Similarly to apparmor/apparmor!403, we don't really need to pass these flags
here, but if we don't, blhc raises a false positive, and I don't want to get
used to ignoring blhc failures on Debian's GitLab CI.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1558
Approved-by: Alex Murray <alex.murray@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>

(cherry picked from commit dbe13a0b9d)
2025-02-24 22:06:29 -08:00
intrigeri
ead6ff3dbe Avoid blhc "CPPFLAGS missing" false positive
Similarly to apparmor/apparmor!403, we don't really need to pass these flags
here, but if we don't, blhc raises a false positive, and I don't want to get
used to ignoring blhc failures on Debian's GitLab CI.

(cherry picked from commit 187c244056)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-24 22:06:29 -08:00
Christian Boltz
e5ae857546 Merge Import translations from launchpad
This imports translations from launchpad up to commit

revno: 2523
committer: Launchpad Translations on behalf of apparmor-dev
branch nick: apparmor
timestamp: Fri 2025-02-21 09:32:26 +0000
message:
  Launchpad automatic translations update.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1559
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit d52b301ee8)

2a87a921 Import translations from launchpad

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-02-24 12:36:30 +00:00
Georgia Garcia
50b30c2922 Merge Miscellaneous typofixes identified by lintian
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1552
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>


(cherry picked from commit de61d374ec)

4286423f parser: hfa.cc debug promt->prompt typofix
eff9f442 binutils: aa-status processess->processes typofix

Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-02-18 21:33:40 +00:00
Georgia Garcia
2312869d6f Merge Perl typemap for const char* subprofiles[]
The original plan was to have a minimal subset for Perl excluding the stuff requiring language-dependent typemaps, but it turns out that there was only one thing that required that, and it was simple enough to copy over from the SWIG repo itself. This MR contains the single non-language-generic part of the SWIG updates.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1341
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>


(cherry picked from commit 792aca634e)

5730fb6d Perl typemap for const char* subprofiles[]

Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-02-18 21:32:17 +00:00
John Johansen
c72c15cb27 Prepare for 4.1.0~beta5 release
- bump version

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:44:22 -08:00
John Johansen
d2707329ba apparmor: update translation pot files
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:39:35 -08:00
John Johansen
3aa8c4959f Merge tests: provide better output on failures
When a test fails because of an unexpected success (XFAIL), do not display the empty error log as that may confuse the reader just as it had confused the author.

In addition, when something legitimately fails then display tail of trace log as that may show some useful information.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1548
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8711c7754b)
2025-02-18 07:24:04 -08:00
Zygmunt Krynicki
12941af65f tests: display tail of bash.trace on failure
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit c268e5d11b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:24:04 -08:00
Zygmunt Krynicki
d0e07e542b tests: do not display bash.err on XFAIL passes
This makes no sense since the test has passed and there's nothing to look at in the log.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 473e791e4e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:24:03 -08:00
John Johansen
2acd4f5c7d Merge tests: mark three regression tests as fixed
The the `attach_disconnectd` test is now passing on Ubuntu 24.04+.
The `posix_ipc` is passing everywhere.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1547
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 84bf3dee2d)
2025-02-18 07:23:52 -08:00
Zygmunt Krynicki
ae4f303907 tests: remove XFAIL/mqeue, stale
There is no mqueue in Makefile TESTS anywhere. This is a red herring.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit c56cbad5ea)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:23:52 -08:00
Zygmunt Krynicki
b5e216a8de tests: mark ptrace test as fixed
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 5f8863c7ca)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:23:52 -08:00
Zygmunt Krynicki
187a1700fa tests: mark posix_ipc test as fixed
The test used to fail on some versions of Ubuntu but it now passes
everywhere.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 083dc9652b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:23:52 -08:00
Zygmunt Krynicki
0179d52a9f tests: mark attach_disconnected as fixed
The test is now passing on Ubuntu 24.04+

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 3987bf0f33)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-18 07:23:52 -08:00
John Johansen
5184066d81 Merge aa-notify: rename polkit files and template info from com.ubuntu
We should be using apparmor controlled domains for these files.

Rename the template file from
  com.ubuntu.pkexec.aa-notify.policy
to
  net.apparmor.pkexec.aa-notify.policy

And update the template file and the install file so that the files
that are generated use net.apparmor instead of com.ubuntu

Signed-off-by: John Johansen <john.johansen@canonical.com>

Closes #486
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1541
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit e085a23b40)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 18:05:30 -08:00
John Johansen
9890acd0c5 aa-notify: rename polkit files and template info from com.ubuntu
We should be using apparmor controlled domains for these files.

Rename the template file from
  com.ubuntu.pkexec.aa-notify.policy
to
  net.apparmor.pkexec.aa-notify.policy

And update the template file and the install file so that the files
that are generated use net.apparmor instead of com.ubuntu

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a410f347a3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 18:03:46 -08:00
John Johansen
819b60f37d aa-notify: fix package build install of polkit files
The install of the polkit action files for aa-notify leaks build root
information.

From OBS
  apparmor-utils.noarch: E: file-contains-buildroot (Badness: 10000) /usr/share/polkit-1/actions/com.ubuntu.pkexec.aa-notify.policy

this is present on Ubuntu as well
    <annotate key="org.freedesktop.policykit.exec.path">/build/apparmor-ZUzkoL/apparmor-4.1.0~beta4/debian/tmp/usr/lib/python3/dist-packages/apparmor/update_profile.py</annotate>

this occurs because the {LIB_PATH} template variable is being replaced
with the self.install_lib. Make sure we strip the build prefix if
we are generating the files in a build environment instead of doing
a direct install.

Closes: https://gitlab.com/apparmor/apparmor/-/issues/486
Co-Author: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit b4e6f0449b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 11:41:10 -08:00
John Johansen
1c3672a644 Merge aa-notify: fix package build install of polkit files
The install of the polkit action files for aa-notify leaks build root
information.

From OBS
  apparmor-utils.noarch: E: file-contains-buildroot (Badness: 10000) /usr/share/polkit-1/actions/com.ubuntu.pkexec.aa-notify.policy

this is present on Ubuntu as well
    <annotate key="org.freedesktop.policykit.exec.path">/build/apparmor-ZUzkoL/apparmor-4.1.0~beta4/debian/tmp/usr/lib/python3/dist-packages/apparmor/update_profile.py</annotate>

this occurs because the {LIB_PATH} template variable is being replaced
with the self.install_lib. Make sure we strip the build prefix if
we are generating the files in a build environment instead of doing
a direct install.

Closes: https://gitlab.com/apparmor/apparmor/-/issues/486
Signed-off-by: John Johansen <john.johansen@canonical.com>

Closes #486
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1540
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 697e53d752)
2025-02-14 11:41:10 -08:00
John Johansen
529f541e7a Merge tunable: add letter, alphanumeric character, hex and words variables.
Follow up from !1544 with the other basic variables.

Variables such as `@{rand6}` and `@{word6}` are very commonly used as they allow us to restrict access from rules such as: `/tmp/*`, `/tmp/??????`

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1546
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit b5ff20b5f1)
2025-02-14 11:40:59 -08:00
Alexandre Pujol
c91730e8ca tunable: add letter, alphanumeric character, hex and words variables.
(cherry picked from commit 8af71cd5f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 11:40:59 -08:00
John Johansen
c0f4a91181 Merge abstraction: add devices-usb & devices-usb-read
Needed for https://gitlab.com/apparmor/apparmor/-/merge_requests/1433

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1545
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit dc583bc1d4)
2025-02-14 11:40:49 -08:00
Alexandre Pujol
0a549886d4 abstraction: add devices-usb & devices-usb-read
(cherry picked from commit 4591ed63ba)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 11:40:49 -08:00
John Johansen
7f97215c75 Merge tunable: add int variable
This PR only adds the digit `@{d}` and integer `@{int}` variables.

It provides two improvements from the use of the `[0-9]*` glob:
- security: the glob means "a digit followed by anything but `/`", whereas `@{int}` means "up to 10 digits"
Next to the
- stability: using glob in path with `x` can expose to path conflict, removing the glob fixed a lot of issues.

These variables are used by a lot of abstractions that could be upstream here from apparmor.d (PR will follow). It is an import from 33681e14f2/apparmor.d/tunables/multiarch.d/system where other similar variables are in use: `@{hex}`, `@{rand}`, `@{word}`, `@{u8}`, `@{u16}`, `@{u64}`, `@{int2}...@{int64}` ...
They also all could be upstreamed here.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1544
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 783f012074)
2025-02-14 10:39:26 -08:00
Alexandre Pujol
00c84dc82b tunable: add int variable
(cherry picked from commit d7a73847de)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-14 10:39:26 -08:00
John Johansen
48d837d829 Merge utils: aa-genprof fails on lxd with OSError: Read-only file system
On certain lxc containers, when aa-genprof tries to set
printk_ratelimit, it fails with the OSError exception, with the
message "OSError: [Errno 30] Read-only file system" instead of
PermissionError.

Since PermissionError is a subclass of OSError, replace it by broader
OSError exception to include both cases in which running aa-genprof
fails.

Reported-by: Paulo Flabiano Smorigo <paulo.smorigo@canonical.com>
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1539
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 226ab5f050)
2025-02-13 14:35:19 -08:00
Georgia Garcia
65971c8764 utils: aa-genprof fails on lxd with OSError: Read-only file system
On certain lxc containers, when aa-genprof tries to set
printk_ratelimit, it fails with the OSError exception, with the
message "OSError: [Errno 30] Read-only file system" instead of
PermissionError.

Since PermissionError is a subclass of OSError, replace it by broader
OSError exception to include both cases in which running aa-genprof
fails.

Reported-by: Paulo Flabiano Smorigo <paulo.smorigo@canonical.com>
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit e1ae6fa81c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 14:35:19 -08:00
John Johansen
042d3b783f Merge utils: allow install locations to be overridden in Makefile
Instead of setting those variables unconditionally, set them if they
aren't externally set by environment variables. This will allow for usages
like DESTDIR=/some/other/dir make install in the utils directory.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1542
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 49bc2d855f)
2025-02-13 13:56:10 -08:00
Ryan Lee
6089302f0b utils: allow install locations to be overridden in Makefile
Instead of setting those variables unconditionally, set them if they
aren't externally set by environment variables. This will allow for usages
like DESTDIR=/some/other/dir make install in the utils directory.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2747013d9b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 13:56:10 -08:00
John Johansen
47096faadd aa-notify: make ttkthemes conditional - partial backport of MR1324
ttkthemees may not be installed on some systems, and if not present
will cause aa-notify to fail. Instead of making ttkthemes a required
dependency, make its use conditional on it being present.

Backport by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:50:24 -08:00
John Johansen
0587826fb4 Merge libapparmor: swig: various build fixes for 32-bit systems and older systems
Changes include:
 - using `long` instead of `intmax_t` for `pid_t` typemap (32-bit build failure); see commit message for more details
 - specifying messages for `static_assert` declarations (required up until C23, was accepted as a compiler extension on the systems I had tested this on previously)
 - removing label-followed-by-declaration instance (also a C23 feature supported as extension)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1536
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 55889ef783)
2025-02-13 00:40:51 -08:00
Ryan Lee
f7503ca183 libapparmor: swig: remove instance of label followed by declaration
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit af883bb706)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:40:51 -08:00
Ryan Lee
908606e8a1 libapparmor: swig: specify message for static_assert usages
The message being optional is apparently a C23 thing that was available as an extension on the systems I tested on previously

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 87b60e4e94)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:40:51 -08:00
Ryan Lee
ecf89330d4 libapparmor: use long as the intermediate pid_t conversion type
The previous code using intmax_t failed to build on armhf because
intmax_t was long long int instead of long int on that platform.
As to shrinking down to a long: not only does SWIG lack a
SWIG_AsVal_intmax_t, but aalogparse also assumes PIDs fit in a long
by storing them as unsigned longs in aa_log_record. Thus, we can
assume that sizeof(pid_t) <= sizeof(long) right now and deal with
the big headache that a change to pid_t would cause if it becomes
larger than a long in the future.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c5016e1227)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:40:51 -08:00
John Johansen
e931561129 Merge man apparmor.d: document how variable expansion and path sanitization works
The documentation was missing information about path sanitization, and
why you shouldn't do a leading @{VAR} on path rules. While the example
doing this was fixed, actual information about why you shouldn't do
this was missing.

Document how apparmor will collapse consecutive / characters into a
single character for paths, except when this occurs at the start of
the path.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1532
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0c4e452b46)
2025-02-13 00:40:28 -08:00
John Johansen
cb2b8aef20 man apparmor.d: document how variable expansion and path sanitization works
The documentation was missing information about path sanitization, and
why you shouldn't do a leading @{VAR} on path rules. While the example
doing this was fixed, actual information about why you shouldn't do
this was missing.

Document how apparmor will collapse consecutive / characters into a
single character for paths, except when this occurs at the start of
the path.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit cce5bd6e95)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:40:28 -08:00
John Johansen
e0e464b757 Merge profiles: fix non-user-namespace-related sandbox bypass in unshare profile
The unshare-userns-restrict profile contained a cx transition to
transition to a profile that allows most things while denying
capabilities:

audit allow cx /** -> unpriv,

However, this transition does not stack the unshare//unpriv profile
against any other profile the target binary might have had. As a result,
the lack of stacking resulted in a non-namespace-related sandboxing
bypass in which attachments of other profiles that should have confined
the target binary do not get applied. Instead, we adopt a stack similar
to the one in bwrap-userns-restrict, with the exception that unshare
does not use no-new-privs and therefore only needs a two-layer stack
instead of a three-layer stack.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1533
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8e586e5492)
2025-02-13 00:39:52 -08:00
Ryan Lee
f7c3a28901 Remove no-longer-true aa-enforce line from unshare-userns-restrict
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c6ba1bd2fb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:39:52 -08:00
Ryan Lee
e3b23b1598 profiles: fix non-user-namespace-related sandbox bypass in unshare profile
The unshare-userns-restrict profile contained a cx transition to
transition to a profile that allows most things while denying
capabilities:

audit allow cx /** -> unpriv,

However, this transition does not stack the unshare//unpriv profile
against any other profile the target binary might have had. As a result,
the lack of stacking resulted in a non-namespace-related sandboxing
bypass in which attachments of other profiles that should have confined
the target binary do not get applied. Instead, we adopt a stack similar
to the one in bwrap-userns-restrict, with the exception that unshare
does not use no-new-privs and therefore only needs a two-layer stack
instead of a three-layer stack.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit ab3ca1a93f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-13 00:39:52 -08:00
John Johansen
f308742119 Prepare for 4.1.0~beta3 release
- bump version

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:36:52 -08:00
John Johansen
7b01cd51e8 libapparmor: bump library version preparing for release
There are minor tweak around the lib, constify some vars etc. That
don't justify a large bump. Bumpt there have been changes to swig
such that we want to force it to be linked against the new lib.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:31:44 -08:00
John Johansen
afb3866c0a Merge parser: fix priority so it is handled on a per permission basis
The current behavior of priority rules can be non-intuitive with
higher priority rules completely overriding lower priority rules even in
permissions not held in common. This behavior does have use cases but
its can be very confusing, and does not normal policy behavior

    Eg.
      priority=0 allow r /**,
      priority=1 deny  w /**,

will result in no allowed permissions even though the deny rule is
only removing the w permission, beause the higher priority rule
completely over ride lower priority permissions sets (including
none shared permissions).

Instead move to tracking the priority at a per permission level. This
allows the w permission to still override at priority 1, while the
read permission is allowed at priority 0.

The final constructed state will still drop priority for the final
permission set on the state.

Note: this patch updates the equality tests for the cases where
      the complete override behavior was being tested for.

      The complete override behavior will be reintroduced in a future
      patch with a keyword extension, enabling that behavior to be used
      for ordered blocks etc.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1522
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0ab4fc0580)
2025-02-11 15:19:32 -08:00
John Johansen
2ab1941d9d parser: change priority so that it accumulates based on permissions
The current behavior of priority rules can be non-intuitive with
higher priority rules completely overriding lower priority rules even in
permissions not held in common. This behavior does have use cases but
its can be very confusing, and does not normal policy behavior

Eg.
  priority=0 allow r /**,
  priority=1 deny  w /**,

will result in no allowed permissions even though the deny rule is
only removing the w permission, beause the higher priority rule
completely over ride lower priority permissions sets (including
none shared permissions).

Instead move to tracking the priority at a per permission level. This
allows the w permission to still override at priority 1, while the
read permission is allowed at priority 0.

The final constructed state will still drop priority for the final
permission set on the state.

Note: this patch updates the equality tests for the cases where
the complete override behavior was being tested for.

The complete override behavior will be reintroduced in a future
patch with a keyword extension, enabling that behavior to be used
for ordered blocks etc.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 1ebd991155)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:19:32 -08:00
John Johansen
6e37bc0067 parser: fix prefix dump to include priority
The original patch adding priority to the set of prefixes failed to
update the prefix dump to include the priority priority field.

Fixes: e3fca60d1 ("parser: add the ability to specify a priority prefix to rules")

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit e56dbc2084)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:19:32 -08:00
John Johansen
29f66c3828 parser: drop priority from state permissions
The priority field is only used during state construction, and can
even prevent later optimizations like minimization. The parser already
explcitily clears the states priority field as part of the last thing
done during construction so it doesn't prevent minimization
optimizations.

This means the state priority not only wastes storage because it is
unused post construction but if used it could introduce regressions,
or other issues.

The change to the minimization tests just removes looking for the
priority field that is no longer reported.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit cc31a0da22)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:19:32 -08:00
John Johansen
71dbc73532 parser: stop using dynamic_cast for prompt permission calculations
Like was done for the other MatchFlags switch to using a node type
instead of dynamic_cast as this will result in a performance
improvement.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 9221d291ec)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:19:32 -08:00
John Johansen
d4ee66e8f4 Merge tests: run regression tests with spread (self-hosted)
This requires a runner with the tags: linux, x86_64, kvm. One needs to
be provisioned for the AppArmor project for the pipeline to function.

It is possible to run the same tests on SAAS runners offered by GitLab
but due to issue gitlab-org/gitlab-runner#6208 there is no way to expose
/dev/kvm on the host to the guest. Without this feature emulation works
but is rather slow as to be impractical.

Note that there's some overlap between the build-all job and spread that
might be avoided in the future. At present this is made more difficult
by the fact that the path where build-all job builds libapparmor is
stored internally by autotools. This prevents us from using GitLab
artifacts from moving the built files across to the spread testing jobs
without extra work.

In addition to adding the spread job, remove test-build-regression job.
This job is now redundant since the same operation is done when spread
builds and runs regression tests.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1512
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 12787648a7)
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
a2335e9395 tests: show timestamps of image-garden files
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 5a44cbe661)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
fbb2ae8b05 tests: explicitly cache cloud-init files
We were not building or caching the .seed.iso target, causing make to re-create
the image, as seen in the make --debug --dry-run output:
```
Updating goal targets....
      File ubuntu-cloud-24.04.user-data does not exist.
     Must remake target ubuntu-cloud-24.04.user-data.
echo "${USER_DATA}" | tee ubuntu-cloud-24.04.user-data
     Successfully remade target file ubuntu-cloud-24.04.user-data.
      File ubuntu-cloud-24.04.meta-data does not exist.
     Must remake target ubuntu-cloud-24.04.meta-data.
echo "${META_DATA}" | tee ubuntu-cloud-24.04.meta-data
     Successfully remade target file ubuntu-cloud-24.04.meta-data.
     Prerequisite ubuntu-cloud-24.04.user-data is newer than target ubuntu-cloud-24.04.seed.iso.
     Prerequisite ubuntu-cloud-24.04.meta-data is newer than target ubuntu-cloud-24.04.seed.iso.
    Must remake target ubuntu-cloud-24.04.seed.iso.
/usr/bin/genisoimage \
	-input-charset utf-8 \
	-output ubuntu-cloud-24.04.seed.iso \
	-volid CIDATA \
	-joliet \
	-rock \
	-graft-points \
	user-data=ubuntu-cloud-24.04.user-data \
	meta-data=ubuntu-cloud-24.04.meta-data
    Successfully remade target file ubuntu-cloud-24.04.seed.iso.
   Prerequisite ubuntu-cloud-24.04.seed.iso is newer than target ubuntu-cloud-24.04.x86_64.qcow2.
```

Build and cache the cloud-init seed iso to prevent that.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 4cfeb4a9ad)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
e6d4f79919 tests: debug image reuse logic
We are seeing images cached and then re-constructed as if something had
changed in the meanitime. Debug image construction with make --dry-run --debug.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit b3ce87af23)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
2845e42c5e tests: quote CI_NODE_INDEX
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 62f93b400e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
ef44d8e177 tests: reorganize spread pipeline a little
This way there's somewhat less repetition and the flow of job definitions is,
at least to me, easier to read.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit bcf8c968db)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
f255fcfcde tests: compress cache faster
Our cache is rather compressed already, so this should help
a little with wall-clock time.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit ebb82952bc)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
21922fea25 tests: improve image caching performance
A new explicit, non-parallel job is injected when the .image-garden.mk or
.spread.yaml file changes. This job warms up the cache for the subsequent
parallel testing jobs.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 14ceb92ca0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
daaf768b3f tests: allow non-default branches to push spread cache
As a security measure, GitLab splits cache into two broad pools: protected and
non-protected. Any job running in a protected branch has access to the
protected cache pool. All other jobs run in the non-protected cache pool.

This effectively forces us to push to cache in non-protected branches, like all
the merge requests, in order to actually use the cache.

Ideally we'd disable this protection and only push from the default branch and
pull otherwise, as changes to dependency set is rather rare.

[1] https://docs.gitlab.com/ee/ci/caching/#use-the-same-cache-for-all-branches

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit a0adb01631)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
1d31e9e3ba tests: remove test-build-regression job
This job is now redundant since the same operation is done when spread
builds and runs regression tests.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit f82c8471f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
40510ba5c0 tests: run regression and profile tests with spread
This requires a runner with the tags: linux, x86_64, kvm. One needs to
be provisioned for the AppArmor project for the pipeline to function.

It is possible to run the same tests on SAAS runners offered by GitLab
but due to issue gitlab-org/gitlab-runner#6208 there is no way to expose
/dev/kvm on the host to the guest. Without this feature emulation works
but is rather slow as to be impractical.

Note that there's some overlap between the build-all job and spread that
might be avoided in the future. At present this is made more difficult
by the fact that the path where build-all job builds libapparmor is
stored internally by autotools. This prevents us from using GitLab
artifacts from moving the built files across to the spread testing jobs
without extra work.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 7f68ed174c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
Zygmunt Krynicki
87d2513823 tests: use one spread worker for ubuntu-cloud-24.04
There's contention between running spread across many nodes, in chunks,
in a CI/CD pipeline, and running spread on one machine, across many
instances at the same time. The case with CI/CD needs one worker, as
parallelism is provided by GitLab. The case with local spread needs many
workers as parallelism is provided locally by spread allocating new
instances.

At present we need to focus on the CI/CD case. I have a plan on how to
avoid the problem entirely down the line, by running multiple copies of
spread locally, as if everything was done in a CI/CD pipeline.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit dfa331dfff)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:28 -08:00
John Johansen
6593912bef Merge profiles: fix unshare for deleted files
Unfortunately similar to bwrap unshare will need the mediate_deleted
flag in some cases.

see
  commit 6488e1fb7 "profiles: add mediate_deleted to bwrap"

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1521
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>

(cherry picked from commit b5b1944f58)
2025-02-11 15:18:11 -08:00
John Johansen
2270a4f44e profiles: fix unshare for deleted files
Unfortunately similar to bwrap unshare will need the mediate_deleted
flag in some cases.

see
  commit 6488e1fb7 "profiles: add mediate_deleted to bwrap"

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit c157eb0cb6)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:18:11 -08:00
John Johansen
325143a3e8 Merge Some updates to modernize the mount regression test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1449
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 5bc1cd763c)
2025-02-11 15:17:41 -08:00
Ryan Lee
77962f6de3 Replace dd with fallocate for faster file setup
This allows the use of sparse allocation on filesystems that support it,
allowing a fallback when the underlying filesystem doesn't.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 98c60e477d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:17:41 -08:00
Ryan Lee
a6bb35dbe7 Fix race condition in loop device setup in mount regression test
Calling losetup -f first and passing its result to create the loop device
creates a race condition in which the loop device might be claimed first
in between the two losetup calls. Instead, create the device atomically
and then obtain the loop device /dev/ handle afterwards.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 95f3bdf66b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:17:41 -08:00
John Johansen
0da5f211b3 Merge spread: Add support for EXPECT_DENIALS in profile tests
This commit adds support for EXPECT_DENIALS in profile tests. Any test
that sets the EXPECT_DENIALS environment variable is expected to trigger
AppArmor denials and will fail if none was generated.

This allows to test that problematic behaviors are correctly blocked.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1515
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit 002bf1339c)
2025-02-11 15:16:33 -08:00
Maxime Bélair
73188a0da1 spread: Add support for EXPECT_DENIALS in profile tests
Introduce the EXPECT_DENIALS environment variable for profile tests.
Each line of EXPECT_DENIALS is a regex that must match an AppArmor
denial for the corresponding test, and conversely.

This ensures that problematic behaviors are correctly blocked and logged.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
(cherry picked from commit fc3f27e255)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:16:33 -08:00
John Johansen
535da1dbea Merge parser: misc fixes on apparmor.d man page
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1516
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 4765bcd7bc)
2025-02-11 15:15:46 -08:00
Georgia Garcia
181f49b20f parser: misc fixes on apparmor.d man page
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 998ee0595e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:15:46 -08:00
John Johansen
0390e2a7ec Merge tests/spread: fix debian system name
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1511
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 54561af112)
2025-02-11 15:15:15 -08:00
Zygmunt Krynicki
42313d81c7 tests/spread: fix debian system name
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 8967dee5b9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:15:14 -08:00
John Johansen
3f40d58642 Merge tests: unify formatting of .gitlab-ci.yml
We had some mixture of indent styles.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1510
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 39cd3f6f21)
2025-02-11 15:14:53 -08:00
Zygmunt Krynicki
3164268b4a tests: unify formatting of .gitlab-ci.yml
We had some mixture of indent styles.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit d4582f232f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:14:53 -08:00
John Johansen
74ed54eb28 Merge tests: mark more regression test as known-failures
A number of tests are failing and since spread does not contain a native
XFAIL facility, we have to maintain a silent-failure feature code
ourselves. A few of those have been fixed since the first iteration of
this patch. The remaining known failures are being fixed.

Later on I would like to separate XFAIL from SKIP so that if a test is
known to exercise kernel feature unavailable on the given system, the
test is just not executed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1483
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit d482aab419)
2025-02-11 15:14:34 -08:00
Zygmunt Krynicki
6e078296bc tests: exclude debian systems from toybox test
This is so that we get a baseline that passes to enable testing in CI/CD
but also to spark a discussion around what to do with a profile that
indirectly relies on a kernel feature that is not available on a given
system.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 32bf95bb1e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:14:34 -08:00
Zygmunt Krynicki
ff3db97d5d tests: mark more regression test as known-failures
A number of tests are failing and since spread does not contain a native
XFAIL facility, we have to maintain a silent-failure feature code
ourselves. A few of those have been fixed since the first iteration of
this patch. The remaining known failures are being fixed.

Later on I would like to separate XFAIL from SKIP so that if a test is
known to exercise kernel feature unavailable on the given system, the
test is just not executed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit b0422d5572)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:14:34 -08:00
John Johansen
5f8c2c5fc9 Merge utils: adjusts aa-notify tests to handle Python 3.13+
Python 3.13 changes the formatting of long-short option pairs that use a
meta-variable. Up until 3.13 the meta-variable was repeated. Since
Python change [1] the meta-var is only printed once.

[1] https://github.com/python/cpython/pull/103372

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1495
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 219626c503)
2025-02-11 15:14:05 -08:00
Zygmunt Krynicki
ee2dc1bd64 utils: abbreviate delta for Python 3.12 argparse
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 0acc138712)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:14:05 -08:00
Zygmunt Krynicki
161863ea4f utils: adjusts aa-notify tests to handle Python 3.13+
Python 3.13 changes the formatting of long-short option pairs that use a
meta-variable. Up until 3.13 the meta-variable was repeated. Since
Python change [1] the meta-var is only printed once.

[1] https://github.com/python/cpython/pull/103372

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 6336465edf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:14:05 -08:00
John Johansen
b04faf1afc Merge tests: add fuse-overlayfs to cloud-init
This is a dependency of the overlayfs_fuse regression test.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1509
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 6405608442)
2025-02-11 15:13:30 -08:00
Zygmunt Krynicki
9e94256fff tests: add fuse-overlayfs to cloud-init
This is a dependency of the overlayfs_fuse regression test.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 237b5c0f73)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:13:30 -08:00
John Johansen
5776e5c9df Merge libapparmor: fixes to the SWIG bindings for SWIG 4.3 and later
Unfortunately we are affected by the backwards-incompatible change introduced by https://github.com/swig/swig/pull/2907

This MR contains fixes to keep the Python-side API the same on systems using SWIG 4.3 or later, e.g. Ubuntu Plucky.

Fixes https://gitlab.com/apparmor/apparmor/-/issues/475.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

Closes #475
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1504
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 265a1656d1)
2025-02-11 15:11:55 -08:00
Ryan Lee
410e486cde Replace aa_find_mountpoint cstring_output_allocate due to $isvoid issue
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 3fa40935f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:11:55 -08:00
Ryan Lee
306d11538a Replace simple %append_output uses with ISVOID helpers for SWIG 4.3
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1620887463)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:11:55 -08:00
Ryan Lee
7cbbcdad42 Create %append_output compatibility wrappers for SWIG 4.3
Unfortunately we are affected by the backwards-incompatible change introduced by https://github.com/swig/swig/pull/2907

These wrappers will be needed to fix tests on systems using SWIG 4.3 or later, e.g. Ubuntu Plucky.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1b46ab10fd)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:11:55 -08:00
John Johansen
0a0e920c0c Merge Python SWIG binding fixes (API breaking)
Changes to Python SWIG bindings that are breaking changes but that fix bindings that were previously unusable.

This MR also depends on !1334 and !1337 being merged first, though ~~I can rebase this one if necesssary~~ this MR has now been rebased after those two were merged.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1338
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit b2f713dd83)
2025-02-11 15:10:29 -08:00
Ryan Lee
0b27a5e0cb Remove aa_query_file_{path,link}_len wrappers
The prefix can be done in higher-level languages via slicing and having an explicit length exposes an out-of-bounds memory read footgun to those higher level languages

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit a2df3143d1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
82f815c587 Write test for aa_gettaskcon SWIG wrapper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 53e3116350)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
e9429a9eaa Write custom SWIG typemap for pid_t
Surprisingly, SWIG did not pick up the "typedef int pid_t" from the C headers.
As such, we need to provide our own wrapper. We don't just replicate the typdef
because we still support systems that have 16-bit PIDs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit d199c2ae33)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
934c41c1e8 Test SWIG Python bindings for aa_query_file_path
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2ce217b873)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
519b7cf4a4 SWIG aa_query helper bitmask constants and stdint header
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit edb4a72c8c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
3ab5d7871f SWIG Python test for change_hat type signatures
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 5db4908fd7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
c2e99bfbfe SWIG Python test refactoring of AppArmor enabled checks
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 930fca1e39)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
e8cb8da296 Test aa_getcon SWIG bindings and leave some comments for untested ones
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 369c9e73de)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
ae08d09995 Write a test for aa_splitcon's SWIG bindings
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 48901f2118)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
dce45c5c4f Typemaps for allowed, audited outputs of query functions
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c471acbe44)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
7423e4199a Add typemap for Python SWIG aa_change_hatv so it can take a string list
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit cdb3e4a14e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
c671d6c9cc Write basic test for Python aa_find_mountpoint
Also exercises aa_is_enabled

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit ea2c957f14)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
cc40903e99 Write custom typemap for aa_splitcon
Can't use %cstring_mutable because aa_splitcon also returns a ptr

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 04da4c86b0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
9ce2a7d83a aa_is_enabled now returns a boolean in Python
Because boooleans are a subclass of ints in Python, this isn't a breaking change

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit f05112b5e9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
e5a86a096c Write an output typemap for errno-based functions
In Python, return status is signalled by exceptions (or lack thereof)
instead of int. Keep the typemap portable for any other languages we may
add in the future.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit a15768b0bf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
Ryan Lee
26818e3747 Include cstring.i and some cstring output typemaps for libapparmor SWIG
This includes a custom typemap to handle (char **label, char **mode)
pairs and a cstring_output_allocate declaration for char **mnt.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 50d26beb00)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:10:29 -08:00
John Johansen
731782ae47 Merge Rename aa_log_record struct fields (C only) to allow inclusion in C++
Do an identifier rename combined with preprocessor directives and SWIG directives to allow the header to be included in C++ while keeping backwards compatibility to the extent possible.

Closes: #439

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

Closes #439
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1342
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 254b324a83)
2025-02-11 15:08:15 -08:00
Ryan Lee
09cdb28270 Basic test that uses aa_log_record struct fields via old, C++-incompatible names
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2d7440350f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:08:15 -08:00
Ryan Lee
39af57ff40 Basic test that invokes aalogparse functions from C++ code
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 645b1406d1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:08:15 -08:00
Ryan Lee
db8dd88f44 Add extern "C" decls to aalogparse.h for C++ usage of aalogparse
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 3cb61b6b41)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:08:15 -08:00
Ryan Lee
d7b1b24736 Add SWIG renames for fields to preserve backcompat
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e2c407c614)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:08:14 -08:00
Ryan Lee
7be9a394f8 Rename aa_log_record struct fields (C only) to allow inclusion in C++
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 3f5180527d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:08:14 -08:00
John Johansen
6f1c29eca0 Merge Remove aa_query_label from SWIG bindings
This is one of those functions that never worked anyways, because it
modified the passed-in label in place. Moreover, it is a low-level
interface that requires its callers to manually construct a binary query.
As such, it would be better not to expose it and to add wrappers like
aa_query_file_path for the other query classes if that functionality is
needed later.

The removal of this function from the bindings was dropped from !1337 because it exposed functionality that was not present in wrappers around aa_query_label. However, upon further discussion, we decided that it'd be better to remove it now and add other wrappers to libapparmor itself if the functionality provided by the existing wrappers became insufficient.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1352
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Ryan Lee <rlee287@yahoo.com>

(cherry picked from commit 5b141dd580)
2025-02-11 15:06:58 -08:00
Ryan Lee
07b0cbfafb Remove aa_query_label from SWIG bindings
This is one of those functions that never worked anyways, because it
modified the passed-in label in place. Moreover, it is a low-level
interface that requires its callers to manually construct a binary query.
As such, it would be better not to expose it and to add wrappers like
aa_query_file_path for the other query classes if that functionality is
needed later.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit d3603a1f20)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:06:58 -08:00
John Johansen
77455d848c Merge Remove broken SWIG functions that we don't actually want to expose
It doesn't make sense to expose the *_raw functions or the varg version
of aa_change_hatv to higher-level languages. While technically a breaking
change, the generated bindings for these functions never actually worked
anyways:

 - aa_change_hat_vargs uses C varargs, which SWIG passes in NULL for by
   default. It does not attempt to process the passed-in arguments at all
   (and in fact caused an unused-argument compiler warning when compiling
   the generated bindings).
 - aa_getprocattr_raw and aa_getpeercon_raw both place output into a ``char
   **mode`` pointer. SWIG by default generates these as opaque pointer
   object arguments, rendering them unusable for getting output. Future
   patches would be needed to fix ``char**`` arguments for the other functions
   that use them. Moreover, these functions expect their caller to handle
   memory allocation, which is also not possible from a higher-level
   language point of view.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1337
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>

(cherry picked from commit d35a6939be)
2025-02-11 15:05:40 -08:00
Ryan Lee
956dc6e9c0 Remove private _aa_is_blacklisted from SWIG bindings
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit bdc8889cc0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:05:40 -08:00
Ryan Lee
74c69b23eb Remove SWIG aa_change_hat_vargs, aa_get_procattr_raw, aa_get_peercon_raw
It doesn't make sense to expose the *_raw functions or the varg version
of aa_change_hatv to higher-level languages. While technically a breaking
change, the generated bindings for these functions never actually worked
anyways:

 - aa_change_hat_vargs uses C varargs, which SWIG passes in NULL for by
   default. It does not attempt to process the passed-in arguments at all
   (and in fact caused an unused-argument compiler warning when compiling
   the generated bindings).
 - aa_getprocattr_raw and aa_getpeercon_raw both place output into a char
   **mode pointer. SWIG by default generates these as opaque pointer
   object arguments, rendering them unusable for getting output. Future
   patches would be needed to fix char** arguments for the other functions
   that use them. Moreover, these functions expect their caller to handle
   memory allocation, which is also not possible from a higher-level
   language point of view.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2bd1884654)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:05:40 -08:00
John Johansen
d149113594 Merge Improvements to the SWIG binding handling of aa_log_record and %exception memory management
This patchset adds annotations so that SWIG can automatically manage the memory lifetimes of aa_log_record objects, and ensures proper cleanup is done in the %exception handler.

This is the first of a sequence of MRs to overhaul the SWIG bindings and fix pieces that never actually worked in the first place. As fixing those other pieces will require breaking changes, I am separating out the non-breaking changes into separate MRs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1334
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Ryan Lee <rlee287@yahoo.com>

(cherry picked from commit bcab725670)
2025-02-11 15:03:20 -08:00
Ryan Lee
2396b4ff14 Apply 1 suggestion(s) to 1 file(s)
Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 61b1501f48)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:03:20 -08:00
Ryan Lee
cbbe950898 Add DeprecationWarning emission to Python free_record wrapper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 398f0790de)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:03:20 -08:00
Ryan Lee
6ddb51e10e Make Python-side free_record a no-op to prevent double-free
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 4a7a8fa213)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:03:20 -08:00
Ryan Lee
aa9e33283e Annotate SWIG aa_log_record alloc+dealloc
Swig generates a "thisown" attribute, which is an escape hatch in case
higher-level code does something weird and needs to tell SWIG whether to
free the C object when Python garbage collects it. Adding this attribute
is not a breaking change w.r.t access to the other attributes of the parsed
record.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e5fd0fc636)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:03:20 -08:00
Ryan Lee
6fe9d2c6a3 Use SWIG_fail in %exception upon throwing OSError for errno
Unfortunately SWIG_exception does not support throwing OSError, so this
still requires Python-specific code.

Unlike just returning NULL, this will clean up intermediate allocations.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 436ebda9b5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:03:20 -08:00
John Johansen
15748e2785 libapparmor: merge Rename aa_query_label allow and audit params in headers
This change matches the names in the .c source and the man page for aa_query_label,
and also simplifies the typemap annotations needed to make the SWIG versions usable.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1339
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>

(cherry picked from commit 65e6620014)
2025-02-11 15:01:48 -08:00
Ryan Lee
d3e3aa87a1 Rename aa_query_label allow and audit params in headers
This change matches the names in the .c source and the man page for aa_query_label,
and also simplifies the typemap annotations needed to make the SWIG versions usable.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 0c4cda2f1c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:01:48 -08:00
John Johansen
cf7f0584dc Merge Change swig prototype of aa_getprocattr to match argname
This will matter later on for adding SWIG annotations

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1329
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 7dc167ea48)
2025-02-11 15:00:48 -08:00
Ryan Lee
2333d48880 Change swig prototype of aa_getprocattr to match argname
This will matter later on for adding SWIG annotations

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 80bdd22ed7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 15:00:48 -08:00
John Johansen
14b54439d9 Merge aa-load documentation improvements
This MR includes copyediting of the `aa-load --help` text as well as a man page based on the help text.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1505
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit c81eacacac)
2025-02-11 14:52:44 -08:00
Ryan Lee
5f3879fce4 Write a man page for aa-load based on the help text
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit ee8300545e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:44 -08:00
Ryan Lee
cd01b4be6a Copyedit the help text for aa-load
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 6592daff90)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:44 -08:00
John Johansen
fff8ea6d0e Merge Set up overlayfs_fuse test that uses a FUSE implementation of overlayfs
This also reorganizes the overlayfs tests slightly in order to maximize code reuse between the old test and the new one.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1503
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit dfb7abf2a6)
2025-02-11 14:52:08 -08:00
Ryan Lee
25740f2b97 Move most file setup and creation to before the overlay mount call
kernel overlayfs propagates the changes, while fuse_overlayfs doesn't

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit be38da7570)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:08 -08:00
Ryan Lee
88020379ca Add fuse_overlayfs to apt dependency list of Gitlab CI test-build-regression
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit ed8b6cb663)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:08 -08:00
Ryan Lee
48d8ec1774 Set up an overlayfs_fuse regression test by using the other path of the overlayfs_common.inc helper
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 9e05668d5a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:08 -08:00
Ryan Lee
d532104072 Wire up the kernel/fuse argument switch in overlayfs_common.inc regression tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit a0f551d5b7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:08 -08:00
Ryan Lee
221e711cd4 Move overlayfs test into include helper and wrap in overlayfs_kernel
By making the test a file to be included as a helper, we can reuse most of the code for a fuse_overlayfs test without copy-pasting

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 9413658277)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:52:08 -08:00
John Johansen
ba0704c206 Merge Upadate man apparmor.d to highlight pivot_root limitation
As pointed out by https://bugs.launchpad.net/apparmor/+bug/2087875 ,
profile transitions with pivot_root are currently not supported on any
kernel.

This commit makes this limitation more obvious to users.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1436
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit dcce4bc62f)
2025-02-11 14:51:27 -08:00
Maxime Bélair
3f15ce23ba Upadate man apparmor.d to highlight pivot_root limitation
As pointed out by https://bugs.launchpad.net/apparmor/+bug/2087875 ,
profile transitions with pivot_root are currently not supported on any
kernel.

This commit makes this limitation more obvious to users.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
(cherry picked from commit cf51f7aadd)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:51:27 -08:00
John Johansen
6077cf37c6 Merge tests: unify CI/CD preparation phase
We now have GitLab CI/CD pipeline co-existing with spread, coupled with
image-garden and the cloud-init profile defined for each distribution.

To avoid duplicating list of required dependencies, re-use cloud-init
profile as the reference list of dependencies (superset between build
and test) to install.

In addition to the dependency list, the build_all job now re-uses spread
prepare section in similar fashion. If it builds in spread, it should
build in CI as well.

A small quality-of-life improvement is the shape of a collapsible
section around dependency installation should make reading job logs
easier.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1494
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 4c8c4a1d77)
2025-02-11 14:50:49 -08:00
Zygmunt Krynicki
0ea717b352 tests: put logs from apt-get in a collapsed section
This is a small quality-of-life improvement when looking at CI/CD logs
on GitLab.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 29c618a11b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:50:49 -08:00
Zygmunt Krynicki
05e42b6a84 tests: unify CI/CD preparation phase
We now have GitLab CI/CD pipeline co-existing with spread, coupled with
image-garden and the cloud-init profile defined for each distribution.

To avoid duplicating list of required dependencies, re-use cloud-init
profile as the reference list of dependencies (superset between build
and test) to install.

In addition to the dependency list, the build_all job now re-uses spread
prepare section in similar fashion. If it builds in spread, it should
build in CI as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit f01a40a77c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:50:49 -08:00
John Johansen
6956eef4cc Merge tests: skip profile tests on Fedora
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1501
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit c80ef6fb59)
2025-02-11 14:48:56 -08:00
Zygmunt Krynicki
0667dc7318 tests: skip profile tests on Fedora
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

(cherry picked from commit 065c1d67ca)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:48:56 -08:00
John Johansen
859fb4ab72 Merge tests: add tool for observing the profile of a given command
Using gdb in batch mode, put a breakpoint on _start and spawn the
process.  Then using the built-in python interpreter print the
confinement label on the process and terminate everything.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1500
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit e750c6c66c)
2025-02-11 14:48:37 -08:00
Zygmunt Krynicki
b548d02bd8 tests: measure toybox with actual-profile-of
This should be a more readable example to follow in other tests.  The
toybox test was special given the fact that it is a shell itself, and is
fairly programmable.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

(cherry picked from commit ffd38b7ac4)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:48:37 -08:00
Zygmunt Krynicki
15bbe786f9 tests: add tool for observing the profile of a given command
Using gdb in batch mode, put a breakpoint on _start and spawn the
process.  Then using the built-in python interpreter print the
confinement label on the process and terminate everything.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 23df780544)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:48:37 -08:00
John Johansen
654b5a2499 Merge tests: add httpd-devel and pam-devel to fedora cloud-init profile
Those are needed to build the two extension modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1499
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit f98c1098b0)
2025-02-11 14:48:12 -08:00
Zygmunt Krynicki
c7574c8687 tests: add httpd-devel and pam-devel to fedora cloud-init profile
Those are needed to build the two extension modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit a2ace0d5d7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:48:12 -08:00
John Johansen
fce197e45d Merge tests: add integration test for toybox
This is something that was done interactively as a part of a training
session.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1487
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 25676c4694)
2025-02-11 14:47:43 -08:00
Zygmunt Krynicki
c35eebf008 tests: add integration test for toybox
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

(cherry picked from commit be47567d27)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:47:43 -08:00
Zygmunt Krynicki
5481571cca tests: add suite with profile tests
Hopefully more and more profiles will come with smoke tests. Since the
pattern of those tests is likely to be very similar (compile profile,
run some programs, remove profile) it will be good to check if the
profile had caused any denials to be logged. Having this at the suite
level should make writing actual tests easier.

The prepare-each and restore-each logic compile the profile, check for
errors and finally remove the profile. The debug-each logic shows the
program name (with full path).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 2ab2c8f8a1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:47:43 -08:00
Zygmunt Krynicki
ccdd3c8353 profiles: attach toybox profile to /usr/bin/toybox
This is the actual path used on Debian and derivatives.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

(cherry picked from commit 5c17df0219)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:47:43 -08:00
John Johansen
5abcb72699 Merge tests: enable build tests on Fedora 41
Tests that interact with the kernel are skipped (tests/regression and
tests/snapd) but everything else is green. Most of the tests are
actually passing. The only exception is the aa-notify test that was
broken by Python 3.13 stdlib change. The fix for that has been posted
separately.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1496
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 1462e1c4b0)
2025-02-11 14:47:15 -08:00
Zygmunt Krynicki
1d999a1735 tests: enable build tests on Fedora 41
Tests that interact with the kernel are skipped (tests/regression and
tests/snapd) but everything else is green. Most of the tests are
actually passing. The only exception is the aa-notify test that was
broken by Python 3.13 stdlib change. The fix for that has been posted
separately.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 7ce6819c53)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:47:15 -08:00
John Johansen
b6ea99bb43 Merge tests: build PAM and apparmor modules in spread
Those fell under the radar during the initial push to expose all of
the tests to spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1493
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 03215f46c4)
2025-02-11 14:46:50 -08:00
Zygmunt Krynicki
b191574d8f tests: build PAM and apparmor modules in spread
Those fell under the radar during the initial push to expose all of
the tests to spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 42c8745e73)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:46:50 -08:00
John Johansen
5efed44a32 Merge tests: switch tumbleweed to boot with security=apparmor
The openSUSE project has decided to switch to security=selinux by
default. For the purpose of continuing to test AppArmor on the
distribution, alter the cloud-init profile to switch to booting with
security=apparmor.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1492
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit ef880d325f)
2025-02-11 14:45:58 -08:00
Zygmunt Krynicki
79abf37d55 tests: switch tumbleweed to boot with security=apparmor
The openSUSE project has decided to switch to security=selinux by
default. For the purpose of continuing to test AppArmor on the
distribution, alter the cloud-init profile to switch to booting with
security=apparmor.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 2b44cc09a6)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:45:58 -08:00
John Johansen
d597549a73 Merge tests: pair of cleanups for the coverity job
Avoid a deprecated feature and reduce YAML complexity.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1491
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 85d57b7f06)
2025-02-11 14:45:28 -08:00
Zygmunt Krynicki
c07a77bcc4 tests: inline .send-to-coverity command
There is no other use of this yaml fragment in the project so inline it
for simplicity.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 5abbf31ce1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:45:28 -08:00
Zygmunt Krynicki
965b78b347 tests: rewrite coverity job to avoid deprecated "only" feature
The "only" feature has been deprecated for a while. The standard
replacement is the rules:if feature.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 61d75a11ef)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:45:28 -08:00
John Johansen
85fddb9e69 gitlab-ci: Build regression test suite in CI
Even if we can't run the regression tests in our GitLab CI environment, we can at least ensure the binaries in the regression test suite compile successfully.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1414
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>

(cherry picked from commit 5b98577a4d)
2025-02-11 14:44:53 -08:00
Ryan Lee
c36660c394 Build regression tests in GitLab CI
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 630b38238d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:44:53 -08:00
John Johansen
467ddd97b0 Merge Use parallelism and make --touch when building in GitLab CI for faster CI times
As per https://docs.gitlab.com/ee/ci/pipelines/compute_minutes.html#gitlab-hosted-runner-cost-factors, GitLab CI computes minutes as wall clock time per stage * a constant cost factor derived from the runner type, so using parallelism in `make -j $(nproc)` will reduce the time it takes for GitLab CI to complete without increasing usage of GitLab CI minutes.

When investigating this, I also found out that the test stages needlessly rebuilt large parts of the C code base due to mtimes not being preserved when artifacts are restored from the build stage. Adding `make --touch` updates the mtimes so that the subsequent tests do not need to rebuild binaries needlessly.

The combined changes in this MR reduce the CI time from 13 minutes and 57 seconds (cb0f84e101 of `master`, https://gitlab.com/rlee287/apparmor/-/pipelines/1501017669 on my own fork without Coverity) to 12 minutes and 49 seconds (https://gitlab.com/rlee287/apparmor/-/pipelines/1502723883). This comparison omits the `make -j $(nproc)` addition to cov-build since I do not have a way of testing its effectiveness.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1387
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8d6270e1fe)
2025-02-11 14:41:45 -08:00
Ryan Lee
b0ccb9bdf1 Pass -j flag for cov-build as well
This is separated out because I have no way of testing this

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 01435aaaa3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:41:45 -08:00
Ryan Lee
ac0d740110 GitLab CI: touch built files in test stages before running tests
The artifact restoration step does not preserve mtime, resulting in source files newer than built files, resulting in a needless rebuild of everything before actually running the tests.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 030f991320)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:41:45 -08:00
Ryan Lee
d09df550f1 Invoke tst_binaries target with parallelism in GitLab CI
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c47943f1af)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:41:45 -08:00
Ryan Lee
3e8f851691 Add a tst_binaries target to the parser to build tst binaries
This allows building the tst_* binaries in parallel independently of running the parser test suite

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2e841655cf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:41:45 -08:00
Ryan Lee
1555b8371b Update .gitlab-ci.yml file with -j $(nproc) lines for faster building
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 88287d4eec)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:41:45 -08:00
John Johansen
1500022fa8 Merge gitlab-ci.yml: only run coverity in the upstream project
This pipeline only makes sense to run in the upstream project where
the coverity variables are defined, so they currently fail in forks.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1351
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 7867a46e2e)
2025-02-11 14:37:22 -08:00
Georgia Garcia
e38516993c gitlab-ci.yml: only run coverity in the upstream project
This pipeline only makes sense to run in the upstream project where
the coverity variables are defined, so they currently fail in forks.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit c382efe119)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:37:22 -08:00
John Johansen
4ef5ac8399 Merge tests: snapd/mount-control: assorted fixes
This makes the snapd/mount-control test pass on all the currently tested systems. Note that there's a somewhat complex problem with the new mount APIs (https://lwn.net/Articles/753473/) from 2018 that are now being used on, for example, Debian 13.

I will need to make similar changes to the profiles generated by snapd, so any insight on what to do there is strongly appreciated.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1479
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit f171f5ebc8)
2025-02-11 14:23:35 -08:00
Zygmunt Krynicki
5e42f492f6 tests: snapd/mount-control: allow paths used on openSUSE
In addition allow linking to libeconf, generalize locale paths to cover
values other than C.UTF-8 and allow reading system-wide locale.alias and
gconv modules.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit cff25b8d17)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:23:35 -08:00
Zygmunt Krynicki
e9c76f03c8 tests: snapd/mount-control: stop/start auditd
This is needed on openSUSE Tumbleweed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 8ed810756b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:23:35 -08:00
Zygmunt Krynicki
b8cd4c9df9 tests: snapd/mount-control: allow new mount APIs
This is not the best of fixes but it seems that on Debian 13, with new
libmount calling fsopen/fsconfig/move_mount, the current apparmor mount
rule is insufficient to allow the call to go through.

The key problems are:
- the fstype is not visible to LSM
- the source directory is an empty string
- the mount is moved to final position

I don't know the extent of "new" mount API coverage by LSM hooks but
I think we should either synthesize new permissions from old rules,
.e.g match each of the system calls against what the mount class
expression, or somehow allow the exceptions better.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 5556de53c0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:23:35 -08:00
Zygmunt Krynicki
29f6786eeb tests: snapd/mount-control: fix bash syntax.
This masked failures that were already occuring.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 32116a50b0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:23:35 -08:00
John Johansen
88c5565552 Merge tests: add dosfstools to image-garden cloud-init
The package is required by the file_unbindable_mount regression test.
To properly re-generate affected images please update image-garden
to version containing 9714dc45d0ef06862ffe7037193dc43386db48ea
(Tie .user-data and .meta-data to MAKEFILE_LIST).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1480
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Zygmunt Krynicki <me@zygoon.pl>

(cherry picked from commit 43355fada5)
2025-02-11 14:17:55 -08:00
Zygmunt Krynicki
494afc470e tests: sort cloud-init package lists
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 699b598593)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:17:55 -08:00
Zygmunt Krynicki
847233b6d6 tests: add dosfstools to image-garden cloud-init
The package is required by the file_unbindable_mount regression test.
To properly re-generate affected images please update image-garden
to version containing 9714dc45d0ef06862ffe7037193dc43386db48ea
(Tie .user-data and .meta-data to MAKEFILE_LIST).

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 215fab71a5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:17:55 -08:00
John Johansen
07e4acfd26 Merge tests: regression: separate bash traces from errors
The BASH_XTRACEFD variable can be used to redirect "set -x" traces
to a dedicated file. We can use it to split the execution trace
(what has actually happened) from the failure messages.

On a failing test this does provide improved clarity when debugging
interactively with "spread -debug". On non-interactive runs the now
shorter error list is also implicitly printed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1481
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit b4cb33b488)
2025-02-11 14:17:25 -08:00
Zygmunt Krynicki
6f2e854320 tests: regression: separate bash traces from errors
The BASH_XTRACEFD variable can be used to redirect "set -x" traces
to a dedicated file. We can use it to split the execution trace
(what has actually happened) from the failure messages.

On a failing test this does provide improved clarity when debugging
interactively with "spread -debug". On non-interactive runs the now
shorter error list is also implicitly printed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 2c2e0478f8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:17:25 -08:00
John Johansen
c5286ff4df Merge tests: run autotools test verbosely
Instead of showing just the summary, display the actual test log as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1482
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit 7fa4b82235)
2025-02-11 14:16:41 -08:00
Zygmunt Krynicki
00d3e750e6 tests: run autotools test verbosely
Instead of showing just the summary, display the actual test log as well.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit fa33d7199b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:16:41 -08:00
John Johansen
efb951c2a8 Merge parser: add a hfa dump that matches the renumbered chfa
Construction of the chfa can reorder states from what the numbering
given during the hfa constuctions because of reordering for better
compression, dead state removal to ensure better packing etc.

This however means the dfa dump is difficult (it is possible using
multiple dumpes) to match up to the chfa that the kernel is
using. Make this easier by making the dfa dump be able to take
the remapping as input, and provide an option to dump the
chfa equivalent hfa.

Renumbered states will show up as {new <== {orig}} in the dump

Eg.
```
--D dfa-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{5} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {5}  0 (0x 4/0//0/0/0)
    0x4 -> {5}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {5}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {5}  0 (0x 4/0//0/0/0)
    \n 0xa -> {5}  0 (0x 4/0//0/0/0)
    \  0x20 -> {5}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {6}
{6} perms: none
    1 0x31 -> {5}  0 (0x 4/0//0/0/0)
```

```
-D dfa-compressed-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{2 == {5}} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    0x4 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \n 0xa -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \  0x20 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {4 == {6}}
{4 == {6}} perms: none
    1 0x31 -> {2 == {5}}  0 (0x 4/0//0/0/0)
```

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1474
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 72f9952a5f)
2025-02-11 14:16:06 -08:00
John Johansen
f19ec79869 parser: add a hfa dump that matches the renumbered chfa
Construction of the chfa can reorder states from what the numbering
given during the hfa constuctions because of reordering for better
compression, dead state removal to ensure better packing etc.

This however means the dfa dump is difficult (it is possible using
multiple dumpes) to match up to the chfa that the kernel is
using. Make this easier by making the dfa dump be able to take the
emapping as input, and provide an option to dump the chfa equivalent
hfa.

Renumbered states will show up as {new <== {orig}} in the dump

Eg.
--D dfa-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{5} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {5}  0 (0x 4/0//0/0/0)
    0x4 -> {5}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {5}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {5}  0 (0x 4/0//0/0/0)
    \n 0xa -> {5}  0 (0x 4/0//0/0/0)
    \  0x20 -> {5}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {6}
{6} perms: none
    1 0x31 -> {5}  0 (0x 4/0//0/0/0)

-D dfa-compressed-states
{1} <== priority (allow/deny/prompt/audit/quiet)
{2 == {5}} 0 (0x 4/0//0/0/0)

{1} perms: none
    0x2 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    0x4 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \a 0x7 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \t 0x9 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \n 0xa -> {2 == {5}}  0 (0x 4/0//0/0/0)
    \  0x20 -> {2 == {5}}  0 (0x 4/0//0/0/0)
    4 0x34 -> {3}
{3} perms: none
    0x0 -> {4 == {6}}
{4 == {6}} perms: none
    1 0x31 -> {2 == {5}}  0 (0x 4/0//0/0/0)

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 50452e1147)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:16:06 -08:00
John Johansen
eec48458ac Merge .gitlab-ci.yml: run pipeline in merge requests too
Hopefully this will allow us to run pipelines in regular branches but
also run it on merge requests on the parent project. This is needed
for users that are not verified by Gitlab.
https://docs.gitlab.com/ee/ci/pipelines/merge_request_pipelines.html#run-pipelines-in-the-parent-project

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1346
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit bb460ba467)
2025-02-11 14:12:30 -08:00
Georgia Garcia
58250a5ca3 .gitlab-ci.yml: run pipeline in merge requests too
Hopefully this will allow us to run pipelines in regular branches but
also run it on merge requests on the parent project. This is needed
for users that are not verified by Gitlab.
https://docs.gitlab.com/ee/ci/pipelines/merge_request_pipelines.html#run-pipelines-in-the-parent-project

(cherry picked from commit 248e5673ef)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-02-11 14:12:30 -08:00
Christian Boltz
e475b3e2f2 Merge Fix leading slash var typo in apparmor.d var example
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1527
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>


(cherry-picked from commit b4caf8782c)

41be573b Fix leading slash var typo in apparmor.d var example

Co-authored-by: John Johansen <john@jjmx.net>
2025-02-07 20:22:26 +00:00
Georgia Garcia
9a3f7a1f6e Merge utils: test: account for last cmd format change in test-aa-notify
The "last" command, which was supplied by util-linux in older Ubuntu
versions, is now supplied by wtmpdb in Oracular and Plucky. Unfortunately,
this changed the output format and broke our column based parsing.

While the wtmpdb upstream has added json support at
https://github.com/thkukuk/wtmpdb/issues/20, we cannot use it because
we need to support systems that do not have this new feature added.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1508
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>


(cherry picked from commit 3b7ee81f04)

afd6aa05 utils: test: account for last cmd format change in test-aa-notify

Co-authored-by: John Johansen <john@jjmx.net>
2025-01-28 12:35:01 +00:00
Georgia Garcia
728145f3fb Merge utils: look for 'file' class when parsing logs
Since kernel commit 8c4b785a86be the class is available to check if
the log belongs to which class. This fixes cases where the logparser
is not able to distinguish between network and file operations.

This issue does not manifest previous to and including apparmor-4.0
because we did not process auditing logs then.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/478
Reported-by: vyomydv vyom.yadav@canonical.com
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

This patch should be cherry-picked to apparmor-4.1

Closes #478
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1507
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>


(cherry picked from commit 5f06df3868)

af6dfe5b utils: look for 'file' class when parsing logs

Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-27 19:34:38 +00:00
Georgia Garcia
51325b3ab7 Merge Allow overrides and preservation of some environment variables in utils make check
Our ubuntu packaging builds Python-enabled libapparmor's in the directories `libapparmor/libapparmor.python[version_identifier]`. In order for the util's `make check` to pick up on the correct libapparmor during the Ubuntu build process, we need the ability to override its search path. This patch introduces a `LIBAPPARMOR_BASEDIR` variable to allow for that.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1497
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>


(cherry picked from commit 17a09d2987)

90143494 Allow overrides and preservation of some environment variables in utils make check

Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 19:12:17 +00:00
Georgia Garcia
f4a07a07c2 Merge utils: test: various fixes for utils testing in Ubuntu packaging
The first patch fixes a `test-aa-notify.py` `TypeError` when `APPARMOR_NOTIFY` and `__AA_CONFDIR` are both specified, which is something that was broken all this time.

The second patch ensures that `aa-notify` in the test suite is run using the same Python interpreter that the test suite itself is run with, which is necessary for testing the utils under different Pythons.

The third patch does analogous modifications to the minitools tests that launch `aa-audit`, `aa-complain`, etc.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1498
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>


(cherry picked from commit 625a919bb8)

3365e492 utils: test: test-aa-notify: Ensure aanotify_bin is always a list
77cabf7d utils: test: use sys.executable when launching aa-notify in tests
e32c2673 utils: test: use sys.executable when launching minitools in tests

Co-authored-by: Georgia Garcia <georgia.garcia@canonical.com>
2025-01-23 19:07:44 +00:00
Ryan Lee
b59626a224 Merge regression tests: fix the overlayfs mv test failures
The file being moved from needs rw permissions and not just w permissions.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1488
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit a12004f96c)
2025-01-21 11:12:40 -08:00
Ryan Lee
d72fa8834c regression tests: fix the overlayfs mv test failures
The file being moved from needs rw permissions and not just w permissions

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 63c944a01a)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:40 -08:00
Ryan Lee
f6c7899f36 Merge Add overlayfs regression tests
These tests exercise various common file operations on files in an overlayfs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1461
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit cd4bb05f20)
2025-01-21 11:12:20 -08:00
Ryan Lee
eb89538cab Shellcheck pass over overlayfs.sh
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1d3d48cc2a)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Ryan Lee
049ad49ffb Extend overlayfs test with more file ops
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit b24a820e7a)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Ryan Lee
150d81a705 Add more operations to the regression test complain binary
This extra functionality is to be used in a different regression test that reuses the binary

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 8212fa8be4)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Ryan Lee
1567a2de16 Add the overlayfs regression test to task.yaml
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e0127767fd)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Ryan Lee
0f2509d74a Add the overlayfs regression test to the Makefile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 1cb11f5a89)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Ryan Lee
24e7b806cc Add a basic overlayfs regression test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 2fdb5c799c)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-21 11:12:20 -08:00
Christian Boltz
db93b6c639 Merge postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/incoming/.

Similar to 3c2aae3.

Example error:

```
type=AVC msg=audit(1737094364.337:12023): apparmor="DENIED" operation="open" profile="postfix-showq" name="/var/spool/postfix/incoming/B7E4C12C784A" pid=17879 comm="showq" requested_mask="r" denied_mask="r" fsuid=91 ouid=91FSUID="postfix" OUID="postfix"
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1489
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 817d5eed1d)

ba765e0e postfix-showq profile fix

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-01-18 13:10:03 +00:00
Christian Boltz
4c849a9c9e Merge Add support for lastlog2 to get last login
lastlog2 is the 2038-safe replacement for wtmp, and in the meantime
became part of util-linux.

Adjust get_last_login_timestamp() to use the lastlog2 database
(/var/lib/lastlog/lastlog2.db) if it exists, and adjust
get_last_login_timestamp_lastlog2() to actually do that.

(If lastlog2.db doesn't exist, aa-notify will read wtmp as usual.)

Unfortunately lastlog2 doesn't have a way to get machine-readable output
(for example json), therefore - after trying and failing to parse the
lastlog2 output - directly read from lastlog2.db. Let's hope the format
never changes ;-)

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1228378

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1216660

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/372

I propose this patch for 4.0 and master.

Closes #372
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1282
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 692e6850ba)

7d537efc Rename get_last_login_timestamp to get_last_login_timestamp_wtmp
371a9ff9 Add support for lastlog2 to get last login
45e4c27c Add support for lastlog2 to get last login

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-01-14 19:13:15 +00:00
Christian Boltz
6de66daba4 Merge Support unloading profiles in kill and prompt mode
... in aa-teardown (actually everything that uses rc.apparmor.functions)
and aa-remove-unknown.

Fixes: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2093797

I propose this fix for 3.0..master, since the apparmor.d manpage in all these branches mentions the `kill` flag.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1484
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 9629bc8b6f)

1c2d79de Support unloading profiles in kill and prompt mode

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2025-01-14 18:24:57 +00:00
Ryan Lee
2e41f447d2 Merge Make libaalogparse fully reentrant by removing its globals
Tested by using Valgrind's Helgrind and DRD against the reentrancy test that I wrote: they both report no errors with the changes while reporting many errors with the old versions.

Commits "Inline _parse_yacc in libaalogparse" and "Make parse_record take a const char pointer since it never modified str anyways" have a tiny potential to be backwards-incompatible changes: I have justified why they shouldn't be in the commit messages, but it's worth looking over in case I was mistaken and we need to back those out.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1322
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 37cac653d1)
2025-01-09 11:16:07 -08:00
Ryan Lee
97051875d0 Remove remnants of comments regarding old apparmor log format
The entry AA_RECORD_SYNTAX_V1 is only there for API compatibility reasons.
If we wanted to remove it, we could just renumber the other two entries
to preserve ABI compatibility. However, it seems easier to just delete the
entry if we ever break backcompat with a libapparmor2.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 79670745d6)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
43c759afc6 Make parse_record take a const char pointer since it never modified str anyways
This shouldn't be a breaking change because it's fine to pass a
non-const pointer to a function taking a const pointer, but not the other way round

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 78f138c37f)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
a6b9fc49d2 Add an aalogparse reentrancy test for simultaneous log parsing from different threads
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 66e1439293)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
fcbfaa29b2 Inline _parse_yacc in libaalogparse
This function was only ever called once inside libaalogparse.c, and it looks
simple enough to not need to be split out into its own helper function.

As this function was never exposed publicly in installed header files, removing it
is not a breaking API change.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 6a55fb5613)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
08cd2271ed Remove manual YYDEBUG define in grammar.y
The generated grammar.h already sets the correct YYDEBUG value regardless
of whether parse.trace is defined

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 7ff045583d)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
2571d5bbc0 Also make the bison parser of libaalogparse fully reentrant
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit dba7669443)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
dde841575e Silence -Wyacc because we rely on GNU bison extensions to yacc
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c5c7565357)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
Ryan Lee
4b290a922a Make libaalogparse lexer fully reentrant by removing its globals
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e0504e697a)
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
2025-01-09 11:16:07 -08:00
John Johansen
8d9a061a45 Prepare for 4.1.0~beta3 release
- bump version

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:47:26 -08:00
John Johansen
94ea0f00b1 Merge parser: convert uint to unsigned int
As reported in https://gitlab.com/apparmor/apparmor/-/merge_requests/1475
uint requires the inclusion of sys/types.h for use in musl libc.
Including that would be fine but since it is only used for the
cast for the owner type comparison, just convert to use a more
standard type.

Reported-by: @fossd <fossdd@pwned.life>
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1478
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit cd8b75abc0)
2025-01-09 02:46:06 -08:00
John Johansen
99e919c288 parser: convert uint to unsigned int
As reported in https://gitlab.com/apparmor/apparmor/-/merge_requests/1475
uint requires the inclusion of sys/types.h for use in musl libc.
Including that would be fine but since it is only used for the
cast for the owner type comparison, just convert to use a more
standard type.

Reported-by: @fossd <fossdd@pwned.life>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit ff03702fde)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:46:06 -08:00
John Johansen
d805b5c3f8 Merge cupsd: Add /etc/paperspecs and convert to @etc_ro/rw
I had this message in my log

```
Dez 30 08:14:46 kernel: audit: type=1400 audit(1735542886.787:307): apparmor="DENIED" operation="open" class="file" profile="/usr/sbin/cupsd" name="/etc/paperspecs" pid=317509 comm="cupsd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```

If the second commit is bad, I can drop it.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1472
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e5a960a685)
2025-01-09 02:26:24 -08:00
Jörg Sommer
2aa7fe4659 cupsd: convert profile to @etc_ro/rw
While cups itself writes to /etc the others require only read-only access
and might therefore live in /usr/etc.

(cherry picked from commit c3af6228fd)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:26:24 -08:00
Jörg Sommer
c456101ebb cupsd: Add /etc/paperspecs read access
Cups uses libpaper which accesses /etc/paperspecs.

ce42216e2e/lib/libpaper.c.in.in (L419)
(cherry picked from commit 97d7fa3f5f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:26:24 -08:00
John Johansen
9875ba19ef Merge Allow write access to /run/user/*/dconf/user
Gtk applications like Firefox request write access to the file
`/run/user/1000/dconf/user`. The code in `dconf_shm_open` opens the file
with `O_RDWR | O_CREAT`.

4057f8c84f/shm/dconf-shm.c (L68)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1471
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0eca26c6c2)
2025-01-09 02:26:07 -08:00
Jörg Sommer
ab15e29654 Allow write access to /run/user/*/dconf/user
Gtk applications like Firefox request write access to the file
`/run/user/1000/dconf/user`. The code in `dconf_shm_open` opens the file
with `O_RDWR | O_CREAT`.

4057f8c84f/shm/dconf-shm.c (L68)
(cherry picked from commit 318fb30446)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 02:26:07 -08:00
John Johansen
320a2a5155 Merge parser: fix priority for file rules.
Fix priority for file rules, and the ability to dump the dfa at different stages, and update and fix the equality tests.

This in particular adds the ability to better debug the equality tests. Instead of just piping the parser output into the hash it creates a tmp dir and drops the binary files there so they can be manually examined. It adds new options particularly the -r option making so the tests will exit on first failure to make it easier to isolate and examine a failure.

Eg.
```
./equality.sh -r -d -v
Equality Tests:
................................................................................................................................................................................................................................
Binary inequality 'priority=-1'x'priority=-1' change_hat rules automatically inserted
FAIL: Hash values match
parser: ./../apparmor_parser -QKSq --features-file=./features_files/features.all
known-good (ee4f926922ecd341f1389a79dd155879) == profile-under-test (ee4f926922ecd341f1389a79dd155879) for the following profiles:
known-good         /t { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current a, ^test { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current a, /f r, }}
profile-under-test /t { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current w, ^test { priority=-1 owner /proc/[0-9]*/attr/{apparmor/,}current w, /f r, }}

  files retained in "/tmp/eq.3240859-deHu10/"
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1455
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 40e9b2a961)
2025-01-09 01:44:18 -08:00
John Johansen
00dc6794f5 parser: equality tests: convert to using sha256sum for the hashes
There is a general industry wide effort to move off of md5 and even
sha1 (see recent kernel changes). While in this particular use case it
doesn't make a difference (besides slightly lowering the chance of a
collision) switch to sha256sum to make sure our code doesn't depend on
tools that are deprecated and there is an effort to remove.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 027b508da8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
958a77a2db parser: equality tests: fix r carve out tests
Similar to the deny x permission tests, the tests that test carving
out r permissions need to be updated to be conditional on what
priority is being used on the rule.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit bf7b80c478)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
b4aa2cfde4 parser: equality tests: update deny x perm carve out test
With priority rules, deny does not carve out permissions from the
higher priority rule. Technically it doesn't from lower priority either
as it completely overrides them, but that case already results in
an inequality so does not cause the tests to fail.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 25f16b239d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
86273b746a parser: equality tests: fix cx specified profile transition
cx rules using a specified profile transition, may be emulated by
using px and a hierarchical profile name. That is

  cx -> b

may be transformed into

  px -> profile//b

which will generate an xtable entry of

  profile//b

which means the previous patch using

  pivot_root -> b,

to reliably add b to the xtable will not cover this case.

transition to using two pivot_root rules to provide the xtable entries
  pivot_root /a -> b,
  pivot_root /c -> /t//b,

the paths /a and /c are irrelavent as long as they don't have an
overlap with the generic globbing expression in the test, Two table
entries will be generated. We guarantee no overlap by converting the

  /** to /f**

Also the xtable reserving rules are moved to the end of the profile so
the table order can be reliably created. A follow on MR around xtable
improvements should add reliability to xtable order.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 369029dc07)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
6a26d1f58c parser: equality tests: fix equality failure due to xtable
exec rules that specify an specific target profile generate an entry
in the xtable. The test entries containing " -> b" are an example of
this.

Currently the parser allocates the xtable entry before priorities are
applied in the backend, or minimization is done. Further more the
parser does not ref count the xtable entry to know what it is no
longer referenced.

The equality tests generate rules that are designed to completely
override and remove a lower priority rule, and remove it. Eg.

  /t { priority=1 /* ux, /f px -> b, }

and then compares the generated profile to the functionaly equivalent
profile eg.

  /t { priority=1 /* ux, }

To verify the overridden rule has been completely removed.
Unfortunately the compilation is not removing the unused xtable entry
for the specified transition, causing the equality comparison to fail.

Ideally the parser should be fixed so unused xtable entries are removed,
but that should be done in a different MR, and have its own test.

To fix the current tests, and another rule that adds an xtable entry
to the same target that can not be overriden by the x rule using
pivot_root. The parser will dedup the xtable entry resulting in the
known and test profile both having the same xtable. So the test will
pass and meet the original goal of verifying the x rule being overriden
and eliminated.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 84650beb2f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
17d3545d07 parser: equality tests: rework and add debug features
Failed equality tests can be hard to debug. The profiles aren't always
enough to figure out what is going on. Add several options that will
help in debugging, and developing new tests.

Add switches and arg parsing.

Add the ability to run tests individually

Add a -r flag to allow retaining the test and output
similar to the regression tests, so the exact output from the
tests can be examined.

Add a -d flag to dump dfa build information.

Allow overriding the parser, features, and description for a given
test run.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit cca842b897)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
640c3dde26 parser: equality tests: wrap test run in function
In preparation for some additional abilities wrap the current tests in
a function.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 05ddc61246)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
380a5c8a72 parser: equality tests: consitently dump error output to stderr
printf of failure/error info should be going to stderr. Unfortunately
the test has a mix of 2>&1 and 1>&2. Having a mix is just wrong, we
could standardize on either but since the info is error info 1>&2
seems to be the better choice.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 31e60baab2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
f26f577742 parser: equality tests: fix failing overlapping x rule tests
The test was passing because the file priority was always zero bug
resulting in the priority rule always being correctly combined
with the specific match x rule, instead of overriding it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 57c57f198c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
2700e58755 parser: equality tests: fix change_hat priority test
The test was passing because the file priority always being zero bug,
the supplied rule always had the same priority as the implied
rule. Resulting in binary_equality always passing even though the
specified priority should have resulted in a failure.

Fix this by checking if the priorities are equal to the implied
rule other wise it should result in an inequality.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 4b410b67f1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
427a895288 parser: equality tests: output parser, config and features info
When there is a failure output the exact call info used to invoke the
parser. To facilitate manually recreating the test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit d275dfdd42)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
dc0a9dc599 parser: equality tests: convert xequality tests to equality
With the file priority fix the xequality (expected equal but known
failure) tests are now passing. So convert them to regular equality
tests.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit fcee32a37e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
74219b34dc parser: add some new dfa dump options.
The dfa goes through several stages during the build. Allow dumping it
at the various stages instead of only at the end.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 5d2a38e816)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
5aaa45e4ce parser: fix priority for file rules.
File rules could drop priority info when rule matched a rule
that was the same except for having different priority. For now
fix this by treating them as a different rule.

The priority was also be dropped when add_prefix was used to
add the priority during the parse resulting in file rules always
getting a default priority of 0.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 9d5b86bc9d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:44:18 -08:00
John Johansen
0c02c8afe1 Merge Allow python cache under the @{HOME}/.cache/ dir
Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment
variable to define a cache directory for Python [1]. I think most people would set
this dir to @{HOME}/.cache/python/ , so the python abstraction should allow
writing to this location.

[1]: https://docs.python.org/3/using/cmdline.html#envvar-PYTHONPYCACHEPREFIX

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1467
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8c799f4eec)
2025-01-09 01:43:42 -08:00
Mikhail Morfikov
70ed8d6f38 Allow python cache under the @{HOME}/.cache/ dir
Starting with Python 3.8, you can use the PYTHONPYCACHEPREFIX environment
variable to define a cache directory for Python [1]. I think most people would set
this dir to @{HOME}/.cache/python/ , so the python abstraction should allow
writing to this location.

[1]: https://docs.python.org/3/using/cmdline.html#envvar-PYTHONPYCACHEPREFIX

(cherry picked from commit 03b5a29b05)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:43:42 -08:00
John Johansen
5751614928 Merge regression tests: make loop device size more generous
Depending on the system, copying echo to the loop device fails because the echo binary is too large.
Especially on systems that have echo be just a symlink to coreutils (e.g. busybox) (as opposed to echo being its own binary) 16k is just not enough.
2M seems fine on my system, but this might need yet a higher value depending on what coreutils other people actually run.

The crash in question:
```
cp: error writing '/tmp/sdtest.3937422-31490-Bxvi6g/mount_target/echo': No space left on device
Fatal Error (file_unbindable_mount): Unexpected shell error. Run with -x to debug
rm: cannot remove '/tmp/sdtest.3937422-31490-Bxvi6g/mount_target': Device or resource busy
```

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1469
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 8e431ebcd9)
2025-01-09 01:43:11 -08:00
Grimmauld
73842b54f7 regression tests: make loop device size more generous
Depending on the system, copying echo to the loop device fails because the echo binary is too large.
Especially on systems that have echo be just a symlink to coreutils (e.g. busybox) 16k is just not enough.
2M seems fine on my system, but this might need yet a higher value depending on what coreutils other people actually run.
The actual loop device needs to be larger to properly fit the allocated file size. Testing shows 4M is sufficient, but this is basically arbitrary.

(cherry picked from commit 1cc2a3bd86)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:43:11 -08:00
John Johansen
54f1cf8dca Merge Write a regression test for mediating file access in private mounts
This test, as is, emits an execname warning which is due to a bug in the `prologue.inc` infrastructure (see !1450 for a fix to this issue).

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1448
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit ba60bfff85)
2025-01-09 01:42:41 -08:00
Ryan Lee
2de3b84de2 Shellcheck fix pass over file_unbindable_mount test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit fa58d3611a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:41 -08:00
Ryan Lee
9fc848be81 Add file_unbindable_mount to regression task.yaml
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit c768a7dc79)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:41 -08:00
Ryan Lee
fefbf514f7 Add file_unbindable_mount to regression test Makefile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 049b35dff0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:41 -08:00
Ryan Lee
ae0c588acb Write a regression test for mediating file access in unbindable mounts
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit f249c6d58f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:41 -08:00
John Johansen
0af8c5e26f Merge aa-status: fix json generation
- previously, aa-status --json --show profiles would return non-standard json
- adding the --pretty flag would crash completely
- closes #470

Things done:
- removed trailing ", " in json generation
- generate json seperator (", ") for each new json field
  (profiles/processes) after the header if json is enabled

Tested on NixOS and apparmor 4.0.3 base, but should work on any version the patch applies on.

Closes #470
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1451
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit c489631770)
2025-01-09 01:42:18 -08:00
Grimmauld
f4deae6759 aa-status: fix json output with --count flag
(cherry picked from commit 9967ba9873)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:18 -08:00
Grimmauld
0691cfcf3c aa-status: fix json generation
- previously, aa-status --json --show profiles would return non-standard json
- adding the --pretty flag would crash completely
- closes #470

Things done:
- removed trailing ", " in json generation
- generate json seperator (", ") for each new json field
  (profiles/processes) after the header if json is enabled

Tested on NixOS and apparmor 4.0.3 base, but should work on any version the patch applies on.

(cherry picked from commit 4f006a660c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:18 -08:00
John Johansen
760ddaeb80 Merge fixes on the testing infrastructure
This MR is meant to resolve warnings such as "Warning: execname '/home/username/Documents/apparmor/tests/regression/apparmor/file_unbindable_mount': no such file or directory" when running tests like the one in the current version of !1448.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1450
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 59957aa1d8)
2025-01-09 01:42:03 -08:00
Georgia Garcia
4e46df38cf tests: fix profile name when wrapper is specified
When settest was called with two parameters, one for the test name and
the other for the test wrapper/binary, the profile created with
genprofile would show the test name, causing an error if the file
didn't exist.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit b4adff2ce0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:03 -08:00
Georgia Garcia
e9858c0c43 tests: add option to append a profile to a profile already generated
Some of the tests using the --stdin option of mkprofile.pl are adding
more than one profile at a time. Whenever a profile is created in the
test, its name is added to the file profile.names so the test
infrastructure can tell if the profile is loaded or removed when
appropriately. The issue is that the name of the second profile
created by --stdin is not added, so these checks are not applied.

This patch adds the option of appending a second profile (not rules).
The option --append was used instead of a short -A because the short
options are arguments of mkprofile.pl, which --append is not.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 0307619ed9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:03 -08:00
Georgia Garcia
0e59b99623 tests: remove outdated restriction on image name specification
Due to how the tests were implemented in the past, permissions could
be passed along with the image name, and the permission part would be
discarded. The issue is that permissions are usually separated by ':',
but namespaces also contain ':', which would cause a conflict.

Since permissions are no longer passed as part of the image name,
remove that description so profile names in namespaces can be
supported.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 9cc40e2dca)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:42:03 -08:00
John Johansen
9a2f0ff702 Merge profiles: transmission-gtk needs attach_disconnected
From LP: #2085377, when using ip netns to torrent traffic through a
VPN, attach_disconnected is needed by the policy because ip netns sets
up a mount namespace.

Fixes: https://bugs.launchpad.net/bugs/2085377
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1395
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 50f260df51)
2025-01-09 01:41:36 -08:00
Georgia Garcia
c153a6916f profiles: transmission-gtk needs attach_disconnected
From LP: #2085377, when using ip netns to torrent traffic through a
VPN, attach_disconnected is needed by the policy because ip netns sets
up a mount namespace.

Fixes: https://bugs.launchpad.net/bugs/2085377
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit f9edc7d4c1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:41:35 -08:00
John Johansen
2316ad42d4 Merge Allow make-* flags with remount operations
While the mount syscall documentation disallows this, the kernel silently
ignores make-* flags when doing a remount, and real applications were
passing this conflicting set of flags. Because changing the kernel to
reject this combination would break userspace, we should allow them
instead.

For an example: see https://bugs.launchpad.net/apparmor/+bug/2091424.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1466
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 3ed5adb665)
2025-01-09 01:41:22 -08:00
Ryan Lee
e46ca918a2 Add a regression test for allowing rprivate with conflicting options
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 83270fcf68)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:41:22 -08:00
Ryan Lee
610d383de2 Allow make-* flags with remount operations
While the mount syscall documentation disallows this, the kernel silently
ignores make-* flags when doing a remount, and real applications were
passing this conflicting set of flags. Because changing the kernel to
reject this combination would break userspace, we should allow them
instead.

For an example: see https://bugs.launchpad.net/apparmor/+bug/2091424.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 52babe8054)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:41:22 -08:00
John Johansen
5ae6f202f8 Merge Add separator between mount flags in dump_flags
The previous code would concatenate all of them together without spacing.
While dump_flags and the corresponding operator<< function aren't currently used,
this will help for when dump_flags is used to debug parser problems.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1465
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 67ee5f8b39)
2025-01-09 01:40:41 -08:00
Ryan Lee
d96d69a60c Add separator between mount flags in dump_flags
The previous code would concatenate all of them together without spacing.
While dump_flags and the corresponding operator<< function aren't currently used,
this will help for when dump_flags is used to debug parser problems.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 96718ea4d1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:40:41 -08:00
John Johansen
164526d16a Merge Update fs type comment in swap regression test
As per https://gitlab.com/apparmor/apparmor/-/merge_requests/1463#note_2259888640: this really should have been a part of !1463, except that cboltz only pointed this out after the MR was already merged. Better late than never, nevertheless.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1464
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit f2c398405b)
2025-01-09 01:39:20 -08:00
Ryan Lee
5267a7eb14 Update fs type comment in swap regression test
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 5cd3362a81)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:39:20 -08:00
John Johansen
fd24c230c9 Merge Fix swap regression test on btrfs
As per !1462 it turns out that the swap regression test on btrfs also needs special casing in order to work properly. This is an analogous patch to check for btrfs.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1463
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 6d7b5df947)
2025-01-09 01:39:00 -08:00
Ryan Lee
14933dc768 Fix swap regression test on btrfs
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 90c7af69c5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:39:00 -08:00
John Johansen
9bf91bbe40 Merge fix swap test on zfs file system
Swap on ZFS is *weird*. Getting it working needs some special casing, see e.g. https://askubuntu.com/questions/1198903/can-not-use-swap-file-on-zfs-files-with-holes

Currently, the swap regression test fails on my system (with /tmp in zfs):
```bash
tests/regression/apparmor ❯ ./swap.sh
Error: swap failed. Test 'SWAPON (unconfined)' was expected to 'pass'. Reason for failure 'FAIL: swapon /tmp/sdtest.872368-19048-kN4FN2/swapfile failed - Invalid argument'
Error: swap failed. Test 'SWAPOFF (unconfined)' was expected to 'pass'. Reason for failure 'FAIL: swapoff /tmp/sdtest.872368-19048-kN4FN2/swapfile failed - Invalid argument'
swapon: /tmp/sdtest.872368-19048-kN4FN2/swapfile: skipping - it appears to have holes.
Fatal Error (swap): Unexpected shell error. Run with -x to debug
```

However, just doing a file mount does make the test work on zfs, similar to how it is done with tmpfs. This means we don't need any special-casing for zfs beyond what is already there for working around (similar) tmpfs limitations.

Also, while researching this, it is possible a similar patch is needed for btrfs, but i currently don't have an easy way to test that.
This is non-breaking for anyone *not* using zfs, and it is currently broken with zfs anyways.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1462
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit e8f1ac4791)
2025-01-09 01:38:43 -08:00
Grimmauld
8597b04aac fix swap test on zfs file system
(cherry picked from commit 9a1b538298)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:38:43 -08:00
John Johansen
28537ff8ec Merge limit buildpath.py setuptools version check to the relevant bits
previously, this check would fail if the setuptools version would contain non-integers.
On my system, that is the case: `setuptools.__version__` is `'75.1.0.post0'`
I believe it is entirely fair to just check the relevant bits and refuse  to continue if those can not be checked properly.
Having some extra slug on the version should not immediately cause issues (e.g. the `post0` here, or slugs like `beta`, `alpha` and the likes).
Probably only very few systems are running setuptools with weird version info, but supporting this is a simple one-line change i figured i might as well MR.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1460
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit b3de4ef022)
2025-01-09 01:38:28 -08:00
Grimmauld
f90a041921 limit buildpath.py setuptools version check to the relevant bits
previously, this check would fail if the setuptools version would contain non-integers.
On my system, that is the case: `setuptools.__version__` is `'75.1.0.post0'`
I believe it is entirely fair to just check the relevant bits and refuse  to continue if those can not be checked properly.
But haviong something extra on the version should not immediately cause issues (e.g. the `post0` here, or slugs like `beta`, `alpha` and the likes).
Probably only very few systems are running setuptools with weird version info, but supporting this doesn't cost much, i believe.

(cherry picked from commit 3302ae98e4)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:38:27 -08:00
John Johansen
ae0d1aafda Merge postfix-smtp profile fix
Allow locking for /var/spool/postfix/pid/unix.relay.

Example log entry: `type=AVC msg=audit(1733851239.685:8882): apparmor="DENIED" operation="file_lock" profile="postfix-smtp" name="/var/spool/postfix/pid/unix.relay" pid=14222 comm="smtp" requested_mask="k" denied_mask="k" fsuid=91 ouid=0FSUID="postfix" OUID="root"`

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1459
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 8a6eb170e1)
2025-01-09 01:37:32 -08:00
pyllyukko
403b3cad10 postfix-smtp profile fix
Allow locking for /var/spool/postfix/pid/unix.relay.

(cherry picked from commit 76dcf46d4f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:37:32 -08:00
John Johansen
851f6013f6 Merge Use MS_SYNCHRONOUS instead of MS_SYNC
MS_SYNC is a flag for msync(2) while MS_SYNCHRONOUS is a flag for mount(2).
The header used to define MS_SYNC but IMO this is confusing since that's an
unrelated flag.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1458
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 60f1b55ab5)
2025-01-09 01:36:14 -08:00
Zygmunt Krynicki
0838496c32 Use MS_SYNCHRONOUS instead of MS_SYNC
MS_SYNC is a flag for msync(2) while MS_SYNCHRONOUS is a flag for mount(2).
The header used to define MS_SYNC but IMO this is confusing since that's an
unrelated flag.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit d164e877f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:36:14 -08:00
John Johansen
191f01b749 Merge Allow spread to use locally-provided kernel
By placing a bzImage into the top level of the AppArmor git repository one can
instruct spread and image-garden to use that image instead of booting
traditionally with an EFI / full disk image pair.

In addition, make error handling in qemu more robust, so failures are both
surfaced and do not cause endless attempts to allocate.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1452
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 239ae21b69)
2025-01-09 01:35:52 -08:00
Zygmunt Krynicki
788d29aacb Allow spread to use locally-provided kernel
By placing a bzImage into the top level of the AppArmor git repository one can
instruct spread and image-garden to use that image instead of booting
traditionally with an EFI / full disk image pair.

In addition, make error handling in qemu more robust, so failures are both
surfaced and do not cause endless attempts to allocate.

Please update image-garden to at least 5a00ead9964df6463e19432ae50e7760fc6da755

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 7031b5aeee)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:35:52 -08:00
John Johansen
1b70d1e9c2 Merge tests: add regression tests for snapd mount-control
The test adds a very small and simple smoke test that shows that a mount rule
with both fstype and options allows mounts to be performed on a real running
kernel.

The test is structured in a way that should make it easy to extend with new
variants (flags, fstype) in the future.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1445
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit 11d121409d)
2025-01-09 01:35:27 -08:00
Zygmunt Krynicki
00a5c07db5 tests: add regression tests for snapd mount-control
The test adds a very small and simple smoke test that shows that a mount rule
with both fstype and options allows mounts to be performed on a real running
kernel.

The test is structured in a way that should make it easy to extend with new
variants (flags, fstype) in the future.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 1f60021979)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:35:27 -08:00
John Johansen
6876448a24 Merge Allow running tests with spread
Spread is a full-system, or integration test suite runner initially developed
to test snapd. Over time it has spread to other projects where it provides a
structured way to organize, run and debug complex full-system interactions.
Spread is documented on https://github.com/canonical/spread and is used in
production since late 2016.

Spread has a notion of backends which are responsible for allocating and
discarding test machines. For the purpose of running AppArmor regression tests,
I've combined spread with my own tool, image garden. The tool provides
off-the-shelf images, constructed on-the-fly from freely available images, and
makes them easily available to spread.

The reason for doing it this way is so that using non-free cloud systems is not
required and anyone can repeat the test process locally, on their own computer.
Vanilla spread is somewhat limited to x86-64 systems but the way I've used it
here makes it equally possible to test x86_64 *and* aarch64 systems. I've done
most of the development on an ARM single-board-computer running on my desk.

Spread requires a top-level spread.yaml file and a collection of task.yaml
files that describe individual tasks (for us, those are just tests). Tasks have
no implied dependency except that to reach a given task, spread will run all
the _prepare_ statements leading to that task, starting from the project, test
suite and then task. With proper care one can then run a specific individual
test with a one-line command, for example:

```
spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```

This will prepare a fresh ubuntu-cloud-24.04 system (matching the CPU
architecture of the host), copy the project tree into the test machine, install
all the build dependencies, build all the parts of apparmor and then run one
specific variant of the regression test, namely the at_secure program.
Importantly the same test can also run on, say debian-cloud-13 (Debian Trixie),
but also, if you have a Google cloud account, on Google Compute Engine or in
one of the other backends either built into spread or available as a fork of
spread or as a helper for ad-hoc backend. Spread can also create more than one
worker per system and distribute the tests to all of the available instances.
In no way are we locking ourselves out of the ability to run our test suite on
our target of choice.

Spread has other useful switches, such as:
- `-reuse` for keeping machines around until discarded with -discard
- `-resend` for re-sending updated copy of the project (useful for -reuse)
- `-debug` for starting an interactive shell on any failure
- `-shell` for starting an interactive shell instead of the `execute` phase

This first patch contains just the spread elements, assuming that both spread
and image-garden are externally installed. A GitLab continuous integration
installing everything required and running a subset of tests will follow
shortly.

I've expanded the initial selection of systems to allow running all the tests
on several versions of Ubuntu, Debian and openSUSE, mainly as a sanity check
but also to showcase how practical spread is at covering real-world systems.

A number of tests are currently failing:

    - garden:debian-cloud-12:tests/regression/apparmor:attach_disconnected
    - garden:debian-cloud-12:tests/regression/apparmor:deleted
    - garden:debian-cloud-12:tests/regression/apparmor:unix_fd_server
    - garden:debian-cloud-12:tests/regression/apparmor:unix_socket_pathname
    - garden:debian-cloud-13:tests/regression/apparmor:attach_disconnected
    - garden:debian-cloud-13:tests/regression/apparmor:deleted
    - garden:debian-cloud-13:tests/regression/apparmor:unix_fd_server
    - garden:debian-cloud-13:tests/regression/apparmor:unix_socket_pathname
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:attach_disconnected
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:deleted
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:e2e
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_fd_server
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_socket_pathname
    - garden:opensuse-cloud-15.6:tests/regression/apparmor:xattrs_profile

In addition, only on openSUSE, I've skipped the entire test suite of the utils
directory, as it requires python3 ttk themes, which I cannot find in packaged
form.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1432
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit d9304c7653)
2025-01-09 01:31:39 -08:00
Zygmunt Krynicki
297cd44aff Document spread tests in README.md
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit d27377a62f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:31:39 -08:00
Zygmunt Krynicki
32da740f1b Third iteration of spread support
- Tests defined in utils/test are now described by a task.yaml in the same
  directory and can run concurrently across many machines.
- Tests for utils/ are now executed on openSUSE Tumbleweed since ttk themes is
  no longer a hard dependency in master.
- Tests no longer run on openSUSE Leap 15.6 due to the age of default
  Python (3.6) and gcc/g++. The tight integration with SWIG which does
  not seem to support other Python versions very well. Perl hard-codes
  old GCC for extension modules. The upcoming openSUSE Leap 16 should be
  a viable target. In the meantime we can still test everything through
  rolling-release Tumbleweed.
- Formatting of YAML files is now more uniform, at four spaces per tab.
- The run-spread.sh script is now in the root of the tree. The script allows
  running all spread tests sequentially on one system, while collecting logs
  and artifacts for convenient analysis after the fact.
- All systems are adjusted to run _four_ workers in parallel with _two_ virtual
  cores each and equipped with 1.5GB of virtual memory. This aims to best
  utilize the capacity of a typical CI worker with two to four cores and about
  8GB of available memory.
- Failing tests are marked as such, so that as a whole the entire spread suite
  can pass and be useful at catching regressions.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 1df91e2c8c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:31:39 -08:00
Zygmunt Krynicki
b24f0bbfa8 Second iteration of spread support
Compared to v1 the following improvements have been made:

- The cost of installing packages have been shifted from each startup to image
  preparation phase, thanks to the integration of custom cloud-init profiles
  into image-garden. This has dramatic impact on iteration time while also
  entirely removing requirement to be online to run once a prepared image is
  available.

- Support for running on Google Compute Engine has been removed since it would
  not be able to use cloud-init the same way would currently only complicate
  setup.

- The number of workers have been tuned for local iteration, aiming for
  comfortable work with 16GB of memory on the host. Once CI/CD pipeline
  support is introduced I will add a dedicated entry so that resources are
  utilized well both locally and when running in CI.

- The set of regression tests listed in tests/regression/apparmor/task.yaml is
  now cross-checked so introduction of a new test to the makefile there is
  automatically flagged and causes spread to fail with a clear message.

- The task tests/unit/utils has been improved to generate profiles. Thanks to
  Christian Boltz for explaining this relationship between tests.

- A number of comments have been improved and cleaned up for readability,
  accuracy and sometimes better grammar.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit c95ac4d350)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:31:39 -08:00
Zygmunt Krynicki
5a4ddbeaeb Allow running tests with spread
Spread is a full-system, or integration test suite runner initially developed
to test snapd. Over time it has spread to other projects where it provides a
structured way to organize, run and debug complex full-system interactions.
Spread is documented on https://github.com/canonical/spread and is used in
production since late 2016.

Spread has a notion of backends which are responsible for allocating and
discarding test machines. For the purpose of running AppArmor regression tests,
I've combined spread with my own tool, image garden. The tool provides
off-the-shelf images, constructed on-the-fly from freely available images, and
makes them easily available to spread.

The reason for doing it this way is so that using non-free cloud systems is not
required and anyone can repeat the test process locally, on their own computer.
Vanilla spread is somewhat limited to x86-64 systems but the way I've used it
here makes it equally possible to test x86_64 *and* aarch64 systems. I've done
most of the development on an ARM single-board-computer running on my desk.

Spread requires a top-level spread.yaml file and a collection of task.yaml
files that describe individual tasks (for us, those are just tests). Tasks have
no implied dependency except that to reach a given task, spread will run all
the _prepare_ statements leading to that task, starting from the project, test
suite and then task. With proper care one can then run a specific individual
test with a one-line command, for example:

```
spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```

This will prepare a fresh ubuntu-cloud-24.04 system (matching the CPU
architecture of the host), copy the project tree into the test machine, install
all the build dependencies, build all the parts of apparmor and then run one
specific variant of the regression test, namely the at_secure program.
Importantly the same test can also run on, say debian-cloud-13 (Debian Trixie),
but also, if you have a Google cloud account, on Google Compute Engine or in
one of the other backends either built into spread or available as a fork of
spread or as a helper for ad-hoc backend. Spread can also create more than one
worker per system and distribute the tests to all of the available instances.
In no way are we locking ourselves out of the ability to run our test suite on
our target of choice.

Spread has other useful switches, such as:
- `-reuse` for keeping machines around until discarded with -discard
- `-resend` for re-sending updated copy of the project (useful for -reuse)
- `-debug` for starting an interactive shell on any failure
- `-shell` for starting an interactive shell instead of the `execute` phase

This first patch contains just the spread elements, assuming that both spread
and image-garden are externally installed. A GitLab continuous integration
installing everything required and running a subset of tests will follow
shortly.

I've expanded the initial selection of systems to allow running all the tests
on several versions of Ubuntu, Debian and openSUSE, mainly as a sanity check
but also to showcase how practical spread is at covering real-world systems.

A number of systems and tests are currently failing:

- garden:debian-cloud-12:tests/regression/apparmor:attach_disconnected
- garden:debian-cloud-12:tests/regression/apparmor:deleted
- garden:debian-cloud-12:tests/regression/apparmor:unix_fd_server
- garden:debian-cloud-12:tests/regression/apparmor:unix_socket_pathname
- garden:debian-cloud-13:tests/regression/apparmor:attach_disconnected
- garden:debian-cloud-13:tests/regression/apparmor:deleted
- garden:debian-cloud-13:tests/regression/apparmor:unix_fd_server
- garden:debian-cloud-13:tests/regression/apparmor:unix_socket_pathname
- garden:opensuse-cloud-15.6:tests/regression/apparmor:attach_disconnected
- garden:opensuse-cloud-15.6:tests/regression/apparmor:deleted
- garden:opensuse-cloud-15.6:tests/regression/apparmor:e2e
- garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_fd_server
- garden:opensuse-cloud-15.6:tests/regression/apparmor:unix_socket_pathname
- garden:opensuse-cloud-15.6:tests/regression/apparmor:xattrs_profile
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:attach_disconnected
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:deleted
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:unix_fd_server
- garden:opensuse-cloud-tumbleweed:tests/regression/apparmor:unix_socket_pathname
- garden:ubuntu-cloud-22.04:tests/regression/apparmor:attach_disconnected

In addition, only on openSUSE, I've skipped the entire test suite of the utils
directory, as it requires python3 ttk themes, which I cannot find in packaged
form.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit cc04181578)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:31:39 -08:00
Zygmunt Krynicki
fd253d1c31 Allow running exactly one test in utils/test
The new check-one-test-% pattern rule allows running individual test scripts.
This allows them to be tested in parallel across many Make worker threads or
across many distinct machines with spread.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 9588b06e0f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:31:39 -08:00
John Johansen
505faeff10 Merge Add explicit test for parser priority-based carveouts
Tests #466 but is marked as expected fail due to that bug not being resolved.

Depends on !1441 which adds the xfail infrastructure to the parser equality testing framework, and should be rebased on top of master once that MR is merged.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1443
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit e1d8bf1888)
2025-01-09 01:30:12 -08:00
Ryan Lee
3d5346b48e parser equality tests: print both profiles upon test failure
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit b925d8acff)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:30:12 -08:00
Ryan Lee
1d9e28df35 Add explicit test for parser priority-based carveouts
These are marked as expected fail due to a bug in the parser's priority
handling.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit 7b5f4c0d6f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:30:12 -08:00
John Johansen
9995e36347 Merge parser: equality tests: add the ability have tests that are a known problem
currently the equality tests require the tests to PASS as known equality
or inequality. Add the ability to add tests that are a known problem
and are expected to fail the equality, or inequality test.

This is done by using

   verify_binary_xequality
   verify_binary_xinequality

This allows new tests to be added to document a known issue, without
having to develop the fix for the issue. The use of this facility
is expected to be temporary, so any test marked as xequality or
xinequality will be noisy but not fail the other tests until they
are fixed, at which point they will cause the tests to fail to
force them to be updated to the correct equality or inequality
test.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1441
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 53e322b755)
2025-01-09 01:27:50 -08:00
John Johansen
08aeeedc69 parser: equality tests: add the ability have tests that are a known problem
currently the equality tests require the tests to PASS as known equality
or inequality. Add the ability to add tests that are a known problem
and are expected to fail the equality, or inequality test.

This is done by using

   verify_binary_xequality
   verify_binary_xinequality

This allows new tests to be added to document a known issue, without
having to develop the fix for the issue. The use of this facility
is expected to be temporary, so any test marked as xequality or
xinequality will be noisy but not fail the other tests until they
are fixed, at which point they will cause the tests to fail to
force them to be updated to the correct equality or inequality
test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit b81ea65c1c)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:27:50 -08:00
John Johansen
d426129baf Merge profiles: update bwrap profile
Update the bwrap profile so that it will attach to application profiles
if present.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1435
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 662a26d133)
2025-01-09 01:26:51 -08:00
John Johansen
cda7af8561 profiles: update bwrap profile
Update the bwrap profile so that it will attach to application profiles
if present.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 1979af7710)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:26:51 -08:00
John Johansen
f5844dc267 Merge regression tests: Add test to check for DAC permissions to the testsuite
The regression test suite uses root with capabilities restricted in
several tests. This can cause the test suite to fail in weird and
confusing ways.

Add a test to check for DAC permissiosns from / to the testsuite
and abort running the tests with an error message if DAC permissions
are going to cause the test suite to fail.

Currently the test is pretty basic, but is better than nothing.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1411
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit c5b17d85ea)
2025-01-09 01:21:11 -08:00
John Johansen
52b83aeac4 regression tests: Add test to check for DAC permissions to the testsuite
The regression test suite uses root with capabilities restricted in
several tests. This can cause the test suite to fail in weird and
confusing ways.

Add a test to check for DAC permissiosns from / to the testsuite
and abort running the tests with an error message if DAC permissions
are going to cause the test suite to fail.

Currently the test is pretty basic, but is better than nothing.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 82e4b4ba00)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:21:11 -08:00
John Johansen
89fd37abbf Merge Assorted fixes for test suite portability
I've been working on improved end-to-end testing of AppArmor on a number
of popular Linux distributions. My first run contains Debian, Ubuntu and openSUSE.

This branch contains three small fixes that, mainly, allow running more tests on
openSUSE Tumbleweed.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1431
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit 6f5cdb7b44)
2025-01-09 01:20:44 -08:00
Zygmunt Krynicki
ffff25e21b On openSUSE 15.6 make fails to find awk
Using this version of make:
```
GNU Make 4.2.1
Built for x86_64-suse-linux-gnu
```
I'm not entirely sure why but the alternative syntax I've used works correctly.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 4caf0aff81)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:44 -08:00
Zygmunt Krynicki
0e7e509ba8 Use larger loop device in mult_mount.sh test
This fixes the test to pass on openSUSE Tumbleweed, where the small size
prevented alloction of an inode for the `lost+found` directory:

```
garden:opensuse-cloud-tumbleweed .../tests/regression/apparmor# mkfs.ext2 -F -m 0 -N 10 /tmp/sdtest.32929-21402-6x826m/image.ext3
mke2fs 1.47.0 (5-Feb-2023)
Discarding device blocks: done
Creating filesystem with 512 1k blocks and 8 inodes

Allocating group tables: done
Writing inode tables: done
ext2fs_mkdir: Could not allocate inode in ext2 filesystem while creating /lost+found
```

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 32ee85cef8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:44 -08:00
Zygmunt Krynicki
4722ff8e65 Quote trailing backslash in test case
This fixes an error with Python 3.11:

```
test/test-parser-simple-tests.py:420:21: E502 the backslash is redundant between brackets
```

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 92fcdcab9e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:44 -08:00
Zygmunt Krynicki
d88c6d3bca Use command -v rather than which
Which is technically not POSIX and command -v works everywhere. This fixes
building and running the test suite on openSUSE Tumbleweed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit 4b0adc63f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:44 -08:00
Zygmunt Krynicki
37ea52db0c parser: quote BISON_MAJOR in case it is empty
On a test system without bison installed, make setup fails with:

  /bin/sh: 1: bison: not found
  /bin/sh: 1: test: -ge: unexpected operator

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
(cherry picked from commit f58fe9cd52)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:44 -08:00
John Johansen
da9c59ab09 Merge regression tests: check for setfattr binary used by xattrs_profile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1412
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 0828ab67b2)
2025-01-09 01:20:26 -08:00
Ryan Lee
8fde25d828 regression tests: check for setfattr binary used by xattrs_profile
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit b39a535cb9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-09 01:20:26 -08:00
John Johansen
5aa7d046db Merge Write basic file complain-mode regression tests
The test "Complain mode profile (file exec cx permission entry)" currently will only pass on a Ubuntu Oracular system due to a kernel bugfix patch that has not yet been upstreamed or backported.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1415
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 926929da16)
2025-01-08 23:06:13 -08:00
Ryan Lee
9c3ac976ec Write basic file complain-mode regression tests
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit cb110eaf98)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 23:06:13 -08:00
John Johansen
f433acb219 Merge Dovecot profile: Allow reading of /proc/sys/kernel/core_pattern
See <https://dovecot.org/bugreport.html>

(the link describes how Dovecot requires access to `core_pattern`)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1331
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit 2b45586fa9)
2025-01-08 23:01:29 -08:00
pyllyukko
5ee3c03101 Dovecot profile: Allow reading of /proc/sys/kernel/core_pattern
See <https://dovecot.org/bugreport.html>

(cherry picked from commit 0a5a9c465f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 23:01:29 -08:00
John Johansen
6fdc08a5a5 Merge tests: fix incorrect setfattr call in xattrs_profile
The file was quoted with the following space, making the test broken.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1429
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>

(cherry picked from commit a2d52fedb2)
2025-01-08 23:01:06 -08:00
Zygmunt Krynicki
e931449ffc tests: fix incorrect setfattr call in xattrs_profile
The file was quoted with the following space, making the test broken.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
(cherry picked from commit 8c16fb2700)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 23:01:06 -08:00
John Johansen
203b4994e9 Merge Quote some variables in regression test suite to allow for spaces
This is not a complete fix for the spaces issue, but it is the next simple step that can be taken before the more difficult work of finding the remaining bugs in each shell script.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1424
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit e27b0ad2b6)
2025-01-08 23:00:44 -08:00
Ryan Lee
7b53763f92 Quote some variables in regression test suite to allow for spaces
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
(cherry picked from commit e7ec01f075)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 23:00:44 -08:00
John Johansen
ddb33d348c Merge parser: fix expr MatchFlag dump
Match Flags convert output to hex but don't restore after outputting
the flag resulting in following numbers being hex encoded. This
results in dumps that can be confusing eg.

rule: \d2  ->  \x2 priority=1001 (0x4/0)< 0x4>

rule: \d7  ->  \a priority=3e9 (0x4/0)< 0x4>

rule: \d10  ->  \n priority=3e9 (0x4/0)< 0x4>

rule: \d9  ->  \t priority=3e9 (0x4/0)< 0x4>

rule: \d14  ->  \xe priority=1001 (0x4/0)< 0x4>

where priority=3e9 is the hex encoded priority 1001.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1419
Approved-by: Maxime Bélair <maxime.belair@canonical.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 2e77129e15)
2025-01-08 22:59:44 -08:00
John Johansen
8274bff547 parser: fix expr MatchFlag dump
Match Flags convert output to hex but don't restore after outputting
the flag resulting in following numbers being hex encoded. This
results in dumps that can be confusing eg.

rule: \d2  ->  \x2 priority=1001 (0x4/0)< 0x4>

rule: \d7  ->  \a priority=3e9 (0x4/0)< 0x4>

rule: \d10  ->  \n priority=3e9 (0x4/0)< 0x4>

rule: \d9  ->  \t priority=3e9 (0x4/0)< 0x4>

rule: \d14  ->  \xe priority=1001 (0x4/0)< 0x4>

where priority=3e9 is the hex encoded priority 1001.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a31343c5f7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 22:59:44 -08:00
John Johansen
b17750163b Merge Partial fix for regression tests if parent directory contains spaces
Most `tests/regression/apparmor/*.sh` scripts contain

    . $bin/prologue.inc

This will explode if one of the parent directories contains a space.

Minimized reproducer:

```
# cat test.sh
pwd=`dirname $0`
pwd=`cd $pwd ; /bin/pwd`
bin=$pwd
echo "pwd: $bin"
. $bin/prologue.inc
# ./test.sh
pwd: /tmp/foo bar
./test.sh: line 9: /tmp/foo: No such file or directory
```

Notice that test.sh tries to source `/tmp/foo` instead of `/tmp/foo bar/prologue.inc`.

The fix is to quote the prologue.inc path:

    . "$bin/prologue.inc"

While on it, also fix other uses of $bin - directly and indirectly - by quoting them.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1418
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit a422d2ea17)
2025-01-08 22:58:38 -08:00
Christian Boltz
9c229d1452 Quote indirect uses of $bin and ${bin}
... to avoid issues with spaces in a parent directory's name.

"Indirect uses" means usage of $bin via another variable, for example
`foo=$bin/whatever`

(cherry picked from commit 55db4af979)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 22:58:38 -08:00
Christian Boltz
702f2863a4 Quote all uses of $bin and ${bin}
... to avoid issues with spaces in a parent directory's name.

(cherry picked from commit 22cf88b7c7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 22:58:38 -08:00
Christian Boltz
989bf0b3ed Fix sourcing prologue.inc if parent directory contains spaces
Most `tests/regression/apparmor/*.sh` scripts contain

    . $bin/prologue.inc

This will explode if one of the parent directories contains a space.

Minimized reproducer:

```
pwd=`dirname $0`
pwd=`cd $pwd ; /bin/pwd`
bin=$pwd
echo "pwd: $bin"
. $bin/prologue.inc
pwd: /tmp/foo bar
./test.sh: line 9: /tmp/foo: No such file or directory
```

Notice that test.sh tries to source `/tmp/foo` instead of `/tmp/foo bar/prologue.inc`.

The fix - as done in this commit - is to quote the prologue.inc path:

    . "$bin/prologue.inc"

(cherry picked from commit e1972eb22f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 22:58:38 -08:00
John Johansen
9b1d0ea3d8 Merge parser: improve libapparmor_re build and dump info
Fix libapparmor_re/Makefile so it works correctly with rebuilds and
improve state machine dump information, to aid with debugging of
permission handling during the compile.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1410
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 015b41aeb4)
2025-01-08 12:24:33 -08:00
John Johansen
a577d92c7b parser: add the abilitiy to dump the permissions table
Instead of encoding permissions in the accept and accept2 tables
extended perms uses a permissions table and accept becomes an index
into the table.

Add the ability to dump the permissions table so that it can be
compared and debugged.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 45964d34e7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 12:22:58 -08:00
John Johansen
a16aff8e20 parser: add the accept2 table entry to the chfa dump
The chfa dump is missing information about the accept2 entry. The
accept2 information is necessary to help with debugging state machine
builds as accept2 is used to store quiet and audit information in the
old format or conditional information in the extended perms format.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 00dedf10ad)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 12:22:45 -08:00
John Johansen
4099bf6574 parser: fix and cleanup libapparmor_re/Makefile
The Makefile is missing some of its .h depenedncies causing compiles
to either fail or worse result in bad builds when rebuilding in an
already built tree.

Move the header dependencies into a variable and use it for each
target. While some targets don't need every include as a dependency
and this will result in unnecessary rebuilds in some cases, it makes
the Makefile cleaner, easier to maintain and makes sure a dependency
isn't accidentally missed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 7cc7f47424)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 12:22:28 -08:00
John Johansen
a102e9dc55 Merge parser: fix mapping of AA_CONT_MATCH for policydb compat entries
The mapping of AA_CONT_MATCH was being dropped resulting in the
tcp tests failing because they would only match up to the first conditional
match check in the layout.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/462
Fixes: e29f5ce5f ("parser: if extended perms are supported by the kernel build a permstable")
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1409
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit f24fc4841f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 11:44:22 -08:00
John Johansen
7c1eff3867 Prepare for 4.1.0~beta2 release
- bump version

Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
d69d4d3ddf Merge parser: bug fix do not change auditing information when applying deny
The parser recently changed how/where deny information is applied.
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed the implicit filtering of explicit denies during
the minimization pass. The implicit clear allowed the explicit
information to be carried into the minimization pass and merged with
implicit denies. The end result being a minimized dfa with the explicit
deny information available to be applied post minimization, and
then dropped later at permission encoding in the accept entries.

Extended permission however enable carrying explicit deny information
into the kernel to fix certain bugs like complain mode not being
able to distinguish between implicit and explicit deny rules (ie.
deny rules get ignored in complain mode). However keeping explicit
deny information when unnecessary result in a larger state machine
than necessary and slower compiles.

commit 179c1c1ba ("parser: fix minimization check for filtering_deny")
Moved the explicit apply_and_clear_deny() pass to before minimization
to restore mnimization's ability to create a minimized dfa with
explicit and implicit deny information merged but this also cleared
the explicit deny information that used to be carried through
minimization. This meant that when the deny information was applied
post minimization it resulted in the audit and quiet information
being cleared.

This resulted in the query_label tests failing as they are checking
for the expected audit infomation in the permissions.

Fixes: 179c1c1ba ("parser: fix minimization check for filtering_deny")
Bug: https://gitlab.com/apparmor/apparmor/-/issues/461
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1408
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit eb365b374d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
5c04b791d2 Merge aa-mergeprof: prevent backtrace if file not found
If a user specifies a non-existing file to merge into the profiles
(`aa-mergeprof /file/not/found`), this results in a backtrace showing an
AppArmorBug because that file unsurprisingly doesn't end up in the
active_profiles filelist.

Handle this more gracefully by adding a read_error_fatal parameter to
read_profile() that, if set, forwards the exception. With that,
aa-mergeprof doesn't try to list the profiles in this non-existing file.

Note that all other callers of read_profile() continue to ignore read
errors, because aborting just because a single file in /etc/apparmor.d/
(for example a broken symlink) isn't readable would be a bad idea.

This bug was introduced in 4e09f315c3, therefore I propose this patch for 3.0..master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1403
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 5ebbe788ea)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
be8d85603e Merge php-fpm: widen allowed socket paths
It is common for packaged PHP applications to ship a PHP-FPM
configuration using a scheme of "$app.sock" or or "$app.socket" instead
of using a generic FPM socket.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1406
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit bfa9147182)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Georgia Garcia
450813869a profiles: update dconf abstraction to use @{etc_ro}
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit cbe8d295a5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 740d7ddae14b69568eaede1b05fe560ae53762df)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
65c41b7fac Merge Misc small fixes to resolve some compiler warnings in regression test suite
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1407
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 14f54f3df2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Georgia Garcia
d19e5e8990 Merge Improvements to Postfix profiles
* Support /usr/libexec/postfix/ path
* Added abstractions/{nameservice,postfix-common} to postfix-postscreen
* Added postfix-tlsproxy, postscreen & spawn to postfix-master
    * Added missing postfix-tlsproxy profile
* Added postscreen cache map (see <https://www.postfix.org/postconf.5.html#postscreen_cache_map>)
* Added /{var/spool/postfix/,}pid/pass.smtpd to postfix-smtpd

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1330
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit f7b5d0e783)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Giampaolo Fresi Roglia
c11ad3e675 abstractions/nameservice: tighten libnss_libvirt file access
(cherry picked from commit 5be4295b5a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Georgia Garcia
de2bb16ad6 Merge Support name resolution via libnss-libvirt
Add support for hostname resolution via libnss-libvirt. This change has been tested against the latest oracular version 10.6.0-1ubuntu3.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1362
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit a522e11129)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Georg Pfuetzenreuter
4f1d2ac549 zgrep: deny passwd access
Bash will try to read the passwd database to find the shell of a user if
$SHELL is not set. This causes zgrep to trigger

```
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
```

if called in a sanitized environment. As the functionality of zgrep is
not impacted by a limited Bash environment, add deny rules to avoid the
potentially misleading AVC messages.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
(cherry picked from commit 48483f2ff8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Christian Boltz
cc9f0ed538 ProfileStorage: store correct name
Instead of always storing the name of the main profile, store the child
profile/hat name if we are in a child profile or hat.

As a result, we always get the correct "profile xy" header even for
child profiles when dumping the ProfileStorage object.

Also extend the tests to check that the name gets stored correctly.

(cherry picked from commit cb943e4efc)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Steve Beattie
1b8afda407 .gitignore: add mod_apparmor and pam_apparmor files
... that are generated during `make`

I propose this patch for 3.x..master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1374
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: Steve Beattie <steve+gitlab@nxnw.org>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
(cherry picked from commit 3478558904)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Christian Boltz
9aae96356e Merge apparmor.vim: Add missing units for rlimit cpu and rttime
... and allow whitespace between the number and the unit.

I propose this patch for 3.x, 4.0 and master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1336
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 247bdd5deb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
b5db2361f3 Merge profiles: add support for ArchLinux php-legacy package to php-fpm
ArchLinux ships a secondary PHP package called php-legacy with different
paths. As of now, the php-fpm profile will cover this binary but
inadequately restrict it.

Fixes: #454

Closes #454
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1401
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 3d1a3493af)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
John Johansen
5db4a1e7ca Merge abstractions/nameservice: include nameservice-strict
... and drop all rules it contains from abstractions/nameservice.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1373
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 4fe3e30abc)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2025-01-08 10:58:20 -08:00
Christian Boltz
230a975916 Merge smbd: allow capability chown
This is neeed for "inherit owner = yes" in smb.conf.

From man smb.conf:

    inherit owner (S)

    The ownership of new files and directories is normally governed by
    effective uid of the connected user. This option allows the Samba
    administrator to specify that the ownership for new files and
    directories should be controlled by the ownership of the parent
    directory.

Fixes: https://bugzilla.suse.com/show_bug.cgi?id=1234327

I propose this fix for 3.x, 4.x and master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1456
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>


(cherry picked from commit a315d89a2b)

d3050285 smbd: allow capability chown

Co-authored-by: John Johansen <john@jjmx.net>
2024-12-10 12:50:24 +00:00
Christian Boltz
aa3592a57e Merge postfix-showq profile fix
Allow reading queue ID files from /var/spool/postfix/hold/.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1454
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit dfe771602d)

3c2aae3a postfix-showq profile fix

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2024-12-09 18:56:41 +00:00
Christian Boltz
a9aef6f37b Merge python 3.13 fixes/workarounds
Fixes/workarounds for python 3.13 support.

fail.py: handle missing cgitb - workaround for https://gitlab.com/apparmor/apparmor/-/issues/447

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1439
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 5fb91616e3)

434e34bb fail.py: handle missing cgitb

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2024-12-05 17:36:32 +00:00
Georgia Garcia
c71c486313 Merge Remove match statements in utils for older Python compatibility
Somehow the use of new match statements slipped by review despite our commitment to supporting older Python versions. Replace them with an unfortunately-needed if-elif chain.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1440
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 36ae21e3fa)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2024-12-03 10:00:25 -03:00
Christian Boltz
4213dcc586 Merge aa-remove-unknown: fix readability check [upstreaming]
I am upstreaming this patch that is part of the nix package of apparmor for close to a year now.
This fixes the issue at https://github.com/NixOS/nixpkgs/issues/273164 for more distros than just NixOS.
The original merge Request on the nix side patching this was https://github.com/NixOS/nixpkgs/pull/285915.
However, people had issues with gitlab, so this never hit apparmor upstream until now. This does however also mean this patch has seen production and seems to work quite well.

## Original reasoning/message of the patch author:

This check is intended for ensuring that the profiles file can actually
be opened.  The *actual* check is performed by the shell, not the read
utility, which won't even be executed if the input redirection (and
hence the test) fails.

If the test succeeds, though, using `read` here might actually
jeopardize the test result if there are no profiles loaded and the file
is empty.

This commit fixes that case by simply using `true` instead of `read`.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1438
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 93c7035148)

b4aa00de aa-remove-unknown: fix readability check

Co-authored-by: Christian Boltz <apparmor@cboltz.de>
2024-12-01 16:11:25 +00:00
Christian Boltz
ff7f0ff0ea Merge test-logprof: Increase timeout once more
Builds for risc64 are much slower than on other architectures (4-5
seconds with qemu-user or on Litchi Pi 4A).

Since the timeout is only meant as a safety net, increase it generously,
and hopefully for the last time.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/463

I propose this patch for 4.0 and master.

Closes #463
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1417
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>


(cherry picked from commit 4c32ad8fb7)

508ace45 test-logprof: Increase timeout once more

Co-authored-by: John Johansen <john@jjmx.net>
2024-11-10 16:34:48 +00:00
John Johansen
9da0f6d3db Merge zgrep: allow reading /etc/nsswitch.conf and /etc/passwd
Seen on various VMs, my guess is that bash wants to translate a uid to a
username.

Log events (slightly shortened)

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/nsswitch.conf" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

apparmor="DENIED" operation="open" class="file" profile="zgrep" name="/etc/passwd" comm="zgrep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

I propose this patch for 3.0..master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1357
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit ab16377838)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:29:38 -07:00
John Johansen
0c1c186267 Merge Fix memory leak in aare_rules UniquePermsCache
When the find fails but the insertion also fails, we leak the new node
that we generated. Delete the new node in this case to avoid leaking
memory.

The question remains, however, as to whether we should implement `operator==` in addition to `operator<` so that they are consistent with each other and `find` works correctly.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1399
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 99261bad11)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:26:54 -07:00
Steve Beattie
bfd2a0e014 profiles: transmission-daemon needs attach_disconnected
Systemd's PrivateTmp= in transmission service is causing mount namespaces to be used leading to disconnected paths

[395201.414562] audit: type=1400 audit(1727277774.392:573): apparmor="ALLOWED" operation="sendmsg" class="file" info="Failed name lookup - disconnected path" error=-13 profile="transmission-daemon" name="run/systemd/notify" pid=193060 comm="transmission-da" requested_mask="w" denied_mask="w" fsuid=114 ouid=0

Fixes: https://bugs.launchpad.net/bugs/2083548
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1355
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Steve Beattie <steve+gitlab@nxnw.org>
(cherry picked from commit 4d3b094d9e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:24:50 -07:00
Georgia Garcia
c87fb0a8c1 Merge abstraction: add nameservice-strict.
As I have read multiple MR mentioning the `nameservice-strict`. Therefore, I thought it would make sense to directly import it here.

To give some context, this abstraction is probably the most commonly included abstraction (after `base`). In `apparmor.d`, it is used by over 700 profiles (only counting direct import). Therefore, adding new rules can have an important impact over a lot of profiles.

Note: the abstraction is a direct import from https://gitlab.com/roddhjav/apparmor.d. The license is the same, I obviously kept Morfikov copyright line. However, I am not sure either or not the SPDX identifier can be used here.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1368
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Approved-by: Christian Boltz <apparmor@cboltz.de>
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 68376e7fee)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:19:06 -07:00
Georgia Garcia
05debdb2d8 Merge Support name resolution via libnss-libvirt
Add support for hostname resolution via libnss-libvirt. This change has been tested against the latest oracular version 10.6.0-1ubuntu3.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1362
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit a522e11129)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:18:32 -07:00
Christian Boltz
8b06f61bea Merge ping: allow reading /proc/sys/net/ipv6/conf/all/disable_ipv6
Fixes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082190

I propose this patch for 3.0..master.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1340
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 4b6df10fe3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:16:50 -07:00
Christian Boltz
34a706f566 Merge abstractions/mesa: allow ~/.cache/mesa_shader_cache_db/
... which is used by Mesa 24.2.2

Reported by darix.

Fixes: https://bugs.launchpad.net/bugs/2081692

I propose this addition for 3.x, 4.0 and master

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1333
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 62ff290c02)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:16:30 -07:00
Georgia Garcia
a31cbd07aa profiles: enable php-fpm in /usr/bin and /usr/sbin
To enable the profile in distros that merge sbin into bin.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/421
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 2083994513)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:09:01 -07:00
Akihiro Suda
c4c020cdc0 profiles: slirp4netns: allow pivot_root
`pivot_root` is required for running `slirp4netns --enable-sandbox` inside LXD.
- https://github.com/rootless-containers/slirp4netns/issues/348
- https://github.com/rootless-containers/slirp4netns/blob/v1.3.1/sandbox.c#L101-L234

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit bf5db67284)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-30 02:08:47 -07:00
John Johansen
3c00ed7c85 Merge parser: fix minimization check for filtering deny
commit 1fa45b7c1 ("parser: dfa minimization prepare for extended
permissions") removed implicit filtering of explicit denies in the
minimization pass (the information was ignored in building the set of
final accept states).

The filtering of explicit denies reduces the size of the produced
dfa. Since we need to be smarter about when explicit denies are
kept (eg. during complain mode), and most dfas are limited to 65k
states we currently need to filter explicit deny perms by default.

To compensate commit 2737cb2c2 ("parser: minimization - remove
unnecessary second minimization pass") moved the
apply_and_clear_deny() to before minimization. However its check to
apply removal denials before minimization is broken. Remove minimization
triggering apply_and_clear_deny() and just set the FILTER_DENY flag
by default, until we have better selection of rules/conditions where
explicit deny information should be carried through to the backend.

Fixes: 2737cb2c2 ("parser: minimization - remove unnecessary second minimization pass")
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1397
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit e9d6e0ba14)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:58:49 -07:00
John Johansen
bf8fd8cfac Merge parser: fix integer overflow bug in rule priority comparisons
There is an integer overflow when comparing priorities when cmp is
used because it uses subtraction to find lessthan, equal, and greater
than in one operation.

But INT_MAX and INT_MIN are being used by priorities and this results
in INT_MAX - INT_MIN and INT_MIN - INT_MAX which are both overflows
causing an incorrect comparison result and selection of the wrong
rule permission.

Closes: https://gitlab.com/apparmor/apparmor/-/issues/452
Fixes: e3fca60d1 ("parser: add the ability to specify a priority prefix to rules")
Signed-off-by: John Johansen <john.johansen@canonical.com>

Closes #452
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1396
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit a5da9d5b5d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:58:35 -07:00
John Johansen
2ca7d30590 Merge utils: catch TypeError exception for binary logs
When a log like system.journal is passed on to aa-genprof, for
example, the user receives a TypeError exception: in method
'parse_record', argument 1 of type 'char *'

This patch catches that exception and displays a more meaningful
message.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/436
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #436
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1354
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit cb0f84e101)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:57:50 -07:00
John Johansen
5a39ae82fe Merge Fix ABI break for aa_log_record
Commit 3c825eb001 adds a field called `execpath` to the `aa_log_record` struct. This field was added in the middle of the struct instead of the end, causing an ABI break in libapparmor without a corresponding major version number bump.
Bug report: https://bugs.launchpad.net/apparmor/+bug/2083435
This is fixed by simply moving execpath at the end of the struct.

Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1345
Approved-by: Ryan Lee <rlee287@yahoo.com>
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 07fe0e9a1b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:56:24 -07:00
John Johansen
c7ce54bcbf Merge aa-notify: Simplify user interfaces and update man page
aa-notify: Simplify user interfaces and update man page

In notifications, Clicking on "allow" now directly adds the rule without
intermediate window, leading to a smoother UX.
Aligning man page with notify.conf.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1313
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit b5af7d5492)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:55:20 -07:00
John Johansen
2318ba598c Merge utils: fixes when handling owner file rules
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/429
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/430

Closes #429 and #430
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1320
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit 1940b1b7cd)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:55:00 -07:00
John Johansen
3d403fe2a7 Merge parser: add port range support on network policy
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1321
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit ebeb89cbce)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:53:20 -07:00
John Johansen
9074b20a95 Merge utils: ignore peer when parsing logs for non-peer access modes
utils: ignore peer when parsing logs for non-peer access modes

Some access modes (create, setopt, getopt, bind, shutdown, listen,
getattr, setattr) cannot be used with a peer in network rules.

Due to how auditing is implemented in the kernel, the peer information
might be available in the log (as faddr= but not daddr=), which causes
a failure in log parsing.

When parsing the log, check if that's the case and ignore the peer,
avoiding the exception on the NetworkRule constructor.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/427

Reported-by: Evan Caville <evan.caville@canonical.com>

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

Closes #427
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1314
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: John Johansen <john@jjmx.net>

(cherry picked from commit ab5f180b08)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:52:21 -07:00
John Johansen
7949339b93 Merge parser: fix rule priority destroying rule permissions for some classes
io_uring and userns mediation are encoding permissions on the class
byte. This is a mistake that should never have been allowed.

With the addition of rule priorities the class byte mediates rule,
that ensure the kernel can determine a class is being mediated is
given the highest priority possible, to ensure class mediation can not
be removed by a deny rule. See
  61b7568e1 ("parser: bug fix mediates_X stub rules.")
for details.

Unfortunately this breaks rule classes that encode permissions on the
class byte, because those rules will always have a lower priority and
the class mediates rule will always be selected over them resulting in
only the class mediates permission being on the rule class state.

Fix this by adding the mediaties class rules for these rule classes
with the lowest priority possible. This means that any rule mediating
the class will wipe out the mediates class rule. So add a new mediates
class rule at the same priority, as the rule being added.

This is a naive implementation and does result in more mediates rules
being added than necessary. The rule class could keep track of the
highest priority rule that had been added, and use that to reduce the
number of mediates rules it adds for the class.

Technically we could also get away with not adding the rules for allow
rules, as the kernel doesn't actually check the encoded permission but
whether the class state is not the trap state. But it is required with
deny rules to ensure the deny rule doesn't result in permissions being
removed from the class, resulting in the kernel thinking it is
unmediated. We also want to ensure that mediation is encoded for other
rule types like prompt, and in the future the kernel could check the
permission so we do want to guarantee that the class state has the
MAY_READ permission on it.

Note: there is another set of classes (file, mqueue, dbus, ...) which
encodes a default rule permission as

  class .* <perm>

this encoding is unfortunate in that it will also add the permission
to the class byte, but also sets up following states with the permission.
thankfully, this accespt anything, including nothing generally isn't
valid in the nothing case (eg. a file without any absolute name). For
this set of classes, the high priority mediates rule just ensures
that the null match case does not have permission.

Fixes: 61b7568e1 parser: bug fix mediates_X stub rules.
Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1307
Approved-by: Georgia Garcia <georgia.garcia@canonical.com>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit b6e9df3495)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:51:48 -07:00
Georgia Garcia
80b6e4ddff Merge libapparmor: make af_protos.h consistent in different archs
af_protos.h is a generated table of the protocols created by looking
for definitions of IPPROTO_* in netinet/in.h. Depending on the
architecture, the order of the table may change when using -dM in the
compiler during the extraction of the defines.

This causes an issue because there is more than one IPPROTO defined
by the value 0: IPPROTO_IP and IPPROTO_HOPOPTS which is a header
extension used by IPv6. So if IPPROTO_HOPOPTS was first in the table,
then protocol=0 in the audit logs would be translated to hopopts.

This caused a failure in arm 32bit:

Output doesn't match expected data:
--- ./test_multi/testcase_unix_01.out	2024-08-15 01:47:53.000000000 +0000
+++ ./test_multi/out/testcase_unix_01.out	2024-08-15 23:42:10.187416392 +0000
@@ -12,7 +12,7 @@
 Peer Addr: @test_abstract_socket
 Network family: unix
 Socket type: stream
-Protocol: ip
+Protocol: hopopts
 Class: net
 Epoch: 1711454639
 Audit subid: 322

By the time protocol is resolved in grammar.y, we don't have have
access to the net family to check if it's inet6. Instead of making
protocol dependent on the net family, make the order of the
af_protos.h table consistent between architectures using -dD.

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1309
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
(cherry picked from commit 0ec0e2b035)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:51:23 -07:00
John Johansen
d824adcf93 Merge utils: change os.mkdir to self.mkpath to create intermediary dirs
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1306
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 4c8a27457e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2024-10-28 04:50:24 -07:00
261 changed files with 10946 additions and 4797 deletions

3
.gitignore vendored
View File

@@ -1,4 +1,4 @@
apparmor-*
apparmor-
cscope.*
binutils/aa-enabled
binutils/aa-enabled.1
@@ -203,6 +203,7 @@ utils/apparmor/*.pyc
utils/apparmor/rule/*.pyc
utils/apparmor.egg-info/
utils/build/
!utils/emacs/apparmor-mode.el
utils/htmlcov/
utils/test/common_test.pyc
utils/test/.coverage

View File

@@ -1,3 +1,9 @@
spec:
inputs:
build-test-images:
default: false
type: boolean
description: Explicitly build virtual machine images used by integration tests.
---
image: ubuntu:latest
@@ -13,8 +19,10 @@ workflow:
stages:
- build
- test
- spread
.ubuntu-common:
interruptible: true
before_script:
# Install build-dependencies by loading the package list from the ubuntu/debian cloud-init profile.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_deps "Installing dependencies..."
@@ -126,19 +134,6 @@ test-profiles:
- make -C profiles check-abstractions.d
- make -C profiles check-local
# Build the regression tests (don't run them because that needs kernel access)
test-build-regression:
stage: test
needs: ["build-all"]
extends:
- .ubuntu-common
script:
# Additional dependencies required by regression tests
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_extra_deps "Installing additional dependencies..."
- apt-get install --no-install-recommends -y attr fuse-overlayfs libdbus-1-dev liburing-dev
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_extra_deps
- make -C tests/regression/apparmor -j $(nproc)
shellcheck:
stage: test
needs: []
@@ -175,6 +170,7 @@ variables:
coverity:
stage: .post
interruptible: true
extends:
- .ubuntu-common
script:
@@ -196,3 +192,146 @@ coverity:
- "apparmor-*.tar.gz"
rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "apparmor/apparmor"
.image-garden-x86_64:
stage: spread
interruptible: true
# TODO: use tagged release once container tagging is improved upstream.
image: registry.gitlab.com/zygoon/image-garden:latest
tags:
- linux
- x86_64
- kvm
variables:
ARCH: x86_64
GARDEN_DL_DIR: dl
CACHE_POLICY: pull-push
CACHE_COMPRESSION_LEVEL: fastest
before_script:
# Restore the mtime of the .image-garden.mk file. This helps make determine
# if there's actually something to do correctly. Git does not preserve the
# mtime of files during checkout.
- git restore-mtime .image-garden.mk
# Prepare the image in dry-run mode. This helps in debugging cache misses
# when files are not cached correctly by the runner, causing the build section
# below to always do hevy-duty work.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image_dry_run "Prepare image (dry run)"
- image-garden make --dry-run --debug "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image_dry_run
script:
# Prepare the image, for real.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image "Prepare image"
# If there's nothing to do then remove all the files that we would normally
# cache so that GitLab skips the cache upload step. This saves significant
# time required to re-compress and upload unchanged content.
# The idea for how to do is is documented at
# https://olex.biz/2025/04/gitlab-ci-prevent-cache-reupload-without-changes/
# The GitLab issue requesting a proper feature is
# https://gitlab.com/gitlab-org/gitlab/-/issues/226068
- |
if image-garden make --question "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"; then
rm -f "$GARDEN_SYSTEM".* efi-code.*.img efi-vars.*.img
rm -rf "$GARDEN_DL_DIR"
else
image-garden make "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
fi
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image
cache:
# Cache the base image (pre-customization).
- key: image-garden-base-${GARDEN_SYSTEM}.${ARCH}
policy: $CACHE_POLICY
when: always
paths:
- $GARDEN_DL_DIR
# Those are never mutated so they are safe to share.
- efi-code.*.img
- efi-vars.*.img
# Cache the customized system. This cache depends on .image-garden.mk file
# so that any customization updates are immediately acted upon.
- key:
prefix: image-garden-custom-${GARDEN_SYSTEM}.${ARCH}-
files:
- .image-garden.mk
policy: $CACHE_POLICY
when: always
paths:
- $GARDEN_SYSTEM.*
- $GARDEN_SYSTEM.seed.iso
- $GARDEN_SYSTEM.meta-data
- $GARDEN_SYSTEM.user-data
# This job builds and caches the image that the job below looks at.
image-ubuntu-cloud-24.04-x86_64:
extends: .image-garden-x86_64
variables:
GARDEN_SYSTEM: ubuntu-cloud-24.04
needs: []
dependencies: []
rules:
- if: $CI_COMMIT_TAG
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
changes:
paths:
- .image-garden.mk
- .gitlab-ci.yml
compare_to: "refs/heads/master"
- if: $CI_COMMIT_BRANCH && "$[[ inputs.build-test-images ]]" == "true"
.spread-x86_64:
extends: .image-garden-x86_64
variables:
# GitLab project identifier of zygoon/spread-dist can be seen on
# https://gitlab.com/zygoon/spread-dist, under the three-dot menu on
# top-right.
SPREAD_GITLAB_PROJECT_ID: "65375371"
# Git revision of spread to install.
# This must have been built via spread-dist.
# TODO: switch to upstream 1.0 release when available.
SPREAD_REV: 413817eda7bec07a3885e0717c178b965f8924e1
# Run all the tasks for a given system.
SPREAD_ARGS: "garden:$GARDEN_SYSTEM:"
SPREAD_GOARCH: amd64
before_script:
# Restore the mtime of the .image-garden.mk file. This helps make determine
# if there's actually something to do correctly. Git does not preserve the
# mtime of files during checkout.
- git restore-mtime .image-garden.mk
# Prepare the image in dry-run mode. This helps in debugging cache misses
# when files are not cached correctly by the runner, causing the build section
# below to always do hevy-duty work.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" prepare_image_dry_run "Prepare image (dry run)"
- image-garden make --dry-run --debug "$GARDEN_SYSTEM.$ARCH.run" "$GARDEN_SYSTEM.$ARCH.qcow2" "$GARDEN_SYSTEM.seed.iso" "$GARDEN_SYSTEM.user-data" "$GARDEN_SYSTEM.meta-data"
- stat .image-garden.mk "$GARDEN_SYSTEM".* || true
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" prepare_image_dry_run
# Install the selected revision of spread.
- printf '\e[0K%s:%s:%s[collapsed=true]\r\e[0K%s\n' section_start "$(date +%s)" install_spread "Installing spread..."
# Install pre-built spread from https://gitlab.com/zygoon/spread-dist generic package repository.
- |
curl --header "JOB-TOKEN: ${CI_JOB_TOKEN}" --location --output spread "${CI_API_V4_URL}/projects/${SPREAD_GITLAB_PROJECT_ID}/packages/generic/spread/${SPREAD_REV}/spread.${SPREAD_GOARCH}"
- chmod +x spread
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" install_spread
script:
- printf '\e[0K%s:%s:%s\r\e[0K%s\n' section_start "$(date +%s)" run_spread "Running spread for $GARDEN_SYSTEM..."
# TODO: transform to inject ^...$ to properly select jobs to run.
- mkdir -p spread-logs spread-artifacts
- ./spread -list $SPREAD_ARGS |
split --number=l/"${CI_NODE_INDEX:-1}"/"${CI_NODE_TOTAL:-1}" |
xargs --verbose ./spread -v -artifacts ./spread-artifacts -v | tee spread-logs/"$GARDEN_SYSTEM".log
- printf '\e[0K%s:%s:%s\r\e[0K\n' section_end "$(date +%s)" run_spread
artifacts:
paths:
- spread-logs
- spread-artifacts
when: always
spread-ubuntu-cloud-24.04-x86_64:
extends: .spread-x86_64
variables:
GARDEN_SYSTEM: ubuntu-cloud-24.04
SPREAD_ARGS: garden:$GARDEN_SYSTEM:tests/regression/ garden:$GARDEN_SYSTEM:tests/profiles/
CACHE_POLICY: pull
dependencies: []
needs:
- job: image-ubuntu-cloud-24.04-x86_64
optional: true
parallel: 4

View File

@@ -2,6 +2,11 @@
# All the package installation happens through cloud-init profiles defined
# below.
# NOTE: Should the kernel be out of date, just increment this value. Make will
# re-create the image whenever the .image-garden.mk file is more recent than
# the image itself. In reality all you need is touch(1), but this is more apt.
unused=1
# This is the cloud-init user-data profile for all Debian systems. Note that it
# is an extension of the default profile necessary for operation of
# image-garden.
@@ -36,6 +41,12 @@ packages:
- python3-ttkthemes
- swig
- toybox
# Update all the packages. This allows us to be on the up-to-date kernel
# version that we cannot otherwise easily select with cloud init alone. Note
# that we do not need to reboot the system as image garden shuts down the image
# after first boot. On subsequent boot we will be running the latest kernel.
package_upgrade: true
package_update: true
endef
# Ubuntu shares cloud-init profile with Debian.
@@ -78,6 +89,10 @@ packages:
- python311
- python311-devel
- swig
- which
# See above for rationale.
package_upgrade: true
package_update: true
endef
define FEDORA_CLOUD_INIT_USER_DATA_TEMPLATE
@@ -107,4 +122,7 @@ packages:
- python3-notify2
- python3-tkinter
- swig
# See above for rationale.
package_upgrade: true
package_update: true
endef

View File

@@ -111,21 +111,13 @@ $ export PYTHON_VERSION=3
$ export PYTHON_VERSIONS=python3
```
Note that, in general, the build steps can be run in parallel, while the test
steps do not gain much speedup from being run in parallel. This is because the
test steps spawn a handful of long-lived test runner processes that mostly
run their tests sequentially and do not use `make`'s jobserver. Moreover,
process spawning overhead constitutes a significant part of test runtime, so
reworking the test harnesses to add parallelism (which would be a major undertaking
for the harnesses that do not have it already) would not produce much of a speedup.
### libapparmor:
```
$ cd ./libraries/libapparmor
$ sh ./autogen.sh
$ sh ./configure --prefix=/usr --with-perl --with-python # see below
$ make -j $(nproc)
$ make
$ make check
$ make install
```
@@ -138,7 +130,7 @@ generate Ruby bindings to libapparmor.]
```
$ cd binutils
$ make -j $(nproc)
$ make
$ make check
$ make install
```
@@ -147,8 +139,7 @@ $ make install
```
$ cd parser
$ make -j $(nproc) # depends on libapparmor having been built first
$ make -j $(nproc) tst_binaries # a build step of make check that can be parallelized
$ make # depends on libapparmor having been built first
$ make check
$ make install
```
@@ -158,7 +149,7 @@ $ make install
```
$ cd utils
$ make -j $(nproc)
$ make
$ make check PYFLAKES=/usr/bin/pyflakes3
$ make install
```
@@ -167,7 +158,7 @@ $ make install
```
$ cd changehat/mod_apparmor
$ make -j $(nproc) # depends on libapparmor having been built first
$ make # depends on libapparmor having been built first
$ make install
```
@@ -176,7 +167,7 @@ $ make install
```
$ cd changehat/pam_apparmor
$ make -j $(nproc) # depends on libapparmor having been built first
$ make # depends on libapparmor having been built first
$ make install
```
@@ -214,6 +205,18 @@ in an ephemeral virtual machine. This allows testing in isolation from the
host, as well as testing across different commonly used distributions and their
real kernels.
Image Garden is available as a snap. If you wish to use it this way then snap
then install the snap with:
```sh
sudo snap install image-garden
```
If you need to install snapd first, see https://snapcraft.io/docs/installing-snapd
Alternatively you may build image-garden and spread from source, and install
dependencies manually.
```sh
sudo apt install git golang whois ovmf genisoimage qemu-utils qemu-system
go install github.com/snapcore/spread/cmd/spread@latest
@@ -227,8 +230,9 @@ git clean -xdf
# or ~/go/bin/spread -v garden:ubuntu-cloud-24.04:tests/regression/apparmor:at_secure
```
Running the `run_spread.sh` script, with `spread` on `PATH` will run all the
tests across several supported systems (Debian, Ubuntu and openSUSE).
Running the `run_spread.sh` script, with `image-garden` snap installed or with
`spread` on `PATH` will run all the tests across several supported systems
(Debian, Ubuntu and openSUSE).
If you include a `bzImage` file in the root of the repository then that kernel
will be used in the integration test. Please look at `spread.yaml` for details.
@@ -243,7 +247,7 @@ To run:
### Regression tests - using apparmor userspace installed on host
```
$ cd tests/regression/apparmor (requires root)
$ make -j $(nproc) USE_SYSTEM=1
$ make USE_SYSTEM=1
$ sudo make tests USE_SYSTEM=1
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```
@@ -256,7 +260,7 @@ $ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```
$ cd tests/regression/apparmor (requires root)
$ make -j $(nproc)
$ make
$ sudo make tests
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```

View File

@@ -80,6 +80,109 @@ aa-exec.
=back
=head1 RESTRICTIONS
aa-exec uses I<aa_change_profile(3)> to change application confinement.
The use of I<aa_change_profile(3)> may be restricted by policy in ways
that will cause failure or results different than expected.
Even when using I<aa-exec> from unconfined restrictions in policy can
causes failure or the confinement entered to be different than requested
See the unpriviled unconfined restriction documentation for more detail.
https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined_restriction
=head1 STACKING
aa-exec can be used to setup a stack of profiles as confinement. When an
application is confined by a stack, all profiles in the stack are checked
as if they were the profile confining the application. The resulting
mediation is the intersection of what is allowed by each profile in the
stack.
The profiles in a stack are treated independently. Each profile can have
its own flags and profile transitions. During an exec each profile gets
to specify its transition and the results brought together to form a
new canonicalized stack.
The profile separator indicating a stack is the character sequence I<//&>.
Thus a stack can be expressed using
=over 4
$ aa-exec -p "unconfined//&firefox" -- bash
$ ps -Z
LABEL PID TTY TIME CMD
unconfined 30714 pts/12 00:00:00 bash
firefox//&unconfined (unconfined) 31160 pts/12 00:00:00 bash
firefox//&unconfined (unconfined) 31171 pts/12 00:00:00 ps
=back
=head1 NAMESPACES
aa-exec can be used to enter confinement in another policy namespace
if the policy namespaces exists, is visible, and the profile exists in
the namespace. Note applications launched within the namespace will
not be able to exit the namespace, and may be restricted by additional
confinement around namespacing. Files and resources visible to the
parent that launches the application may not be visible in the policy
namespace resulting in access denials.
To enter a policy namespace the profile is prefixed with the namespace's
name, using a I<:> prefix and suffix.
Eg.
=over 4
$ aa-exec -p :ex1:unconfined -- bash
$ ps -Z
LABEL PID TTY TIME CMD
- 30714 pts/12 00:00:00 bash
unconfined 34372 pts/12 00:00:00 bash
unconfined 34379 pts/12 00:00:00 ps
=back
Confinement of processes outside of the namespace may not be visible
in which case the confinement will be represented with a -. If policy
is stacked only part of the confinement might be visible. However
confinement is usually fully visible from the parent policy namespace.
Eg. the confinement of the child can be queried in the parent to see
=over 4
$ ps -Z 34372
LABEL PID TTY STAT TIME COMMAND
:ex1:unconfined 34372 pts/12 S+ 0:00 bash
=back
And in the case of stacking with namespaces
=over 4
$ aa-exec -p "unconfined//&:ex1:unconfined" -- bash
$ ps -Z
LABEL PID TTY TIME CMD
- 30714 pts/12 00:00:00 bash
unconfined 36298 pts/12 00:00:00 bash
unconfined 36305 pts/12 00:00:00 ps
=back
while from the parent namespace the full confinement can be seen
=over 4
$ ps -Z 36298
LABEL PID TTY STAT TIME COMMAND
unconfined//&:ex1:unconfined 36298 pts/12 S+ 0:00 bash
=back
=head1 BUGS
If you find any bugs, please report them at
@@ -87,7 +190,7 @@ L<https://gitlab.com/apparmor/apparmor/-/issues>
=head1 SEE ALSO
aa-stack(8), aa-namespace(8), apparmor(7), apparmor.d(5), aa_change_profile(3),
apparmor(7), apparmor.d(5), aa_change_profile(3),
aa_change_onexec(3) and L<https://wiki.apparmor.net>.
=cut

View File

@@ -117,13 +117,13 @@ display only counts for selected information.
=item --filter.mode=filter
Allows specifying a posix regular expression filter that will be
applied against the displayed processess and profiles apparmor profile
applied against the displayed processes and profiles apparmor profile
mode, reducing the output.
=item --filter.profiles=filter
Allows specifying a posix regular expression filter that will be
applied against the displayed processess and profiles confining
applied against the displayed processes and profiles confining
profile, reducing the output.
=item --filter.pid=filter

View File

@@ -17,6 +17,7 @@
#include <fcntl.h>
#include <string.h>
#include <dirent.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>

View File

@@ -20,8 +20,6 @@
#include <ctype.h>
#include <dirent.h>
#include <regex.h>
#include <libintl.h>
#define _(s) gettext(s)
#include <sys/apparmor.h>
#include <sys/apparmor_private.h>
@@ -133,7 +131,7 @@ const char *process_statuses[] = {"enforce", "complain", "prompt", "kill", "unco
#define eprintf(...) \
do { \
if (!quiet) \
fprintf(stderr, __VA_ARGS__); \
fprintf(stderr, __VA_ARGS__); \
} while (0)
#define dprintf(...) \
@@ -158,14 +156,14 @@ static int open_profiles(FILE **fp)
ret = stat("/sys/module/apparmor", &st);
if (ret != 0) {
eprintf(_("apparmor not present.\n"));
eprintf("apparmor not present.\n");
return AA_EXIT_DISABLED;
}
dprintf(_("apparmor module is loaded.\n"));
dprintf("apparmor module is loaded.\n");
ret = aa_find_mountpoint(&apparmorfs);
if (ret == -1) {
eprintf(_("apparmor filesystem is not mounted.\n"));
eprintf("apparmor filesystem is not mounted.\n");
return AA_EXIT_NO_CONTROL;
}
@@ -178,9 +176,9 @@ static int open_profiles(FILE **fp)
*fp = fopen(apparmor_profiles, "r");
if (*fp == NULL) {
if (errno == EACCES) {
eprintf(_("You do not have enough privilege to read the profile set.\n"));
eprintf("You do not have enough privilege to read the profile set.\n");
} else {
eprintf(_("Could not open %s: %s"), apparmor_profiles, strerror(errno));
eprintf("Could not open %s: %s", apparmor_profiles, strerror(errno));
}
return AA_EXIT_NO_PERM;
}
@@ -353,7 +351,7 @@ static int get_processes(struct profile *profiles,
continue;
} else if (rc == -1 ||
asprintf(&exe, "/proc/%s/exe", entry->d_name) == -1) {
eprintf(_("ERROR: Failed to allocate memory\n"));
eprintf("ERROR: Failed to allocate memory\n");
ret = AA_EXIT_INTERNAL_ERROR;
goto exit;
} else if (mode) {
@@ -376,7 +374,7 @@ static int get_processes(struct profile *profiles,
// ensure enough space for NUL terminator
real_exe = calloc(PATH_MAX + 1, sizeof(char));
if (real_exe == NULL) {
eprintf(_("ERROR: Failed to allocate memory\n"));
eprintf("ERROR: Failed to allocate memory\n");
ret = AA_EXIT_INTERNAL_ERROR;
goto exit;
}
@@ -600,7 +598,7 @@ static int detailed_profiles(FILE *outf, filters_t *filters, bool json,
*/
subfilters.mode = &mode_filter;
if (regcomp(&mode_filter, profile_statuses[i], REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile sub filter '%s'\n"),
eprintf("Error: failed to compile sub filter '%s'\n",
profile_statuses[i]);
return AA_EXIT_INTERNAL_ERROR;
}
@@ -666,7 +664,7 @@ static int detailed_processes(FILE *outf, filters_t *filters, bool json,
*/
subfilters.mode = &mode_filter;
if (regcomp(&mode_filter, process_statuses[i], REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile sub filter '%s'\n"),
eprintf("Error: failed to compile sub filter '%s'\n",
profile_statuses[i]);
return AA_EXIT_INTERNAL_ERROR;
}
@@ -728,7 +726,7 @@ exit:
static int print_legacy(const char *command)
{
printf(_("Usage: %s [OPTIONS]\n"
printf("Usage: %s [OPTIONS]\n"
"Legacy options and their equivalent command\n"
" --profiled --count --profiles\n"
" --enforced --count --profiles --mode=enforced\n"
@@ -736,8 +734,8 @@ static int print_legacy(const char *command)
" --kill --count --profiles --mode=kill\n"
" --prompt --count --profiles --mode=prompt\n"
" --special-unconfined --count --profiles --mode=unconfined\n"
" --process-mixed --count --ps --mode=mixed\n"),
command);
" --process-mixed --count --ps --mode=mixed\n",
command);
exit(0);
return 0;
@@ -747,7 +745,7 @@ static int usage_filters(void)
{
long unsigned int i;
printf(_("Usage of filters\n"
printf("Usage of filters\n"
"Filters are used to reduce the output of information to only\n"
"those entries that will match the filter. Filters use posix\n"
"regular expression syntax. The possible values for exes that\n"
@@ -757,7 +755,7 @@ static int usage_filters(void)
" --filter.profiles: regular expression to match displayed profile names\n"
" --filter.pid: regular expression to match displayed processes pids\n"
" --filter.exe: regular expression to match executable\n"
));
);
for (i = 0; i < ARRAY_SIZE(process_statuses); i++) {
printf("%s%s", i ? ", " : "", process_statuses[i]);
}
@@ -775,7 +773,7 @@ static int print_usage(const char *command, bool error)
status = EXIT_FAILURE;
}
printf(_("Usage: %s [OPTIONS]\n"
printf("Usage: %s [OPTIONS]\n"
"Displays various information about the currently loaded AppArmor policy.\n"
"Default if no options given\n"
" --show=all\n\n"
@@ -792,8 +790,8 @@ static int print_usage(const char *command, bool error)
" --verbose (default) displays data points about loaded policy set\n"
" --quiet don't output error messages\n"
" -h[(legacy|filters)] this message, or info on the specified option\n"
" --help[=(legacy|filters)] this message, or info on the specified option\n"),
command);
" --help[=(legacy|filters)] this message, or info on the specified option\n",
command);
exit(status);
@@ -869,7 +867,7 @@ static int parse_args(int argc, char **argv)
} else if (strcmp(optarg, "filters") == 0) {
usage_filters();
} else {
eprintf(_("Error: Invalid --help option '%s'.\n"), optarg);
eprintf("Error: Invalid --help option '%s'.\n", optarg);
print_usage(argv[0], true);
break;
}
@@ -937,7 +935,7 @@ static int parse_args(int argc, char **argv)
} else if (strcmp(optarg, "processes") == 0) {
opt_show = SHOW_PROCESSES;
} else {
eprintf(_("Error: Invalid --show option '%s'.\n"), optarg);
eprintf("Error: Invalid --show option '%s'.\n", optarg);
print_usage(argv[0], true);
break;
}
@@ -959,7 +957,7 @@ static int parse_args(int argc, char **argv)
break;
default:
eprintf(_("Error: Invalid command.\n"));
eprintf("Error: Invalid command.\n");
print_usage(argv[0], true);
break;
}
@@ -984,7 +982,7 @@ int main(int argc, char **argv)
if (argc > 1) {
int pos = parse_args(argc, argv);
if (pos < argc) {
eprintf(_("Error: Unknown options.\n"));
eprintf("Error: Unknown options.\n");
print_usage(progname, true);
}
} else {
@@ -996,24 +994,24 @@ int main(int argc, char **argv)
init_filters(&filters, &filter_set);
if (regcomp(filters.mode, opt_mode, REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile mode filter '%s'\n"),
eprintf("Error: failed to compile mode filter '%s'\n",
opt_mode);
return AA_EXIT_INTERNAL_ERROR;
}
if (regcomp(filters.profile, opt_profiles, REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile profiles filter '%s'\n"),
eprintf("Error: failed to compile profiles filter '%s'\n",
opt_profiles);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
if (regcomp(filters.pid, opt_pid, REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile ps filter '%s'\n"),
eprintf("Error: failed to compile ps filter '%s'\n",
opt_pid);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
if (regcomp(filters.exe, opt_exe, REG_NOSUB) != 0) {
eprintf(_("Error: failed to compile exe filter '%s'\n"),
eprintf("Error: failed to compile exe filter '%s'\n",
opt_exe);
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
@@ -1028,7 +1026,7 @@ int main(int argc, char **argv)
outf_save = outf;
outf = open_memstream(&buffer, &buffer_size);
if (!outf) {
eprintf(_("Failed to open memstream: %m\n"));
eprintf("Failed to open memstream: %m\n");
return AA_EXIT_INTERNAL_ERROR;
}
}
@@ -1038,8 +1036,8 @@ int main(int argc, char **argv)
* have policy associated.
*/
ret = get_profiles(fp, &profiles, &nprofiles);
if (ret != 0) {
eprintf(_("Failed to get profiles: %d....\n"), ret);
if (ret != 0 && !opt_json) {
eprintf("Failed to get profiles: %d....\n", ret);
goto out;
}
@@ -1068,7 +1066,7 @@ int main(int argc, char **argv)
ret = get_processes(profiles, nprofiles, &processes, &nprocesses);
if (ret != 0) {
eprintf(_("Failed to get processes: %d....\n"), ret);
eprintf("Failed to get processes: %d....\n", ret);
} else if (opt_count) {
ret = simple_filtered_process_count(outf, &filters, opt_json,
processes, nprocesses);
@@ -1094,14 +1092,14 @@ int main(int argc, char **argv)
outf = outf_save;
json = cJSON_Parse(buffer);
if (!json) {
eprintf(_("Failed to parse json output"));
eprintf("Failed to parse json output");
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}
pretty = cJSON_Print(json);
if (!pretty) {
eprintf(_("Failed to print pretty json"));
eprintf("Failed to print pretty json");
ret = AA_EXIT_INTERNAL_ERROR;
goto out;
}

View File

@@ -1,14 +1,14 @@
# Translations for aa_enabled
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# Translations for aa_exec
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# Translations for aa_features_abi
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2011.
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"POT-Creation-Date: 2020-10-14 03:52-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,14 +1,14 @@
# Translations for aa_load
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2020.
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 15:59-0700\n"
"POT-Creation-Date: 2025-02-18 07:37-0800\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"

View File

@@ -1,165 +0,0 @@
# Translations for aa_status
# Copyright (C) 2024 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2024.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 17:49-0700\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=CHARSET\n"
"Content-Transfer-Encoding: 8bit\n"
#: ../aa_status.c:161
msgid "apparmor not present.\n"
msgstr ""
#: ../aa_status.c:164
msgid "apparmor module is loaded.\n"
msgstr ""
#: ../aa_status.c:168
msgid "apparmor filesystem is not mounted.\n"
msgstr ""
#: ../aa_status.c:181
msgid "You do not have enough privilege to read the profile set.\n"
msgstr ""
#: ../aa_status.c:183
#, c-format
msgid "Could not open %s: %s"
msgstr ""
#: ../aa_status.c:356 ../aa_status.c:379
msgid "ERROR: Failed to allocate memory\n"
msgstr ""
#: ../aa_status.c:587 ../aa_status.c:653
#, c-format
msgid "Error: failed to compile sub filter '%s'\n"
msgstr ""
#: ../aa_status.c:715
#, c-format
msgid ""
"Usage: %s [OPTIONS]\n"
"Legacy options and their equivalent command\n"
" --profiled --count --profiles\n"
" --enforced --count --profiles --mode=enforced\n"
" --complaining --count --profiles --mode=complain\n"
" --kill --count --profiles --mode=kill\n"
" --prompt --count --profiles --mode=prompt\n"
" --special-unconfined --count --profiles --mode=unconfined\n"
" --process-mixed --count --ps --mode=mixed\n"
msgstr ""
#: ../aa_status.c:734
#, c-format
msgid ""
"Usage of filters\n"
"Filters are used to reduce the output of information to only\n"
"those entries that will match the filter. Filters use posix\n"
"regular expression syntax. The possible values for exes that\n"
"support filters are below\n"
"\n"
" --filter.mode: regular expression to match the profile "
"mode modes: enforce, complain, kill, unconfined, mixed\n"
" --filter.profiles: regular expression to match displayed profile names\n"
" --filter.pid: regular expression to match displayed processes pids\n"
" --filter.exe: regular expression to match executable\n"
msgstr ""
#: ../aa_status.c:762
#, c-format
msgid ""
"Usage: %s [OPTIONS]\n"
"Displays various information about the currently loaded AppArmor policy.\n"
"Default if no options given\n"
" --show=all\n"
"\n"
"OPTIONS (one only):\n"
" --enabled returns error code if AppArmor not enabled\n"
" --show=X What information to show. {profiles,processes,all}\n"
" --count print the number of entries. Implies --quiet\n"
" --filter.mode=filter see filters\n"
" --filter.profiles=filter see filters\n"
" --filter.pid=filter see filters\n"
" --filter.exe=filter see filters\n"
" --json displays multiple data points in machine-readable JSON "
"format\n"
" --pretty-json same data as --json, formatted for human consumption as "
"well\n"
" --verbose (default) displays data points about loaded policy set\n"
" --quiet don't output error messages\n"
" -h[(legacy|filters)] this message, or info on the specified option\n"
" --help[=(legacy|filters)] this message, or info on the specified option\n"
msgstr ""
#: ../aa_status.c:856
#, c-format
msgid "Error: Invalid --help option '%s'.\n"
msgstr ""
#: ../aa_status.c:924
#, c-format
msgid "Error: Invalid --show option '%s'.\n"
msgstr ""
#: ../aa_status.c:946
msgid "Error: Invalid command.\n"
msgstr ""
#: ../aa_status.c:971
msgid "Error: Unknown options.\n"
msgstr ""
#: ../aa_status.c:983
#, c-format
msgid "Error: failed to compile mode filter '%s'\n"
msgstr ""
#: ../aa_status.c:988
#, c-format
msgid "Error: failed to compile profiles filter '%s'\n"
msgstr ""
#: ../aa_status.c:994
#, c-format
msgid "Error: failed to compile ps filter '%s'\n"
msgstr ""
#: ../aa_status.c:1000
#, c-format
msgid "Error: failed to compile exe filter '%s'\n"
msgstr ""
#: ../aa_status.c:1015
#, c-format
msgid "Failed to open memstream: %m\n"
msgstr ""
#: ../aa_status.c:1026
#, c-format
msgid "Failed to get profiles: %d....\n"
msgstr ""
#: ../aa_status.c:1050
#, c-format
msgid "Failed to get processes: %d....\n"
msgstr ""
#: ../aa_status.c:1076
msgid "Failed to parse json output"
msgstr ""
#: ../aa_status.c:1083
msgid "Failed to print pretty json"
msgstr ""

67
binutils/po/be.po Normal file
View File

@@ -0,0 +1,67 @@
# Belarusian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-05 21:55+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Belarusian <be@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-06 05:41+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/ca.po Normal file
View File

@@ -0,0 +1,71 @@
# Catalan translation for apparmor
# Copyright (c) 2024 Rosetta Contributors and Canonical Ltd 2024
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2024.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2024-09-14 10:17+0000\n"
"Last-Translator: Walter Garcia-Fontes <walter.garcia@upf.edu>\n"
"Language-Team: Catalan <ca@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2024-09-15 07:16+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opcions]\n"
" opcions:\n"
" -q | --quiet No imprimeixis cap missatge\n"
" -h | --help Imprimeix l'ajuda\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opcions desconegudes o incompatibles\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opció desconeguda «%s»\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Sí\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "No - no esta disponible a aquest sistema\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "No - desactivat a l'inici.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Potser - la interfície de política no està disponible.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Potser - permisos insuficient per determinar la disponibilitat.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Error - '%s'\n"

67
binutils/po/cs.po Normal file
View File

@@ -0,0 +1,67 @@
# Czech translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-01-09 11:59+0000\n"
"Last-Translator: Marek Hladík <mhladik@seznam.cz>\n"
"Language-Team: Czech <cs@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-01-10 06:32+0000\n"
"X-Generator: Launchpad (build 1682fd44eec4f62371f0bed122a83482daf08e23)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "neznámé nebo nekompatibilní volby\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "neznámá volba '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Ano\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ne - není v tomto systému k dispozici.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ne - zakázáno při startu.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Možná - rozhraní zásad není k dispozici.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Možná - nedostatečná oprávnění k určení dostupnosti.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Chyba - '%s'\n"

67
binutils/po/en_AU.po Normal file
View File

@@ -0,0 +1,67 @@
# English (Australia) translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-11-28 04:45+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: English (Australia) <en_AU@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-11-29 06:26+0000\n"
"X-Generator: Launchpad (build 12d09381f8e8eee3115395875b132e165fa96574)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

67
binutils/po/en_CA.po Normal file
View File

@@ -0,0 +1,67 @@
# English (Canada) translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-10-01 04:55+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: English (Canada) <en_CA@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-10-02 06:17+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/et.po Normal file
View File

@@ -0,0 +1,71 @@
# Estonian translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-07-04 08:52+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Estonian <et@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-07-05 04:31+0000\n"
"X-Generator: Launchpad (build beda0e9dd2b131780db60fe479d4b43618b27243)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [valikud]\n"
" valikud:\n"
" -q | --quiet Ärge printige sõnumeid välja\n"
" -h | --help Prindi abiinfo\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "tundmatud või ühildumatud valikud\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "tundmatu valik '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Jah\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ei pole selles süsteemis saadaval.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ei käivitamisel keelatud.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Võib-olla poliisiliides pole saadaval.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Võib-olla - kättesaadavuse määramiseks pole piisavalt õigusi.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Viga '%s'\n"

67
binutils/po/gl.po Normal file
View File

@@ -0,0 +1,67 @@
# Galician translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-21 14:59+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Galician <gl@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-22 06:10+0000\n"
"X-Generator: Launchpad (build aad6b57d58e2f621954298e262c1cc904860f5d2)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/he.po Normal file
View File

@@ -0,0 +1,71 @@
# Hebrew translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-10-05 05:12+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Hebrew <he@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-10-06 08:32+0000\n"
"X-Generator: Launchpad (build bd6cfd0cfc024dbe1dcd7d5d91165fb4f6a6c596)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [אפשרויות]\n"
" אפשרויות:\n"
" -q | --quiet לא להציג הודעות\n"
" -h | --help הצגת עזרה\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "אפשרויות לא ידועות או לא נתמכות\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "האפשרות %s לא מוכרת\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "כן\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "לא - לא זמין במערכת הזאת.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "לא - מושבת בעלייה.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "אולי - מנשק המדיניות לא זמין.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "אולי - אין מספיק הרשאות לקבוע זמינות.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "שגיאה - %s\n"

67
binutils/po/hi.po Normal file
View File

@@ -0,0 +1,67 @@
# Hindi translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-01-09 07:39+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Hindi <hi@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-01-10 06:22+0000\n"
"X-Generator: Launchpad (build 87bfee1fd14ea3245297d63eeec1e4c8a1d203a8)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/hr.po Normal file
View File

@@ -0,0 +1,71 @@
# Croatian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-10-03 10:17+0000\n"
"Last-Translator: gogo <trebelnik2@gmail.com>\n"
"Language-Team: Croatian <hr@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-10-04 06:23+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [mogućnosti]\n"
" options:\n"
" -q | --quiet Ne prikazuj poruke\n"
" -h | --help Prikaži pomoć\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "nepoznata ili nepotpuna mogućnost\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "nepoznata mogućnost '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Da\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ne - nedostupno na ovom sustavu.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ne - onemogućeno pri pokretanju.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Možda - pravilo sučelja nedostupno.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Možda - nedovoljna dozvola za određivanje dostupnosti.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Greška - '%s'\n"

72
binutils/po/it.po Normal file
View File

@@ -0,0 +1,72 @@
# Italian translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-06-30 17:54+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Italian <it@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-07-01 04:30+0000\n"
"X-Generator: Launchpad (build f48158886a49da429840bcd298f0c7ed60f9ad7b)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opzioni]\n"
" opzioni:\n"
" -q | --quiet Non stampa nessun messaggio\n"
" -h | --help Stampa la guida\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opzioni sconosciute o incompatibili\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opzione sconosciuta '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Si\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "No - non disponibile su questo sistema.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "No - disabilitato all'avvio.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Forse - interfaccia dei criteri non disponibile.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
"Forse - autorizzazioni insufficienti per determinare la disponibilità.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Errore - '%s'\n"

72
binutils/po/ka.po Normal file
View File

@@ -0,0 +1,72 @@
# Georgian translation for apparmor
# Copyright (c) 2023 Rosetta Contributors and Canonical Ltd 2023
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2023.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2023-06-26 15:06+0000\n"
"Last-Translator: NorwayFun <temuri.doghonadze@gmail.com>\n"
"Language-Team: Georgian <ka@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2023-06-27 04:31+0000\n"
"X-Generator: Launchpad (build aedf8597c50c1abc5fb7f9e871e686dfcb381fde)\n"
"Language: aa\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [პარამეტრები]\n"
" პარამეტრები:\n"
" -q | --quiet შეტყობინებები გამოტანილი არ იქნება\n"
" -h | --help დახმარების გამოტანა\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "უცნობი ან შეუთავსებელი პარამეტრები\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "უცნობი პარამეტრი \"%s\"-სთვის\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "დიახ\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "არა - მიუწვდომელია ამ სისტემაზე\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "არა - გამორთულია ჩატვირთვისას\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "შეიძლება - პოლიტიკის ინტერფეისი ხელმისაწვდომი არაა.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "შეიძლება - არასაკმარისი წვდომები ხელმისაწვდომობის დასადგენად.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "შეცდომა - \"%s\"\n"

67
binutils/po/kab.po Normal file
View File

@@ -0,0 +1,67 @@
# Kabyle translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-29 14:31+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Kabyle <kab@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-30 05:44+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

73
binutils/po/my.po Normal file
View File

@@ -0,0 +1,73 @@
# Burmese translation for apparmor
# Copyright (c) 2022 Rosetta Contributors and Canonical Ltd 2022
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2022.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2022-06-26 11:50+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Burmese <my@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2022-06-27 04:30+0000\n"
"X-Generator: Launchpad (build 51a2e4fa2e9b8e45f00904ad7f53546f45ac48a5)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s- [options]\n"
" ရွေးချယ်စရာများ-\n"
" -q | --quiet မည်သည့်စာတိုကိုမှ ပရင့်မထုတ်ပါနှင့်။\n"
" -h | --help ပရင့်အကူအညီ\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "အမည်မသိ သို့မဟုတ် သဟဇာတမဖြစ်သော ရွေးချယ်စရာများ\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "အမည်မသိရွေးချယ်မှု '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "ဟုတ်\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "မဟုတ်ပါ - ဤစနစ်တွင် မရနိုင်ပါ။\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "မဟုတ်ပါ - boot တွင် ပိတ်ထားပါသည်။\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "ဖြစ်နိုင်ပါသည် - မူဝါဒ interface ကို မရနိုင်ပါ။\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
"ဖြစ်နိုင်ပါသည် - ရရှိနိုင်မှုကို ဆုံးဖြတ်ရန်အတွက် ခွင့်ပြုချက်များမှာ "
"လုံလောက်မှုမရှိပါ။\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "အမှား- '%s'\n"

67
binutils/po/oc.po Normal file
View File

@@ -0,0 +1,67 @@
# Occitan (post 1500) translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-01-14 18:26+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Occitan (post 1500) <oc@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-01-15 07:59+0000\n"
"X-Generator: Launchpad (build 511b4a3b6512aa3d421c5f7d74f3527e78bff26e)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/pl.po Normal file
View File

@@ -0,0 +1,71 @@
# Polish translation for apparmor
# Copyright (c) 2021 Rosetta Contributors and Canonical Ltd 2021
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2021.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2021-07-22 20:10+0000\n"
"Last-Translator: Marek Adamski <Unknown>\n"
"Language-Team: Polish <pl@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2021-07-23 06:03+0000\n"
"X-Generator: Launchpad (build 7edebbcd0516593cf020aaa3c59299732a7c73cc)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opcje]\n"
" opcje:\n"
" -q | --quiet Nie wyświetlaj żadnych komunikatów\n"
" -h | --help Wyświetl pomoc\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "nieznane lub niekompatybilne opcje\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "nieznana opcja '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Tak\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Nie - nie jest dostępne w tym systemie.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Nie - wyłączone podczas rozruchu.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Może - interfejs zasad nie jest dostępny.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Może - brak wystarczających uprawnień do określenia dostępności.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Błąd - '%s'\n"

71
binutils/po/pt_BR.po Normal file
View File

@@ -0,0 +1,71 @@
# Brazilian Portuguese translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-04-27 20:32+0000\n"
"Last-Translator: Rodrigo Farias <Unknown>\n"
"Language-Team: Brazilian Portuguese <pt_BR@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-04-28 05:52+0000\n"
"X-Generator: Launchpad (build d1105341713c5be348effe2a5142c4a210ce4cde)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [options]\n"
" opções:\n"
" -q | --quiet Não imprimir nenhum mensagem\n"
" -h | --help Assistente de impressão\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opções incompatíveis ou desconhecidas\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opção desconhecida '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Sim\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Não - não disponível neste sistema.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Não - desabilitado na inicialização.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Talvez - interface de política não disponível.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Talvez - permissões insuficientes para determinar disponibilidade.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Erro - '%s'\n"

View File

@@ -1,21 +1,26 @@
# Romanian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# Romanian translation for apparmor, "apparmor-binutils" component.
# Mesajele în limba română pentru pachetul „apparmor”, componenta „apparmor-binutils”.
# Copyright © 2020 Rosetta Contributors and Canonical Ltd.
# Copyright © 2024 Canonical Ltd.
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
# Daniel Slavu <Unknown>, feb-2020.
# Remus-Gabriel Chelu <remusgabriel.chelu@disroot.org>, sep-2024.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"Project-Id-Version: apparmor-binutils\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-02-20 21:47+0000\n"
"Last-Translator: Daniel Slavu <Unknown>\n"
"Language-Team: Romanian <ro@li.org>\n"
"PO-Revision-Date: 2024-09-23 22:45+0000\n"
"Last-Translator: Remus-Gabriel Chelu <Unknown>\n"
"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-02-21 05:39+0000\n"
"X-Generator: Launchpad (build 19413b719a8df7423ab1390528edadce9e0e4aca)\n"
"X-Launchpad-Export-Date: 2024-09-25 04:33+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
"Language: ro\n"
#: ../aa_enabled.c:26
#, c-format
@@ -27,8 +32,8 @@ msgid ""
msgstr ""
"%s: [opțiuni]\n"
" opțiuni:\n"
" -q | --calm Nu imprima niciun mesaj\n"
" -h | - ajutor Imprimare ajutor\n"
" -q | --quiet nu afișează niciun mesaj\n"
" -h | --help imprimă ajutorul\n"
#: ../aa_enabled.c:45
#, c-format
@@ -38,7 +43,7 @@ msgstr "opțiuni necunoscute sau incompatibile\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opțiune necunoscută '%s'\n"
msgstr "opțiune necunoscută %s\n"
#: ../aa_enabled.c:64
#, c-format
@@ -58,7 +63,8 @@ msgstr "Nu - dezactivat la pornire.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Poate - interfața politică nu este disponibilă.\n"
msgstr ""
"Poate - interfața politică (de directive politice) nu este disponibilă.\n"
#: ../aa_enabled.c:81
#, c-format
@@ -69,4 +75,4 @@ msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Eroare - '%s'\n"
msgstr "Eroare - %s\n"

67
binutils/po/sr.po Normal file
View File

@@ -0,0 +1,67 @@
# Serbian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-11-23 18:06+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Serbian <sr@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-11-24 05:55+0000\n"
"X-Generator: Launchpad (build c35ff22711d15549e2303ae18ae521fd91f6bf00)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

71
binutils/po/uk.po Normal file
View File

@@ -0,0 +1,71 @@
# Ukrainian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-19 21:48+0000\n"
"Last-Translator: Nazarii Ritter <nazariy.ritter@gmail.com>\n"
"Language-Team: Ukrainian <uk@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-20 05:42+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [опції]\n"
" опції:\n"
" -q | --quiet Не виводити жодних повідомлень\n"
" -h | --help Вивести довідку\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "невідомі або несумісні опції\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "невідомий параметр «%s»\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Так\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Ні недоступно на цій системі.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Ні вимкнено під час завантаження.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Можливо інтерфейс політики недоступний.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Можливо недостатньо дозволів для визначення наявності.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Помилка - '%s'\n"

71
binutils/po/zh_CN.po Normal file
View File

@@ -0,0 +1,71 @@
# Chinese (Simplified) translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2020-05-14 09:16+0000\n"
"Last-Translator: 玉堂白鹤 <yjwork@qq.com>\n"
"Language-Team: Chinese (Simplified) <zh_CN@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-15 05:51+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [选项]\n"
" 选项:\n"
" -q | --quiet 不要打印任何消息\n"
" -h | --help 打印帮助\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "未知或不兼容的选项\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "未知选项 '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "是\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "否 - 在此系统上不可用。\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "否 - 引导时被禁用。\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "也许 - 策略界面不可用\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "也许 - 没有足够的权限确定可用性。\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "错误 - '%s'\n"

View File

@@ -35,14 +35,14 @@ VERSION=$(shell cat $(COMMONDIR)/Version)
pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH)))))
map = $(foreach a,$(2),$(call $(1),$(a)))
AWK?=$(or $(shell command -v awk),$(error awk utility required for build but not available))
AWK?=$(or $(shell which awk),$(error awk utility required for build but not available))
define nl
endef
REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || awk '{ print $2 }' common/.stamp_rev
REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || $(AWK) '{ print $2 }' common/.stamp_rev
ifndef PYTHON_VERSIONS
PYTHON_VERSIONS = $(call map, pathsearch, python3)

View File

@@ -1 +1 @@
4.1.0~beta1
4.1.1

View File

@@ -22,15 +22,15 @@
=head1 NAME
aa_change_hat - change to or from a "hat" within a AppArmor profile
aa_change_hat - change to or from a "hat" within a AppArmor profile
=head1 SYNOPSIS
B<#include E<lt>sys/apparmor.hE<gt>>
B<int aa_change_hat (const char *subprofile, unsigned long magic_token);>
B<int aa_change_hat (char *subprofile, unsigned long magic_token);>
B<int aa_change_hatv (const char *subprofiles[], unsigned long magic_token);>
B<int aa_change_hatv (char *subprofiles[], unsigned long magic_token);>
B<int aa_change_hat_vargs (unsigned long magic_token, ...);>

View File

@@ -22,7 +22,7 @@
=head1 NAME
aa_change_profile, aa_change_onexec - change a task's profile
aa_change_profile, aa_change_onexec - change a tasks profile
=head1 SYNOPSIS
@@ -58,8 +58,8 @@ The aa_change_onexec() function is like the aa_change_profile() function
except it specifies that the profile transition should take place on the
next exec instead of immediately. The delayed profile change takes
precedence over any exec transition rules within the confining profile.
Delaying the profile boundary has a couple of advantages: it removes the
need for stub transition profiles, and the exec boundary is a natural security
Delaying the profile boundary has a couple of advantages, it removes the
need for stub transition profiles and the exec boundary is a natural security
layer where potentially sensitive memory is unmapped.
=head1 RETURN VALUE

View File

@@ -54,7 +54,7 @@ B<typedef struct aa_features aa_features;>
B<int aa_features_new(aa_features **features, int dirfd, const char *path);>
B<int aa_features_new_from_file(aa_features **features, int file);>
B<int aa_features_new_from_file(aa_features **features, int fd);>
B<int aa_features_new_from_string(aa_features **features, const char *string, size_t size);>

View File

@@ -58,9 +58,6 @@ appropriately.
=head1 ERRORS
# podchecker warns about duplicate link targets for EACCES, EBUSY, ENOENT,
# and ENOMEM, but this is a warning that is safe to ignore.
B<aa_is_enabled>
=over 4

View File

@@ -41,7 +41,7 @@ result is an intersection of all profiles which are stacked. Stacking profiles
together is desirable when wanting to ensure that confinement will never become
more permissive. When changing between two profiles, as performed with
aa_change_profile(2), there is always the possibility that the new profile is
more permissive than the old profile, but that possibility is eliminated when
more permissive than the old profile but that possibility is eliminated when
using aa_stack_profile().
To stack a profile with the current confinement context, a task can use the
@@ -68,7 +68,7 @@ The aa_stack_onexec() function is like the aa_stack_profile() function
except it specifies that the stacking should take place on the next exec
instead of immediately. The delayed profile change takes precedence over any
exec transition rules within the confining profile. Delaying the stacking
boundary has a couple of advantages: it removes the need for stub transition
boundary has a couple of advantages, it removes the need for stub transition
profiles and the exec boundary is a natural security layer where potentially
sensitive memory is unmapped.

View File

@@ -32,10 +32,10 @@ INCLUDES = $(all_includes)
#
# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
AA_LIB_CURRENT = 20
AA_LIB_REVISION = 0
AA_LIB_AGE = 19
EXPECTED_SO_NAME = libapparmor.so.1.19.0
AA_LIB_CURRENT = 25
AA_LIB_REVISION = 2
AA_LIB_AGE = 24
EXPECTED_SO_NAME = libapparmor.so.1.24.2
SUFFIXES = .pc.in .pc

View File

@@ -399,6 +399,10 @@ static bool walk_one(const char **str, const struct component *component,
i = 0;
cur++;
/* Partial match, continue to search */
if (i == component->len && !isbrace_space_or_nul(*cur))
i = 0;
}
/* Return false if a full match was not found */

View File

@@ -1,3 +1,3 @@
SUBDIRS = perl python ruby
EXTRA_DIST = SWIG/*.i
EXTRA_DIST = SWIG/*.i java/Makefile.am

View File

@@ -258,7 +258,13 @@ extern int aa_is_enabled(void);
* allocation uninitialized (0) != SWIG_NEWOBJ
*/
%#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
static_assert(SWIG_NEWOBJ != 0);
/*
* Some older versions of SWIG place this right after a goto label
* This would then be a label followed by a declaration, a C23 extension (!)
* To ensure this works for older SWIG versions and older compilers,
* make this a block element with curly braces.
*/
{static_assert(SWIG_NEWOBJ != 0, "SWIG_NEWOBJ is 0");}
%#endif
if ($1 != NULL && alloc_tracking$argnum != NULL) {
for (Py_ssize_t i=0; i<seq_len$argnum; i++) {
@@ -272,6 +278,35 @@ extern int aa_is_enabled(void);
}
#endif
#ifdef SWIGPERL
// Copied from perl's argcargv.i, which should be good enough for us
%typemap(in) (const char *subprofiles[]) {
int i;
SSize_t len;
AV *av = (AV *)SvRV($input);
if (SvTYPE(av) != SVt_PVAV) {
SWIG_croak("in method '$symname', Expecting reference to argv array");
goto fail;
}
len = av_len(av) + 1;
$1 = (char **) malloc((len+1)*sizeof(char *));
for (i = 0; i < len; i++) {
SV **tv = av_fetch(av, i, 0);
$1[i] = SvPV_nolen(*tv);
}
$1[i] = NULL;
}
%typemap(typecheck, precedence=SWIG_TYPECHECK_STRING_ARRAY) (const char *subprofiles[]) {
AV *av = (AV *)SvRV($input);
$1 = SvTYPE(av) == SVt_PVAV;
}
%typemap(freearg) (const char *subprofiles[]) {
free((void *)$1);
}
#endif
/* These should not receive the VOID_Object typemap */
extern int aa_change_hat(const char *subprofile, unsigned long magic_token);
extern int aa_change_profile(const char *profile);
@@ -315,10 +350,17 @@ extern int aa_stack_onexec(const char *profile);
* We can't use "typedef int pid_t" because we still support systems
* with 16-bit PIDs and SWIG can't find sys/types.h
*
* Capture the passed-in value as an intmax_t because pid_t is guaranteed
* to be a signed integer
* Capture the passed-in value as a long because pid_t is guaranteed
* to be a signed integer and because the aalogparse struct uses
* (unsigned) longs to store pid values. While intmax_t would be more
* technically correct, if sizeof(pid_t) > sizeof(long) then aalogparse
* itself would also need fixing.
*/
%typemap(in,noblock=1,fragment="SWIG_AsVal_long") pid_t (int conv_pid, intmax_t pid_large) {
%typemap(in,noblock=1,fragment="SWIG_AsVal_long") pid_t (int conv_pid, long pid_large) {
%#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
static_assert(sizeof(pid_t) <= sizeof(long),
"pid_t type is too large to be stored in a long");
%#endif
conv_pid = SWIG_AsVal_long($input, &pid_large);
if (!SWIG_IsOK(conv_pid)) {
%argument_fail(conv_pid, "pid_t", $symname, $argnum);
@@ -328,7 +370,7 @@ extern int aa_stack_onexec(const char *profile);
* Technically this is implementation-defined behaviour but we should be fine
*/
$1 = (pid_t) pid_large;
if ((intmax_t) $1 != pid_large) {
if ((long) $1 != pid_large) {
SWIG_exception_fail(SWIG_OverflowError, "pid_t is too large");
}
}

View File

@@ -0,0 +1,21 @@
WRAPPERFILES = apparmorlogparse_wrap.c
BUILT_SOURCES = apparmorlogparse_wrap.c
all-local: apparmorlogparse_wrap.o
$(CC) -module apparmorlogparse_wrap.o -o libaalogparse.so
apparmorlogparse_wrap.o: apparmorlogparse_wrap.c
$(CC) -c apparmorlogparse_wrap.c $(CFLAGS) -I../../src -I/usr/include/classpath -fno-strict-aliasing -o apparmorlogparse_wrap.o
clean-local:
rm -rf org
apparmorlogparse_wrap.c: org/aalogparse ../SWIG/*.i
$(SWIG) -java -I../SWIG -I../../src -outdir org/aalogparse \
-package org.aalogparse -o apparmorlogparse_wrap.c libaalogparse.i
org/aalogparse:
mkdir -p org/aalogparse
EXTRA_DIST = $(BUILT_SOURCES)

View File

@@ -15,6 +15,7 @@ PYTHON_DIST_BUILD_PATH = '$(builddir)/../build/$$($(PYTHON) buildpath.py)'
TESTS = test_python.py
TESTS_ENVIRONMENT = \
LD_LIBRARY_PATH='$(top_builddir)/src/.libs:$(PYTHON_DIST_BUILD_PATH)' \
PYTHONPATH='$(PYTHON_DIST_BUILD_PATH)'
PYTHONPATH='$(PYTHON_DIST_BUILD_PATH)' \
PYTHONDONTWRITEBYTECODE='1'
endif

View File

@@ -1,4 +1,2 @@
/home/cb/bin/hello.sh {
/usr/bin/rm mrix,
}

View File

@@ -1,4 +1,2 @@
/usr/bin/wireshark {
/usr/lib64/wireshark/extcap/androiddump mrix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
/bin/ping mrix,
ping2 ix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
/bin/ping mrix,
/bin/ping ix,
}

View File

@@ -1,4 +1,4 @@
/bin/ping {
/bin/ping mrix,
/bin/ping ix,
}

View File

@@ -1,4 +0,0 @@
/home/steve/aa-regression-tests/link {
/tmp/sdtest.8236-29816-IN8243/target l,
}

View File

@@ -1,4 +1,3 @@
/tmp/apparmor-2.8.0/tests/regression/apparmor/dbus_service {
dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName peer=(label=unconfined),
dbus send bus=system path=/org/freedesktop/systemd1 interface=org.freedesktop.systemd1.Manager member=LookupDynamicUserByName peer=( name=org.freedesktop.systemd1, label=unconfined),
}

View File

@@ -37,7 +37,7 @@ MANPAGES=apparmor.d.5 apparmor.7 apparmor_parser.8 aa-teardown.8 apparmor_xattrs
# default behavior changed in version 3.6
# parse.error=verbose supported from 3.0 so just test on that
# TODO move to autoconf
BISON_MAJOR:=$(shell bison --version | awk '/^bison/ { print ($$NF) }' | awk -F. '{print $$1 }')
BISON_MAJOR:=$(shell bison --version | ${AWK} '/^bison/ { print ($$NF) }' | ${AWK} -F. '{print $$1 }')
USE_PARSE_ERROR:=$(shell test "${BISON_MAJOR}" -ge 3 && echo true)
YACC := bison
@@ -375,7 +375,7 @@ tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
errnos.h:
echo '#include <errno.h>' > dump.c
$(CC) -E -dD dump.c | awk '/^#define E/ { printf "{ \"%s\", %s },\n", $$2, $$2 }' > errnos.h
$(CC) $(CPPFLAGS) -E -dD dump.c | $(AWK) '/^#define E/ { printf "{ \"%s\", %s },\n", $$2, $$2 }' > errnos.h
rm -f dump.c
.SILENT: check

View File

@@ -114,7 +114,7 @@ B<XATTR VALUE FILEGLOB> = I<FILEGLOB>
B<PROFILE FLAG CONDS> = [ 'flags=' ] '(' comma or white space separated list of I<PROFILE FLAGS> ')'
B<PROFILE FLAGS> = I<PROFILE MODE> | I<AUDIT_MODE> | 'mediate_deleted'
| 'attach_disconnected' | 'attach_disconneced.path='I<ABS PATH> | 'chroot_relative'
| 'attach_disconnected' | 'attach_disconnected.path='I<ABS PATH> | 'chroot_relative'
| 'debug' | 'interruptible' | 'kill.signal='I<SIGNAL> | 'error='I<ERROR CODE>
B<ERROR CODE> = (case insensitive error code name starting with 'E'; see errno(3))
@@ -388,7 +388,7 @@ aa_change_hat(2) can take advantage of subprofiles to run under different
confinements, dependent on program logic. Several aa_change_hat(2)-aware
applications exist, including an Apache module, mod_apparmor(5); a PAM
module, pam_apparmor; and a Tomcat valve, tomcat_apparmor. Applications
written or modified to use aa_change_profile(2) transition permanently to the
written or modified to use change_profile(2) transition permanently to the
specified profile. libvirt is one such application.
=head2 Profile Head
@@ -604,7 +604,7 @@ modes:
=item B<Ux>
- unconfined execute -- use ld.so(8) secure-execution mode
- unconfined execute -- scrub the environment
=item B<px>
@@ -612,7 +612,7 @@ modes:
=item B<Px>
- discrete profile execute -- use ld.so(8) secure-execution mode
- discrete profile execute -- scrub the environment
=item B<cx>
@@ -620,7 +620,7 @@ modes:
=item B<Cx>
- transition to subprofile on execute -- use ld.so(8) secure-execution mode
- transition to subprofile on execute -- scrub the environment
=item B<ix>
@@ -632,7 +632,7 @@ modes:
=item B<Pix>
- discrete profile execute with inherit fallback -- use ld.so(8) secure-execution mode
- discrete profile execute with inherit fallback -- scrub the environment
=item B<cix>
@@ -640,7 +640,7 @@ modes:
=item B<Cix>
- transition to subprofile on execute with inherit fallback -- use ld.so(8) secure-execution mode
- transition to subprofile on execute with inherit fallback -- scrub the environment
=item B<pux>
@@ -648,7 +648,7 @@ modes:
=item B<PUx>
- discrete profile execute with fallback to unconfined -- use ld.so(8) secure-execution mode
- discrete profile execute with fallback to unconfined -- scrub the environment
=item B<cux>
@@ -656,7 +656,7 @@ modes:
=item B<CUx>
- transition to subprofile on execute with fallback to unconfined -- use ld.so(8) secure-execution mode
- transition to subprofile on execute with fallback to unconfined -- scrub the environment
=item B<deny x>
@@ -715,20 +715,20 @@ constrained, see the apparmor(7) man page.
B<WARNING> 'ux' should only be used in very special cases. It enables the
designated child processes to be run without any AppArmor protection.
'ux' does not use ld.so(8) secure-execution mode to clear variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee. Use this mode only if the child absolutely must be
'ux' does not scrub the environment of variables such as LD_PRELOAD;
as a result, the calling domain may have an undue amount of influence
over the callee. Use this mode only if the child absolutely must be
run unconfined and LD_PRELOAD must be used. Any profile using this mode
provides negligible security. Use at your own risk.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Ux - unconfined execute -- use ld.so(8) secure-execution mode>
=item B<Ux - unconfined execute -- scrub the environment>
'Ux' allows the named program to run in 'ux' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
B<WARNING> 'Ux' should only be used in very special cases. It enables the
designated child processes to be run without any AppArmor protection.
@@ -743,18 +743,18 @@ This mode requires that a discrete security profile is defined for a
program executed and forces an AppArmor domain transition. If there is
no profile defined then the access will be denied.
B<WARNING> 'px' does not use ld.so(8) secure-execution mode to clear variables
such as LD_PRELOAD; as a result, the calling domain may have an undue amount of
B<WARNING> 'px' does not scrub the environment of variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Px - Discrete Profile execute mode -- use ld.so(8) secure-execution mode>
=item B<Px - Discrete Profile execute mode -- scrub the environment>
'Px' allows the named program to run in 'px' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
Incompatible with other exec transition modes and the deny qualifier.
@@ -764,18 +764,18 @@ This mode requires that a local security profile is defined and forces an
AppArmor domain transition to the named profile. If there is no profile
defined then the access will be denied.
B<WARNING> 'cx' does not use ld.so(8) secure-execution mode to clear variables
such as LD_PRELOAD; as a result, the calling domain may have an undue amount of
B<WARNING> 'cx' does not scrub the environment of variables such as
LD_PRELOAD; as a result, the calling domain may have an undue amount of
influence over the callee.
Incompatible with other exec transition modes and the deny qualifier.
=item B<Cx - Transition to Subprofile execute mode -- use ld.so(8) secure-execution mode>
=item B<Cx - Transition to Subprofile execute mode -- scrub the environment>
'Cx' allows the named program to run in 'cx' mode, but AppArmor
will invoke the Linux Kernel's B<unsafe_exec> routines to set ld.so(8)
secure-execution mode and clear environment variables such as LD_PRELOAD,
similar to setuid programs. (See ld.so(8) for more information.)
will invoke the Linux Kernel's B<unsafe_exec> routines to scrub
the environment, similar to setuid programs. (See ld.so(8) for some
information on setuid/setgid environment scrubbing.)
Incompatible with other exec transition modes and the deny qualifier.
@@ -788,7 +788,7 @@ will inherit the current profile.
This mode is useful when a confined program needs to call another
confined program without gaining the permissions of the target's
profile, or losing the permissions of the current profile. There is no
version to set secure-execution mode because 'ix' executions don't change
version to scrub the environment because 'ix' executions don't change
privileges.
Incompatible with other exec transition modes and the deny qualifier.
@@ -1690,11 +1690,11 @@ rule set. Eg.
change_profile /bin/bash -> {new_profile1,new_profile2,new_profile3},
The exec mode dictates whether or not the Linux Kernel's B<unsafe_exec>
routines should be used to set ld.so(8) secure-execution mode and clear
environment variables such as LD_PRELOAD, similar to setuid programs.
(See ld.so(8) for more information.) The B<safe> mode sets up secure-execution
mode for the new application, and B<unsafe> mode disables AppArmor's
requirement for it (the kernel and/or libc may still turn it on). An
routines should be used to scrub the environment, similar to setuid programs.
(See ld.so(8) for some information on setuid/setgid environment scrubbing.) The
B<safe> mode sets up environment scrubbing to occur when the new application is
executed and B<unsafe> mode disables AppArmor's requirement for environment
scrubbing (the kernel and/or libc may still require environment scrubbing). An
exec mode can only be specified when an exec condition is present.
change_profile safe /bin/bash -> new_profile,
@@ -1796,6 +1796,61 @@ F</etc/apparmor.d/tunables/xdg-user-dirs.d> for B<@{XDG_*}>.
The special B<@{profile_name}> variable is set to the profile name and may be
used in all policy.
=head3 Notes on variable expansion and the / character
It is important to note that how AppArmor performs variable expansion
depends on the context where a variable is used. When a variable is
expanded it can result in a string with multiple path characters
next to each other, in a way that is not evident when looking at
policy.
Eg.
=over 4
Given the following variable definition and rule
@{HOME}=/home/*/
file rw @{HOME}/*,
The variable expansion results in a rule of
file rw /home/*//*.
=back
When this occurs in a context where a path is expected, AppArmor will
canonicalize the path by collapsing consecutive / characters into
a single character. For the above example, this would be
file rw /home/*/*,
There is one exception to this rule, when the consecutive / characters
are at the beginning of a path, this indicates a posix namespace
and the characters will not be collapsed.
Eg.
=over 4
@{HOME}=/home/*/
file rw /@{HOME}/*,
will result in an expansion of
file rw //home/*//*,
which is collapsed to
file rw //home/*/*,
Note: that the leading // in the above example is not collapsed to a
single /. However the second // (that was also seen in the first
example) is collapsed.
=back
=head2 Alias rules
AppArmor also provides alias rules for remapping paths for site-specific
@@ -2097,7 +2152,7 @@ An example AppArmor profile:
/usr/lib/** r,
/tmp/foo.pid wr,
/tmp/foo.* lrw,
/@{HOME}/.foo_file rw,
@{HOME}/.foo_file rw,
/usr/bin/baz Cx -> baz,
# a comment about foo's hat (subprofile), bar.
@@ -2159,7 +2214,7 @@ negative values match when specifying one or the other. Eg, 'rw' matches when
=head1 SEE ALSO
apparmor(7), apparmor_parser(8), apparmor_xattrs(7), aa-complain(1),
aa-enforce(1), aa_change_hat(2), aa_change_profile(2), mod_apparmor(5), and
aa-enforce(1), aa_change_hat(2), mod_apparmor(5), and
L<https://wiki.apparmor.net>.
=cut

View File

@@ -206,8 +206,8 @@ which can help debugging profiles.
=head2 Enable debug mode
When debug mode is enabled, AppArmor will log a few extra messages to
dmesg (not via the audit subsystem). For example, the logs will state when
ld.so(8) secure-execution mode has been applied in a profile transition.
dmesg (not via the audit subsystem). For example, the logs will tell
whether environment scrubbing has been applied.
To enable debug mode, run:

View File

@@ -63,6 +63,7 @@ typedef enum capability_flags {
} capability_flags;
int name_to_capability(const char *keyword);
void capabilities_init(void);
void __debug_capabilities(uint64_t capset, const char *name);
bool add_cap_feature_mask(struct aa_features *features, capability_flags flags);
void clear_cap_flag(capability_flags flags);

View File

@@ -10,199 +10,6 @@ aare_rules.{h,cc} - code to that binds parse -> expr-tree -> hfa generation
-> chfa generation into a basic interface for converting
rules to a runtime ready state machine.
Notes on the compiler pipeline order
============================================
Front End: Program driver logic and policy text parsing into an
abstract syntax tree.
Middle Layer: Transforms and operations on the abstract syntax tree.
Converts syntax tree into expression tree for back end.
Back End: transforms of syntax tree, and creation of policy HFA from
expression trees and HFAs.
Basic order of the backend of the compiler pipe line and where the
dump information occurs in the pipeline.
===== Front End (parse -> AST ================
|
v
yyparse
|
+--->--+-->-+
| |
| +-->---- +---------------------------<-----------------------+
| | | |
| | v |
| | yylex |
| | | |
| ^ token match |
| | | |
| | +----------------------------+ |
| | | | ^
| | v v |
| +-<- rule match? preprocess |
| | | |
| early var expansion +----------+-----------+ |
| | | | | |
^ v v v v |
| new rule() / new ent include variable conditional |
| | | | | |
| v +---->-----+----->-----+----->----+
| new rule semantic check
| |
+-----<-----+
|
----------- | ------ End of Parse --------------------
|
v
post_parse_profile semantic check
|
v
post_process
|
v
add implied rules()
|
v
process_profile_variables()
|
v
rule->expand_variables()
|
+--------+
|
v
replace aliases (to be moved to backend rewrite)
|
v
merge rules
|
v
profile->merge_rules()
|
v
+-->--rule->is_mergeable()
| |
^ v
| add to table
| |
+-------+--------+
|
v
sort->cmp()/oper<()
|
rule->merge()
|
+------------+
|
v
process_profile_rules
|
v
rule->gen_policy_re()
|
v
===== Mid layer (AST -> expr tree) =================
|
+-> add_rule() (aare_rules.{h,cc})
| |
| v
| rule parse (parse.y)
| | |
| | v
| | expr tree (expr-tree.{h,cc})
| | |
| v |
| unique perms | (aare_rules.{h,cc})
| | |
| +------ +
| |
| v
| add to rules expr tree (aare_rules.{h,c})
| |
+------+
|
+------------------+
|
v
create_dfablob()
|
v
expr tree
|
v
create_chfa() (aare_rules.cc)
|
v
expr normalization (expr-tree.{h,cc})
|
v
expr simplification (expr-tree.{h,c})
|
+- D expr-tree
|
+- D expr-simplified
|
==== Back End - Create cHFA out of expr tree and other HFAs ====
v
hfa creation (hfa.{h,cc})
|
+- D dfa-node-map
|
+- D dfa-uniq-perms
|
+- D dfa-states-initial
|
v
hfa rewrite (not yet implemented)
|
v
filter deny (hfa.{h,cc})
|
+- D dfa-states-post-filter
|
v
minimization (hfa.{h,cc})
|
+- D dfa-minimize-partitions
|
+- D dfa-minimize-uniq-perms
|
+- D dfa-states-post-minimize
|
v
unreachable state removal (hfa.{h,cc})
|
+- D dfa-states-post-unreachable
|
+- D dfa-states constructed hfa
|
+- D dfa-graph
|
v
equivalence class construction
|
+- D equiv
|
diff encode (hfa.{h,cc})
|
+- D diff-encode
|
compute perms table
|
+- D compressed-dfa == perm table dump
|
compressed hfa (chfa.{h,cc}
|
+- D compressed-dfa == transition tables
|
+- D dfa-compressed-states - compress HFA in state form
|
v
Return to Mid Layer
Notes on the compress hfa file format (chfa)
==============================================

View File

@@ -25,8 +25,6 @@
#include <iostream>
#include <fstream>
#include <limits>
#include <arpa/inet.h>
#include <stdio.h>
#include <string.h>
@@ -594,11 +592,10 @@ void CHFA::weld_file_to_policy(CHFA &file_chfa, size_t &new_start,
// to repeat
assert(accept.size() == old_base_size);
accept.resize(accept.size() + file_chfa.accept.size());
assert(policy_perms.size() < std::numeric_limits<ssize_t>::max());
ssize_t size = (ssize_t) policy_perms.size();
size_t size = policy_perms.size();
policy_perms.resize(size*2 + file_perms.size());
// shift and double the policy perms
for (ssize_t i = size - 1; i >= 0; i--) {
for (size_t i = size - 1; size >= 0; i--) {
policy_perms[i*2] = policy_perms[i];
policy_perms[i*2 + 1] = policy_perms[i];
}

View File

@@ -558,14 +558,6 @@ void DFA::dump_uniq_perms(const char *s)
//TODO: add prompt
}
// make sure work_queue and reachable insertion are always done together
static void push_reachable(set<State *> &reachable, list<State *> &work_queue,
State *state)
{
work_queue.push_back(state);
reachable.insert(state);
}
/* Remove dead or unreachable states */
void DFA::remove_unreachable(optflags const &opts)
{
@@ -573,18 +565,19 @@ void DFA::remove_unreachable(optflags const &opts)
/* find the set of reachable states */
reachable.insert(nonmatching);
push_reachable(reachable, work_queue, start);
work_queue.push_back(start);
while (!work_queue.empty()) {
State *from = work_queue.front();
work_queue.pop_front();
reachable.insert(from);
if (from->otherwise != nonmatching &&
reachable.find(from->otherwise) == reachable.end())
push_reachable(reachable, work_queue, from->otherwise);
work_queue.push_back(from->otherwise);
for (StateTrans::iterator j = from->trans.begin(); j != from->trans.end(); j++) {
if (reachable.find(j->second) == reachable.end())
push_reachable(reachable, work_queue, j->second);
work_queue.push_back(j->second);
}
}
@@ -1398,9 +1391,31 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
MatchFlag *match, perms_t &perms, perms_t &exact,
bool filedfa)
{
if (priority[i] > match->priority) {
// scaling priority *4
int pri = match->priority<<2;
/* use priority to get proper ordering and application of the type
* of match flag.
*
* Note: this is the last use of priority, it is dropped and not
* used in the backend.
*/
if (match->is_type(NODE_TYPE_DENYMATCHFLAG))
pri += 3;
// exact match must be same priority as allow as its audit
// flags has the same priority.
// current no ALLOWMATCHFLAG it is just absence of other flags
// so it has to be second last in this list, using !last
// until this gets fixed
else if (match->is_type(NODE_TYPE_EXACTMATCHFLAG) ||
(!match->is_type(NODE_TYPE_PROMPTMATCHFLAG)))
pri += 2;
else if (match->is_type(NODE_TYPE_PROMPTMATCHFLAG))
pri += 1;
if (priority[i] > pri) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " > " << match->priority << " SKIPPING " << hex << (match->perms) << "/" << (match->audit) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " > " << pri << " SKIPPING " << hex << (match->perms) << "/" << (match->audit) << dec << "\n";
return 0;
}
@@ -1416,8 +1431,8 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
if (match->perms & AA_EXEC_INHERIT) {
xmask |= AA_USER_EXEC_MMAP;
//USER_EXEC_MAP = 6
if (priority[6] < match->priority)
priority[6] = match->priority;
if (priority[6] < pri)
priority[6] = pri;
}
amask = mask | xmask;
} else if (mask & AA_OTHER_EXEC) {
@@ -1426,8 +1441,8 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
if (match->perms & AA_OTHER_EXEC_INHERIT) {
xmask |= AA_OTHER_EXEC_MMAP;
//OTHER_EXEC_MAP = 20
if (priority[20] < match->priority)
priority[20] = match->priority;
if (priority[20] < pri)
priority[20] = pri;
}
amask = mask | xmask;
} else if (((mask & AA_USER_EXEC_MMAP) &&
@@ -1436,17 +1451,17 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
(match->perms & AA_OTHER_EXEC_INHERIT))) {
// if exec && ix we handled mmp above
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " SKIPPING mmap unmasked " << hex << match->perms << "/" << match->audit << " masked " << (match->perms & amask) << "/" << (match->audit & amask) << " data " << (perms.allow & mask) << "/" << (perms.audit & mask) << " exact " << (exact.allow & mask) << "/" << (exact.audit & mask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " SKIPPING mmap unmasked " << hex << match->perms << "/" << match->audit << " masked " << (match->perms & amask) << "/" << (match->audit & amask) << " data " << (perms.allow & mask) << "/" << (perms.audit & mask) << " exact " << (exact.allow & mask) << "/" << (exact.audit & mask) << dec << "\n";
return 0;
}
}
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " vs. " << match->priority << " mask: " << hex << mask << " xmask: " << xmask << " amask: " << amask << dec << "\n";
if (priority[i] < match->priority) {
cerr << " " << match << "[" << i << "]=" << priority[i] << " vs. " << pri << " mask: " << hex << mask << " xmask: " << xmask << " amask: " << amask << dec << "\n";
if (priority[i] < pri) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " < " << match->priority << " clearing " << hex << (perms.allow & amask) << "/" << (perms.audit & amask) << " -> " << dec;
priority[i] = match->priority;
cerr << " " << match << "[" << i << "]=" << priority[i] << " < " << pri << " clearing " << hex << (perms.allow & amask) << "/" << (perms.audit & amask) << " -> " << dec;
priority[i] = pri;
perms.clear_bits(amask);
exact.clear_bits(amask);
if (opts.dump & DUMP_DFA_PERMS)
@@ -1456,7 +1471,7 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
// the if conditions in order of permission priority
if (match->is_type(NODE_TYPE_DENYMATCHFLAG)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " deny " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " deny " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
perms.deny |= match->perms & amask;
perms.quiet |= match->audit & amask;
@@ -1466,11 +1481,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
} else if (match->is_type(NODE_TYPE_EXACTMATCHFLAG)) {
/* exact match only asserts dominance on the XTYPE */
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " exact " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " exact " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa &&
!is_merged_x_consistent(exact.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " exact match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " exact match conflict" << "\n";
return 1;
}
exact.allow |= match->perms & amask;
@@ -1491,11 +1506,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
// allow perms, if exact has been encountered will already be set
// if overlaps x here, don't conflict, because exact will override
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " allow " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " allow " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa && !(exact.allow & mask) &&
!is_merged_x_consistent(perms.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " allow match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " allow match conflict" << "\n";
return 1;
}
// mask off if XTYPE in xmatch
@@ -1509,11 +1524,11 @@ static int pri_update_perm(optflags const &opts, vector<int> &priority, int i,
}
} else { // if (match->is_type(NODE_TYPE_PROMPTMATCHFLAG)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " promt " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " prompt " << hex << (match->perms & amask) << "/" << (match->audit & amask) << dec << "\n";
if (filedfa && !((exact.allow | perms.allow) & mask) &&
!is_merged_x_consistent(perms.allow, match->perms & amask)) {
if (opts.dump & DUMP_DFA_PERMS)
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << match->priority << " prompt match conflict" << "\n";
cerr << " " << match << "[" << i << "]=" << priority[i] << " <= " << pri << " prompt match conflict" << "\n";
return 1;
}
if ((exact.allow | exact.audit | perms.allow | perms.audit) & mask) {
@@ -1539,9 +1554,8 @@ int accept_perms(optflags const &opts, NodeVec *state, perms_t &perms,
{
int error = 0;
perms_t exact;
// size of vector needs to be number of bits in the data type
// being used for the permission set.
std::vector<int> priority(sizeof(perm32_t)*8, MIN_INTERNAL_PRIORITY);
// scaling priority by *4
std::vector<int> priority(sizeof(perm32_t)*8, MIN_INTERNAL_PRIORITY<<2); // 32 but wan't tied to perm32_t
perms.clear();
if (!state)

View File

@@ -275,7 +275,7 @@ public:
ostream &dump(ostream &os)
{
os << *this << "\n";
cerr << *this << "\n";
for (StateTrans::iterator i = trans.begin(); i != trans.end(); i++) {
os << " " << i->first.c << " -> " << *i->second << "\n";
}

View File

@@ -288,7 +288,7 @@ static struct mnt_keyword_table mnt_opts_table[] = {
{"make-rshared", MS_RSHARED, 0},
{"relatime", MS_RELATIME, 0},
{"norelatime", 0, MS_NORELATIME},
{"norelatime", 0, MS_RELATIME},
{"iversion", MS_IVERSION, 0},
{"noiversion", 0, MS_IVERSION},
{"strictatime", MS_STRICTATIME, 0},
@@ -355,8 +355,7 @@ int is_valid_mnt_cond(const char *name, int src)
static unsigned int extract_flags(struct value_list **list, unsigned int *inv)
{
unsigned int flags = 0, invflags = 0;
if (inv)
*inv = 0;
*inv = 0;
struct value_list *entry, *tmp, *prev = NULL;
list_for_each_safe(*list, entry, tmp) {
@@ -369,7 +368,11 @@ static unsigned int extract_flags(struct value_list **list, unsigned int *inv)
" => req: 0x%x inv: 0x%x\n",
entry->value, mnt_opts_table[i].set,
mnt_opts_table[i].clear, flags, invflags);
list_remove_at(*list, prev, entry);
if (prev)
prev->next = tmp;
if (entry == *list)
*list = tmp;
entry->next = NULL;
free_value_list(entry);
} else
prev = entry;
@@ -680,7 +683,7 @@ int mnt_rule::cmp(rule_t const &rhs) const {
return cmp_vec_int(opt_flagsv, rhs_mnt.opt_flagsv);
}
static bool build_mnt_flags(char *buffer, int size, unsigned int flags,
static int build_mnt_flags(char *buffer, int size, unsigned int flags,
unsigned int opt_flags)
{
char *p = buffer;
@@ -690,8 +693,8 @@ static bool build_mnt_flags(char *buffer, int size, unsigned int flags,
/* all flags are optional */
len = snprintf(p, size, "%s", default_match_pattern);
if (len < 0 || len >= size)
return false;
return true;
return FALSE;
return TRUE;
}
for (i = 0; i <= 31; ++i) {
if ((opt_flags) & (1 << i))
@@ -702,7 +705,7 @@ static bool build_mnt_flags(char *buffer, int size, unsigned int flags,
continue;
if (len < 0 || len >= size)
return false;
return FALSE;
p += len;
size -= len;
}
@@ -713,15 +716,15 @@ static bool build_mnt_flags(char *buffer, int size, unsigned int flags,
* like the empty string
*/
if (size < 9)
return false;
return FALSE;
strcpy(p, "(\\xfe|)");
}
return true;
return TRUE;
}
static bool build_mnt_opts(std::string& buffer, struct value_list *opts)
static int build_mnt_opts(std::string& buffer, struct value_list *opts)
{
struct value_list *ent;
pattern_t ptype;
@@ -729,19 +732,19 @@ static bool build_mnt_opts(std::string& buffer, struct value_list *opts)
if (!opts) {
buffer.append(default_match_pattern);
return true;
return TRUE;
}
list_for_each(opts, ent) {
ptype = convert_aaregex_to_pcre(ent->value, 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
if (ent->next)
buffer.append(",");
}
return true;
return TRUE;
}
void mnt_rule::warn_once(const char *name)
@@ -844,8 +847,12 @@ int mnt_rule::gen_policy_bind_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (!clear_and_convert_entry(devbuf, device))
if (device && strcmp(device, "detached") == 0) {
/* see note in move_mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
goto fail;
}
vec[1] = devbuf.c_str();
/* skip type */
vec[2] = default_match_pattern;
@@ -946,8 +953,12 @@ int mnt_rule::gen_policy_move_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (!clear_and_convert_entry(devbuf, device))
if (device && strcmp(device, "detached") == 0) {
/* see note in move_mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
goto fail;
}
vec[1] = devbuf.c_str();
/* skip type */
vec[2] = default_match_pattern;
@@ -987,8 +998,12 @@ int mnt_rule::gen_policy_new_mount(Profile &prof, int &count,
if (!convert_entry(mntbuf, mnt_point))
goto fail;
vec[0] = mntbuf.c_str();
if (!clear_and_convert_entry(devbuf, device))
if (device && strcmp(device, "detached") == 0) {
/* see note in move mount. match nothing */
devbuf.clear();
} else if (!clear_and_convert_entry(devbuf, device)) {
goto fail;
}
vec[1] = devbuf.c_str();
typebuf.clear();
if (!build_list_val_expr(typebuf, dev_type))

View File

@@ -148,6 +148,8 @@ ostream &mqueue_rule::dump(ostream &os)
os << ")";
}
if (label)
os << " label=" << label;
if (qname)
os << " " << qname;
@@ -238,6 +240,19 @@ int mqueue_rule::gen_policy_re(Profile &prof)
audit == AUDIT_FORCE ? map_mqueue_perms(perms) : 0, 1,
vec, parseopts, false))
goto fail;
/* create should be allowed when label is present since the
* queue needs to be created to have a label associated to it
*/
if (perms & AA_MQUEUE_CREATE &&
!prof.policy.rules->add_rule_vec(
priority,
rule_mode,
map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS),
audit == AUDIT_FORCE ? map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS) : 0, 1,
vec, parseopts, false))
goto fail;
/* also provide label match with perm */
if (!prof.policy.rules->add_rule_vec(priority,
rule_mode,
@@ -282,6 +297,19 @@ int mqueue_rule::gen_policy_re(Profile &prof)
audit == AUDIT_FORCE ? map_mqueue_perms(perms) : 0, 1,
vec, parseopts, false))
goto fail;
/* create should be allowed when label is present since the
* queue needs to be created to have a label associated to it
*/
if (perms & AA_MQUEUE_CREATE &&
!prof.policy.rules->add_rule_vec(
priority,
rule_mode,
map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS),
audit == AUDIT_FORCE ? map_mqueue_perms(perms & AA_MQUEUE_CREATE_PERMS) : 0, 1,
vec, parseopts, false))
goto fail;
/* also provide label match with perm */
if (!prof.policy.rules->add_rule_vec(priority,
rule_mode,

View File

@@ -69,6 +69,12 @@
#define AA_VALID_MQUEUE_PERMS (AA_VALID_POSIX_MQ_PERMS | \
AA_VALID_SYSV_MQ_PERMS)
/* read and write needed with create because mq_open can be called
* with O_CREAT | O_RDWR, which all show up in the requested perms at
* the same time during creation
*/
#define AA_MQUEUE_CREATE_PERMS (AA_MQUEUE_CREATE | AA_MQUEUE_READ | \
AA_MQUEUE_WRITE)
// warning getting into overlap area
/* Type of mqueue - can be explicit or implied by rule id/path */

View File

@@ -179,6 +179,8 @@ struct var_string {
#define OPTION_STDOUT 4
#define OPTION_OFILE 5
#define BOOL int
extern int preprocess_only;
#define PATH_CHROOT_REL 0x1
@@ -211,6 +213,13 @@ do { \
errno = perror_error; \
} while (0)
#ifndef TRUE
#define TRUE (1)
#endif
#ifndef FALSE
#define FALSE (0)
#endif
#define MIN_PORT 0
#define MAX_PORT 65535
@@ -242,6 +251,17 @@ do { \
len; \
})
#define list_find_prev(LIST, ENTRY) \
({ \
typeof(ENTRY) tmp, prev = NULL; \
list_for_each((LIST), tmp) { \
if (tmp == (ENTRY)) \
break; \
prev = tmp; \
} \
prev; \
})
#define list_pop(LIST) \
({ \
typeof(LIST) _entry = (LIST); \
@@ -259,6 +279,12 @@ do { \
(LIST) = (ENTRY)->next; \
(ENTRY)->next = NULL; \
#define list_remove(LIST, ENTRY) \
do { \
typeof(ENTRY) prev = list_find_prev((LIST), (ENTRY)); \
list_remove_at((LIST), prev, (ENTRY)); \
} while (0)
#define DUP_STRING(orig, new, field, fail_target) \
do { \
@@ -321,6 +347,7 @@ extern int features_supports_inet;
extern int kernel_supports_policydb;
extern int kernel_supports_diff_encode;
extern int features_supports_mount;
extern bool features_supports_detached_mount;
extern int features_supports_dbus;
extern int features_supports_signal;
extern int features_supports_ptrace;
@@ -397,10 +424,10 @@ extern const char *basedir;
#define glob_null 1
extern pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
std::string& pcre, int *first_re_pos);
extern bool build_list_val_expr(std::string& buffer, struct value_list *list);
extern bool convert_entry(std::string& buffer, char *entry);
extern int build_list_val_expr(std::string& buffer, struct value_list *list);
extern int convert_entry(std::string& buffer, char *entry);
extern int clear_and_convert_entry(std::string& buffer, char *entry);
extern bool convert_range(std::string& buffer, bignum start, bignum end);
extern int convert_range(std::string& buffer, bignum start, bignum end);
extern int process_regex(Profile *prof);
extern int post_process_entry(struct cod_entry *entry);
@@ -419,6 +446,7 @@ extern void free_var_string(struct var_string *var);
extern void warn_uppercase(void);
extern int is_blacklisted(const char *name, const char *path);
extern struct value_list *new_value_list(char *value);
extern struct value_list *dup_value_list(struct value_list *list);
extern void free_value_list(struct value_list *list);
extern void print_value_list(struct value_list *list);
extern struct cond_entry *new_cond_entry(char *name, int eq, struct value_list *list);

View File

@@ -142,10 +142,8 @@ static void process_entries(const void *nodep, VISIT value, int level unused)
}
if (dup) {
dup->alias_ignore = true;
/* The original entry->next is in dup->next, so we don't lose
* any of the original elements of the linked list. Also, by
* setting dup->alias_ignore, we trigger the check at the start
* of the loop, skipping the new entry we just inserted.
/* adds to the front of the list, list iteratition
* will skip it
*/
entry->next = dup;

View File

@@ -73,6 +73,7 @@ int features_supports_inet = 0; /* kernel supports inet network rules */
int features_supports_unix = 0; /* kernel supports unix socket rules */
int kernel_supports_policydb = 0; /* kernel supports new policydb */
int features_supports_mount = 0; /* kernel supports mount rules */
bool features_supports_detached_mount = false;
int features_supports_dbus = 0; /* kernel supports dbus rules */
int kernel_supports_diff_encode = 0; /* kernel supports diff_encode */
int features_supports_signal = 0; /* kernel supports signal rules */

View File

@@ -202,7 +202,7 @@ static void start_include_position(const char *filename)
current_lineno = 1;
}
void push_include_stack(const char *filename)
void push_include_stack(char *filename)
{
struct include_stack_t *include = NULL;

View File

@@ -29,7 +29,7 @@ extern void parse_default_paths(void);
extern int do_include_preprocessing(char *profilename);
FILE *search_path(char *filename, char **fullpath, bool *skip);
extern void push_include_stack(const char *filename);
extern void push_include_stack(char *filename);
extern void pop_include_stack(void);
extern void reset_include_stack(const char *filename);

View File

@@ -245,7 +245,7 @@ static inline void sd_write_uint64(std::ostringstream &buf, u64 b)
static inline void sd_write_name(std::ostringstream &buf, const char *name)
{
PDEBUG("Writing name '%s'\n", name ? name : "(null)");
PDEBUG("Writing name '%s'\n", name);
if (name) {
sd_write8(buf, SD_NAME);
sd_write16(buf, strlen(name) + 1);

View File

@@ -956,6 +956,14 @@ void set_supported_features()
features_supports_mount = features_intersect(kernel_features,
policy_features,
"mount");
/*
* note: detached mounts are just a null condition, so previous
* mount rule encoding supports it, if the kernel supports
* it. So support for detached depends on mount intersect and
* kernel detached.
*/
features_supports_detached_mount = aa_features_supports(kernel_features,
"mount/move_mount/detached");
features_supports_dbus = features_intersect(kernel_features,
policy_features, "dbus");
features_supports_signal = features_intersect(kernel_features,
@@ -1620,6 +1628,7 @@ int main(int argc, char *argv[])
progname = argv[0];
init_base_dir();
capabilities_init();
process_early_args(argc, argv);
process_config_file(config_file);

View File

@@ -35,7 +35,6 @@
#include <sys/apparmor_private.h>
#include <algorithm>
#include <unordered_map>
#include "capability.h"
#include "lib.h"
@@ -62,10 +61,6 @@ void *reallocarray(void *ptr, size_t nmemb, size_t size)
}
#endif
#ifndef NULL
#define NULL nullptr
#endif
int is_blacklisted(const char *name, const char *path)
{
int retval = _aa_is_blacklisted(name);
@@ -76,7 +71,12 @@ int is_blacklisted(const char *name, const char *path)
return !retval ? 0 : 1;
}
static const unordered_map<string, int> keyword_table = {
struct keyword_table {
const char *keyword;
unsigned int token;
};
static struct keyword_table keyword_table[] = {
/* network */
{"network", TOK_NETWORK},
{"unix", TOK_UNIX},
@@ -132,9 +132,16 @@ static const unordered_map<string, int> keyword_table = {
{"sqpoll", TOK_SQPOLL},
{"all", TOK_ALL},
{"priority", TOK_PRIORITY},
/* terminate */
{NULL, 0}
};
static const unordered_map<string, int> rlimit_table = {
/* glibc maps bsd ofile to nofile but musl does not. */
#ifndef RLIMIT_OFILE
#define RLIMIT_OFILE RLIMIT_NOFILE
#endif
static struct keyword_table rlimit_table[] = {
{"cpu", RLIMIT_CPU},
{"fsize", RLIMIT_FSIZE},
{"data", RLIMIT_DATA},
@@ -142,9 +149,7 @@ static const unordered_map<string, int> rlimit_table = {
{"core", RLIMIT_CORE},
{"rss", RLIMIT_RSS},
{"nofile", RLIMIT_NOFILE},
#ifdef RLIMIT_OFILE
{"ofile", RLIMIT_OFILE},
#endif
{"as", RLIMIT_AS},
{"nproc", RLIMIT_NPROC},
{"memlock", RLIMIT_MEMLOCK},
@@ -160,33 +165,37 @@ static const unordered_map<string, int> rlimit_table = {
#ifdef RLIMIT_RTTIME
{"rttime", RLIMIT_RTTIME},
#endif
/* terminate */
{NULL, 0}
};
/* for alpha matches, check for keywords */
static int get_table_token(const char *name unused, const unordered_map<string, int> &table,
const string &keyword)
static int get_table_token(const char *name unused, struct keyword_table *table,
const char *keyword)
{
auto token_entry = table.find(keyword);
if (token_entry == table.end()) {
PDEBUG("Unable to find %s %s\n", name, keyword.c_str());
return -1;
} else {
PDEBUG("Found %s %s\n", name, keyword.c_str());
return token_entry->second;
int i;
for (i = 0; table[i].keyword; i++) {
PDEBUG("Checking %s %s\n", name, table[i].keyword);
if (strcmp(keyword, table[i].keyword) == 0) {
PDEBUG("Found %s %s\n", name, table[i].keyword);
return table[i].token;
}
}
PDEBUG("Unable to find %s %s\n", name, keyword);
return -1;
}
/* for alpha matches, check for keywords */
int get_keyword_token(const char *keyword)
{
// Can't use string_view because that requires C++17
return get_table_token("keyword", keyword_table, string(keyword));
return get_table_token("keyword", keyword_table, keyword);
}
int get_rlimit(const char *name)
{
// Can't use string_view because that requires C++17
return get_table_token("rlimit", rlimit_table, string(name));
return get_table_token("rlimit", rlimit_table, name);
}
@@ -202,164 +211,55 @@ struct capability_table {
capability_flags flags;
};
/*
* Enum for the results of adding a capability, with values assigned to match
* the int values returned by the old capable_add_cap function:
*
* -1: error
* 0: no change - capability already in table
* 1: added flag to capability in table
* 2: added new capability
*/
enum add_cap_result {
ERROR = -1, // Was only used for OOM conditions
ALREADY_EXISTS = 0,
FLAG_ADDED = 1,
CAP_ADDED = 2
};
static struct capability_table base_capability_table[] = {
/* capabilities */
#include "cap_names.h"
};
static const size_t BASE_CAP_TABLE_SIZE = sizeof(base_capability_table)/sizeof(struct capability_table);
class capability_lookup {
vector<capability_table> cap_table;
// Use unordered_map to avoid pulling in two map implementations
// We may want to switch to boost::multiindex to avoid duplication
unordered_map<string, capability_table&> name_cap_map;
unordered_map<unsigned int, capability_table&> int_cap_map;
private:
void add_capability_table_entry_raw(capability_table entry) {
cap_table.push_back(entry);
capability_table &entry_ref = cap_table.back();
name_cap_map.emplace(string(entry_ref.name), entry_ref);
int_cap_map.emplace(entry_ref.cap, entry_ref);
}
public:
capability_lookup() :
cap_table(vector<capability_table>()),
name_cap_map(unordered_map<string, capability_table&>(BASE_CAP_TABLE_SIZE)),
int_cap_map(unordered_map<unsigned int, capability_table&>(BASE_CAP_TABLE_SIZE)) {
cap_table.reserve(BASE_CAP_TABLE_SIZE);
for (size_t i=0; i<BASE_CAP_TABLE_SIZE; i++) {
add_capability_table_entry_raw(base_capability_table[i]);
}
}
capability_table* find_cap_entry_by_name(string const & name) const {
auto map_entry = this->name_cap_map.find(name);
if (map_entry == this->name_cap_map.end()) {
return NULL;
} else {
PDEBUG("Found %s %s\n", name.c_str(), map_entry->second.name);
return &map_entry->second;
}
}
capability_table* find_cap_entry_by_num(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return NULL;
} else {
PDEBUG("Found %d %d\n", cap, map_entry->second.cap);
return &map_entry->second;
}
}
int name_to_capability(string const &cap) const {
auto map_entry = this->name_cap_map.find(cap);
if (map_entry == this->name_cap_map.end()) {
PDEBUG("Unable to find %s %s\n", "capability", cap.c_str());
return -1;
} else {
return map_entry->second.cap;
}
}
const char *capability_to_name(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return "invalid-capability";
} else {
return map_entry->second.name;
}
}
int capability_backmap(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return NO_BACKMAP_CAP;
} else {
return map_entry->second.backmap;
}
}
bool capability_in_kernel(unsigned int cap) const {
auto map_entry = this->int_cap_map.find(cap);
if (map_entry == this->int_cap_map.end()) {
return false;
} else {
return map_entry->second.flags & CAPFLAG_KERNEL_FEATURE;
}
}
void __debug_capabilities(uint64_t capset, const char *name) const {
printf("%s:", name);
for (auto it = this->cap_table.cbegin(); it != this->cap_table.cend(); it++) {
if ((1ull << it->cap) & capset)
printf (" %s", it->name);
}
printf("\n");
}
add_cap_result capable_add_cap(string const & str, unsigned int cap,
capability_flags flag) {
struct capability_table *ent = this->find_cap_entry_by_name(str);
if (ent) {
if (ent->cap != cap) {
pwarn(WARN_UNEXPECTED, "feature capability '%s:%d' does not equal expected %d. Ignoring ...\n", str.c_str(), cap, ent->cap);
/* TODO: make warn to error config */
return add_cap_result::ALREADY_EXISTS;
}
if (ent->flags & flag)
return add_cap_result::ALREADY_EXISTS;
ent->flags = (capability_flags) (ent->flags | flag);
return add_cap_result::FLAG_ADDED;
} else {
struct capability_table new_entry;
new_entry.name = strdup(str.c_str());
if (!new_entry.name) {
yyerror(_("Out of memory"));
return add_cap_result::ERROR;
}
new_entry.cap = cap;
new_entry.backmap = 0;
new_entry.flags = flag;
try {
this->add_capability_table_entry_raw(new_entry);
} catch (const std::bad_alloc &_e) {
yyerror(_("Out of memory"));
return add_cap_result::ERROR;
}
// TODO: exception catching for causes other than OOM
return add_cap_result::CAP_ADDED;
}
}
void clear_cap_flag(capability_flags flags)
{
for (auto it = this->cap_table.begin(); it != this->cap_table.end(); it++) {
PDEBUG("Clearing capability flag for capability \"%s\"\n", it->name);
it->flags = (capability_flags) (it->flags & ~flags);
}
}
/* terminate */
{NULL, 0, 0, CAPFLAGS_CLEAR}
};
static capability_lookup cap_table;
static struct capability_table *cap_table;
static int cap_table_size;
void capabilities_init(void)
{
cap_table = (struct capability_table *) malloc(sizeof(base_capability_table));
if (!cap_table)
yyerror(_("Memory allocation error."));
memcpy(cap_table, base_capability_table, sizeof(base_capability_table));
cap_table_size = sizeof(base_capability_table)/sizeof(struct capability_table);
}
struct capability_table *find_cap_entry_by_name(const char *name)
{
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Checking %s %s\n", name, cap_table[i].name);
if (strcmp(name, cap_table[i].name) == 0) {
PDEBUG("Found %s %s\n", name, cap_table[i].name);
return &cap_table[i];
}
}
return NULL;
}
struct capability_table *find_cap_entry_by_num(unsigned int cap)
{
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Checking %d %d\n", cap, cap_table[i].cap);
if (cap == cap_table[i].cap) {
PDEBUG("Found %d %d\n", cap, cap_table[i].cap);
return &cap_table[i];
}
}
return NULL;
}
/* don't mark up str with \0 */
static const char *strn_token(const char *str, size_t &len)
@@ -397,6 +297,59 @@ bool strcomp (const char *lhs, const char *rhs)
return null_strcmp(lhs, rhs) < 0;
}
/*
* Returns: -1: error
* 0: no change - capability already in table
* 1: added flag to capability in table
* 2: added new capability
*/
static int capable_add_cap(const char *str, int len, unsigned int cap,
capability_flags flag)
{
/* extract name from str so we can treat as a string */
autofree char *name = strndup(str, len);
if (!name) {
yyerror(_("Out of memory"));
return -1;
}
struct capability_table *ent = find_cap_entry_by_name(name);
if (ent) {
if (ent->cap != cap) {
pwarn(WARN_UNEXPECTED, "feature capability '%s:%d' does not equal expected %d. Ignoring ...\n", name, cap, ent->cap);
/* TODO: make warn to error config */
return 0;
}
if (ent->flags & flag)
return 0; /* no change */
ent->flags = (capability_flags) (ent->flags | flag);
return 1; /* modified */
} else {
struct capability_table *tmp;
tmp = (struct capability_table *) reallocarray(cap_table, sizeof(struct capability_table), cap_table_size+1);
if (!tmp) {
yyerror(_("Out of memory"));
/* TODO: change away from yyerror */
return -1;
}
cap_table = tmp;
ent = &cap_table[cap_table_size - 1]; /* overwrite null */
ent->name = strndup(name, len);
if (!ent->name) {
/* TODO: change away from yyerror */
yyerror(_("Out of memory"));
return -1;
}
ent->cap = cap;
ent->flags = flag;
cap_table[cap_table_size].name = NULL; /* new null */
cap_table_size++;
}
return 2; /* added */
}
bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
{
autofree char *value = NULL;
@@ -413,8 +366,7 @@ bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
for (capstr = strn_token(value, len);
capstr;
capstr = strn_token(capstr + len, len)) {
string capstr_as_str = string(capstr, len);
if (cap_table.capable_add_cap(capstr_as_str, n, flags) < 0)
if (capable_add_cap(capstr, len, n, flags) < 0)
return false;
n++;
if (len > valuelen) {
@@ -430,32 +382,70 @@ bool add_cap_feature_mask(struct aa_features *features, capability_flags flags)
void clear_cap_flag(capability_flags flags)
{
cap_table.clear_cap_flag(flags);
int i;
for (i = 0; cap_table[i].name; i++) {
PDEBUG("Clearing capability flag for capability \"%s\"\n", cap_table[i].name);
cap_table[i].flags = (capability_flags) (cap_table[i].flags & ~flags);
}
}
int name_to_capability(const char *cap)
{
return cap_table.name_to_capability(string(cap));
struct capability_table *ent;
ent = find_cap_entry_by_name(cap);
if (ent)
return ent->cap;
PDEBUG("Unable to find %s %s\n", "capability", cap);
return -1;
}
const char *capability_to_name(unsigned int cap)
{
return cap_table.capability_to_name(cap);
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->name;
return "invalid-capability";
}
int capability_backmap(unsigned int cap)
{
return cap_table.capability_backmap(cap);
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->backmap;
return NO_BACKMAP_CAP;
}
bool capability_in_kernel(unsigned int cap)
{
return cap_table.capability_in_kernel(cap);
struct capability_table *ent;
ent = find_cap_entry_by_num(cap);
if (ent)
return ent->flags & CAPFLAG_KERNEL_FEATURE;
return false;
}
void __debug_capabilities(uint64_t capset, const char *name)
{
cap_table.__debug_capabilities(capset, name);
unsigned int i;
printf("%s:", name);
for (i = 0; cap_table[i].name; i++) {
if ((1ull << cap_table[i].cap) & capset)
printf (" %s", cap_table[i].name);
}
printf("\n");
}
char *processunquoted(const char *string, int len)
@@ -1213,6 +1203,37 @@ void free_value_list(struct value_list *list)
}
}
struct value_list *dup_value_list(struct value_list *list)
{
struct value_list *entry, *dup, *head = NULL;
char *value;
list_for_each(list, entry) {
value = NULL;
if (list->value) {
value = strdup(list->value);
if (!value)
goto fail2;
}
dup = new_value_list(value);
if (!dup)
goto fail;
if (head)
list_append(head, dup);
else
head = dup;
}
return head;
fail:
free(value);
fail2:
free_value_list(head);
return NULL;
}
void print_value_list(struct value_list *list)
{
struct value_list *entry;

View File

@@ -178,6 +178,8 @@ Profile *merge_policy(Profile *a, Profile *b)
}
}
a->rule_ents.splice(a->rule_ents.end(), b->rule_ents);
merge_hats(a, b->hat_table);
delete b;
out:

View File

@@ -50,7 +50,7 @@ enum error_type {
void filter_slashes(char *path)
{
char *sptr, *dptr;
bool seen_slash = false;
BOOL seen_slash = 0;
if (!path || (strlen(path) < 2))
return;
@@ -69,7 +69,7 @@ void filter_slashes(char *path)
++sptr;
} else {
*dptr++ = *sptr++;
seen_slash = true;
seen_slash = TRUE;
}
} else {
seen_slash = 0;
@@ -111,14 +111,14 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
#define MAX_ALT_DEPTH 50
*first_re_pos = 0;
int ret = 1;
int ret = TRUE;
/* flag to indicate input error */
enum error_type error;
const char *sptr;
pattern_t ptype;
bool bEscape = false; /* flag to indicate escape */
BOOL bEscape = 0; /* flag to indicate escape */
int ingrouping = 0; /* flag to indicate {} context */
int incharclass = 0; /* flag to indicate [ ] context */
int grouping_count[MAX_ALT_DEPTH] = {0};
@@ -150,7 +150,7 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
if (bEscape) {
pcre.append("\\\\");
} else {
bEscape = true;
bEscape = TRUE;
++sptr;
continue; /*skip turning bEscape off */
} /* bEscape */
@@ -393,7 +393,7 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
break;
} /* switch (*sptr) */
bEscape = false;
bEscape = FALSE;
++sptr;
} /* while error == e_no_error && *sptr) */
@@ -419,12 +419,12 @@ pattern_t convert_aaregex_to_pcre(const char *aare, int anchor, int glob,
PERROR(_("%s: Unable to parse input line '%s'\n"),
progname, aare);
ret = 0;
ret = FALSE;
goto out;
}
out:
if (ret == 0)
if (ret == FALSE)
ptype = ePatternInvalid;
if (parseopts.dump & DUMP_DFA_RULE_EXPR)
@@ -464,7 +464,7 @@ static void warn_once_xattr(const char *name)
common_warn_once(name, "xattr attachment conditional ignored", &warned_name);
}
static bool process_profile_name_xmatch(Profile *prof)
static int process_profile_name_xmatch(Profile *prof)
{
std::string tbuf;
pattern_t ptype;
@@ -479,7 +479,7 @@ static bool process_profile_name_xmatch(Profile *prof)
/* don't filter_slashes for profile names, do on attachment */
name = strdup(local_name(prof->name));
if (!name)
return false;
return FALSE;
}
filter_slashes(name);
ptype = convert_aaregex_to_pcre(name, 0, glob_default, tbuf,
@@ -491,7 +491,7 @@ static bool process_profile_name_xmatch(Profile *prof)
PERROR(_("%s: Invalid profile name '%s' - bad regular expression\n"), progname, name);
if (!prof->attachment)
free(name);
return false;
return FALSE;
}
if (!prof->attachment)
@@ -506,11 +506,11 @@ static bool process_profile_name_xmatch(Profile *prof)
/* build a dfa */
aare_rules *rules = new aare_rules();
if (!rules)
return false;
return FALSE;
if (!rules->add_rule(tbuf.c_str(), 0, RULE_ALLOW,
AA_MAY_EXEC, 0, parseopts)) {
delete rules;
return false;
return FALSE;
}
if (prof->altnames) {
struct alt_name *alt;
@@ -525,7 +525,7 @@ static bool process_profile_name_xmatch(Profile *prof)
RULE_ALLOW, AA_MAY_EXEC,
0, parseopts)) {
delete rules;
return false;
return FALSE;
}
}
}
@@ -567,7 +567,7 @@ static bool process_profile_name_xmatch(Profile *prof)
&len);
if (!rules->append_rule(tbuf.c_str(), true, true, parseopts)) {
delete rules;
return false;
return FALSE;
}
}
}
@@ -581,10 +581,10 @@ build:
prof->xmatch = rules->create_dfablob(&prof->xmatch_size, &prof->xmatch_len, prof->xmatch_perms_table, parseopts, false, false, false);
delete rules;
if (!prof->xmatch)
return false;
return FALSE;
}
return true;
return TRUE;
}
static int warn_change_profile = 1;
@@ -606,21 +606,21 @@ static bool is_change_profile_perms(perm32_t perms)
return perms & AA_CHANGE_PROFILE;
}
static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
static int process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
{
std::string tbuf;
pattern_t ptype;
int pos;
if (!entry) /* shouldn't happen */
return false;
return TRUE;
if (!is_change_profile_perms(entry->perms))
filter_slashes(entry->name);
ptype = convert_aaregex_to_pcre(entry->name, 0, glob_default, tbuf, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
entry->pattern_type = ptype;
@@ -649,13 +649,13 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
entry->perms & ~(AA_LINK_BITS | AA_CHANGE_PROFILE),
entry->audit == AUDIT_FORCE ? entry->perms & ~(AA_LINK_BITS | AA_CHANGE_PROFILE) : 0,
parseopts))
return false;
return FALSE;
} else if (!is_change_profile_perms(entry->perms)) {
if (!dfarules->add_rule(tbuf.c_str(), entry->priority,
entry->rule_mode, entry->perms,
entry->audit == AUDIT_FORCE ? entry->perms : 0,
parseopts))
return false;
return FALSE;
}
if (entry->perms & (AA_LINK_BITS)) {
@@ -669,7 +669,7 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
filter_slashes(entry->link_name);
ptype = convert_aaregex_to_pcre(entry->link_name, 0, glob_default, lbuf, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
if (entry->subset)
perms |= LINK_TO_LINK_SUBSET(perms);
vec[1] = lbuf.c_str();
@@ -681,7 +681,7 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
entry->rule_mode, perms,
entry->audit == AUDIT_FORCE ? perms & AA_LINK_BITS : 0,
2, vec, parseopts, false))
return false;
return FALSE;
}
if (is_change_profile_perms(entry->perms)) {
const char *vec[3];
@@ -702,7 +702,7 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (entry->onexec) {
ptype = convert_aaregex_to_pcre(entry->onexec, 0, glob_default, xbuf, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
vec[0] = xbuf.c_str();
} else
/* allow change_profile for all execs */
@@ -713,14 +713,14 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!parse_label(&stack, &ns, &name,
tbuf.c_str(), false)) {
return false;
return FALSE;
}
if (stack) {
fprintf(stderr,
_("The current kernel does not support stacking of named transitions: %s\n"),
tbuf.c_str());
return false;
return FALSE;
}
if (ns)
@@ -734,13 +734,13 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
AA_CHANGE_PROFILE | onexec_perms,
0, index - 1, &vec[1], parseopts, false))
return false;
return FALSE;
/* onexec rules - both rules are needed for onexec */
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
onexec_perms,
0, 1, vec, parseopts, false))
return false;
return FALSE;
/**
* pick up any exec bits, from the frontend parser, related to
@@ -750,19 +750,19 @@ static bool process_dfa_entry(aare_rules *dfarules, struct cod_entry *entry)
if (!dfarules->add_rule_vec(entry->priority, entry->rule_mode,
onexec_perms, 0, index, vec,
parseopts, false))
return false;
return FALSE;
}
return true;
return TRUE;
}
bool post_process_entries(Profile *prof)
int post_process_entries(Profile *prof)
{
int ret = true;
int ret = TRUE;
struct cod_entry *entry;
list_for_each(prof->entries, entry) {
if (!process_dfa_entry(prof->dfa.rules, entry))
ret = false;
ret = FALSE;
}
return ret;
@@ -815,7 +815,7 @@ out:
return error;
}
bool build_list_val_expr(std::string& buffer, struct value_list *list)
int build_list_val_expr(std::string& buffer, struct value_list *list)
{
struct value_list *ent;
pattern_t ptype;
@@ -823,7 +823,7 @@ bool build_list_val_expr(std::string& buffer, struct value_list *list)
if (!list) {
buffer.append(default_match_pattern);
return true;
return TRUE;
}
buffer.append("(");
@@ -840,12 +840,12 @@ bool build_list_val_expr(std::string& buffer, struct value_list *list)
}
buffer.append(")");
return true;
return TRUE;
fail:
return false;
return FALSE;
}
bool convert_entry(std::string& buffer, char *entry)
int convert_entry(std::string& buffer, char *entry)
{
pattern_t ptype;
int pos;
@@ -853,12 +853,12 @@ bool convert_entry(std::string& buffer, char *entry)
if (entry) {
ptype = convert_aaregex_to_pcre(entry, 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
} else {
buffer.append(default_match_pattern);
}
return true;
return TRUE;
}
int clear_and_convert_entry(std::string& buffer, char *entry)
@@ -959,7 +959,7 @@ static std::string generate_regex_range(bignum start, bignum end)
return result.str();
}
bool convert_range(std::string& buffer, bignum start, bignum end)
int convert_range(std::string& buffer, bignum start, bignum end)
{
pattern_t ptype;
int pos;
@@ -969,24 +969,24 @@ bool convert_range(std::string& buffer, bignum start, bignum end)
if (!regex_range.empty()) {
ptype = convert_aaregex_to_pcre(regex_range.c_str(), 0, glob_default, buffer, &pos);
if (ptype == ePatternInvalid)
return false;
return FALSE;
} else {
buffer.append(default_match_pattern);
}
return true;
return TRUE;
}
bool post_process_policydb_ents(Profile *prof)
int post_process_policydb_ents(Profile *prof)
{
for (RuleList::iterator i = prof->rule_ents.begin(); i != prof->rule_ents.end(); i++) {
if ((*i)->skip())
continue;
if ((*i)->gen_policy_re(*prof) == RULE_ERROR)
return false;
return FALSE;
}
return true;
return TRUE;
}
@@ -1449,6 +1449,9 @@ int main(void)
int rc = 0;
int retval;
// Default is parser_common.c, but it should be this source file instead
progname = __FILE__;
retval = test_filter_slashes();
if (retval != 0)
rc = retval;

View File

@@ -79,7 +79,7 @@ struct var_string *split_out_var(const char *string)
{
struct var_string *n = NULL;
const char *sptr;
bool bEscape = false; /* flag to indicate escape */
BOOL bEscape = 0; /* flag to indicate escape */
if (!string) /* shouldn't happen */
return NULL;
@@ -89,11 +89,15 @@ struct var_string *split_out_var(const char *string)
while (!n && *sptr) {
switch (*sptr) {
case '\\':
bEscape = !bEscape;
if (bEscape) {
bEscape = FALSE;
} else {
bEscape = TRUE;
}
break;
case '@':
if (bEscape) {
bEscape = false;
bEscape = FALSE;
} else if (*(sptr + 1) == '{') {
const char *eptr = get_var_end(sptr + 2);
if (!eptr)
@@ -107,7 +111,8 @@ struct var_string *split_out_var(const char *string)
}
break;
default:
bEscape = false;
if (bEscape)
bEscape = FALSE;
}
sptr++;
}

View File

@@ -704,7 +704,7 @@ rules: rules opt_prefix block
if (($2).priority != 0) {
yyerror(_("priority is not allowed on rule blocks"));
}
PDEBUG("matched: %s%s%s%sblock\n",
PDEBUG("matched: %s%s%sblock\n",
$2.audit == AUDIT_FORCE ? "audit " : "",
$2.rule_mode == RULE_DENY ? "deny " : "",
$2.rule_mode == RULE_PROMPT ? "prompt " : "",

View File

@@ -8,33 +8,33 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 01:27+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"PO-Revision-Date: 2020-03-12 02:48+0000\n"
"Last-Translator: bernard stafford <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2020-03-13 05:43+0000\n"
"X-Generator: Launchpad (build 3a6db24bbe7280ec09bae73384238390fcc98ad3)\n"
"Language: af\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr ""
msgstr "Fout: Buite geheue.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
msgstr "Fout: basedir %s is nie 'n gids, huppel tans.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
msgstr "Fout: Kon gids nie by te voeg %s om soek pad.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr ""
msgstr "Fout: Kon nie geheue toeken.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
@@ -50,7 +50,7 @@ msgstr "Geheue is opgebruik\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "Kon nie profiel kopieer: Slegte geheue-adres\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -62,7 +62,7 @@ msgstr "Profiel stem nie ooreen met handtekening nie\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
msgstr "Profiel weergawe nie gesteunde deur Apparmora module\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -74,12 +74,12 @@ msgstr "Profiel bestaan nie\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "Toestemming ontkened; poging tot laai 'n profiel terwyl confined?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Onbekende fout (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -109,7 +109,7 @@ msgstr "%s: Kan nie na stdout toe skryf nie\n"
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: Nie in staat is om te skryf aan uitset lêer\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -145,11 +145,11 @@ msgstr "PANIEK slegs inkrementbuffer %p pos %p uitbr %p grootte %d res %p\n"
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "profiel %s netwerk reëls nie afgedwing\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "Onbekend patroon tipe\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -162,13 +162,13 @@ msgstr "Kan %s - %s nie open nie\n"
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
msgstr "Geheue Allokasie Fout: Nie in staat om verwyder ^%s\n"
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
msgstr "Geheue Allokasie Fout: Nie in staat om verwyder %s:%s."
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -190,32 +190,32 @@ msgstr "%s: Kan nie volledige profielinskrywing skryf nie\n"
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
msgstr "%s: Nie in staat skryf die entire profiel inskrywing om kas\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "Kon nie oopmaak '%s'"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "fstat misluk vir '%s'"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "oopdir misluk '%s'"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "stat misluk vir '%s'"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "Kon nie oopmaak '%s' in '%s'"
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -225,17 +225,17 @@ msgstr "Onverwagte karakter gevind: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "Veranderlike aangiftes aanvaar nie trailing kommas"
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr ""
msgstr "(netwerk_modus) Gevind onverwagte karakter: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "Waarskuwing vanaf %s (%s%sline %d): %s"
#: ../parser_main.c:531
#, c-format
@@ -248,6 +248,8 @@ msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"Waarskuwing: nie in staat om vind 'n geskikte fs in %s, is dit gemonteer?\n"
"Gebruik --subdomainfs om override.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
@@ -255,6 +257,8 @@ msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: Jammer. Wat jy nodig het root voorregte om hierdie program uit te voer.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
@@ -263,12 +267,16 @@ msgid ""
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: Waarskuwing! Jy het stel hierdie program setuid root.\n"
"Enigiemand wat hierdie programe kan jou AppArmor profiele by te werk kan "
"hardloop.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
msgstr "Fout: Kan nie profiel lees %s: %s.\n"
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -294,12 +302,12 @@ msgstr "Geheuetoekenningsfout."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "Kas laai suksesvol vir \"%s\".\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "Kas relaai suksesvol vir \"%s\".\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -311,11 +319,14 @@ msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
"Hoofletters kwalifiseerders \"RWLIMX\" is deprecated, asseblief omskakel na "
"kleinletters\n"
"Sien die apparmor.d(5) manpage vir besonderhede.\n"
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
msgstr "Konflik 'a' en 'w' perms is onderling uitsluitend."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
@@ -329,12 +340,17 @@ msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
"Onbegrensde exec kwalifiseerder (%c%c) toelaat sommige gevaarlike omgewing "
"veranderlikes om wees geslaag om die onbegrensde proses; 'man 5 apparmor.d' "
"vir besonderhede.\n"
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kwalifiseerder '%c' ongeldig, konflikterende kwalifiseerder reeds "
"gespesifiseer"
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
@@ -342,22 +358,24 @@ msgstr ""
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kwalifiseerder '%c%c' ongeldig, konflikterende kwalifiseerder reeds "
"gespesifiseer"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
msgstr "Interne: onverwagte modus karakter '%c' in insette"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
msgstr "Interne fout gegenereer ongeldige perm 0x%llx\n"
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr ""
msgstr "AppArmor parser fout: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
@@ -366,47 +384,50 @@ msgstr "Kon inskrywings nie saamvleg nie. Geheue is opgebruik\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "profiel %s: het saamgevoegde reël %s met konflikterende x wysigers\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "Profiel beslaglegging moet begin met 'n '/'."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Profiel name moet begin met 'n '/', naamruimte of sleutelwoord 'profile' of "
"'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
msgstr "Kon nie alias skep %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
msgstr "Profiel vlag chroot_relatiewe konflik met naamruimte_relatiewe"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
msgstr "Profiel vlag bemiddel_geskrap konflikte met delegeer_geskrap"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Profiel vlag hechten_ontkoppelde konflikte met geen_hechten_ontkoppel"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
msgstr "Profiel vlag chroot_hechten konflik met chroot_geen_hechten"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
msgstr "Profiel vlag 'debug' is nie meer geldig."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
msgstr "Ongeldige profiel vlag: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
@@ -418,23 +439,29 @@ msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"Ongeldige modus, in ontken reëls 'x' moet nie voorafgegaan word deur exec "
"kwalifiseerder 'i', 'p', of 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Ongeldige modus, 'x' moet voorafgegaan word deur exec kwalifiseerder 'i', "
"'p', 'c', of 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Ongeldige modus, 'x' moet voorafgegaan word deur exec kwalifiseerder 'i', "
"'p', of 'u'"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
msgstr "Assert: `network_rule' ongeldige protokol terugstuur."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
msgstr "Assert: `change_profile' teruggekeer NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
@@ -442,28 +469,28 @@ msgstr "Beweer: `hat-reël' het NUL teruggestuur."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
msgstr "Assert: 'local_profile rule' teruggekeer NULL."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
msgstr "Unset boolean veranderlike %s gebruik in if-uitdrukking"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
msgstr "onveilige reël ontbreek exec toestemmings"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
msgstr "subset kan slegs gebruik word met skakel reëls."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
msgstr "skakel en exec perms konflik op 'n lêer reël met behulp van ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
msgstr "skakel perms word nie toegelaat op 'n vernoem profiel oorgang.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
@@ -473,22 +500,22 @@ msgstr "ontbreek daar n reëleindkarakter? (inskrywing: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
msgstr "Ongeldig netwerk inskrywing."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr ""
msgstr "Ongeldige capvermoë %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "AppArmor parser fout vir %s%s%s by lyn %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "AppArmor parser fout,%s%s lyn %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -514,6 +541,8 @@ msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
"%s: Regex groepering fout: Unclosed groepering of karakter klas, verwag tans "
"sluit }\n"
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
@@ -528,12 +557,12 @@ msgstr "%s: Kan insetreël '%s' nie ontleed nie\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: Ongeldig profiel naam '%s' - slegte gereelde uitdrukking\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
msgstr "FOUT samesmelting reëls vir profiele %s, kon nie laai nie\n"
#: ../parser_policy.c:234
#, c-format
@@ -542,21 +571,24 @@ msgid ""
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
"FOUT profiel %s bevat beleid elemente nie bruikbaar met hierdie kern:\n"
"\t'*', '?', karakter reekse, en alternations is nie toegelaat.\n"
"\t'**' mag enigste wees gebruik an die einde van 'n rule.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
msgstr "FOUT verwerking regexs vir profiel %s, misluk om laai\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
msgstr "FOUT uitbrei tans veranderlikes vir praofiel %s, misluk om laai\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
msgstr "FOUT bygevoeg hoed toegang reël vir profiel %s\n"
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
@@ -566,17 +598,17 @@ msgstr "FOUT in profiel %s, het misluk om te laai\n"
#: ../parser_policy.c:675
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr ""
msgstr "%s: Foute gevind tydens naverwerking. Aborteer tans.\n"
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr ""
msgstr "%s: Foute gevind tydens regex naverwerking. Aborteer tans.\n"
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr ""
msgstr "%s: Foute gevind tydens na-proses. Aborteer tans.\n"
#: ../parser_policy.c:696
#, c-format
@@ -587,161 +619,162 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "Kon nie proses -insluit gids '%s' in '%s'"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Funksie buffer volle."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
msgstr "Uit van geheue"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "Kan nie kasgids skep nie: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Lêer in kas directory plek: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "Kan nie kasgids opdateer: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "interne: onverwagte DBUS modus karakter '%c' in insette"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "Interne fout gegenereer ongeldig DBus perm 0x%x\n"
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
msgstr "ontken voorvoegsel nie toegelaat"
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op reëls berg"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toelaat op dbus reëls"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toelaat op capvermoë reëls"
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "ongeldig berg voorwaardelike %s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
msgstr "slegte berg reël"
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "hegpunt voorwaardes tans nie ondersteun nie"
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "ongeldig pivotroot voorwaardelike '%s'"
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Regex groepering fout: Ongeldig naby ], geen bypassende oop [ bespeur\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
msgstr "%s: Regex groepering fout: Oorskry maksimum nes van {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
msgstr "FOUT verwerking beleiddb reëls vir profiel %s, kon nie laai nie\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "FOUT vervanging van aliasse vir profiel %s, misluk om laai\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: Nie in staat om skryf %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
msgstr "Fout: Kon nie lees binêre profiel of kaslêer %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Fout: Kon nie lees kaslêer '%s', huppel tans...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Interne: onverwagte %s modus karakter '%c' in inset"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Interne fout gegenereer ongeldig %s perm 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op reëls berg"
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op dbus reëls"
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op sein reëls"
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op ptrace reëls"
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op unix reëls"
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "eienaar voorvoegsel nie toegelaat op capvermoë reëls"
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "dbus reël: ongeldig voorwaardelike groep %s=()"
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "unix reël: ongeldig voorwaardelike groep %s=()"
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: Regex fout: trailing '\\' ontsnapping karakter\n"

View File

@@ -1,14 +1,14 @@
# Translations for apparmor_parser
# Copyright (C) 2024 YEAR Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2011.
# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR Canonical Ltd
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2024-08-31 15:55-0700\n"
"POT-Creation-Date: 2025-02-18 07:32-0800\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
@@ -326,7 +326,7 @@ msgstr ""
#: parser_yacc.y:744 parser_yacc.y:1073 parser_yacc.y:1160 parser_yacc.y:1169
#: parser_yacc.y:1173 parser_yacc.y:1183 parser_yacc.y:1193 parser_yacc.y:1287
#: parser_yacc.y:1365 parser_yacc.y:1561 parser_yacc.y:1569 parser_yacc.y:1619
#: parser_yacc.y:1624 parser_yacc.y:1701 parser_yacc.y:1750 ../network.cc:899
#: parser_yacc.y:1624 parser_yacc.y:1701 parser_yacc.y:1750 ../network.cc:945
#: ../af_unix.cc:197 ../all_rule.cc:102 ../all_rule.cc:131
msgid "Memory allocation error."
msgstr ""
@@ -411,12 +411,12 @@ msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71 ../parser_merge.c:74
#: ../parser_merge.c:71 ../parser_merge.c:77
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93 ../parser_merge.c:97
#: ../parser_merge.c:93 ../parser_merge.c:100
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -542,7 +542,7 @@ msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
#: ../network.cc:484
#: ../network.cc:515
msgid "Invalid network entry."
msgstr ""
@@ -830,16 +830,16 @@ msgstr ""
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
#: ../parser_common.c:112 ../parser_common.c:134
#: ../parser_common.c:112 ../parser_common.c:139
#, c-format
msgid "%s from %s (%s%sline %d): %s"
msgstr ""
#: ../parser_common.c:113 ../parser_common.c:135
#: ../parser_common.c:113 ../parser_common.c:140
msgid "Warning converted to Error"
msgstr ""
#: ../parser_common.c:113 ../parser_common.c:135
#: ../parser_common.c:113 ../parser_common.c:140
msgid "Warning"
msgstr ""
@@ -1051,13 +1051,13 @@ msgstr ""
msgid "Internal: unexpected %s perms character '%c' in input"
msgstr ""
#: ../parser_misc.c:1098
#: ../parser_misc.c:1100
msgid ""
"Invalid perms, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: ../parser_misc.c:1102
#: ../parser_misc.c:1104
msgid "Invalid perms, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
@@ -1091,16 +1091,16 @@ msgstr ""
msgid "attach_disconnected_path value must begin with a /"
msgstr ""
#: ../mount.cc:897
#: ../mount.cc:903
msgid ""
"The use of source as mount point for propagation type flags is deprecated.\n"
msgstr ""
#: ../network.h:200
#: ../network.h:202
msgid "priority prefix not allowed on network rules"
msgstr ""
#: ../network.h:204
#: ../network.h:206
msgid "owner prefix not allowed on network rules"
msgstr ""

741
parser/po/be.po Normal file
View File

@@ -0,0 +1,741 @@
# Belarusian translation for apparmor
# Copyright (c) 2020 Rosetta Contributors and Canonical Ltd 2020
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2020.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2020-05-03 16:54+0000\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: Belarusian <be@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2020-05-04 04:32+0000\n"
"X-Generator: Launchpad (build fbdff7602bd10fb883bf7e2ddcc7fd5a16f60398)\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr ""
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr ""
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr ""
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr ""
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr ""
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
msgstr ""
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
msgid "Profile does not match signature\n"
msgstr ""
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
msgstr ""
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
msgid "Profile doesn't exist\n"
msgstr ""
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr ""
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr ""
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr ""
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr ""
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr ""
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr ""
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr ""
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
msgstr ""
#: ../parser_interface.c:818 ../parser_interface.c:810
#, c-format
msgid "unable to serialize profile %s\n"
msgstr ""
#: ../parser_interface.c:829 ../parser_interface.c:916
#: ../parser_interface.c:821 ../parser_interface.c:908
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr ""
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr ""
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr ""
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
#: ../parser_main.c:531
#, c-format
msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
#: parser_yacc.y:624 parser_yacc.y:939 parser_yacc.y:948 parser_yacc.y:960
#: parser_yacc.y:1008 parser_yacc.y:1019 parser_yacc.y:1101 parser_yacc.y:1119
#: parser_yacc.y:1126 ../parser_main.c:850 ../parser_main.c:1015
#: ../parser_main.c:1229 ../parser_main.c:1283 ../parser_misc.c:431
#: parser_yacc.y:268 parser_yacc.y:416 parser_yacc.y:426 parser_yacc.y:537
#: parser_yacc.y:626 parser_yacc.y:976 parser_yacc.y:1021 parser_yacc.y:1030
#: parser_yacc.y:1042 parser_yacc.y:1078 parser_yacc.y:1082 parser_yacc.y:1092
#: parser_yacc.y:1102 parser_yacc.y:1201 parser_yacc.y:1223 parser_yacc.y:1234
#: parser_yacc.y:1309 parser_yacc.y:1327 parser_yacc.y:1334 parser_yacc.y:1385
#: ../parser_main.c:735 ../parser_main.c:923 ../parser_main.c:1133
#: ../parser_main.c:1187 parser_yacc.y:311 parser_yacc.y:462 parser_yacc.y:472
#: parser_yacc.y:583 parser_yacc.y:662 parser_yacc.y:669 parser_yacc.y:1130
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
msgid "Memory allocation error."
msgstr ""
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr ""
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
#: ../parser_regex.c:244
#, c-format
msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:234
#, c-format
msgid ""
"ERROR profile %s contains policy elements not usable with this kernel:\n"
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
msgid "ERROR in profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:675
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr ""
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr ""
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr ""
#: ../parser_policy.c:696
#, c-format
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -8,33 +8,33 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 01:59+0000\n"
"Last-Translator: Christian Boltz <Unknown>\n"
"PO-Revision-Date: 2024-09-14 11:03+0000\n"
"Last-Translator: Walter Garcia-Fontes <walter.garcia@upf.edu>\n"
"Language-Team: Catalan\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2024-09-15 07:16+0000\n"
"X-Generator: Launchpad (build 1b1ed1ad2dbfc71ee62b5c5491c975135a771bf0)\n"
"Language: ca\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr ""
msgstr "Error: Sense memòria.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
msgstr "Error: basedir %s no és un directori, s'omet.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
msgstr "Error: no s'ha pogut afegir el directori %s al camí de cerca.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr ""
msgstr "Error: no s'ha pogut assignar memòria.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
@@ -50,7 +50,7 @@ msgstr "Sense memòria\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "No s'ha pogut copiar el perfil: adreça de memòria incorrecta\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -62,7 +62,7 @@ msgstr "El perfil no coincideix amb la signatura\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
msgstr "La versió del perfil no és compatible amb el mòdul Apparmor\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -75,11 +75,13 @@ msgstr "El perfil no existeix\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
"S'ha denegat el permís; s'ha intentat carregar un perfil mentre està "
"confinat?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Error desconegut (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -109,7 +111,7 @@ msgstr "%s: no es pot escriure a l'stdout\n"
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: no s'ha pogut escriure al fitxer de sortida\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -147,11 +149,11 @@ msgstr ""
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "el perfil %s de les regles de xarxa no està obligat\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "Tipus de patró desconegut\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -164,13 +166,13 @@ msgstr "No es pot obrir %s - %s\n"
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
msgstr "Error d'assignació de memòria: no es pot eliminar ^%s\n"
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
msgstr "Error d'assignació de memòria: no es pot eliminar %s:%s."
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -193,31 +195,32 @@ msgstr "%s: no es pot escriure tota l'entrada del perfil\n"
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
"%s: No s'ha pogut escriure l'entrada de perfil sencera a la memòria cau\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "No s'ha pogut obrir «%s»"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "ha fallat fstat per a «%s»"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "opendir ha fallat «%s»"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "stat ha fallat per a «%s»"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "No s'ha pogut obrir «%s» a «%s»"
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -227,17 +230,17 @@ msgstr "S'ha trobat un caràcter inesperat: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "Les declaracions de variables no accepten comes finals"
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr ""
msgstr "(networkmode) S'ha trobat un caràcter inesperat: «%s»"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "Avís de %s (%s%slínia %d): %s"
#: ../parser_main.c:531
#, c-format
@@ -252,6 +255,8 @@ msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"Avís: no s'ha pogut trobar un fs adequat a %s, està muntat?\n"
"Utilitzeu --subdomainfs per a substituir.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#, c-format
@@ -259,6 +264,8 @@ msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: Ho sento. Necessiteu privilegis de root per a executar aquest programa.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#, c-format
@@ -267,12 +274,16 @@ msgid ""
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: Avís! Heu establert el setuid d'aquest programa a root.\n"
"Qualsevol persona que pugui executar aquest programa pot actualitzar els "
"perfils de l'AppArmor.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
msgstr "Error: no s'ha pogut llegir el perfil %s: %s.\n"
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -298,12 +309,12 @@ msgstr "S'ha produït un error d'assignació de memòria."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "La càrrega a la memòria cau ha estat correcta per a «%s».\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "S'ha recarregat a la memòria cau amb èxit per a «%s».\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -315,11 +326,14 @@ msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
msgstr ""
"Els classificadors «RWLIMX» en majúscules estan obsolets, si us plau "
"convertiu-los a minúscules\n"
"Vegeu la pàgina del manual apparmor.d(5) per a més detalls.\n"
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
msgstr "Els perms del conflicte «a» i «w» són mútuament excloents."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
@@ -333,12 +347,17 @@ msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
"to be passed to the unconfined process; 'man 5 apparmor.d' for details.\n"
msgstr ""
"El qualificador d'exec no confiat (%c%c) permet passar algunes variables "
"d'entorn perilloses al procés no confiat; «man 5 apparmor.d» per als "
"detalls.\n"
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
"El qualificador d'execució «%c» no és vàlid, ja s'ha especificat un "
"qualificador conflictiu"
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
@@ -346,22 +365,24 @@ msgstr ""
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
"El qualificador d'execució «%c%c» no és vàlid, ja s'ha especificat un "
"qualificador conflictiu"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
msgstr "Intern: el caràcter de mode «%c» no és esperat a l'entrada"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
msgstr "Error intern generat un perm 0x%llx no vàlid\n"
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr ""
msgstr "Error de l'analitzador AppArmor: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
msgid "Couldn't merge entries. Out of Memory\n"
@@ -370,47 +391,56 @@ msgstr "No s'han pogut fusionar les entrades. Sense memòria\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "perfil %s: té la regla fusionada %s amb modificadors X conflictius\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "L'adjunt del perfil ha de començar amb una «/»."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Els noms de perfil han de començar amb un '/', espai de noms o paraula clau "
"'profile' o 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
msgstr "No s'ha pogut crear l'àlies %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"L'indicador de perfil chrootrelative entra en conflicte amb "
"namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"L'indicador del perfil mediate_deleted entre en conflicte amb "
"delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"L'indicador de perfil attach_disconnected entra en conflicte amb "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"El perfil de l'etiqueta chroot_attach entra en conflicte amb chroot_noattach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
msgstr "L'indicador de perfil «debug» ja no és vàlid."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
msgstr "Indicador de perfil no vàlid: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
@@ -422,23 +452,29 @@ msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"El mode no és vàlid, a les regles de denegació «x» no s'ha de precedir per "
"«i», «p» o «u»"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"El mode no és vàlid, «x» ha d'anar precedit del qualificador «i», «p», «c» o "
"«u»"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"El mode no és vàlid, «x» ha d'anar precedit del qualificador exec «i», «p» o "
"«u»"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
msgstr "Assert: «network_rule» retorna un protocol no vàlid."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr ""
msgstr "Confirmació: «change_profile» ha retornat NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
@@ -446,28 +482,32 @@ msgstr "Confirmació: 'hat rule' ha retornat NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
msgstr "Confirmació: «local_profile rule» ha retornat NULL."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
"No s'ha establert la variable booleana %s utilitzada a l'expressió if"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
msgid "unsafe rule missing exec permissions"
msgstr ""
msgstr "manca permisos d'execució per a la regla insegura"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
msgid "subset can only be used with link rules."
msgstr ""
msgstr "el subconjunt només es pot utilitzar amb regles d'enllaç."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
"l'enllaç i els permisos exec entren en conflicte amb una regla de fitxer "
"utilitzant ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
"no es permeten permisos d'enllaç en una transició de perfil amb nom.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#, c-format
@@ -477,22 +517,22 @@ msgstr "falta un caràcter de final de línia? (entrada: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
msgid "Invalid network entry."
msgstr ""
msgstr "Entrada de xarxa no vàlida."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#, c-format
msgid "Invalid capability %s."
msgstr ""
msgstr "Capacitat no vàlida %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "Error de l'analitzador AppArmor per a %s%s%s a la línia %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "Error de l'analitzador AppArmor, %s%s línia %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -521,6 +561,8 @@ msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
"close }\n"
msgstr ""
"%s: error d'agrupament d'expressions regulars: agrupació sense tancar o "
"classe de caràcters, esperant tancar }\n"
#: ../parser_regex.c:351 ../parser_regex.c:357
#, c-format
@@ -538,11 +580,14 @@ msgstr "%s: no es pot analitzar la línia d'entrada '%s'\n"
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
"%s: el nom del perfil «%s» no és vàlid - expressió regular incorrecta\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
"S'ha produït un ERROR en fusionar les regles per al perfil %s, no s'ha pogut "
"carregar\n"
#: ../parser_policy.c:234
#, c-format
@@ -551,21 +596,28 @@ msgid ""
"\t'*', '?', character ranges, and alternations are not allowed.\n"
"\t'**' may only be used at the end of a rule.\n"
msgstr ""
"El perfil d'ERROR %s conté elements de política no usables amb aquest "
"nucli:\n"
"\t'*', '?', intervals de caràcters i alternances no estan permesos.\n"
"\t«**» només es pot utilitzar al final d'una regla.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
"S'ha produït un ERROR en processar les expressions regulars del perfil %s, "
"no s'ha pogut carregar\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"ERROR en expandir les variables del perfil %s, no s'ha pogut carregar\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
msgstr "ERROR en afegir la regla d'accés al barret per al perfil %s\n"
#: ../parser_policy.c:490 ../parser_policy.c:271
#, c-format
@@ -576,16 +628,20 @@ msgstr "ERROR al perfil %s, no s'ha pogut carregar\n"
#, c-format
msgid "%s: Errors found during postprocessing. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocessament. S'està avortant.\n"
#: ../parser_policy.c:682 ../parser_policy.c:704
#, c-format
msgid "%s: Errors found during regex postprocess. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocés de l'expressió regular. S'està "
"avortant.\n"
#: ../parser_policy.c:689
#, c-format
msgid "%s: Errors found during postprocess. Aborting.\n"
msgstr ""
"%s: S'han trobat errors durant el postprocessament. S'està avortant.\n"
#: ../parser_policy.c:696
#, c-format
@@ -597,161 +653,171 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "No s'ha pogut processar el directori d'inclusió «%s» a «%s»"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Memòria intermèdia de funcions plena."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
msgstr "Sense memòria"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "No es pot crear el directori de la memòria cau: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Fitxer a la ubicació del directori de la memòria cau: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "No es pot actualitzar el directori de la memòria cau: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "Intern: el caràcter «%c» del mode DBus no és esperat a l'entrada"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "S'ha produït un error intern al DBus perm 0x%x no vàlid\n"
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
msgstr "no es permet el prefix de denegació"
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
msgstr "no es permet el prefix del propietari"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "el prefix propietari no permet les regles de muntatge"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "el prefix del propietari no permet a les regles de dbus"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "el prefix del propietari no permet les regles de capacitat"
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "el muntatge condicional %s%s no és vàlid"
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
msgstr "regla de muntatge incorrecta"
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "les condicions del punt de muntatge no són compatibles actualment"
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "la condició «%s» de l'arrel dinàmica no és vàlida"
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: error d'agrupament d'expressions regulars: tancament invàlid ], no s'ha "
"trobat cap obert coincident [ detectat\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Error d'agrupament d'expressions regulars: s'ha superat la imbricació "
"màxima de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"S'ha produït un error en processar les regles policydb per al perfil %s, no "
"s'ha pogut carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
"ERROR en substituir els àlies del perfil %s, no s'ha pogut carregar\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: no s'ha pogut escriure %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Error: no s'ha pogut llegir el perfil binari o el fitxer de memòria cau %s: "
"%s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
"Error: no s'ha pogut llegir el fitxer de la memòria cau «%s», s'omet...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Intern: al mode %s el caràcter «%c» no és l'esperat"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Error intern generat no vàlid %s perm 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles de muntatge"
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles de dbus"
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles del senyal"
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles «ptrace»"
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles unix"
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "no es permet el prefix del propietari a les regles de capacitat"
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "regla dbus: el grup condicional %s()() no és vàlid"
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "regla unix: el grup condicional %s()() no és vàlid"
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: error d'expressió regular: caràcter d'escapament «\\» al final\n"

View File

@@ -6,130 +6,142 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 02:07+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"PO-Revision-Date: 2022-03-10 18:26+0000\n"
"Last-Translator: Marek Hladík <mhladik@seznam.cz>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2022-03-11 06:22+0000\n"
"X-Generator: Launchpad (build 61f4697954ab70d633d14d8ceecff69a20b08a6b)\n"
"Language: cs\n"
#: ../parser_include.c:113 ../parser_include.c:111
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
msgid "Error: Out of memory.\n"
msgstr "Chyba: Nedostatek paměti\n"
#: ../parser_include.c:123 ../parser_include.c:121
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Chyba: Základní adresář %s není adresář, přeskakuje se.\n"
#: ../parser_include.c:137
#: ../parser_include.c:137 ../parser_include.c:122
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Chyba: Adresář %s nelze přidat ke hledané cestě.\n"
#: ../parser_include.c:147 ../parser_include.c:151
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
msgid "Error: Could not allocate memory.\n"
msgstr "Chyba: Nelze přidělit paměť\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Špatná pozice zápisu\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "Oprávnění odepřeno\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Nedostatek paměti\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "Nelze zkopírovat profil: Špatná adresa paměti\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Profil neodpovídá protokolu\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Profil neodpovídá podpisu\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Modul Apparmor nepodporuje verzi profilu.\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "Profil již existuje\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "Profil neexistuje\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "Přístup odepřen. Pokoušíte se načíst profil, i přes jistá omezeni?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Neznámá chyba (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Nelze přidat \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#: ../parser_interface.c:101 ../parser_interface.c:105
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Nelze nahradit \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#: ../parser_interface.c:106 ../parser_interface.c:110
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: Nelze odstranit \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#: ../parser_interface.c:111 ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: nelze zapisovat na standardní výstup\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#: ../parser_interface.c:115 ../parser_interface.c:119
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: Nelze zapsat výstupní soubor\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: ASSERT: neplatná volba: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#: ../parser_interface.c:127 ../parser_interface.c:132
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "Přidání uspělo pro \"%s\".\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#: ../parser_interface.c:131 ../parser_interface.c:136
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "Nahrazení uspělo pro \"%s\".\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#: ../parser_interface.c:135 ../parser_interface.c:140
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "Odstranění uspělo pro \"%s\".\n"
@@ -140,14 +152,14 @@ msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr "PANIKA: chybný přírůstkový buffer %p pos %p ext %p size %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#: ../parser_interface.c:446 ../parser_interface.c:476
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "profilu %s nejsou vynucena síťová pravidla\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "Neznámý typ vzoru\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -185,35 +197,35 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Nelze zapsat celý záznam profilu\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#: ../parser_interface.c:593 ../parser_interface.c:579
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
msgstr "%s: Nelze zapsat celý záznam profilu do mezipaměti\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "Nelze otevřít '%s'"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "fstat selhal pro '%s'"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "opendir selhal '%s'"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "stat selhal pro '%s'"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "Nelze otevřít '%s' v '%s'"
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -221,9 +233,9 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr "Nalezen neočekávaný znak: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "U deklarace proměnných nejsou přípustné koncové čárky"
#: parser_lex.l:420
#, c-format
@@ -233,7 +245,7 @@ msgstr "(režim_sítě) Nalezen neplatný znak: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "Pozor na %s (%s%s řádku %d): %s"
#: ../parser_main.c:531
#, c-format
@@ -241,6 +253,7 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr "%s: Nelze alokovat paměť pro bod připojení subdomainbase\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -250,6 +263,7 @@ msgstr ""
"Možnost lze přepsat pomocí možnosti --subdomainfs.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -259,6 +273,7 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -272,7 +287,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Chyba: Nelze číst profil %s: %s.\n"
@@ -294,26 +309,36 @@ msgstr "Chyba: Nelze číst profil %s: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
msgid "Memory allocation error."
msgstr "Chyba alokace paměti."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "Načtení z mezipaměti pro „%s“ bylo úspěšné\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "Opětovné načtení mezipaměti pro „%s“ bylo úspěšné\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Chyby v souboru. Ukončuji.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -324,16 +349,19 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "Oprávnění 'a' a 'w' se vzájemně vylučují."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Exec kvalifikátor 'i' je neplatný, byl již specifikován konfliktní "
"kvalifikátor"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -345,6 +373,7 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -353,6 +382,7 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
@@ -361,11 +391,13 @@ msgstr ""
"kvalifikátor"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Vnitřní: Neznámý znak režimu '%c' na vstupu."
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Vnitřní chyba způsobila neplatné perm 0x%llx\n"
@@ -377,137 +409,148 @@ msgid "AppArmor parser error: %s\n"
msgstr "Chyba parseru AppArmor: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Nelze sloučit záznamy. Nedostatek paměti\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "profil %s: bylo sloučeno pravidlo %s s konfliktními x modifikátory\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "Příloha profilu musí začínat znakem '/'."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Názvy profilů musí začínat znakem '/', jmenným prostorem nebo klíčovým "
"slovem 'profile' nebo 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "Nelze vytvořit alias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"Příznak profilu 'chroot_relative' je v konfliktu s 'namespace_relative'"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"Příznak profilu 'mediate_deleted' je v konfliktu s 'delegate_deleted'"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Příznak profilu 'connect_disconnected' je v konfliktu s "
"'no_attach_disconnected'"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
msgstr "Příznak profilu 'chroot_attach' je v konfliktu s 'chroot_no_attach'"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
msgid "Profile flag 'debug' is no longer valid."
msgstr "Příznak profilu 'debug' již není platný."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Neplatný příznak profilu: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Assert: `rule' vrátil NULL."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
"Neplatný režim, před 'x' musí být exec kvalifikátor 'i', 'p' nebo 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Neplatný režim, před 'x' musí být exec kvalifikátor 'i', 'p', 'c' nebo 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr "Neplatný režim, před 'x' musí být kvalifikátor 'i', 'p' nebo 'u'."
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Assert: `pravidlo_sítě' vrací neplatný protokol."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
msgid "Assert: `change_profile' returned NULL."
msgstr "Assert: `změna_profilu' vrátila hodnotu NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
msgid "Assert: 'hat rule' returned NULL."
msgstr "Assert: 'hat rule' vrátil NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Assert: 'local_profile rule' vrátil NULL."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "Ve výrazu 'if' byla použita nenastavená booleovská proměnná %s."
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
msgid "unsafe rule missing exec permissions"
msgstr "nebezpečné pravidlo nemá oprávnění ke spuštění"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
msgid "subset can only be used with link rules."
msgstr "podskupina může být použita pouze s pravidly odkazů."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
msgid "link and exec perms conflict on a file rule using ->"
msgstr "link a exec perms konflikt souboru pravidel používajícím ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
msgid "link perms are not allowed on a named profile transition.\n"
msgstr "link perms nejsou povoleny na přechodu pojmenovaného profilu.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "chybí znak konce řádku? (záznam: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
msgid "Invalid network entry."
msgstr "Neplatná položka sítě."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr "Neplatná schopnost %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "Chyba parseru AppArmor pro %s%s%s na řádku %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "Chyba parseru AppArmor, %s%s řádek %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -515,11 +558,13 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: nepovolená otvírací {, vnořené seskupování není povoleno\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr "%s: Chyba seskupování regex: neplatný počet položek mezi {}\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -528,6 +573,7 @@ msgstr ""
"otevírací {\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -542,16 +588,19 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Detekováno vnitřní přetečení zásobníku, přesáhlo %d znaků\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Nelze analyzovat vstupní řádku '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: Neplatné jméno profilu '%s' - špatný regulární výraz\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -569,6 +618,7 @@ msgstr ""
"\t'**' lze použít pouze na konci pravidla.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
@@ -576,12 +626,14 @@ msgstr ""
"načítání.\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"CHYBA při rozšíření proměnných pro profil %s, došlo k chybě při načítání.\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "Chyba při přidání pravidla pro přístup k hat pro profil %s\n"
@@ -613,164 +665,170 @@ msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
"%s: Nalezeny chyby při postprocesingu kombinačních pravidel. Ukončuji.\n"
#: parser_lex.l:180 parser_lex.l:186
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "Nelze zpracovat vloženého adresáře '%s' v '%s'"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Vyrovnávací paměť pro funkce je plná."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
msgid "Out of memory"
msgstr ""
msgstr "Nedostatek paměti"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "Nelze vytvořit adresář mezipaměti: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Soubor v adresáři mezipaměti: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "Nelze aktualizovat adresář mezipaměti: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "Interní: Neočekávaný znak '%c' režimu DBus na vstupu"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "Interní chyba vygenerovaná neplatnou DBus perm 0x%x\n"
#: parser_yacc.y:575 parser_yacc.y:621
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
msgid "deny prefix not allowed"
msgstr ""
msgstr "deny prefix není povolen"
#: parser_yacc.y:612 parser_yacc.y:658
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
msgid "owner prefix not allowed"
msgstr ""
msgstr "prefix vlastníka není povolen"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "prefix vlastníka není povolen v pravidlech pro připojení"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "prefix vlastníka není povolen v pravidlech dbus"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "prefix vlastníka není povolen v pravidlech schopností"
#: parser_yacc.y:1357 parser_yacc.y:1613
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "neplatná podmínka připojení %s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
msgid "bad mount rule"
msgstr ""
msgstr "špatné pravidlo připojení"
#: parser_yacc.y:1381 parser_yacc.y:1635
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "podmínky přípojného bodu nejsou aktuálně podporovány"
#: parser_yacc.y:1398 parser_yacc.y:1650
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "neplatný podmíněný pivotroot '%s'"
#: ../parser_regex.c:241 ../parser_regex.c:236
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Chyba seskupení regulárních výrazů: Neplatné uzavření ], nebylo zjištěno "
"žádné odpovídající otevření [\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Chyba seskupení regulárních výrazů: Překročen maximální počet vnoření "
"{}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"CHYBA zpracování pravidel policydb pro profil %s, načtení se nezdařilo\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "CHYBA při nahrazení aliasů pro profil %s, načtení se nezdařilo\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: Nelze zapsat %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
msgstr "Chyba: Nelze přečíst binární profil nebo soubor mezipaměti %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Chyba: Nelze přečíst soubor mezipaměti '%s', přeskočení...\n"
#: ../parser_misc.c:575
#: ../parser_misc.c:575 ../parser_misc.c:768
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Interní: V režimu %s se na vstupu vyskytl neočekávaný znak '%c'"
#: ../parser_misc.c:599
#: ../parser_misc.c:599 ../parser_misc.c:792
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Interní chyba vygenerovala neplatné %s perm 0x%x\n"
#: parser_yacc.y:703
#: parser_yacc.y:703 parser_yacc.y:784
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech připojení povolen"
#: parser_yacc.y:720
#: parser_yacc.y:720 parser_yacc.y:801
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech dbus povolen"
#: parser_yacc.y:736
#: parser_yacc.y:736 parser_yacc.y:817
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech signálu povolen"
#: parser_yacc.y:752
#: parser_yacc.y:752 parser_yacc.y:833
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech ptrace povolen"
#: parser_yacc.y:768
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech unixu povolen"
#: parser_yacc.y:794
#: parser_yacc.y:794 parser_yacc.y:885
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "prefix vlastníka není v pravidlech schopností povolen"
#: parser_yacc.y:1293
#: parser_yacc.y:1293 parser_yacc.y:1377
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "pravidlo dbus: neplatná podmíněná skupina %s=()"
#: parser_yacc.y:1371
#: parser_yacc.y:1371 parser_yacc.y:1455
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "unixové pravidlo: neplatná podmíněná skupina %s=()"
#: ../parser_regex.c:368
#: ../parser_regex.c:368 ../parser_regex.c:410
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: Chyba regulárního výrazu: koncový znak escape '\\'\n"

View File

@@ -6,38 +6,38 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-26 03:48+0000\n"
"Last-Translator: Monkey <monkey.libre@gmail.com>\n"
"PO-Revision-Date: 2024-10-09 22:03+0000\n"
"Last-Translator: Rodrigo Lledó <rodhos92@gmail.com>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2024-10-10 07:50+0000\n"
"X-Generator: Launchpad (build 6341c735b243a0768c3cb66edf85737937cab327)\n"
"Language: es\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Error: memoria insuficiente.\n"
msgstr "Error: Memoria insuficiente.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Error: el directorio base %s no es un directorio. Se va a omitir.\n"
msgstr "Error: el directorio base %s no es un directorio. Se omitido.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
"Error: no se ha podido añadir el directorio %s a la a de búsqueda.\n"
"Error: No se ha podido añadir el directorio %s a la ruta de búsqueda.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Error: no es posible asignar memoria.\n"
msgstr "Error: la memoria no pudo ser asignada.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr "Posición de escritura incorrecta\n"
msgstr "Escrito en el lugar equivocado.\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
@@ -45,15 +45,15 @@ msgstr "Permiso denegado\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr "Memoria agotada\n"
msgstr "Sin memoria.\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr "No se puede copiar el perfil. Dirección de memoria incorrecta\n"
msgstr "No se pudo copiar el perfil. Dirección de memoria incorrecta.\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
msgstr "El perfil no se ajusta al protocolo\n"
msgstr "El perfil no cumple el protocolo.\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
msgid "Profile does not match signature\n"
@@ -61,7 +61,7 @@ msgstr "El perfil no coincide con la firma\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "La versión del perfil no se admite en el módulo de Apparmor.\n"
msgstr "Versión del perfil no compatible con el módulo Apparmor.\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -73,8 +73,7 @@ msgstr "El perfil no existe\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
"Permiso denegado. ¿Intentando cargar un perfil mientras estaba confinado?\n"
msgstr "Permiso denegado. ¿Intentó cargar un perfil restringido?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
@@ -140,8 +139,7 @@ msgstr "Eliminación correcta de \"%s\".\n"
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
"PANIC: incremento de buffer incorrecto; pos %p; ext %p; tamaño %p; res %d "
"%p\n"
"PÁNICO: error en el aumento del búfer %p pos %p ext %p size %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
@@ -186,18 +184,18 @@ msgstr "no es posible poner en serie el perfil %s\n"
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: no es posible escribir todo el perfil\n"
msgstr "%s: no es posible escribir el acceso al perfil completo\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr "%s: Imposible escribir la entrada de perfil completa a la caché\n"
msgstr "%s: no es posible escribir el acceso al perfil completo al caché\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr "No se pudo abrir '%s'"
msgstr "No se pudo abrir «%s»"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
@@ -212,7 +210,7 @@ msgstr "opendir falló «%s»"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "stat falló para «%s»"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
@@ -223,11 +221,11 @@ msgstr "No se pudo abrir «%s» en «%s»"
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr "Se ha detectado un carácter inesperado: '%s'"
msgstr "Se ha detectado un carácter inesperado: «%s»"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "Las declaraciones de variables no aceptan comas al final"
#: parser_lex.l:420
#, c-format
@@ -237,7 +235,7 @@ msgstr "(network_mode) Se ha encontrado un carácter inesperado: %s"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "Aviso desde %s (%s%slínea %d): %s"
#: ../parser_main.c:531
#, c-format
@@ -308,12 +306,12 @@ msgstr "Error de asignación de memoria."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "Se ha cargado caché con éxito para «%s».\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "Se ha recargado caché con éxito para «%s».\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -391,15 +389,18 @@ msgstr "No es posible fusionar las entradas. Memoria agotada\n"
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
"el perfil %s: ha fusionado la regla %s con modificadores x en conflicto\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "El adjunto al perfil debe empezar con un «/»."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Los nombres del perfil deben empezar con un «/», espacio de nombre o palabra "
"clave «profile» o «hat»."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -409,19 +410,24 @@ msgstr "Error al crear el alias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"La marca del perfi chroot_relative está en conflicto con namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"La marca del perfil mediate_deleted está en conflicto con delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"La marca del perfil attach_disconnected está en conflicto con "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"La marca del perfil chroot_attach está en conflicto con chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -516,12 +522,12 @@ msgstr "Característica no válida %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "Error del analizador AppArmor para %s%s%s en la línea %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "Error de análisis AppArmor,%s%s línea %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -565,7 +571,7 @@ msgstr "%s: no es posible analizar la línea de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: nombre de perfil no válido «%s» - expresión regular incorrecta\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -631,161 +637,166 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "No se pudo procesar la inclusión del directorio «%s» en «%s»"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Buffer de características lleno."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
msgstr "Memoria agotada"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "No se puede crear el directorio de antememoria: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Archivo en ubicación de directorio de caché: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "No se puede actualizar el directorio de caché: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "Interno: carácter de modo DBUS «%c» inesperado en entrada"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "Error interno generado perm DBus no válido 0x%x\n"
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
msgstr "prefijo de denegación no permitido"
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
msgstr "prefijo de propietario no permitido"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas de montaje"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas dbus"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "prefijo de priopietario no permitido en reglas de capacidades"
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "condicional de montaje %s%s no válido"
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
msgstr "regla de montaje errónea"
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "condiciones de punto de montaje actualmente no soportadas"
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "condicional pivotroot no válido «%s»"
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Error de agrupamiento regex: Cierre no válido ], no se detectó pareja de "
"apertura [\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Error de agrupamiento regex: Se excedió el máximo de anidado de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"ERROR al procesar reglas policydb para el perfil %s, falló al cargar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "ERROR al reemplazar aliases para el perfil %s, falló al cargar\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: no se pudo escribir %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Error: no se pudo leer archivo de perfil binario o archivo de caché %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Error: no se pudo leer archivo de caché «%s», omitiendo...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Interno: modo inesperado %s carácter «%c» en la entrada"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Un error interno ha generado un %s perm no válido 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas de montaje"
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas de dbus"
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas de señal"
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "prefijo de propietario no permitido en reglas de ptrace"
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "prefijo de propietario no permitido en las reglas de Unix"
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "prefijo de propietario no permitido en las reglas de capacidad"
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "regla dbus: grupo condicional no válido %s=()"
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "regla unix: grupo condicional no válido %s=()"
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: Error regex: arrastrando carácter de escape «\\»\n"

View File

@@ -8,132 +8,145 @@ msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2019-12-27 08:23+0000\n"
"Last-Translator: VahidNameni <Unknown>\n"
"PO-Revision-Date: 2023-12-31 16:22+0000\n"
"Last-Translator: S.M.Mousavi <Unknown>\n"
"Language-Team: Persian <fa@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-12-28 05:38+0000\n"
"X-Generator: Launchpad (build bceb5ef013b87ef7aafe0755545ceb689ca7ac60)\n"
"X-Launchpad-Export-Date: 2024-01-01 04:31+0000\n"
"X-Generator: Launchpad (build e1eeab5b20e19239bd7d5f36676f7a52988db88b)\n"
#: ../parser_include.c:113 ../parser_include.c:111
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
msgid "Error: Out of memory.\n"
msgstr "خطا: خارج از حافظه.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
msgstr "خطا: basedir %s یک شاخه نیست، در حال رد کردن.\n"
#: ../parser_include.c:137
#: ../parser_include.c:137 ../parser_include.c:122
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "خطا: امکان اضافه کردن پوشه %s به مسیر جستجو نیست.\n"
#: ../parser_include.c:147 ../parser_include.c:151
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
msgid "Error: Could not allocate memory.\n"
msgstr ""
msgstr "خطا: عدم توانایی تخصیص حافظه.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr ""
msgstr "مکان نوشتن اشتباه\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "مجوز صادر نگردید\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "خارج از حافظه\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "عدم توانایی رونوشت از نمایه: آدرس حافظه بد\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr ""
msgstr "نمایه با پروتکل مطابقت ندارد\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "نمایه با امضا مطابقت ندارد\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
msgstr "نسخه نمایه توسط ماژول Apparmor پشتیبانی نمی‌شود\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr ""
msgstr "نمایه موجود است\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr ""
msgstr "نمایه موجود نیست\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
"اجازه رد شد؛ آیا در حالیکه محدود هستید، سعی در بارگزاری یک نمایه کردید؟\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "خطای ناشناخته (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr ""
msgstr "%s: عدم توانایی اضافه کردن \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#: ../parser_interface.c:101 ../parser_interface.c:105
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr ""
msgstr "%s: عدم توانایی جایگزینی \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#: ../parser_interface.c:106 ../parser_interface.c:110
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr ""
msgstr "%s: عدم توانایی حذف \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#: ../parser_interface.c:111 ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr ""
msgstr "%s: عدم توانایی نوشتن در stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#: ../parser_interface.c:115 ../parser_interface.c:119
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: عدم توانایی نوشتن در فایل خروجی\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr ""
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#: ../parser_interface.c:127 ../parser_interface.c:132
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr ""
msgstr "اضافه کردن \"%s\" با موفقیت انجام شد.\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#: ../parser_interface.c:131 ../parser_interface.c:136
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr ""
msgstr "جایگزینی \"%s\" با موفقیت انجام شد.\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#: ../parser_interface.c:135 ../parser_interface.c:140
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr ""
msgstr "حذف \"%s\" با موفقیت انجام شد.\n"
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
@@ -141,33 +154,33 @@ msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#: ../parser_interface.c:446 ../parser_interface.c:476
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "نوع الگوی ناشناخته\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr ""
msgstr "عدم توانایی بازکردن %s - %s\n"
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
msgstr "خطای تخصیص حافظه: عدم توانایی حذف ^%s\n"
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
msgstr "خطای تخصیص حافظه: عدم توانایی حذف %s:%s."
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
@@ -186,7 +199,7 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr ""
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#: ../parser_interface.c:593 ../parser_interface.c:579
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
@@ -196,7 +209,7 @@ msgstr ""
msgid "Could not open '%s'"
msgstr ""
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
@@ -222,7 +235,7 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr ""
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
msgid "Variable declarations do not accept trailing commas"
msgstr ""
@@ -242,6 +255,7 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -249,6 +263,7 @@ msgid ""
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -256,6 +271,7 @@ msgid ""
msgstr ""
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -264,7 +280,7 @@ msgid ""
msgstr ""
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
@@ -286,26 +302,36 @@ msgstr ""
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
msgid "Memory allocation error."
msgstr ""
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr ""
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -313,14 +339,17 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -329,23 +358,27 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
@@ -357,10 +390,12 @@ msgid "AppArmor parser error: %s\n"
msgstr ""
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -369,115 +404,118 @@ msgstr ""
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
@@ -493,17 +531,20 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -516,16 +557,19 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -539,16 +583,19 @@ msgid ""
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -578,7 +625,7 @@ msgstr ""
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
@@ -588,7 +635,8 @@ msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
msgid "Out of memory"
msgstr ""
@@ -617,11 +665,11 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
msgid "owner prefix not allowed"
msgstr ""
@@ -637,41 +685,41 @@ msgstr ""
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -691,51 +739,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575
#: ../parser_misc.c:575 ../parser_misc.c:768
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599
#: ../parser_misc.c:599 ../parser_misc.c:792
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
#: parser_yacc.y:703 parser_yacc.y:784
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720
#: parser_yacc.y:720 parser_yacc.y:801
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736
#: parser_yacc.y:736 parser_yacc.y:817
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752
#: parser_yacc.y:752 parser_yacc.y:833
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794
#: parser_yacc.y:794 parser_yacc.y:885
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293
#: parser_yacc.y:1293 parser_yacc.y:1377
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371
#: parser_yacc.y:1371 parser_yacc.y:1455
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368
#: ../parser_regex.c:368 ../parser_regex.c:410
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -16,14 +16,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2014-05-01 19:38+0000\n"
"Last-Translator: Jiri Grönroos <Unknown>\n"
"PO-Revision-Date: 2021-04-11 15:29+0000\n"
"Last-Translator: Markus Mikkonen <Unknown>\n"
"Language-Team: Suomi <fi@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2021-04-12 06:41+0000\n"
"X-Generator: Launchpad (build f3c8a1aed7c0b9bc4f5601dbf2698b30e1ab66f1)\n"
"Language: fi\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -643,7 +643,7 @@ msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
msgstr "Muisti lopussa"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format

View File

@@ -11,49 +11,49 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 02:58+0000\n"
"Last-Translator: Krešimir Jozić <Unknown>\n"
"PO-Revision-Date: 2021-10-03 10:20+0000\n"
"Last-Translator: gogo <trebelnik2@gmail.com>\n"
"Language-Team: Croatian <en@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2021-10-04 06:23+0000\n"
"X-Generator: Launchpad (build 1ce78163f6a09ed42b4201fe7d3f0e3a2eba7d02)\n"
"Language: hr\n"
#: ../parser_include.c:113 ../parser_include.c:111
msgid "Error: Out of memory.\n"
msgstr "Greška: Nedovoljno memorije.\n"
msgstr "Greška: ponestalo memorije.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Greška: temeljni direktorij %s nije direktorij, preskačem.\n"
msgstr "Greška: osnovni direktorij %s nije direktorij, preskačem.\n"
#: ../parser_include.c:137
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Greška: Ne mogu dodati direktorij %s u putanju za pretragu.\n"
msgstr "Greška: nemoguće dodavanje direktorija %s u putanju pretrage.\n"
#: ../parser_include.c:147 ../parser_include.c:151
msgid "Error: Could not allocate memory.\n"
msgstr "Greška: Ne mogu rezervirati memoriju.\n"
msgstr "Greška: nemoguće dodijeliti memoriju.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
msgid "Bad write position\n"
msgstr "Neipravan položaj za zapisivanje\n"
msgstr "Netočan položaj zapisivanja\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr "Pristup odbijen\n"
msgstr "Pristup uskraćen\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
msgstr "Nema dovoljno memorije\n"
msgstr "Ponestalo memorije\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "Nemoguće kopiranje profila: neispravna memorijska adresa\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -65,7 +65,7 @@ msgstr "Profil ne odgovara potpisu\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
msgid "Profile version not supported by Apparmor module\n"
msgstr "Verzija profila nije podržana od Apparmor modula\n"
msgstr "Inačicu profila ne podržava Apparmor modul\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
msgid "Profile already exists\n"
@@ -77,42 +77,42 @@ msgstr "Profil ne postoji\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "Pristup odbijen, pokušaj učitavanja profila tijekom ograničenja?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Nepoznata greška (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Ne mogu dodati \"%s\". "
msgstr "%s: Nemoguće je dodati \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Ne mogu zamijeniti \"%s\". "
msgstr "%s: Nemoguće je zamijeniti \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s : Ne mogu ukloniti \"%s\". "
msgstr "%s : Nemoguće je ukloniti \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: Ne mogu pisati na stdout\n"
msgstr "%s: Nemoguće je zapisivati u stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: Nemoguće je zapisivati u izlaznu datoteku\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165

View File

@@ -9,267 +9,293 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-14 22:25+0000\n"
"Last-Translator: George Machitidze <giomac@gmail.com>\n"
"PO-Revision-Date: 2023-06-26 15:06+0000\n"
"Last-Translator: NorwayFun <temuri.doghonadze@gmail.com>\n"
"Language-Team: Georgian <i18n@suse.de>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2023-06-27 04:31+0000\n"
"X-Generator: Launchpad (build aedf8597c50c1abc5fb7f9e871e686dfcb381fde)\n"
"Language: ka\n"
#: ../parser_include.c:113 ../parser_include.c:111
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
msgid "Error: Out of memory.\n"
msgstr ""
msgstr "შეცდომა: არასაკმარისი მეხსიერება.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr ""
"შეცდომა: საბაზისო საქაღალდე %s საქაღალდეს არ წარმოადგენს. გამოტოვება\n"
#: ../parser_include.c:137
#: ../parser_include.c:137 ../parser_include.c:122
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
msgstr "შეცდომა: საქაღალდის %s ძებნის ბილიკში ჩამატების შეცდომა.\n"
#: ../parser_include.c:147 ../parser_include.c:151
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
msgid "Error: Could not allocate memory.\n"
msgstr ""
msgstr "შეცდომა: მეხსიერების გამოყოფა შეუძლებელია.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr ""
msgstr "არასწორი ჩაწერის მდებარეობა\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr ""
msgstr "წვდომა აკრძალულია\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr ""
msgstr "არასაკმარისი მეხსიერება\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "პროფილს კოპირება შეუძლებელია: არასწორი მეხსიერების მისამართი\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr ""
msgstr "პროფილი პროტოკოლს არ ემორჩილება\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr ""
msgstr "პროფილი ხელმოწერას არ ემთხვევა\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr ""
msgstr "პროფილის ვერსია Apparmor-ის მოდულის მიერ მხარდაჭერილი არაა\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr ""
msgstr "პროფილი უკვე არსებობს\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr ""
msgstr "პროფილი არ არსებობს\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "წვდომა აკრძალულია. პროფილის ჩატვირთვის მცდელობა შეზღუდვისას?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "უცნობი შეცდომა (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr ""
msgstr "%s: \"%s\"-ის დამატების შეცდომა. "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#: ../parser_interface.c:101 ../parser_interface.c:105
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr ""
msgstr "%s: \"%s\"-ის ჩანაცვლების შეცდომა. "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#: ../parser_interface.c:106 ../parser_interface.c:110
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr ""
msgstr "%s: \"%s\"-ის წაშლის შეცდომა. "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#: ../parser_interface.c:111 ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr ""
msgstr "%s: stdout-ში ჩაწერის შეცდომა\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#: ../parser_interface.c:115 ../parser_interface.c:119
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: გამოტანის ფაილში ჩაწერის შეცდომა\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr ""
msgstr "%s: მტკიცება: არასწორი პარამეტრი: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#: ../parser_interface.c:127 ../parser_interface.c:132
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr ""
msgstr "\"%s\"-სთვის დამატება წარმატებულია.\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#: ../parser_interface.c:131 ../parser_interface.c:136
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr ""
msgstr "\"%s\"-სთვის ჩანაცვლება წარმატებულია.\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#: ../parser_interface.c:135 ../parser_interface.c:140
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr ""
msgstr "\"%s\"-სთვის წაშლა წარმატებულია.\n"
#: ../parser_interface.c:251 ../parser_interface.c:254
#, c-format
msgid "PANIC bad increment buffer %p pos %p ext %p size %d res %p\n"
msgstr ""
msgstr "პანიკა. არასწორი ზრდადი ბუფერი %p მდებ %p გაფართ %p ზომა %d რეს %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#: ../parser_interface.c:446 ../parser_interface.c:476
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "პროფილის %s ქსელის წესები არ მოქმედებს\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "უცნობი ნიმუშის ტიპი\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
#: ../parser_interface.c:518 ../parser_interface.c:669
#, c-format
msgid "Unable to open %s - %s\n"
msgstr ""
msgstr "%s-ის გახსნა შეუძლებელია - %s\n"
#: ../parser_interface.c:776 ../parser_interface.c:768
#: ../parser_interface.c:543
#, c-format
msgid "Memory Allocation Error: Unable to remove ^%s\n"
msgstr ""
msgstr "მეხსიერების გამოყოფის შეცდომა: ^%s-ის წაშლა შეუძლებელია\n"
#: ../parser_interface.c:789 ../parser_interface.c:781
#: ../parser_interface.c:556
#, c-format
msgid "Memory Allocation Error: Unable to remove %s:%s."
msgstr ""
msgstr "მეხსიერების გამოყოფის შეცდომა: %s-ის წაშლა შეუძლებელია: %s."
#: ../parser_interface.c:810 ../parser_interface.c:802
msgid "unable to create work area\n"
msgstr ""
msgstr "სამუშაო ფართობის შექმნა შეუძლებელია\n"
#: ../parser_interface.c:818 ../parser_interface.c:810
#, c-format
msgid "unable to serialize profile %s\n"
msgstr ""
msgstr "პროფილის %s სერიალიზაცია შეუძლებელია\n"
#: ../parser_interface.c:829 ../parser_interface.c:916
#: ../parser_interface.c:821 ../parser_interface.c:908
#: ../parser_interface.c:582
#, c-format
msgid "%s: Unable to write entire profile entry\n"
msgstr ""
msgstr "%s: სრული პროფილის ელემენტის ჩაწერა შეუძლებელია\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#: ../parser_interface.c:593 ../parser_interface.c:579
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
msgstr "%s: სრული პროფილის ელემენტის კეშში ჩაწერა შეუძლებელია\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "'%s'-ის გახსნის შეცდომა"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "fstat-ის შეცდომა '%s'-სთვის"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "opendir -ის შეცდომა '%s'-სთვის"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "%s-სთვის stat()-ის შეცდომა"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "'%s'-ის '%s'-ში გახსნის შეცდომა"
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
#, c-format
msgid "Found unexpected character: '%s'"
msgstr ""
msgstr "ნაპოვნია მოულოდნელი სიმბოლო: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "ცვლადის სახელებს ბოლოში მიწერილი მძიმეების მხარდაჭერა არ გააჩნია"
#: parser_lex.l:420
#, c-format
msgid "(network_mode) Found unexpected character: '%s'"
msgstr ""
msgstr "(network_mode) ნაპოვნია მოულოდნელი სიმბოლო: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "გაფრთხილება %s-დან (%s%s ხაზი %d): %s"
#: ../parser_main.c:531
#, c-format
msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr ""
"%s: მეხსიერების გამოყოფის შეცდომა subdomainbase მიმაგრების წერტილისთვის\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
"Use --subdomainfs to override.\n"
msgstr ""
"გაფრთხილება: %s-ში შესაბამისი FS ვერ ვიპოვე. მიმაგრებულია?\n"
"გადასაფარად გამოიყენეთ --subdomainfs.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
"\n"
msgstr ""
"%s: უკაცრავად, მაგრამ ამ პროგრამის გასაშვებად root-ის პრივილეგიები "
"დაგჭირდებათ.\n"
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
"Anybody who can run this program can update your AppArmor profiles.\n"
"\n"
msgstr ""
"%s: გაფრთხილება: პროგრამაზე setuid root დააყენეთ.\n"
"ყველა, ვინც ამ პროგრამას გაუშვებს, AppArmor-ის პროფილების განახლება "
"შეეძლება.\n"
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr ""
msgstr "შეცდომა: პროფილის '%s' წაკითხვის შეცდომა: %s.\n"
#: ../parser_main.c:718 ../parser_misc.c:270 parser_yacc.y:227
#: parser_yacc.y:374 parser_yacc.y:386 parser_yacc.y:484 parser_yacc.y:586
@@ -288,26 +314,36 @@ msgstr ""
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
msgid "Memory allocation error."
msgstr ""
msgstr "მეხსიერების გამოყოფის შეცდომა."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "დაკეშილი ჩატვირთვა \"%s\"-სთვის წარმატებულია.\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "დაკეშილი თავიდან ჩატვირთვა \"%s\"-სთვის წარმატებულია.\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr ""
msgstr "%s: ფაილში აღმოჩენილია შეცდომები. მუშაობის დასრულება.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -315,14 +351,17 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
msgstr "წვდომები 'a' და 'w' ურთიერთგამომრიცხავია."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -331,163 +370,176 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr ""
msgstr "შიდა: შეყვანაში აღმოჩენილია მოულოდნელი რეჟიმის სიმბოლო '%c'"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
msgstr "შიდა შეცდომის მიერ გენერირებული არასწორი წვდომა 0x%llx\n"
#: ../parser_misc.c:865 ../parser_symtab.c:561 ../parser_regex.c:626
#: ../parser_variable.c:229
#, c-format
msgid "AppArmor parser error: %s\n"
msgstr ""
msgstr "AppArmor-ის დამმუშავებლის შეცდომა: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr ""
msgstr "ელემენტების შერწყმა შეუძლებელია. არასაკმარისი მეხსიერება\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "პროფილის მიმაგრება '/'-ით უნდა იწყებოდეს."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"პროფილის სახელი '/'-ით, სახელის სივრცით ან საკვანძო სიტყვებიდან 'profile' ან "
"'hat' უნდა იწყებოდეს."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
msgstr "შეცდომა ფსევდონიმის (%s) შექმნისას -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"პროფილის ალამი chroot_relative კონფლიქტშია ალამთან namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
msgstr "პროფილის ალამი mediate_deleted კონფლიქტშია ალამთან delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"პროფილის ალამი attach_disconnect კონფლიქტშია ალამთან no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
msgstr "პროფილის ალამი chroot_attach კონფლიქტშია ალამთან chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
msgstr "პროფილის ალამი 'debug' აღარ გამოიყენება."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
msgstr "არასწორი პროფილის ალამი: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr ""
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
msgid "Assert: 'hat rule' returned NULL."
msgstr ""
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr ""
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr ""
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
msgid "Invalid network entry."
msgstr ""
msgstr "არასწორი ქსელის ჩანაწერი."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr ""
msgstr "არასწორი შესაძლებლობა %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "AppArmor-ის დამმუშავებლის შეცდომა. %s%s%s ხაზზე ნომრით %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "AppArmor-ის დამმუშავებლის შეცდომა. %s%s ხაზზე ნომრით %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -495,17 +547,20 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr ""
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
msgstr ""
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -518,16 +573,19 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr ""
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr ""
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -541,16 +599,19 @@ msgid ""
msgstr ""
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -580,34 +641,35 @@ msgstr ""
msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "ჩასასმელი საქაღალდის ('%s') '%s'-ში დამუშავება შეუძლებელია"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "თვისების ბუფერი სავსეა."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
msgid "Out of memory"
msgstr ""
msgstr "არასაკმარისი მეხსიერება"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "კეშის საქაღალდის შექმნის შეცდომა: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "ფაილი კეშის საქაღალდის მდებარეობაზე: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "კეშის საქაღალდის განახლების შეცდომა: %s\n"
#: ../parser_misc.c:833
#, c-format
@@ -619,61 +681,61 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
msgid "deny prefix not allowed"
msgstr ""
msgstr "აკრძალვის პრეფიქსი დაშვებული არაა"
#: parser_yacc.y:612 parser_yacc.y:658
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
msgid "owner prefix not allowed"
msgstr ""
msgstr "მფლობლის პრეფიქსი დაშვებული არაა"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი მიმაგრების წესებში დაშვებული არაა"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი dbus-ის წესებში დაშვებული არაა"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი შესაძლებლობების წესებში დაშვებული არაა"
#: parser_yacc.y:1357 parser_yacc.y:1613
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "არასწორი მიმაგრების პირობითი %s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
msgid "bad mount rule"
msgstr ""
msgstr "არასწორი მიმაგრების წესი"
#: parser_yacc.y:1381 parser_yacc.y:1635
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "მიმაგრების წერტილის პირობები ამჟამად მხარდაჭერილი არაა"
#: parser_yacc.y:1398 parser_yacc.y:1650
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "არასწორი pivotroot პირობითი '%s'"
#: ../parser_regex.c:241 ../parser_regex.c:236
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -693,51 +755,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575
#: ../parser_misc.c:575 ../parser_misc.c:768
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599
#: ../parser_misc.c:599 ../parser_misc.c:792
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
#: parser_yacc.y:703 parser_yacc.y:784
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი მიმაგრების წესებზე დაშვებული არაა"
#: parser_yacc.y:720
#: parser_yacc.y:720 parser_yacc.y:801
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი dbus-ის წესებზე დაშვებული არაა"
#: parser_yacc.y:736
#: parser_yacc.y:736 parser_yacc.y:817
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი სიგნალის წესებზე დაშვებული არაა"
#: parser_yacc.y:752
#: parser_yacc.y:752 parser_yacc.y:833
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი ptrace-ის წესებზე დაშვებული არაა"
#: parser_yacc.y:768
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი unix-ის წესებზე დაშვებული არაა"
#: parser_yacc.y:794
#: parser_yacc.y:794 parser_yacc.y:885
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "მფლობლის პრეფიქსი შესაძლებლობების წესებზე დაშვებული არაა"
#: parser_yacc.y:1293
#: parser_yacc.y:1293 parser_yacc.y:1377
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "dbus-ის წესი: არასწორი პირობითი ჯგუფი %s=0"
#: parser_yacc.y:1371
#: parser_yacc.y:1371 parser_yacc.y:1455
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "unix-ის წესი: არასწორი პირობითი ჯგუფი %s=0"
#: ../parser_regex.c:368
#: ../parser_regex.c:368 ../parser_regex.c:410
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -11,14 +11,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2016-03-03 08:40+0000\n"
"Last-Translator: Ivo Xavier <ivofernandes12@gmail.com>\n"
"PO-Revision-Date: 2020-07-13 00:17+0000\n"
"Last-Translator: Peter J. Mello <admin@petermello.net>\n"
"Language-Team: Portuguese <opensuse-pt@opensuse.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:32+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2020-07-14 05:50+0000\n"
"X-Generator: Launchpad (build 4809fcb62f445aaa3ae919f7f6c3cc7d156ea57a)\n"
"Language: pt\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -230,7 +230,7 @@ msgstr "Encontrado caracter inesperado: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "As declarações variáveis não aceitam vírgulas de seguimento"
#: parser_lex.l:420
#, c-format
@@ -308,12 +308,12 @@ msgstr "Erro de alocação de memória."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "A carga em cache foi bem sucedida para \"%s\".\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "A recarga em cache foi bem sucedida para \"%s\".\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -390,7 +390,7 @@ msgstr "Não é possível intercalar as entradas. Memória Esgotada\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "perfil %s: fundiu a regra %s com modificadores conflitantes x\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
@@ -400,6 +400,8 @@ msgstr "Anexo de perfil deve começar com '/'."
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Os nomes dos perfis têm que começar com '/', espaço de nomes, ou palavra-"
"chave 'profile' ou 'hat'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -409,19 +411,21 @@ msgstr "Falha na criação da alcunha %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"A marcação do perfil chroot_relative conflitos com o namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
msgstr "A marcação do perfil mediate_deleted conflitos com delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"A marcação do perfil attach_disconnected conflitos com no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
msgstr "A marcação do perfil chroot_attach conflitos com chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -515,12 +519,12 @@ msgstr "Capacidade inválida %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "Erro de analisador AppArmor para %s%s%s na linha %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "Erro de analisador AppArmor,%s%s linha %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -565,7 +569,7 @@ msgstr "%s: Não foi possível analisar a linha de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: Nome de perfil inválido '%s' - má expressão regular\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -633,11 +637,11 @@ msgstr ""
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "Não foi possível processar incluir pasta '%s' em '%s'"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Amortecedor de características cheio."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
@@ -652,7 +656,7 @@ msgstr "Não foi possível criar diretório de cache: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Ficheiro na localização da pasta do cache: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
@@ -662,132 +666,137 @@ msgstr "Não foi possível atualizar o diretório da cache: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "Interno: carácter do modo D-Bus '%c' inesperado na entrada"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "Erro interno gerado por permissão do D-Bus inválido 0x%x\n"
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
msgstr "Não é permitido prefixo deny"
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
msgstr "Não é permitido prefixo owner"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "Não é permitido prefixo owner nas regras de montar"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "Não é permitido prefixo owner nas regras de D-Bus"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "Não é permitido prefixo owner nas regras de capacidade"
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "montar condicional inválido %s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
msgstr "regra de montagem errada"
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "condições do ponto de montagem não suportadas atualmente"
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "pivotroot condicional inválido '%s'"
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Erro de agrupamento de expressões regulares: Fechamento inválido ], sem "
"abertura correspondente [ detectado\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Erro de agrupamento de expressões regulares: Excedido o máximo de "
"aninhamento de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"O ERRO processando regras de policydb para perfil %s, falhou em carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "O ERRO substituindo aliases para perfil %s, falhou em carregar\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: Não foi possível gravar %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
msgstr "Erro: Não pôde ler o perfil binário ou o ficheiro de cache %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Erro: Não foi possível ler o ficheiro de cache '%s', a ignorar...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Interno: caractere inesperado do modo %s: '%c' na entrada"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Erro interno gerado permissão %s inválido 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras de montar"
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras de D-Bus"
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras do sinal"
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras de ptrace"
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras de unix"
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "prefixo owner não permitido nas regras de capacidade"
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "regra dbus: grupo condicional inválido %s=()"
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "regra unix: grupo condicional inválido %s=()"
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: Erro de expressão regular: carácter de fuga '\\' seguinte\n"

View File

@@ -6,131 +6,143 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 03:51+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"PO-Revision-Date: 2022-06-17 21:43+0000\n"
"Last-Translator: Isabella Rocha de Oliveira <Unknown>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2022-06-18 04:31+0000\n"
"X-Generator: Launchpad (build ae54683eb2eb8ed62cda30dc44e60c5387c78159)\n"
"Language: pt_BR\n"
#: ../parser_include.c:113 ../parser_include.c:111
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
msgid "Error: Out of memory.\n"
msgstr "Erro: Sem memória.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Erro: O diretório base %s não é um diretório; ignorando.\n"
#: ../parser_include.c:137
#: ../parser_include.c:137 ../parser_include.c:122
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr ""
"Erro: Não foi possível adicionar o diretório %s ao caminho de pesquisa.\n"
#: ../parser_include.c:147 ../parser_include.c:151
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
msgid "Error: Could not allocate memory.\n"
msgstr "Erro: Não foi possível alocar memória.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Posição de gravação incorreta\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "Permissão negada\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Memória insuficiente\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "Não foi possível copiar perfil: Endereço de memória incorreto\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Perfil não compatível com o protocolo\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Perfil não corresponde à assinatura\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Versão de perfil não suportada pelo módulo do AppArmor\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "O perfil já existe\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "O perfil não existe\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "Permissão negada; tentou carregar um perfil enquanto restrito?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Erro desconhecido (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: Impossível adicionar \"%s\". "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#: ../parser_interface.c:101 ../parser_interface.c:105
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: Impossível substituir \"%s\". "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#: ../parser_interface.c:106 ../parser_interface.c:110
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: Impossível remover \"%s\". "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#: ../parser_interface.c:111 ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: Impossível gravar em stdout\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#: ../parser_interface.c:115 ../parser_interface.c:119
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: Não é possível salvar no arquivo de saída\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: DECLARAR: Opção inválida: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#: ../parser_interface.c:127 ../parser_interface.c:132
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "Adição bem-sucedida de \"%s\".\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#: ../parser_interface.c:131 ../parser_interface.c:136
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "Substituição bem-sucedida de \"%s\".\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#: ../parser_interface.c:135 ../parser_interface.c:140
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "Remoção bem-sucedida de \"%s\".\n"
@@ -142,14 +154,14 @@ msgstr ""
"PÂNICO: buffer de incremento incorreto %p pos %p ext %p tamanho %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#: ../parser_interface.c:446 ../parser_interface.c:476
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "perfil %s regras de rede não impostas\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "Tipo padrão desconhecido\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -187,35 +199,35 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Impossível gravar toda a entrada do perfil\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#: ../parser_interface.c:593 ../parser_interface.c:579
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
msgstr "%s: Não é possível gravar o perfil de entrada completo no cache\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "Não foi possível abrir '%s'"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "fstat falhou para '%s'"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "opendir falhou '%s'"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "stat falhou para '%s'"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "Não foi possível abrir '%s' em '%s'"
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -223,9 +235,9 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr "Caractere inesperado encontrado: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "Declarações de variável não aceitam vírgulas como último caractere"
#: parser_lex.l:420
#, c-format
@@ -235,7 +247,7 @@ msgstr "(network_mode) Caractere inesperado encontrado: '%s'"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "Aviso de %s (%s%sline %d): %s"
#: ../parser_main.c:531
#, c-format
@@ -244,6 +256,7 @@ msgstr ""
"%s: Impossível alocar memória para ponto de montagem de base de subdomínio\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -253,6 +266,7 @@ msgstr ""
"Use --subdomainfs para anular.\n"
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -262,6 +276,7 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -274,7 +289,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Erro: Não foi possível ler o perfil %s: %s.\n"
@@ -296,26 +311,36 @@ msgstr "Erro: Não foi possível ler o perfil %s: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
msgid "Memory allocation error."
msgstr "Erro de alocação de memória."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "Cache carregado com sucesso para \"%s\".\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "Cache recarregado com sucesso para \"%s\".\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Erros encontrados no arquivo. Interrompendo.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -326,16 +351,19 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr "As permissões 'a' e 'w' de conflito são mutuamente exclusivas."
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Qualificador de execução 'i' inválido. Qualificador em conflito já "
"especificado"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -347,6 +375,7 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -355,6 +384,7 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
@@ -363,11 +393,13 @@ msgstr ""
"especificado"
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Interno: caractere '%c' inesperado de modo na entrada"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr "Erro interno gerou permissão inválida 0x%llx\n"
@@ -379,60 +411,70 @@ msgid "AppArmor parser error: %s\n"
msgstr "Erro do analisador do AppArmor: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Impossível mesclar entradas. Memória Insuficiente\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "perfil % s: mesclou regra %s com conflitantes x modificadores\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "O anexo do perfil deve começar com um '/'."
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
"Nomes de perfil devem começar com um '/', namespace ou palavra-chave "
"'perfil' ou 'chapéu'."
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr "Falha ao criar o álias %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
"Sinalizador de perfil chroot_relative está em conflito com namespace_relative"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
"Sinalizador de perfil mediate_deleted está em conflito com delegate_deleted"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
"Sinalizador de perfil attach_disconnected está em conflito com "
"no_attach_disconnected"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
"Sinalizador de perfil chroot_attach está em conflito com chroot_no_attach"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
msgid "Profile flag 'debug' is no longer valid."
msgstr "O flag de perfil 'debug' não é mais válido."
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#, c-format
msgid "Invalid profile flag: %s."
msgstr "Flag de perfil inválido: %s."
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Declarar: `rule' retornou NULL."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
@@ -440,82 +482,84 @@ msgstr ""
"Modo inválido. Nas regras de negação, o 'x' não deve ser precedido pelo "
"qualificador de execução 'i', 'p' ou 'u'"
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
"Modo inválido. O 'x' deve ser precedido pelo qualificador de execução 'i', "
"'p','c' ou 'u'"
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Modo inválido; 'x' deve ser precedido pelo qualificador de execução 'i', 'p' "
"ou 'u'"
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr "Declarar: `network_rule' retornou um protocolo inválido."
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
msgid "Assert: `change_profile' returned NULL."
msgstr "Declarar: `change_profile' retornou NULL."
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
msgid "Assert: 'hat rule' returned NULL."
msgstr "Declarar: 'hat rule' retornou NULL."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "Declaração: a regra 'local_profile' retornou NULO."
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "Cancelar a definição da variável booleana %s usada na expressão if"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
msgid "unsafe rule missing exec permissions"
msgstr "permissões de execução não seguras com regra ausente"
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
msgid "subset can only be used with link rules."
msgstr "subconjunto somente deve ser usado com regras de link."
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
"conflito de permissões de link e execução em uma regra de arquivo usando ->"
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
"permissões de link não são permitidas em uma transição de perfil nomeada.\n"
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "caractere de fim de linha ausente? (entrada: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
msgid "Invalid network entry."
msgstr "Entrada de rede inválida."
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr "Recurso inválido %s."
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "Erro do analisador AppArmor para %s%s%s na linha %d: %s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "Erro do analisador AppArmor,%s%s linha %d: %s\n"
#: ../parser_regex.c:244
#, c-format
@@ -523,6 +567,7 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: Abertura ilegal {, agrupamentos aninhados não permitidos\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr ""
@@ -530,6 +575,7 @@ msgstr ""
"{}\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -538,6 +584,7 @@ msgstr ""
"abertura correspondente { detectada\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -552,16 +599,19 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Overflow de buffer interno detectado; %d caracteres excedidos\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Impossível analisar linha de entrada '%s'\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: Nome do perfil inválido '%s' - expressão regular inválida\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr "ERRO ao fundir regras para o perfil %s; falha ao carregar\n"
@@ -579,6 +629,7 @@ msgstr ""
"\t'**' somente podem ser usados no final de uma regra.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr ""
@@ -586,11 +637,13 @@ msgstr ""
"carregar\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr "ERRO ao expandir variáveis para o perfil %s; falha ao carregar\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr "ERRO ao adicionar a regra de acesso hat para o perfil %s\n"
@@ -624,164 +677,170 @@ msgstr ""
"%s: Erros encontrados no pós-processamento de regras de combinação. "
"Interrompendo.\n"
#: parser_lex.l:180 parser_lex.l:186
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "Não foi possível processar a inclusão do diretório '%s' em '%s'"
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "Recurso buffer está lotado."
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
msgid "Out of memory"
msgstr ""
msgstr "Memória insuficiente"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "Não é possível criar o diretório de cache: %s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "Arquivo no local do diretório de cache: %s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "Não é possível atualizar o diretório de cache: %s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "Interno: caractere mode DBus '%c' inesperado na entrada"
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "Erro interno gerou DBus perm 0x%x inválido\n"
#: parser_yacc.y:575 parser_yacc.y:621
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
msgid "deny prefix not allowed"
msgstr ""
msgstr "Prefixo deny não é permitido"
#: parser_yacc.y:612 parser_yacc.y:658
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
msgid "owner prefix not allowed"
msgstr ""
msgstr "Prefixo owner não é permitido"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "Prefixo owner não é permitido em regras de montagem"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "Prefixo owner não é permitido em regras de dbus"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "Prefixo owner não é permitido em regras de capacidade"
#: parser_yacc.y:1357 parser_yacc.y:1613
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "montagem condicional inválida %s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
msgid "bad mount rule"
msgstr ""
msgstr "regra de montagem inválida"
#: parser_yacc.y:1381 parser_yacc.y:1635
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "condições do ponto de montagem não são suportadas atualmente"
#: parser_yacc.y:1398 parser_yacc.y:1650
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "pivotroot condicional inválido '%s'"
#: ../parser_regex.c:241 ../parser_regex.c:236
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
"%s: Erro de agrupamento de regex: Fechamento inválido ], nenhuma abertura "
"compatível ] foi detectada\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
"%s: Erro de agrupamento de regex: Excedeu o aninhamento máximo de {}\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
"ERRO processando regras do policydb para o perfil %s, falha ao carregar\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "Erro substituindo pseudônimos para o perfil %s, falha ao carregar\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: Não foi possível escrever %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Erro: Não foi possível ler o perfil binário ou arquivo cache %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Erro: Não foi possível ler o arquivo cache '%s', pulando...\n"
#: ../parser_misc.c:575
#: ../parser_misc.c:575 ../parser_misc.c:768
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "Interno: modo %s caractere '%c' inesperado na entrada"
#: ../parser_misc.c:599
#: ../parser_misc.c:599 ../parser_misc.c:792
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Erro interno gerou %s perm 0x%x inválido\n"
#: parser_yacc.y:703
#: parser_yacc.y:703 parser_yacc.y:784
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "prefixo owner não permitido em regras de montagem"
#: parser_yacc.y:720
#: parser_yacc.y:720 parser_yacc.y:801
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "prefixo owner não permitido em regras dbus"
#: parser_yacc.y:736
#: parser_yacc.y:736 parser_yacc.y:817
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "prefixo owner não permitido em regras de sinal"
#: parser_yacc.y:752
#: parser_yacc.y:752 parser_yacc.y:833
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "prefixo owner não permitido em regras ptrace"
#: parser_yacc.y:768
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "prefixo owner não permitido em regras unix"
#: parser_yacc.y:794
#: parser_yacc.y:794 parser_yacc.y:885
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "prefixo owner não permitido em regras de capacidade"
#: parser_yacc.y:1293
#: parser_yacc.y:1293 parser_yacc.y:1377
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "regra dbus: grupo condicional inválido %s=()"
#: parser_yacc.y:1371
#: parser_yacc.y:1371 parser_yacc.y:1455
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "regra unix: grupo condicional inválido %s=()"
#: ../parser_regex.c:368
#: ../parser_regex.c:368 ../parser_regex.c:410
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: Erro regex: caractere de escape à direita '\\'\n"

File diff suppressed because it is too large Load Diff

View File

@@ -11,130 +11,142 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 03:41+0000\n"
"Last-Translator: Ömer Kehri <Unknown>\n"
"PO-Revision-Date: 2022-04-25 20:47+0000\n"
"Last-Translator: Sabri Ünal <Unknown>\n"
"Language-Team: turkish <i18n@suse.de>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2022-04-26 06:26+0000\n"
"X-Generator: Launchpad (build 1445a2883c2be41f8e3d484e7c1c2b98b0a1caf9)\n"
"Language: tr\n"
#: ../parser_include.c:113 ../parser_include.c:111
#: ../parser_include.c:113 ../parser_include.c:111 ../parser_include.c:96
msgid "Error: Out of memory.\n"
msgstr "Hata: Yetersiz bellek.\n"
#: ../parser_include.c:123 ../parser_include.c:121
#: ../parser_include.c:123 ../parser_include.c:121 ../parser_include.c:106
#, c-format
msgid "Error: basedir %s is not a directory, skipping.\n"
msgstr "Hata: %s temel dizini bir dizin değil, atlanıyor.\n"
#: ../parser_include.c:137
#: ../parser_include.c:137 ../parser_include.c:122
#, c-format
msgid "Error: Could not add directory %s to search path.\n"
msgstr "Hata: %s dizini arama yollarına eklenemedi.\n"
#: ../parser_include.c:147 ../parser_include.c:151
#: ../parser_include.c:147 ../parser_include.c:151 ../parser_include.c:136
msgid "Error: Could not allocate memory.\n"
msgstr "Hata: Bellek tahsis edilemedi.\n"
#: ../parser_interface.c:69 ../parser_interface.c:72 ../parser_interface.c:49
#: ../parser_interface.c:52
msgid "Bad write position\n"
msgstr "Hatalı yazma pozisyonu\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
#: ../parser_interface.c:55
msgid "Permission denied\n"
msgstr "İzin verilmedi\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
#: ../parser_interface.c:58
msgid "Out of memory\n"
msgstr "Yetersiz bellek\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
#: ../parser_interface.c:61
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
#: ../parser_interface.c:64
msgid "Profile doesn't conform to protocol\n"
msgstr "Profil protokole uymuyor\n"
#: ../parser_interface.c:84 ../parser_interface.c:87 ../parser_interface.c:64
#: ../parser_interface.c:67
msgid "Profile does not match signature\n"
msgstr "Profil imzası tutmuyor\n"
#: ../parser_interface.c:87 ../parser_interface.c:90 ../parser_interface.c:67
#: ../parser_interface.c:70
msgid "Profile version not supported by Apparmor module\n"
msgstr "Profil sürümü Apparmor modülü tarafından desteklenmiyor\n"
#: ../parser_interface.c:90 ../parser_interface.c:93 ../parser_interface.c:70
#: ../parser_interface.c:73
msgid "Profile already exists\n"
msgstr "Profil zaten mevcut\n"
#: ../parser_interface.c:93 ../parser_interface.c:96 ../parser_interface.c:73
#: ../parser_interface.c:76
msgid "Profile doesn't exist\n"
msgstr "Profil mevcut değil\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
#: ../parser_interface.c:79
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#: ../parser_interface.c:82
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "Bilinmeyen hata (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
#: ../parser_interface.c:116 ../parser_interface.c:119 ../parser_interface.c:96
#: ../parser_interface.c:100
#, c-format
msgid "%s: Unable to add \"%s\". "
msgstr "%s: \"%s\" eklenemedi. "
#: ../parser_interface.c:121 ../parser_interface.c:124
#: ../parser_interface.c:101
#: ../parser_interface.c:101 ../parser_interface.c:105
#, c-format
msgid "%s: Unable to replace \"%s\". "
msgstr "%s: \"%s\" değiştirilemedi. "
#: ../parser_interface.c:126 ../parser_interface.c:129
#: ../parser_interface.c:106
#: ../parser_interface.c:106 ../parser_interface.c:110
#, c-format
msgid "%s: Unable to remove \"%s\". "
msgstr "%s: \"%s\" silinemedi. "
#: ../parser_interface.c:131 ../parser_interface.c:134
#: ../parser_interface.c:111
#: ../parser_interface.c:111 ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: stdout'a yazılamadı.\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#: ../parser_interface.c:115 ../parser_interface.c:119
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: çıkış dosyasına yazılamıyor\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
#: ../parser_interface.c:118 ../parser_interface.c:142
#: ../parser_interface.c:123 ../parser_interface.c:147
#, c-format
msgid "%s: ASSERT: Invalid option: %d\n"
msgstr "%s: ASSERT: Geçersiz seçenek: %d\n"
#: ../parser_interface.c:147 ../parser_interface.c:150
#: ../parser_interface.c:127
#: ../parser_interface.c:127 ../parser_interface.c:132
#, c-format
msgid "Addition succeeded for \"%s\".\n"
msgstr "\"%s\" için ekleme başarılı oldu.\n"
#: ../parser_interface.c:151 ../parser_interface.c:154
#: ../parser_interface.c:131
#: ../parser_interface.c:131 ../parser_interface.c:136
#, c-format
msgid "Replacement succeeded for \"%s\".\n"
msgstr "\"%s\" için değiştirme başarılı oldu.\n"
#: ../parser_interface.c:155 ../parser_interface.c:158
#: ../parser_interface.c:135
#: ../parser_interface.c:135 ../parser_interface.c:140
#, c-format
msgid "Removal succeeded for \"%s\".\n"
msgstr "\"%s\" için silme başarılı oldu.\n"
@@ -146,7 +158,7 @@ msgstr ""
"PANİK hatalı arttırma arabelleği %p pozisyon %p ext %p boyut %d res %p\n"
#: ../parser_interface.c:656 ../parser_interface.c:658
#: ../parser_interface.c:446
#: ../parser_interface.c:446 ../parser_interface.c:476
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
@@ -191,7 +203,7 @@ msgid "%s: Unable to write entire profile entry\n"
msgstr "%s: Profil girdisinin tamamı yazılamadı\n"
#: ../parser_interface.c:839 ../parser_interface.c:831
#: ../parser_interface.c:593
#: ../parser_interface.c:593 ../parser_interface.c:579
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
@@ -199,9 +211,9 @@ msgstr ""
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "'%s' açılamadı"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173 parser_lex.l:174
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
@@ -227,7 +239,7 @@ msgstr ""
msgid "Found unexpected character: '%s'"
msgstr "Beklenmeyen karakter bulundu: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428 parser_lex.l:474
msgid "Variable declarations do not accept trailing commas"
msgstr ""
@@ -247,6 +259,7 @@ msgid "%s: Could not allocate memory for subdomainbase mount point\n"
msgstr "%s: subdomainbase bağlantı noktası için bellek ayrılamadı\n"
#: ../parser_main.c:577 ../parser_main.c:616 ../parser_main.c:479
#: ../parser_main.c:1444
#, c-format
msgid ""
"Warning: unable to find a suitable fs in %s, is it mounted?\n"
@@ -254,6 +267,7 @@ msgid ""
msgstr ""
#: ../parser_main.c:597 ../parser_main.c:635 ../parser_main.c:498
#: ../parser_main.c:822
#, c-format
msgid ""
"%s: Sorry. You need root privileges to run this program.\n"
@@ -263,6 +277,7 @@ msgstr ""
"\n"
#: ../parser_main.c:604 ../parser_main.c:642 ../parser_main.c:505
#: ../parser_main.c:828
#, c-format
msgid ""
"%s: Warning! You've set this program setuid root.\n"
@@ -274,7 +289,7 @@ msgstr ""
"\n"
#: ../parser_main.c:704 ../parser_main.c:813 ../parser_main.c:836
#: ../parser_main.c:946 ../parser_main.c:860
#: ../parser_main.c:946 ../parser_main.c:860 ../parser_main.c:1038
#, c-format
msgid "Error: Could not read profile %s: %s.\n"
msgstr "Hata: %s profili okunamadı: %s.\n"
@@ -296,26 +311,36 @@ msgstr "Hata: %s profili okunamadı: %s.\n"
#: parser_yacc.y:1166 parser_yacc.y:1170 parser_yacc.y:1180 parser_yacc.y:1190
#: parser_yacc.y:1298 parser_yacc.y:1376 parser_yacc.y:1479 parser_yacc.y:1490
#: parser_yacc.y:1565 parser_yacc.y:1583 parser_yacc.y:1590 parser_yacc.y:1639
#: ../network.c:314 ../af_unix.cc:203
#: ../network.c:314 ../af_unix.cc:203 ../parser_misc.c:215 ../parser_misc.c:939
#: parser_yacc.y:343 parser_yacc.y:367 parser_yacc.y:533 parser_yacc.y:543
#: parser_yacc.y:660 parser_yacc.y:741 parser_yacc.y:750 parser_yacc.y:1171
#: parser_yacc.y:1219 parser_yacc.y:1255 parser_yacc.y:1264 parser_yacc.y:1268
#: parser_yacc.y:1278 parser_yacc.y:1288 parser_yacc.y:1382 parser_yacc.y:1460
#: parser_yacc.y:1592 parser_yacc.y:1597 parser_yacc.y:1674 parser_yacc.y:1692
#: parser_yacc.y:1699 parser_yacc.y:1748 ../network.c:315 ../af_unix.cc:194
msgid "Memory allocation error."
msgstr "Bellek ayırma hatası."
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#: ../parser_main.c:975
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#: ../parser_main.c:979
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#: ../parser_main.c:1132
#, c-format
msgid "%s: Errors found in file. Aborting.\n"
msgstr "%s: Dosyada hatalar bulundu. Durduruluyor.\n"
#: ../parser_misc.c:426 ../parser_misc.c:597 ../parser_misc.c:339
#: ../parser_misc.c:532
msgid ""
"Uppercase qualifiers \"RWLIMX\" are deprecated, please convert to lowercase\n"
"See the apparmor.d(5) manpage for details.\n"
@@ -326,15 +351,18 @@ msgstr ""
#: ../parser_misc.c:467 ../parser_misc.c:474 ../parser_misc.c:638
#: ../parser_misc.c:645 ../parser_misc.c:380 ../parser_misc.c:387
#: ../parser_misc.c:573 ../parser_misc.c:580
msgid "Conflict 'a' and 'w' perms are mutually exclusive."
msgstr ""
#: ../parser_misc.c:491 ../parser_misc.c:662 ../parser_misc.c:404
#: ../parser_misc.c:597
msgid "Exec qualifier 'i' invalid, conflicting qualifier already specified"
msgstr ""
"Çalıştırma niteleyicisi 'i' geçersiz, çakışan niteleyici zaten belirtilmiş"
#: ../parser_misc.c:502 ../parser_misc.c:673 ../parser_misc.c:415
#: ../parser_misc.c:608
#, c-format
msgid ""
"Unconfined exec qualifier (%c%c) allows some dangerous environment variables "
@@ -343,6 +371,7 @@ msgstr ""
#: ../parser_misc.c:510 ../parser_misc.c:551 ../parser_misc.c:681
#: ../parser_misc.c:722 ../parser_misc.c:423 ../parser_misc.c:464
#: ../parser_misc.c:616 ../parser_misc.c:657
#, c-format
msgid "Exec qualifier '%c' invalid, conflicting qualifier already specified"
msgstr ""
@@ -350,17 +379,20 @@ msgstr ""
#: ../parser_misc.c:537 ../parser_misc.c:545 ../parser_misc.c:708
#: ../parser_misc.c:716 ../parser_misc.c:450 ../parser_misc.c:458
#: ../parser_misc.c:643 ../parser_misc.c:651
#, c-format
msgid ""
"Exec qualifier '%c%c' invalid, conflicting qualifier already specified"
msgstr ""
#: ../parser_misc.c:593 ../parser_misc.c:764 ../parser_misc.c:506
#: ../parser_misc.c:699
#, c-format
msgid "Internal: unexpected mode character '%c' in input"
msgstr "Dahili: girdide beklenmeyen mod karakteri '%c'"
#: ../parser_misc.c:615 ../parser_misc.c:786 ../parser_misc.c:528
#: ../parser_misc.c:721
#, c-format
msgid "Internal error generated invalid perm 0x%llx\n"
msgstr ""
@@ -372,10 +404,12 @@ msgid "AppArmor parser error: %s\n"
msgstr "AppArmor inceleyici hatası: %s\n"
#: ../parser_merge.c:92 ../parser_merge.c:91 ../parser_merge.c:83
#: ../parser_merge.c:71
msgid "Couldn't merge entries. Out of Memory\n"
msgstr "Girdiler birleştirilemiyor. Yetersiz bellek\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#: ../parser_merge.c:93
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
@@ -384,117 +418,120 @@ msgstr ""
msgid "Profile attachment must begin with a '/'."
msgstr ""
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348 parser_yacc.y:407
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384 parser_yacc.y:449
#, c-format
msgid "Failed to create alias %s -> %s\n"
msgstr ""
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506 parser_yacc.y:581
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510 parser_yacc.y:585
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513 parser_yacc.y:588
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516 parser_yacc.y:591
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530 parser_yacc.y:607
msgid "Profile flag 'debug' is no longer valid."
msgstr ""
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552
#: parser_yacc.y:463 parser_yacc.y:506 parser_yacc.y:552 parser_yacc.y:629
#, c-format
msgid "Invalid profile flag: %s."
msgstr ""
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
#: parser_yacc.y:673
msgid "Assert: `rule' returned NULL."
msgstr "Assert: `rule' NULL döndürdü."
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
#: parser_yacc.y:598 parser_yacc.y:630 parser_yacc.y:677 parser_yacc.y:709
msgid ""
"Invalid mode, in deny rules 'x' must not be preceded by exec qualifier 'i', "
"'p', or 'u'"
msgstr ""
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602
#: parser_yacc.y:524 parser_yacc.y:556 parser_yacc.y:602 parser_yacc.y:681
msgid ""
"Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', 'c', or 'u'"
msgstr ""
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633
#: parser_yacc.y:549 parser_yacc.y:587 parser_yacc.y:633 parser_yacc.y:712
msgid "Invalid mode, 'x' must be preceded by exec qualifier 'i', 'p', or 'u'"
msgstr ""
"Geçersiz mod; 'x', çalıştırma değişkenleri 'i', 'p' ya da 'u'dan sonra "
"gelmelidir."
#: parser_yacc.y:574 parser_yacc.y:612 parser_yacc.y:614 parser_yacc.y:660
#: parser_yacc.y:739
msgid "Assert: `network_rule' return invalid protocol."
msgstr ""
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786 parser_yacc.y:867
msgid "Assert: `change_profile' returned NULL."
msgstr ""
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810 parser_yacc.y:905
msgid "Assert: 'hat rule' returned NULL."
msgstr "Assert: `hat rule' NULL döndürdü."
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819 parser_yacc.y:914
msgid "Assert: 'local_profile rule' returned NULL."
msgstr ""
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992 parser_yacc.y:1077
#, c-format
msgid "Unset boolean variable %s used in if-expression"
msgstr "If deyimi içinde ayarlanmamış boolean değişkeni %s"
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092
#: parser_yacc.y:882 parser_yacc.y:986 parser_yacc.y:1092 parser_yacc.y:1181
msgid "unsafe rule missing exec permissions"
msgstr ""
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060
#: parser_yacc.y:901 parser_yacc.y:954 parser_yacc.y:1060 parser_yacc.y:1148
msgid "subset can only be used with link rules."
msgstr ""
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062
#: parser_yacc.y:903 parser_yacc.y:956 parser_yacc.y:1062 parser_yacc.y:1150
msgid "link and exec perms conflict on a file rule using ->"
msgstr ""
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064
#: parser_yacc.y:905 parser_yacc.y:958 parser_yacc.y:1064 parser_yacc.y:1152
msgid "link perms are not allowed on a named profile transition.\n"
msgstr ""
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109
#: parser_yacc.y:921 parser_yacc.y:1003 parser_yacc.y:1109 parser_yacc.y:1198
#, c-format
msgid "missing an end of line character? (entry: %s)"
msgstr "eksik satır sonu karakteri? (girdi: %s)"
#: parser_yacc.y:975 parser_yacc.y:985 parser_yacc.y:1057 parser_yacc.y:1067
#: parser_yacc.y:1145 parser_yacc.y:1155
#: parser_yacc.y:1145 parser_yacc.y:1155 parser_yacc.y:1234 parser_yacc.y:1244
msgid "Invalid network entry."
msgstr ""
#: parser_yacc.y:1039 parser_yacc.y:1048 parser_yacc.y:1254 parser_yacc.y:1510
#: parser_yacc.y:1617
#, c-format
msgid "Invalid capability %s."
msgstr ""
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525 parser_yacc.y:1637
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
@@ -510,11 +547,13 @@ msgid "%s: Illegal open {, nesting groupings not allowed\n"
msgstr "%s: Kural dışıık {, iç içe konan gruplamalara izin verilmez\n"
#: ../parser_regex.c:265 ../parser_regex.c:274 ../parser_regex.c:278
#: ../parser_regex.c:306
#, c-format
msgid "%s: Regex grouping error: Invalid number of items between {}\n"
msgstr "%s: Regex gruplama hatası: {} içinde geçersiz öğe sayısı\n"
#: ../parser_regex.c:271 ../parser_regex.c:280 ../parser_regex.c:284
#: ../parser_regex.c:312
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close }, no matching open { detected\n"
@@ -523,6 +562,7 @@ msgstr ""
"bulunamadı\n"
#: ../parser_regex.c:337 ../parser_regex.c:343 ../parser_regex.c:361
#: ../parser_regex.c:403
#, c-format
msgid ""
"%s: Regex grouping error: Unclosed grouping or character class, expecting "
@@ -537,16 +577,19 @@ msgid "%s: Internal buffer overflow detected, %d characters exceeded\n"
msgstr "%s: Dahili ara bellek taşması saptandı, %d karakter aşıldı\n"
#: ../parser_regex.c:355 ../parser_regex.c:361 ../parser_regex.c:377
#: ../parser_regex.c:419
#, c-format
msgid "%s: Unable to parse input line '%s'\n"
msgstr "%s: Giriş satırı '%s' incelenemedi\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#: ../parser_regex.c:487
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#: ../parser_policy.c:383
#, c-format
msgid "ERROR merging rules for profile %s, failed to load\n"
msgstr ""
@@ -565,17 +608,20 @@ msgstr ""
"\t'**' sadece bir kuralın sonunda kullanılabilir.\n"
#: ../parser_policy.c:279 ../parser_policy.c:359 ../parser_policy.c:332
#: ../parser_policy.c:340
#, c-format
msgid "ERROR processing regexs for profile %s, failed to load\n"
msgstr "HATA: %s profilinin regex'leri işlenemedi, yükleme başarısız oldu\n"
#: ../parser_policy.c:306 ../parser_policy.c:389 ../parser_policy.c:362
#: ../parser_policy.c:370
#, c-format
msgid "ERROR expanding variables for profile %s, failed to load\n"
msgstr ""
"HATA: %s profili için değişkenler genişletilemedi, yükleme başarısız oldu\n"
#: ../parser_policy.c:390 ../parser_policy.c:382 ../parser_policy.c:355
#: ../parser_policy.c:363
#, c-format
msgid "ERROR adding hat access rule for profile %s\n"
msgstr ""
@@ -606,7 +652,7 @@ msgid "%s: Errors found in combining rules postprocessing. Aborting.\n"
msgstr ""
"%s: Kural birleştirme sonrası işlemlerde hata bulundu. Durduruluyor.\n"
#: parser_lex.l:180 parser_lex.l:186
#: parser_lex.l:180 parser_lex.l:186 parser_lex.l:187
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
@@ -616,9 +662,10 @@ msgid "Feature buffer full."
msgstr ""
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
#: ../parser_main.c:1041 ../parser_main.c:1332 ../parser_main.c:1354
#: ../parser_misc.c:280 ../parser_misc.c:299 ../parser_misc.c:308
msgid "Out of memory"
msgstr ""
msgstr "Yetersiz bellek"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
@@ -645,11 +692,11 @@ msgstr ""
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
#: parser_yacc.y:575 parser_yacc.y:621
#: parser_yacc.y:575 parser_yacc.y:621 parser_yacc.y:700
msgid "deny prefix not allowed"
msgstr ""
#: parser_yacc.y:612 parser_yacc.y:658
#: parser_yacc.y:612 parser_yacc.y:658 parser_yacc.y:737
msgid "owner prefix not allowed"
msgstr ""
@@ -665,41 +712,41 @@ msgstr ""
msgid "owner prefix not allow on capability rules"
msgstr ""
#: parser_yacc.y:1357 parser_yacc.y:1613
#: parser_yacc.y:1357 parser_yacc.y:1613 parser_yacc.y:1722
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
#: parser_yacc.y:1374 parser_yacc.y:1628
#: parser_yacc.y:1374 parser_yacc.y:1628 parser_yacc.y:1737
msgid "bad mount rule"
msgstr ""
#: parser_yacc.y:1381 parser_yacc.y:1635
#: parser_yacc.y:1381 parser_yacc.y:1635 parser_yacc.y:1744
msgid "mount point conditions not currently supported"
msgstr ""
#: parser_yacc.y:1398 parser_yacc.y:1650
#: parser_yacc.y:1398 parser_yacc.y:1650 parser_yacc.y:1759
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
#: ../parser_regex.c:241 ../parser_regex.c:236
#: ../parser_regex.c:241 ../parser_regex.c:236 ../parser_regex.c:264
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
#: ../parser_regex.c:257 ../parser_regex.c:256
#: ../parser_regex.c:257 ../parser_regex.c:256 ../parser_regex.c:284
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
#: ../parser_policy.c:366 ../parser_policy.c:339
#: ../parser_policy.c:366 ../parser_policy.c:339 ../parser_policy.c:347
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
#: ../parser_policy.c:396 ../parser_policy.c:369
#: ../parser_policy.c:396 ../parser_policy.c:369 ../parser_policy.c:377
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
@@ -719,51 +766,51 @@ msgstr ""
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
#: ../parser_misc.c:575
#: ../parser_misc.c:575 ../parser_misc.c:768
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
#: ../parser_misc.c:599
#: ../parser_misc.c:599 ../parser_misc.c:792
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
#: parser_yacc.y:703
#: parser_yacc.y:703 parser_yacc.y:784
msgid "owner prefix not allowed on mount rules"
msgstr ""
#: parser_yacc.y:720
#: parser_yacc.y:720 parser_yacc.y:801
msgid "owner prefix not allowed on dbus rules"
msgstr ""
#: parser_yacc.y:736
#: parser_yacc.y:736 parser_yacc.y:817
msgid "owner prefix not allowed on signal rules"
msgstr ""
#: parser_yacc.y:752
#: parser_yacc.y:752 parser_yacc.y:833
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
#: parser_yacc.y:768
#: parser_yacc.y:768 parser_yacc.y:849 parser_yacc.y:869
msgid "owner prefix not allowed on unix rules"
msgstr ""
#: parser_yacc.y:794
#: parser_yacc.y:794 parser_yacc.y:885
msgid "owner prefix not allowed on capability rules"
msgstr ""
#: parser_yacc.y:1293
#: parser_yacc.y:1293 parser_yacc.y:1377
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
#: parser_yacc.y:1371
#: parser_yacc.y:1371 parser_yacc.y:1455
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
#: ../parser_regex.c:368
#: ../parser_regex.c:368 ../parser_regex.c:410
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""

View File

@@ -13,14 +13,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 12:27+0000\n"
"Last-Translator: yurchor <Unknown>\n"
"PO-Revision-Date: 2020-05-19 21:52+0000\n"
"Last-Translator: Nazarii Ritter <nazariy.ritter@gmail.com>\n"
"Language-Team: Ukrainian <translation@linux.org.ua>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2020-05-20 05:42+0000\n"
"X-Generator: Launchpad (build 0385b538081bc4718df6fb844a3afc89729c94ce)\n"
"Language: uk\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -747,27 +747,29 @@ msgstr "ПОМИЛКА заміри псевдонімів для профілю
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: Неможливо записати %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
"Помилка: Не вдалося прочитати бінарний профіль або файл кешу %s: %s.\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "Помилка: Не вдалося прочитати файл кешу '%s', пропуск…\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
"Внутрішня помилка: неочікуваний режим %s символу «%c» у вхідних даних"
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "Внутрішня помилка, спричинена невірним дозволом %s 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"

View File

@@ -6,14 +6,14 @@ msgstr ""
"Project-Id-Version: apparmor-parser\n"
"Report-Msgid-Bugs-To: <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2014-09-13 00:11-0700\n"
"PO-Revision-Date: 2013-11-15 04:12+0000\n"
"Last-Translator: Novell Language <Unknown>\n"
"PO-Revision-Date: 2022-01-15 11:52+0000\n"
"Last-Translator: Yulin Yang <yylteam@icloud.com>\n"
"Language-Team: Novell Language <language@novell.com>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2019-04-18 05:33+0000\n"
"X-Generator: Launchpad (build 18928)\n"
"X-Launchpad-Export-Date: 2022-01-16 04:32+0000\n"
"X-Generator: Launchpad (build 0072e2709f85567cc6c8d33e98acde9fcc09f491)\n"
"Language: zh_CN\n"
#: ../parser_include.c:113 ../parser_include.c:111
@@ -40,7 +40,7 @@ msgstr "写入位置无效\n"
#: ../parser_interface.c:72 ../parser_interface.c:75 ../parser_interface.c:52
msgid "Permission denied\n"
msgstr "拒绝许可权限\n"
msgstr "权限不足\n"
#: ../parser_interface.c:75 ../parser_interface.c:78 ../parser_interface.c:55
msgid "Out of memory\n"
@@ -48,7 +48,7 @@ msgstr "内存不足\n"
#: ../parser_interface.c:78 ../parser_interface.c:81 ../parser_interface.c:58
msgid "Couldn't copy profile: Bad memory address\n"
msgstr ""
msgstr "无法复制配置文件:内存地址不正确\n"
#: ../parser_interface.c:81 ../parser_interface.c:84 ../parser_interface.c:61
msgid "Profile doesn't conform to protocol\n"
@@ -72,12 +72,12 @@ msgstr "配置文件不存在\n"
#: ../parser_interface.c:96 ../parser_interface.c:99 ../parser_interface.c:76
msgid "Permission denied; attempted to load a profile while confined?\n"
msgstr ""
msgstr "权限被拒绝;试图在受限时加载配置文件?\n"
#: ../parser_interface.c:99 ../parser_interface.c:102 ../parser_interface.c:79
#, c-format
msgid "Unknown error (%d): %s\n"
msgstr ""
msgstr "未知错误 (%d): %s\n"
#: ../parser_interface.c:116 ../parser_interface.c:119
#: ../parser_interface.c:96
@@ -101,13 +101,13 @@ msgstr "%s: 无法去除\"%s\"。 "
#: ../parser_interface.c:111
#, c-format
msgid "%s: Unable to write to stdout\n"
msgstr "%s: 无法写入 stdout\n"
msgstr "%s: 无法写入到标准输出\n"
#: ../parser_interface.c:135 ../parser_interface.c:138
#: ../parser_interface.c:115
#, c-format
msgid "%s: Unable to write to output file\n"
msgstr ""
msgstr "%s: 无法写入输出文件\n"
#: ../parser_interface.c:138 ../parser_interface.c:162
#: ../parser_interface.c:141 ../parser_interface.c:165
@@ -143,11 +143,11 @@ msgstr "PANIC 无效的递增缓冲区:%p pos %p ext %p size %d res %p\n"
#: ../parser_interface.c:446
#, c-format
msgid "profile %s network rules not enforced\n"
msgstr ""
msgstr "配置文件%s网络规则未强制执行\n"
#: ../parser_interface.c:666
msgid "Unknown pattern type\n"
msgstr ""
msgstr "未知模式类型\n"
#: ../parser_interface.c:750 ../parser_interface.c:902
#: ../parser_interface.c:743 ../parser_interface.c:894
@@ -188,32 +188,32 @@ msgstr "%s: 无法写入整个配置文件项\n"
#: ../parser_interface.c:593
#, c-format
msgid "%s: Unable to write entire profile entry to cache\n"
msgstr ""
msgstr "%s: 无法将整个配置文件项写入缓存\n"
#: parser_lex.l:100 parser_lex.l:163 parser_lex.l:169
#, c-format
msgid "Could not open '%s'"
msgstr ""
msgstr "无法打开“%s”"
#: parser_lex.l:104 parser_lex.l:167 parser_lex.l:173
#, c-format
msgid "fstat failed for '%s'"
msgstr ""
msgstr "\"%s\"的 fstat 失败"
#: parser_lex.l:121
#, c-format
msgid "opendir failed '%s'"
msgstr ""
msgstr "打开目录\"%s\"失败"
#: parser_lex.l:152
#, c-format
msgid "stat failed for '%s'"
msgstr ""
msgstr "\"%s\"的 stat 失败"
#: parser_lex.l:155 parser_lex.l:133 parser_lex.l:139
#, c-format
msgid "Could not open '%s' in '%s'"
msgstr ""
msgstr "无法在\"%2$s\"中打开\"%1$s\""
#: parser_lex.l:284 parser_lex.l:322 parser_lex.l:362 parser_lex.l:399
#: parser_lex.l:469 parser_lex.l:655 parser_lex.l:586 parser_lex.l:638
@@ -223,7 +223,7 @@ msgstr "发现意外字符: '%s'"
#: parser_lex.l:386 parser_lex.l:418 parser_lex.l:428
msgid "Variable declarations do not accept trailing commas"
msgstr ""
msgstr "变量声明不接受尾随逗号"
#: parser_lex.l:420
#, c-format
@@ -233,7 +233,7 @@ msgstr "(network_mode) 发现意外字符:“%s”"
#: ../parser_main.c:333 ../parser_common.c:61 ../parser_common.c:106
#, c-format
msgid "Warning from %s (%s%sline %d): %s"
msgstr ""
msgstr "来自%s%s%s行 %d的警告%s"
#: ../parser_main.c:531
#, c-format
@@ -299,12 +299,12 @@ msgstr "内存分配错误。"
#: ../parser_main.c:740 ../parser_main.c:872 ../parser_main.c:757
#, c-format
msgid "Cached load succeeded for \"%s\".\n"
msgstr ""
msgstr "\"%s\"的缓存加载成功。\n"
#: ../parser_main.c:744 ../parser_main.c:876 ../parser_main.c:761
#, c-format
msgid "Cached reload succeeded for \"%s\".\n"
msgstr ""
msgstr "\"%s\"的缓存重加载成功。\n"
#: ../parser_main.c:910 ../parser_main.c:1058 ../parser_main.c:967
#, c-format
@@ -372,16 +372,16 @@ msgstr "无法合并项。内存不足\n"
#: ../parser_merge.c:111 ../parser_merge.c:113 ../parser_merge.c:105
#, c-format
msgid "profile %s: has merged rule %s with conflicting x modifiers\n"
msgstr ""
msgstr "配置文件%s已将规则%s与冲突的x修饰符合并\n"
#: parser_yacc.y:236 parser_yacc.y:277 parser_yacc.y:320
msgid "Profile attachment must begin with a '/'."
msgstr ""
msgstr "配置文件附件必须以\"/\"开头。"
#: parser_yacc.y:260 parser_yacc.y:302 parser_yacc.y:348
msgid ""
"Profile names must begin with a '/', namespace or keyword 'profile' or 'hat'."
msgstr ""
msgstr "配置文件名称必须以\"/\"、命名空间或关键字\"profile\"或\"hat\"开头。"
#: parser_yacc.y:296 parser_yacc.y:338 parser_yacc.y:384
#, c-format
@@ -390,20 +390,20 @@ msgstr "无法创建别名 %s -> %s\n"
#: parser_yacc.y:417 parser_yacc.y:460 parser_yacc.y:506
msgid "Profile flag chroot_relative conflicts with namespace_relative"
msgstr ""
msgstr "配置文件标志 chroot_relative 与 namespace_relative 冲突"
#: parser_yacc.y:421 parser_yacc.y:464 parser_yacc.y:510
msgid "Profile flag mediate_deleted conflicts with delegate_deleted"
msgstr ""
msgstr "配置文件标志 mediate_deleted 与 delegate_deleted 冲突"
#: parser_yacc.y:424 parser_yacc.y:467 parser_yacc.y:513
msgid ""
"Profile flag attach_disconnected conflicts with no_attach_disconnected"
msgstr ""
msgstr "配置文件标志 attach_disconnected 与 no_attach_disconnected 冲突"
#: parser_yacc.y:427 parser_yacc.y:470 parser_yacc.y:516
msgid "Profile flag chroot_attach conflicts with chroot_no_attach"
msgstr ""
msgstr "配置文件标志 chroot_attach 与 chroot_no_attach 冲突"
#: parser_yacc.y:441 parser_yacc.y:484 parser_yacc.y:530
msgid "Profile flag 'debug' is no longer valid."
@@ -416,7 +416,7 @@ msgstr "无效的配置文件标志:%s。"
#: parser_yacc.y:498 parser_yacc.y:520 parser_yacc.y:548 parser_yacc.y:594
msgid "Assert: `rule' returned NULL."
msgstr "声明:`rule'返回 NULL。"
msgstr "声明:`rule'返回空值(NULL)。"
#: parser_yacc.y:501 parser_yacc.y:546 parser_yacc.y:552 parser_yacc.y:584
#: parser_yacc.y:598 parser_yacc.y:630
@@ -440,15 +440,15 @@ msgstr "声明“network_rule”返回无效协议。"
#: parser_yacc.y:649 parser_yacc.y:696 parser_yacc.y:786
msgid "Assert: `change_profile' returned NULL."
msgstr "声明“change_profile”返回 NULL。"
msgstr "声明“change_profile”返回空值(NULL)。"
#: parser_yacc.y:680 parser_yacc.y:720 parser_yacc.y:810
msgid "Assert: 'hat rule' returned NULL."
msgstr "声明:'hat rule'返回 NULL。"
msgstr "声明:'hat rule'返回空值(NULL)。"
#: parser_yacc.y:689 parser_yacc.y:729 parser_yacc.y:819
msgid "Assert: 'local_profile rule' returned NULL."
msgstr "声明“local_profile rule”返回 NULL。"
msgstr "声明“local_profile rule”返回空值(NULL)。"
#: parser_yacc.y:824 parser_yacc.y:885 parser_yacc.y:992
#, c-format
@@ -489,12 +489,12 @@ msgstr "功能 %s 无效。"
#: parser_yacc.y:1066 parser_yacc.y:1269 parser_yacc.y:1525
#, c-format
msgid "AppArmor parser error for %s%s%s at line %d: %s\n"
msgstr ""
msgstr "第 %4$d 行 %1$s%2$s%3$s 的AppArmor分析器错误%5$s\n"
#: parser_yacc.y:1072 parser_yacc.y:1275 parser_yacc.y:1531
#, c-format
msgid "AppArmor parser error,%s%s line %d: %s\n"
msgstr ""
msgstr "AppArmor分析器错误在 %s%s 行 %d%s\n"
#: ../parser_regex.c:244
#, c-format
@@ -532,7 +532,7 @@ msgstr "%s: 无法对输入行'%s'进行语法分析\n"
#: ../parser_regex.c:397 ../parser_regex.c:405 ../parser_regex.c:421
#, c-format
msgid "%s: Invalid profile name '%s' - bad regular expression\n"
msgstr ""
msgstr "%s: 配置文件名称\"%s\"无效-错误的正则表达式\n"
#: ../parser_policy.c:202 ../parser_policy.c:402 ../parser_policy.c:375
#, c-format
@@ -593,161 +593,161 @@ msgstr "%s: 在组合规则后处理中发现错误。正在中止。\n"
#: parser_lex.l:180 parser_lex.l:186
#, c-format
msgid "Could not process include directory '%s' in '%s'"
msgstr ""
msgstr "无法处理\"%s\"中的包含目录\"%s\""
#: ../parser_main.c:660 ../parser_main.c:523
msgid "Feature buffer full."
msgstr ""
msgstr "功能缓冲区已满。"
#: ../parser_main.c:1115 ../parser_main.c:1132 ../parser_main.c:1024
#: ../parser_main.c:1041
msgid "Out of memory"
msgstr ""
msgstr "内存不足"
#: ../parser_main.c:1182 ../parser_main.c:1091
#, c-format
msgid "Can't create cache directory: %s\n"
msgstr ""
msgstr "无法创建目录:%s\n"
#: ../parser_main.c:1185 ../parser_main.c:1094
#, c-format
msgid "File in cache directory location: %s\n"
msgstr ""
msgstr "缓存目录位置中的文件:%s\n"
#: ../parser_main.c:1188 ../parser_main.c:1097
#, c-format
msgid "Can't update cache directory: %s\n"
msgstr ""
msgstr "无法更新缓存目录:%s\n"
#: ../parser_misc.c:833
#, c-format
msgid "Internal: unexpected DBus mode character '%c' in input"
msgstr ""
msgstr "内部输入中意外的DBus模式字符\"%c\""
#: ../parser_misc.c:857
#, c-format
msgid "Internal error generated invalid DBus perm 0x%x\n"
msgstr ""
msgstr "内部错误生成了无效的DBus perm 0x%x\n"
#: parser_yacc.y:575 parser_yacc.y:621
msgid "deny prefix not allowed"
msgstr ""
msgstr "不允许使用拒绝前缀"
#: parser_yacc.y:612 parser_yacc.y:658
msgid "owner prefix not allowed"
msgstr ""
msgstr "不允许使用所有者前缀"
#: parser_yacc.y:660
msgid "owner prefix not allow on mount rules"
msgstr ""
msgstr "装载规则中不允许使用所有者前缀"
#: parser_yacc.y:677
msgid "owner prefix not allow on dbus rules"
msgstr ""
msgstr "dbus规则上不允许使用所有者前缀"
#: parser_yacc.y:704
msgid "owner prefix not allow on capability rules"
msgstr ""
msgstr "不允许在功能规则上使用所有者前缀"
#: parser_yacc.y:1357 parser_yacc.y:1613
#, c-format
msgid "invalid mount conditional %s%s"
msgstr ""
msgstr "无效的装载条件%s%s"
#: parser_yacc.y:1374 parser_yacc.y:1628
msgid "bad mount rule"
msgstr ""
msgstr "错误的装载规则"
#: parser_yacc.y:1381 parser_yacc.y:1635
msgid "mount point conditions not currently supported"
msgstr ""
msgstr "当前不支持装载点条件"
#: parser_yacc.y:1398 parser_yacc.y:1650
#, c-format
msgid "invalid pivotroot conditional '%s'"
msgstr ""
msgstr "无效的pivotroot条件\"%s\""
#: ../parser_regex.c:241 ../parser_regex.c:236
#, c-format
msgid ""
"%s: Regex grouping error: Invalid close ], no matching open [ detected\n"
msgstr ""
msgstr "%s: 正则表达式分组错误:无效的关闭\"]\",未检测到匹配的打开\"[\"\n"
#: ../parser_regex.c:257 ../parser_regex.c:256
#, c-format
msgid "%s: Regex grouping error: Exceeded maximum nesting of {}\n"
msgstr ""
msgstr "%s: 正则表达式分组错误:超过了{}的最大嵌套\n"
#: ../parser_policy.c:366 ../parser_policy.c:339
#, c-format
msgid "ERROR processing policydb rules for profile %s, failed to load\n"
msgstr ""
msgstr "处理配置文件 %s 的policydb规则时出错加载失败\n"
#: ../parser_policy.c:396 ../parser_policy.c:369
#, c-format
msgid "ERROR replacing aliases for profile %s, failed to load\n"
msgstr ""
msgstr "替换配置文件 %s 的别名时出错,加载失败\n"
#: ../parser_interface.c:635 ../parser_interface.c:638
#, c-format
msgid "%s: Unable to write %s\n"
msgstr ""
msgstr "%s: 无法写入 %s\n"
#: ../parser_main.c:721
#, c-format
msgid "Error: Could not read binary profile or cache file %s: %s.\n"
msgstr ""
msgstr "错误:无法读取二进制配置文件或缓存文件 %s%s。\n"
#: ../parser_main.c:811
#, c-format
msgid "Error: Could not read cache file '%s', skipping...\n"
msgstr ""
msgstr "错误:无法读取缓存文件\"%s\",正在跳过...\n"
#: ../parser_misc.c:575
#, c-format
msgid "Internal: unexpected %s mode character '%c' in input"
msgstr ""
msgstr "内部:输入中出现意外的 %s 模式字符\"%c\""
#: ../parser_misc.c:599
#, c-format
msgid "Internal error generated invalid %s perm 0x%x\n"
msgstr ""
msgstr "内部错误,生成了无效的 %s perm 0x%x\n"
#: parser_yacc.y:703
msgid "owner prefix not allowed on mount rules"
msgstr ""
msgstr "装载规则上不允许使用所有者前缀"
#: parser_yacc.y:720
msgid "owner prefix not allowed on dbus rules"
msgstr ""
msgstr "dbus规则上不允许使用所有者前缀"
#: parser_yacc.y:736
msgid "owner prefix not allowed on signal rules"
msgstr ""
msgstr "信号规则中不允许使用所有者前缀"
#: parser_yacc.y:752
msgid "owner prefix not allowed on ptrace rules"
msgstr ""
msgstr "ptrace规则上不允许使用所有者前缀"
#: parser_yacc.y:768
msgid "owner prefix not allowed on unix rules"
msgstr ""
msgstr "unix规则上不允许使用所有者前缀"
#: parser_yacc.y:794
msgid "owner prefix not allowed on capability rules"
msgstr ""
msgstr "功能规则上不允许使用所有者前缀"
#: parser_yacc.y:1293
#, c-format
msgid "dbus rule: invalid conditional group %s=()"
msgstr ""
msgstr "dbus规则无效的条件组 %s=()"
#: parser_yacc.y:1371
#, c-format
msgid "unix rule: invalid conditional group %s=()"
msgstr ""
msgstr "unix规则无效的条件组 %s=()"
#: ../parser_regex.c:368
#, c-format
msgid "%s: Regex error: trailing '\\' escape character\n"
msgstr ""
msgstr "%s: 正则表达式错误:尾随\"\\\"转义字符\n"

View File

@@ -226,13 +226,13 @@ static bool add_proc_access(Profile *prof, const char *rule)
char *buffer = strdup("/proc/*/attr/apparmor/");
if (!buffer) {
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
add_entry_to_policy(prof, new_ent);
@@ -240,13 +240,13 @@ static bool add_proc_access(Profile *prof, const char *rule)
buffer = strdup("/sys/module/apparmor/parameters/enabled");
if (!buffer) {
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_READ, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
add_entry_to_policy(prof, new_ent);
@@ -254,17 +254,17 @@ static bool add_proc_access(Profile *prof, const char *rule)
buffer = strdup(rule);
if (!buffer) {
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
new_ent = new_entry(buffer, AA_MAY_WRITE, NULL);
if (!new_ent) {
free(buffer);
PERROR("Memory allocation error\n");
return false;
return FALSE;
}
add_entry_to_policy(prof, new_ent);
return true;
return TRUE;
}
#define CHANGEPROFILE_PATH "/proc/*/attr/{apparmor/,}{current,exec}"

View File

@@ -363,7 +363,7 @@ public:
struct cond_entry_list xattrs;
/* char *sub_name; */ /* subdomain name or NULL */
/* bool default_deny; */
/* int default_deny; */ /* TRUE or FALSE */
bool local;
Profile *parent;

View File

@@ -23,7 +23,7 @@
#include <iomanip>
#include <string>
#include <sstream>
#include <unordered_map>
#include <map>
#include "parser.h"
#include "profile.h"
@@ -35,7 +35,7 @@
#define MAXRT_SIG 32 /* Max RT above MINRT_SIG */
/* Signal names mapped to and internal ordering */
static unordered_map<string, int> signal_map = {
static struct signal_map { const char *name; int num; } signal_map[] = {
{"hup", 1},
{"int", 2},
{"quit", 3},
@@ -55,8 +55,7 @@ static unordered_map<string, int> signal_map = {
{"chld", 17},
{"cont", 18},
{"stop", 19},
{"stp", 20}, // parser's previous name for SIGTSTP
{"tstp", 20},
{"stp", 20},
{"ttin", 21},
{"ttou", 22},
{"urg", 23},
@@ -65,12 +64,14 @@ static unordered_map<string, int> signal_map = {
{"vtalrm", 26},
{"prof", 27},
{"winch", 28},
{"io", 29}, // SIGIO == SIGPOLL
{"poll", 29},
{"io", 29},
{"pwr", 30},
{"sys", 31},
{"emt", 32},
{"exists", 35},
/* terminate */
{NULL, 0}
};
/* this table is ordered post sig_map[sig] mapping */
@@ -95,7 +96,7 @@ static const char *const sig_names[MAXMAPPED_SIG + 1] = {
"chld",
"cont",
"stop",
"tstp",
"stp",
"ttin",
"ttou",
"urg",
@@ -104,7 +105,7 @@ static const char *const sig_names[MAXMAPPED_SIG + 1] = {
"vtalrm",
"prof",
"winch",
"io", // SIGIO == SIGPOLL
"io",
"pwr",
"sys",
"emt",
@@ -129,14 +130,12 @@ int find_signal_mapping(const char *sig)
return -1;
return MINRT_SIG + n;
} else {
// Can't use string_view because that requires C++17
auto sigmap = signal_map.find(string(sig));
if (sigmap != signal_map.end()) {
return sigmap->second;
} else {
return -1;
for (int i = 0; signal_map[i].name; i++) {
if (strcmp(sig, signal_map[i].name) == 0)
return signal_map[i].num;
}
}
return -1;
}
void signal_rule::extract_sigs(struct value_list **list)

View File

@@ -6,7 +6,7 @@ PARSER_BIN=apparmor_parser
PARSER=$(PARSER_DIR)/$(PARSER_BIN)
# parser.conf to use in tests. Note that some test scripts have the parser options hardcoded, so passing PARSER_ARGS=... is not enough to override it.
PARSER_ARGS=--config-file=./parser.conf
PROVE_ARG=-f --directives -j2
PROVE_ARG=-f --directives
ifeq ($(VERBOSE),1)
PROVE_ARG+=-v
@@ -37,11 +37,6 @@ error_output: $(PARSER)
parser_sanity: $(PARSER) gen_xtrans gen_dbus
$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
# use this target for faster manual testing if you don't want/need to test all the profiles generated by gen-*.py
parser_sanity-no-gen: clean $(PARSER)
@echo WARNING: not creating the profiles using the gen-*.py scripts
$(Q)LANG=C APPARMOR_PARSER="$(PARSER)" ${PROVE} ${PROVE_ARG} ${TESTS}
caching: $(PARSER)
LANG=C ./caching.py -p "$(PARSER)" $(PYTEST_ARG)

View File

@@ -879,28 +879,11 @@ verify_binary_equality "'$p1'x'$p2' link rules slash filtering" \
@{BAR}=/mnt/
/t { $p2 link @{FOO}/foo -> @{BAR}/bar, }"
verify_binary_equality "'$p1'x'$p2' attachment slash filtering" \
"/t /bin/foo { }" \
"/t /bin//foo { }" \
"@{BAR}=/bin/
/t @{BAR}/foo { }" \
"@{FOO}=/foo
/t /bin/@{FOO} { }" \
"@{BAR}=/bin/
@{FOO}=/foo
/t @{BAR}/@{FOO} { }"
# verify comment at end of variable assignment is not treated as a value
verify_binary_equality "comment at end of set var" \
"/t { /bin/ r, }" \
"@{BAR}=/bin/ #a tail comment
/t { @{BAR} r, }"
verify_binary_equality "value like comment at end of set var" \
"/t { /{bin/,#value} r, }" \
"@{BAR}=bin/ \#value
/t { /@{BAR} r, }"
# Verify equality with mount detached source
verify_binary_equality "'$p1'x'$p2' mount detached vs empty source" \
"/t { $p1 mount \"\" -> /destination, }" \
"/t { $p2 mount detached -> /destination, }"
# This can potentially fail as ideally it requires a better dfa comparison
# routine as it can generates hormomorphic dfas. The enumeration of the
@@ -912,12 +895,6 @@ verify_binary_equality "'$p1'x'$p2' mount specific deny doesn't affect non-overl
"/t { $p2 audit deny mount /s/** -> /**,
mount options=bind /e/ -> /**, }"
if [ $fails -ne 0 ] || [ $errors -ne 0 ]
then
printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 1>&2
exit $((fails + errors))
fi
## priority override equivalence tests
## compare single rule, to multi-rule profile where one rule overrides
@@ -1082,6 +1059,29 @@ run_tests()
"/t { /a r, }" \
"/t { priority=-1 audit deny /* rwxlk, /a r, }"
# Tests that do not use priority keywords at all
verify_binary_equality "attachment slash filtering" \
"/t /bin/foo { }" \
"/t /bin//foo { }" \
"@{BAR}=/bin/
/t @{BAR}/foo { }" \
"@{FOO}=/foo
/t /bin/@{FOO} { }" \
"@{BAR}=/bin/
@{FOO}=/foo
/t @{BAR}/@{FOO} { }"
# verify comment at end of variable assignment is not treated as a value
verify_binary_equality "comment at end of set var" \
"/t { /bin/ r, }" \
"@{BAR}=/bin/ #a tail comment
/t { @{BAR} r, }"
verify_binary_equality "value like comment at end of set var" \
"/t { /{bin/,#value} r, }" \
"@{BAR}=bin/ \#value
/t { /@{BAR} r, }"
# verify combinations of different priority levels
# for single rule comparisons, rules should keep same expected result
# even when the priorities are different.
@@ -1109,8 +1109,13 @@ run_tests()
done
[ -z "${verbose}" ] && printf "\n"
printf "PASS\n"
exit 0
if [ $fails -ne 0 ] || [ $errors -ne 0 ]; then
printf "ERRORS: %d\nFAILS: %d\n" $errors $fails 1>&2
exit $((fails + errors))
else
printf "PASS\n"
exit 0
fi
}
@@ -1218,7 +1223,7 @@ done
set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
if [ $# -eq 0 -o -z $testtype] ; then
if [ $# -eq 0 -o -z "$testtype" ] ; then
run_tests "$@"
exit $?
fi

View File

@@ -0,0 +1,7 @@
#
#=Description basic detached mount rule
#=EXRESULT PASS
#
/usr/bin/foo {
mount detached -> /foo,
}

View File

@@ -0,0 +1,7 @@
#
#=Description detached mount rule with options
#=EXRESULT PASS
#
/usr/bin/foo {
mount options=(ro) fstype=ext4 detached -> /destination,
}

Some files were not shown because too many files have changed in this diff Show More