2
0
mirror of https://gitlab.com/apparmor/apparmor synced 2025-08-31 22:35:35 +00:00

Compare commits

...

2614 Commits

Author SHA1 Message Date
John Johansen
19daf74dc6 Merge [2.11..2.13] Add 'mctp' network domain keyword [only to utils]
Reported as comment on https://build.opensuse.org/request/show/951354
(update to glibc 2.35)

This is a partial backport of
https://gitlab.com/apparmor/apparmor/-/merge_requests/832

I propose this patch for 2.11, 2.12 and 2.13.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/911
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 157c8ee36a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2022-08-22 15:31:58 -07:00
John Johansen
8275386e55 Merge [2.11..2.13] Support setuptools >= 61.2 in Python tests
Fix for #253, by mirroring the change from 1c23f5e1e4

On top of that, fix setuptools version detection in buildpath.py. libraries/libapparmor/swig/python/test/buildpath.py: The changes introduced in cc7f549665 targetted a wrong setuptools version (61.2). The change in build directory naming has been introduced with 62.0.

Fixes #259 Fixes #39

The first 3 commits are based on https://gitlab.com/apparmor/apparmor/-/merge_requests/897, the other two come from https://gitlab.com/apparmor/apparmor/-/merge_requests/904. Since there are several differences between 2.13 and >= 3.0, I had to adjust the patches at several places.

I propose this MR for 2.11, 2.12 and 2.13.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/910
Approved-by: John Johansen <john@jjmx.net>
Merged-by: John Johansen <john@jjmx.net>
(cherry picked from commit 3c047517a4)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2022-08-22 15:30:33 -07:00
Christian Boltz
2814e1ddd3 Merge [2.11..2.13] Grep away deprecation warning for distutils
... which will be removed in Python 3.12, and that probably won't be
used on systems running the AppArmor 2.1x branches.

This prevents CI failures on gitlab.com, which uses a new-enough python
to show

    DeprecationWarning: The distutils package is deprecated and slated for removal in Python 3.12. Use setuptools or check PEP 632 for potential alternatives

For 3.0 and master, the proper fix (switching to setuptools) was done in
!813.

I propose this patch for 2.11, 2.12 and 2.13.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/908
Approved-by: John Johansen <john@jjmx.net>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit fd1b463643)

ca3e5be5 Grep away deprecation warning for distutils
2022-08-22 20:03:16 +00:00
Christian Boltz
d987563091 Merge Set (instead of compare) exresult
Interestingly this accidentally worked because `if exresult` is true for
both a non-empty string ("PASS") as well as a real `True` value.

Found by Mark Grassi as part of
https://gitlab.com/apparmor/apparmor/-/merge_requests/906

I propose this patch for all branches.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/907
Approved-by: Jon Tourville <jon.tourville@canonical.com>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit c06ea77445)

5a2fb856 Set (instead of compare) exresult
2022-08-16 19:27:29 +00:00
Christian Boltz
a9d6b8f2fc Merge Allow dovecot to use all signals
similar to commit 2f9d172c64
we discovered that there was a service outage
when dovecot tried to send a usr1 signal

type=AVC msg=audit(1648024138.249:184964): apparmor="DENIED" operation="signal" profile="dovecot" pid=1690 comm="dovecot" requested_mask="send" denied_mask="send" signal=usr1 peer="dovecot-imap-login"

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/865
Approved-by: Christian Boltz <apparmor@cboltz.de>
Merged-by: Christian Boltz <apparmor@cboltz.de>


(cherry picked from commit 83685ba703)

f0919f83 Allow dovecot to use all signals
2022-03-25 20:54:04 +00:00
John Johansen
1ef18b6461 Merge abstractions/openssl: allow /etc/ssl/{engdef,engines}.d/
These directories were introduced in openssl in https://patchwork.ozlabs.org/project/openwrt/patch/20210429153530.10020-2-cotequeiroz@gmail.com/

I propose this patch for 3.0 and master. Optionally also for older branches, even if it's unlikely that systems using 2.13.x or older get a new-enough openssl to need this ;-)

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/818
Acked-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2b270216aa)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2022-01-17 12:11:21 -08:00
John Johansen
46dd61b0a1 Merge Add missing /proc permissions to avahi-daemon profile
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/203

MR:https://gitlab.com/apparmor/apparmor/-/merge_requests/811
Acked-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit ee9e61aad2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-10-30 02:23:01 -07:00
Steve Beattie
7f5a65fbe2 utils: Add new python versions to logprof.conf
Adding everything up to 3.19 should make the file future-proof for a
while ;-)

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/193
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/795
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 4559a2997c)
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2021-08-26 10:57:40 -07:00
Christian Boltz
999d0365a6 Merge branch 'cboltz-typo' into 'master'
Fix typo in manpage

Closes #192

See merge request apparmor/apparmor!789

Acked-by: Acked-by: Seth Arnold <seth.arnold@canonical.com> for all branches

(cherry picked from commit 131ae8425b)

1459f49b Fix typo in manpage
2021-08-17 18:27:11 +00:00
John Johansen
9876f84028 Merge allow Prometheus metrics end-point in dovecot/stats
Patch by Michael Ströder <michael@stroeder.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/776
Acked-by: John Johansen <john@jjmx.net>
(cherry picked from commit d8ec3dafb7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-07-21 12:31:02 -07:00
John Johansen
0237a8eaeb parser: fix cache time stamp check to include dir time stamps
Currently for directory includes the directory timestamp is ignored.
This is wrong as operations like removing a file from the dir won't
be considered in the timestamp check.

Fix this by updating the timestamp check to include the included
directories timestamp.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/760
Signed-off-by: John Johansen <john@jjmx.net>
Acked-by: Georgia Garcia  <georgia.garcia@canonical.com>
(cherry picked from commit 3d1232e640)
2021-07-13 18:44:55 -07:00
Georgia Garcia
5c7395ba03 tests: fix i18n.sh regression test on arm64
The following errors are happening on the regression tests
of i18n.sh on arm64 hirsute/impish:

Error: open failed. Test 'i18n (194) OPEN (octal) "/tmp/sdtest.3654-6536-J2ZwFM/file__post" RW' was expected to 'pass'. Reason for failure 'FAIL: open /tmp/sdtest.3654-6536-J2ZwFM/file__post failed - Permission denied'
...

The cause is a bash bug handling UTF-8 on subshells.

Fixes: https://bugs.launchpad.net/apparmor/+bug/1932331
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/765

Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 458a981b62)
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
2021-06-28 15:50:42 -03:00
Christian Boltz
753b51afb6 abstractions/php: support PHP 8
Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1186267
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/755
(cherry picked from commit 5853f52233)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-05-24 03:13:17 -07:00
John Johansen
9e4614b28e profiles: dhclient: allow setting task comm name
dhclient wants to set its thread names to functional names for
introspection purposes. Eg.

$ pstree -at 3395
dhclient ens3
  ├─{isc-socket}
  ├─{isc-timer}
  └─{isc-worker0000}

When denied this can result in dhclient breaking and failing to obtain
IPv4 addresses.

Fixes: https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1918410
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit c734839551)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-31 03:03:24 -07:00
John Johansen
b63dfedb0b profiles: dhcpd: add rule for port_range
The following AppArmor denial errors are shown on startup:

Oct 25 00:52:00 xxx kernel: [  556.231990] audit: type=1400 audit(1603601520.710:32): apparmor="DENIED" operation="open" profile="/usr/sbin/dhcpd" name="/proc/sys/net/ipv4/ip_local_port_range" pid=1982 comm="dhcpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Oct 25 00:52:00 xxx kernel: [  556.232257] audit: type=1400 audit(1603601520.710:33): apparmor="DENIED" operation="open" profile="/usr/sbin/dhcpd" name="/proc/sys/net/ipv4/ip_local_port_range" pid=1982 comm="dhcpd" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Fixes: https://bugs.launchpad.net/bugs/1901373
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/726
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 277677daf3)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-15 23:59:34 -07:00
John Johansen
b7e6a0a042 parser: fix filter slashes for link targets
The parser is failing to properly filter the slashes in the link name
after variable expansion. Causing match failures when multiple slashes
occur.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/153
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/723
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 2852e1ecdf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-15 01:15:13 -07:00
Mikhail Morfikov
edae9c98ac abstractions: Add missing rule in wutmp abstraction
Currently the wutmp abstraction has the following rules:
  /var/log/lastlog  rwk,
  /var/log/wtmp     wk,
  @{run}/utmp       rwk,

According to what I see in my apparmor profiles, just a few apps want
to interact with the files listed above, especially with the
/var/log/wtmp . But when the apps do this, they sometimes want the
read access to this file. An example could be the last command. Is
there any reason for not having the r in the rule?  The second thing
is the file /var/log/btmp (which isn't included in the
abstracion). Whenever I see an app, which wants to access the
/var/log/wtmp file, it also tries to interact with the /var/log/btmp
file, for instance lightdm/sddm or su . Most of the time they need
just wk permissions, but sometimes apps need also r on this file, an
example could be the lastb command, which is just a link to last.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/152
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/724
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit d4e0a94511)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-14 11:56:31 -07:00
John Johansen
fc1998e819 parser: fix backport of MR700
The backport of
  855dbd4a parser: fix rule downgrade for unix rules

using the rule_t::warn_once which doesn't exist in the 2.x parser
series. Switch this the the static function warn_once.

Fixes: ff392e6f parser: fix rule downgrade for unix rules
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-14 09:06:40 -07:00
John Johansen
ff392e6f49 parser: fix rule downgrade for unix rules
Rule downgrades are used to provide some confinement when a feature
is only partially supported by the kernel.

  Eg. On a kernel that doesn't support fine grained af_unix mediation
      but does support network mediation.

        unix (connect, receive, send)
              type=stream
              peer=(addr="@/tmp/.ICE-unix/[0-9]*"),

      will be downgraded to

        network unix type=stream,

Which while more permissive still provides some mediation while
allowing the appication to still function. However making the rule
a deny rule result in tightening the profile.

  Eg.
        deny unix (connect, receive, send)
              type=stream
              peer=(addr="@/tmp/.ICE-unix/[0-9]*"),

      will be downgraded to

        deny network unix type=stream,

and that deny rule will take priority over any allow rule. Which means
that if the profile also had unix allow rules they will get blocked by
the downgraded deny rule, because deny rules have a higher priority,
and the application will break. Even worse there is no way to add the
functionality back to the profile without deleting the offending deny
rule.

To fix this we drop deny rules that can't be downgraded in a way that
won't break the application.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1180766
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/700
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 855dbd4ac8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-03-14 07:20:13 -07:00
Rose Kunkel
57d56dc2c0 Fix nscd conflict with systemd-homed
My main user account is managed by systemd-homed. When I enable
AppArmor and have nscd running, I get inconsistent behavior with my
user account - sometimes I can't log in, sometimes I can log in but
not use sudo, etc.

This is the output of getent passwd:
  $ getent passwd
  root0:0::/root:/usr/bin/zsh
  bin1:1::/:/sbin/nologin
  daemon2:2::/:/sbin/nologin
  mail8:12::/var/spool/mail:/sbin/nologin
  ftp14:11::/srv/ftp:/sbin/nologin
  http33:33::/srv/http:/sbin/nologin
  nobody65534:65534:Nobody:/:/sbin/nologin
  dbus81:81:System Message Bus:/:/sbin/nologin
  [...]
  rose1000:1000:Rose Kunkel:/home/rose:/usr/bin/zsh

But getent passwd rose and getent passwd 1000 both return no output.
Stopping nscd.service fixes these problems. Checking the apparmor
logs, I noticed that nscd was denied access to
/etc/machine-id. Allowing access to that file seems to have fixed the
issue.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/707
Fixes: https://gitlab.com/apparmor/apparmor/-/issues/145
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit ee5303c8a0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-02-11 22:56:53 -08:00
Seth Arnold
939a0dea74 profiles: firefox Add support for widevine DRM
Ubuntu 18.04, Firefox 60.0.1+build2-0ubuntu0.18.04.1

Running firefix, then going to netflix.com and attempting to play a
movie. The widevinecdm plugin crashes, the following is found in
syslog:

Jun 15 19:13:22 xplt kernel: [301351.553043] audit: type=1400 audit(1529046802.585:246): apparmor="DENIED" operation="file_mmap" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/home/xav/.mozilla/firefox/wiavokxk.default-1510977878171/gmp-widevinecdm/1.4.8.1008/libwidevinecdm.so" pid=16118 comm="plugin-containe" requested_mask="m" denied_mask="m" fsuid=1000 ouid=1000
Jun 15 19:13:22 xplt kernel: [301351.553236] audit: type=1400 audit(1529046802.585:247): apparmor="DENIED" operation="ptrace" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=24714 comm="firefox" requested_mask="trace" denied_mask="trace" peer="/usr/lib/firefox/firefox{,*[^s][^h]}"
Jun 15 19:13:22 xplt kernel: [301351.553259] plugin-containe[16118]: segfault at 0 ip 00007fcdfdaa76af sp 00007ffc1ff03e28 error 6 in libxul.so[7fcdfb77a000+6111000]
Jun 15 19:13:22 xplt snmpd[2334]: error on subcontainer 'ia_addr' insert
...

Fixes: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1777070
Reported-by: Xav Paice <xav.paice@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/684
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 656f2103ed)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2021-02-11 19:41:31 -08:00
John Johansen
2f2f8e82e3 parser: fix --jobs so job scaling is applied correctly
job scaling allows the parser to resample the number of cpus available
and increase the number of jobs that can be launched if cpu available
increases.

Unfortunately job scaling was being applied even when a fixed number
of jobs was specified. So
  --jobs=2

doesn't actually clamp the compile at 2 jobs.

Instead job scaling should only be applied when --jobs=auto or when
jobs are set to a multiple of the cpus.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/703
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 65ba20b955)
2021-02-10 19:21:42 -08:00
Christian Boltz
c00b2b5483 apparmor.vim: add support for abi rules
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/690
(cherry picked from commit c421fcd38a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-12-11 14:57:04 -08:00
Christian Boltz
ecaa87b6dd aa-autodep: load abstractions on start
So far, aa-autodep "accidently" loaded the abstractions when parsing the
existing profiles. Obviously, this only worked if there is at least one
profile in the active or extra profile directory.

Without any existing profiles, aa-autodep crashed with
KeyError: '/tmp/apparmor.d/abstractions/base'

Prevent this crash by explicitely loading the abstractions on start.

Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1178527#c1 [1]
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/682
(cherry picked from commit f6b3de7116)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-11-28 05:15:14 -08:00
Christian Boltz
97c191a616 abstractions/X: Allow (only) reading X compose cache
... (/var/cache/libx11/compose/*), and deny any write attempts

Reported by darix,
https://git.nordisch.org/darix/apparmor-profiles-nordisch/-/blob/master/apparmor.d/teams

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/685
(cherry picked from commit 78bd811e2a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-11-17 02:09:05 -08:00
John Johansen
d6421c994a Merge [2.11] Check hotkey conflicts case-insensitive
This is needed to catch conflicts between uppercase and lowercase hotkeys of the same letter, as seen with `(B)enannt` and `A(b)lehnen` in the german utils translations.

(cherry picked from commit 07bd11390e)

This is the 2.11 variant of https://gitlab.com/apparmor/apparmor/-/merge_requests/675 - and luckily the 2.11 branch doesn't have any hotkey conflicts.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/680
Acked-by: John Johansen <john.johansen@canonical.com>
2020-11-03 09:47:35 +00:00
Christian Boltz
2c104537c9 Check hotkey conflicts case-insensitive
This is needed to catch conflicts between uppercase and lowercase
hotkeys of the same letter, as seen with `(B)enannt` and `A(b)lehnen` in
the german utils translations.

(cherry picked from commit 07bd11390e)
2020-11-01 23:25:33 +01:00
Vincas Dargis
5d98b68604 dovecot: allow reading dh.pem
Dovecot is hit with this denial on Debian 10 (buster):
```
type=AVC msg=audit(1603647096.369:24514): apparmor="DENIED"
operation="open" profile="dovecot" name="/usr/share/dovecot/dh.pem"
pid=28774 comm="doveconf" requested_mask="r" denied_mask="r" fsuid=0
ouid=0
```

This results in fatal error:

```
Oct 25 19:31:36 dovecot[28774]: doveconf: Fatal: Error in configuration
file /etc/dovecot/conf.d/10-ssl.conf line 50: ssl_dh: Can't open file
/usr/share/dovecot/dh.pem: Permission denied
```

Add rule to allow reading dh.pem.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/671
(cherry picked from commit 9d8e111abe)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-26 15:22:58 -07:00
Vincas Dargis
11e2998cbe dovecot: allow kill signal
Dovecot might try to kill related processes:

```
type=AVC msg=audit(1601314853.031:9327): apparmor="DENIED"
operation="signal" profile="dovecot" pid=21223 comm="dovecot"
requested_mask="send" denied_mask="send" signal=kill
peer="/usr/lib/dovecot/auth"

type=AVC msg=audit(1601315453.655:9369): apparmor="DENIED"
operation="signal" profile="dovecot" pid=21223 comm="dovecot"
requested_mask="send" denied_mask="send" signal=kill
peer="/usr/lib/dovecot/pop3"

type=AVC msg=audit(1602939754.145:101362): apparmor="DENIED"
operation="signal" profile="dovecot" pid=31632 comm="dovecot"
requested_mask="send" denied_mask="send" signal=kill
peer="/usr/lib/dovecot/pop3-login"
```
This discovered on low-power high-load machine (last resort timeout
handling?).

Update signal rule to allow SIGKILL.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/671
(cherry picked from commit 2f9d172c64)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-26 15:22:58 -07:00
Christian Boltz
6328de241b Add CAP_CHECKPOINT_RESTORE to severity.db
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/656
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2c2dbdc3a3)
2020-10-15 03:05:19 -07:00
John Johansen
532d52309e parser: call filter slashes for mount conditionals
The mnt_point and devices conditionals in mount rules are generally
paths and should have slashes filtered after variable expansion.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/607
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a1978fb1b2)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-09 02:45:46 -07:00
John Johansen
b3ab839ae5 parser: call filter slashes for the dbus path conditional
Similar to unix addr rules, the dbus path conditional is more a path
than a profile name and should get its slashes filtered after variable
expansion.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/607
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 35f6d49ec6)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-09 02:45:46 -07:00
John Johansen
fd708dc939 parser: enable variable expansion for mount type= and options=
Currently mount options type= and options= do not expand variables
but they should. Fix it.

Note: this does not treat either as paths because their use is
too device dependent for it to be safe to filter slashes.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/99
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/638
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 882380ad3d)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-09 02:45:46 -07:00
Patrick Steinhardt
20038dbdd4 libapparmor: add missing include for socklen_t
While `include/sys/apparmor.h` makes use of `socklen_t`, it doesn't
include the `<sys/socket.h>` header to make its declaration available.
While this works on systems using glibc via transitive includes, it
breaks compilation on musl libc.

Fix the issue by including the header.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
(cherry picked from commit 47263a3a74)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-10-03 13:22:33 -07:00
Patrick Steinhardt
61ff07ad7b libapparmor: add _aa_asprintf to private symbols
While `_aa_asprintf` is supposed to be of private visibility, it's used
by apparmor_parser and thus required to be visible when linking. This
commit thus adds it to the list of private symbols to make it available
for linking in apparmor_parser.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/643
Signed-off-by: Patrick Steinhardt <ps@pks.im>
(cherry picked from commit 9a8fee6bf1)
2020-10-03 12:26:02 -07:00
John Johansen
35c95e6517 parser: Fix expansion of variables in unix rules addr= conditional
The parser is not treating unix addr as a path and filtering slashes
after variable expansion. This can lead to errors where

@{foo}=/a/
unix bind addr=@{foo}/bar,

will always fail because addr is being matched as /a//bar instead of
/a/bar.

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/607
Fixes: https://bugs.launchpad.net/apparmor/+bug/1856738
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 6af05006d9)
2020-09-29 12:02:11 -07:00
John Johansen
c08871ccf9 regression tests: Don't build syscall_sysctl if missing kernel headers
sys/sysctl.h is not guaranteed to exist anymore since
https://sourceware.org/pipermail/glibc-cvs/2020q2/069366.html

which is a follow on to the kernel commit
61a47c1ad3a4 sysctl: Remove the sysctl system call

While the syscall_sysctl currently checks if the kernel supports
sysctrs before running the tests. The tests can't even build if the
kernel headers don't have the sysctl defines.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/119
Fixes: https://bugs.launchpad.net/apparmor/+bug/1897288
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/637
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 2e5a266eb7)
2020-09-29 11:57:34 -07:00
Steve Beattie
07e3e409fb regression tests/prologue: adjust sed to not use ~ as regex separators
prologue.inc:settest() in same cases invokes a sed command that uses
'~' as a pattern separator, on things that can contain filesystem
paths. However, in the debian/ubuntu world, '~' can be used in version
strings, particularly for pre-release versions, and when this happens
and the version is embedded in the path, the sed command breaks
because of the extraneous separator. Fix this by using '#' as a
separator, which has the benefit of being considered a comment if
accidentally interpreted by a shell.

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/599
(cherry picked from commit efc6590409)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-08-28 02:06:38 -07:00
John Johansen
968d8e532c Merge utils make check_severity_db: say ERROR for failing the build
utils `make check_severity_db` will fail the build if a (probably new) capability in not listed in severity.db. This also means it should print out an ERROR, not a warning.

This is a follow-up of lp#1890547 and https://gitlab.com/apparmor/apparmor/-/merge_requests/589

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/591
Acked-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2f5d5e1b24)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-08-20 01:16:28 -07:00
Christian Boltz
fd0ee07ed7 Add CAP_BPF and CAP_PERFMON to severity.db
These capabilities were introduced in Linux 5.8

References: https://bugs.launchpad.net/bugs/1890547
(cherry picked from commit ae01250209)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-08-07 13:53:10 -07:00
Steve Beattie
cfbc133945 utils/tests: add libaparmor swig library path
Similar to the profiles/ check using the python utilities, the
tests for the python utilities were not including the path for the
swig libapparmor library in the LD_LIBRARY_PATH variable, only in
PYTHONPATH. This commit fixes that, renaming the variable used for
the built libapparmor check.

v2:
 - actually use the LIBAPPARMOR_PATH variable when defining
   LD_LIBRARY_PATH

Bug: https://gitlab.com/apparmor/apparmor/-/issues/98
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/586
2020-07-25 01:00:43 -07:00
Steve Beattie
afd316f76f profiles/Makefile: fix aa-logprof invocation
The commit c8b6d8b393 ("profiles: Update 'make check' to select tools
based on USE_SYSTEM") set a bunch of variables but neglected to apply
them when invoking aa-logprof. This commit addresses this by:

  * correcting the PYTHONPATH used with aa-logprof
  * setting LD_LIBRARY_PATH when invoking aa-logprof
  * adjusting LD_LIBRARY_PATH to include both the directory location
    of libapparmor but also the swig libapparmor library needed for
    python tools to function.
  * adjusts the test for the presence of libapparmor to not use
    LD_LIBRARY_PATH but instead a libapparmor specific variable
    LIBAPPARMOR_PATH

Bug: https://gitlab.com/apparmor/apparmor/-/issues/98
Fixes: c8b6d8b393
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/586
2020-07-25 01:00:43 -07:00
Steve Beattie
869b8ad2d8 profiles/Makefile: add check for built libapparmor
When running the 'check-logprof' test using tools in the tree,
libapparmor needs to have been built for the python utilities to work.
Add a check for its existence to the test-dependencies target.

Bug: https://gitlab.com/apparmor/apparmor/-/issues/98
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/586
2020-07-25 01:00:43 -07:00
Steve Beattie
e1a8253fc2 profiles/Makefile: local target does not depend on parser
The "local" make target does not depend on the parser having been
built. Create a separate "test-dependencies" target and have the tests
that need them depend on that and the "local" target, when validating
the profile set against the apparmor tools.

Fixes: c8b6d8b393
Bug: https://gitlab.com/apparmor/apparmor/-/issues/98
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/586
2020-07-25 01:00:43 -07:00
John Johansen
bf02fc0af2 profiles: Update 'make check' to select tools based on USE_SYSTEM
The profiles dirs make check is not always using the correct tools.
Update it to be similar to other Makefiles where the var USE_SYSTEM

  make check USE_SYSTEM=1

is used to indicated that the system installed tools should be used
and

  make check

is used to run the tests against the in tree tools

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/580
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit c8b6d8b393)
2020-07-22 16:18:44 -07:00
Christian Boltz
71707c084f abstractions/X: add another xauth path
Future sddm version will use $XDG_RUNTIME_DIR/xauth_XXXXXX

References:
- https://bugzilla.opensuse.org/show_bug.cgi?id=1174290
- https://bugzilla.suse.com/show_bug.cgi?id=1174293
- https://github.com/sddm/sddm/pull/1230
- https://github.com/jonls/redshift/issues/763

This is the 2.13 version of 35f033ca7c /
https://gitlab.com/apparmor/apparmor/-/merge_requests/582

The difference is that this commit avoids using the @{run} variable.

(cherry picked from commit 02b9090eda)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-07-21 15:40:25 -07:00
Christian Boltz
ae9942444e allow reading my.cnf in dovecot-dict profile
Seen on openSUSE Tumbleweed with the mail users in a mysql database.

(cherry picked from commit f7ab91f423)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-13 01:58:14 -07:00
Christian Boltz
d9652bd559 Allow /proc/*/attr/current in dovecot imap and lmtp
This is needed when using the "apparmor" plugin which means dovecot
switches to user-specific hats.

Seen on openSUSE Tumbleweed.

(backported from commit 6a388859f8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-06-13 01:58:03 -07:00
Christian Boltz
0232617e89 Fix strip_quotes() to handle empty strings
strip_quotes() assumed its parameter is at least one character long, and
errored out on an empty string.

It also converted a string consisting of a single quote to an empty
string because that single quote had a quote as first and last char.

This commit fixes these two bugs.

Also rewrite TestStripQuotes to use tests[], and add some test for an empty
string, a one-char path (just a slash) and a single quote.

(cherry picked from commit 373e8e23b1)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2020-05-26 00:45:50 -07:00
Christian Boltz
a324b59aea Merge branch 'cboltz-fail-verbose' into 'master'
read_profile(): don't fail silently

See merge request apparmor/apparmor!530

Acked-by: Steve Beattie <steve.beattie@canonical.com> for 2.11..master

(cherry picked from commit e0f9b7cb07)

af8b9dc5 read_profile(): don't fail silently
2020-05-12 19:44:22 +00:00
Christian Boltz
7463c7f72f Merge branch 'cboltz-vim-alias' into 'master'
apparmor.vim: allow leading whitespace for alias rules

See merge request apparmor/apparmor!527

Acked-by: Steve Beattie <steve.beattie@canonical.com> for 2.11..master

(cherry picked from commit ae70ecfbaa)

c636580f apparmor.vim: allow leading whitespace for alias rules
2020-05-10 22:55:06 +00:00
intrigeri
a2c8864212 Fix a Python 3.8 autoconf check
Bug-Debian: https://bugs.debian.org/943657

Author: Matthias Klose <doko@debian.org>
(cherry picked from commit ccbf1e0bf1)

The default ubuntu:latest docker image has moved to ubuntu 20.04
LTS which includes python 3.8. Without this fix, the libapparmor
configure script fails against python 3.8, as seen in the gitlab
CI build failures.

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/519
2020-05-07 10:52:56 -07:00
Christian Boltz
632b090869 Merge branch 'privacy' into 'master'
Privacy statement

See merge request apparmor/apparmor!441

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.11..master

(cherry picked from commit 4281b58c89)

bfde89a6 infrastructure: Add privacy statement to the README
2020-04-26 11:43:50 +00:00
Christian Boltz
92b8c29c6d Merge branch 'profile-usr.sbin.dnsmasq' into 'master'
usr.sbin.dnsmasq: update to support dnsmasq 2.81

See merge request apparmor/apparmor!475

Acked-by: Christian Boltz for 2.11..master

(cherry picked from commit acafe9de82)

88c142c6 usr.sbin.dnsmasq: allow reading @{PROC}/@{pid}/fd/ as is needed by dnsmasq 2.81
2020-04-12 09:45:48 +00:00
Christian Boltz
b995a03eef Merge branch 'run-uuidd-request' into 'master'
abstractions/base: allow read access to /run/uuidd/request

See merge request apparmor/apparmor!445

Acked-by: John Johansen <john.johansen@canonical.com> for 2.11..master
Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.11..master


(cherry picked from commit 80bf920929)

45fffc12 abstractions/base: allow read access to /run/uuidd/request
2020-02-03 21:18:05 +00:00
Christian Boltz
d7d3f400c1 Merge branch 'gnome-abstraction-more-mimeapps' into 'master'
abstractions/gnome: also allow /etc/xdg/mimeapps.list

See merge request apparmor/apparmor!444

Acked-by: John Johansen <john.johansen@canonical.com> for 2.11..master
Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.11..master


(cherry picked from commit 3becbbab2c)

67cf4fa3 abstractions/gnome: also allow /etc/xdg/mimeapps.list
2020-02-03 21:17:10 +00:00
Christian Boltz
cb72e56610 Merge branch 'ecryptfs-top-dir' into 'master'
abstractions/base: allow read access to top-level ecryptfs directories

See merge request apparmor/apparmor!443

Acked-by: John Johansen <john.johansen@canonical.com> for 2.11..master
Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.11..master


(cherry picked from commit 24895ea302)

fbd8981e abstractions/base: allow read access to top-level ecryptfs directories
2020-02-03 21:16:11 +00:00
Ian Johnson
0d261bf757 docs: fix typo in man doc of unix rules
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
(cherry picked from commit f4220a19be)
2020-01-31 22:23:40 -08:00
Christian Boltz
a19a96291c Merge branch 'cboltz-backport-tunables-share' into 'apparmor-2.12'
[2.11+2.12] Backport tunables/share to 2.11 and 2.12 branch

See merge request apparmor/apparmor!446

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 6784de4ba1)

99e2d38c Backport tunables/share to 2.11 and 2.12 branch
2020-01-10 12:18:55 +00:00
John Johansen
84daf8ad17 gnome abstraction: allow reading per-user themes from $XDG_DATA_HOME
Bug-Debian: https://bugs.debian.org/930031

As per https://developer.gnome.org/gtk3/stable/ch32s03.html, since GTK+ 3.6, $XDG_DATA_HOME/themes is preferred over $HOME/.themes. We already support the latter, let's also support the former.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/442
Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit 098f0a7b5f)

852c1e76 gnome abstraction: allow reading per-user themes from $XDG_DATA_HOME
2019-12-17 23:21:11 +00:00
John Johansen
b62627d05e Enable CI for the 2.11 branch
This adds a copy of the current .gitlab-ci.yml from master to the 2.11 branch to enable CI checks.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/438
Acked-by: John Johansen <john.johansen@canonical.com>
2019-11-28 00:44:14 +00:00
Christian Boltz
b2945bf7bc Enable CI for the 2.11 branch
This adds a copy of the current .gitlab-ci.yml from master to the 2.11
branch to enable CI checks.
2019-11-28 00:47:54 +01:00
John Johansen
514a338042 [2.11] fix utils test failures
Fix two test failures in the 2.11 branch:

    utils: fixup test-aa.py tests that fail due to usr-merge
    drop owner restriction from backported libapparmor test_multi profile (not supported in 2.11)

See the individual commit for details.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/437
Acked-by: John Johansen <john.johansen@canonical.com>
2019-11-27 23:33:59 +00:00
Steve Beattie
dd74758305 utils: fixup test-aa.py tests that fail due to usr-merge
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
(cherry picked from commit 45c26214cc)
2019-11-27 23:42:16 +01:00
Christian Boltz
b029e9fc5b Drop owner restriction from backported libapparmor profile
2.11 doesn't support adding the 'owner' restriction when parsing a
logfile. When MR 402 was backported (7ce6ee2a19),
this introduced a test failure.

This commit drops the owner restriction from libapparmor
unbalanced_parenthesis.profile. While this is technically wrong, it's
the expected result in the 2.11 branch.
2019-11-27 23:26:40 +01:00
Christian Boltz
b0356dc64f Merge branch 'cboltz-abstractions-kerberos' into 'master'
abstractions/kerberosclient: allow reading /etc/krb5.conf.d/

See merge request apparmor/apparmor!425

Acked-by: Steve Beattie <steve@nxnw.org> for 2.10..master
Acked-by: John Johansen <john.johansen@canonical.com> for 2.10..master


(cherry picked from commit 663546c284)

dffed831 abstractions/kerberosclient: allow reading /etc/krb5.conf.d/
2019-11-18 21:36:06 +00:00
Christian Boltz
2437a386f5 Merge branch 'cboltz-pyflakes-version' into 'master'
README: add PYFLAKES=/usr/bin/pyflakes3 env variable

See merge request apparmor/apparmor!429

Acked-by: John Johansen <john.johansen@canonical.com> for 2.11..master

(cherry picked from commit 1567ea6f4c)

556bb94a README: add PYFLAKES=/usr/bin/pyflakes3 env variable
2019-10-24 21:09:10 +00:00
Christian Boltz
e9f95fbab7 Merge branch 'cboltz-status-parenthesis' into 'master'
aa-status: handle profile names containing '('

Closes #51

See merge request apparmor/apparmor!415

Acked-by: John Johansen <john.johansen@canonical.com> for 2.10..master

(cherry picked from commit b76567ce10)

41d26b01 aa-status: handle profile names containing '('
2019-09-23 18:56:04 +00:00
Paulo Gomes
d34f8bc63a Fix capability mispelling.
PR: https://gitlab.com/apparmor/apparmor/merge_requests/421
(cherry picked from commit 2d19d4d159)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-09-20 02:16:21 -07:00
Tyler Hicks
44c83f000a parser: Fix typoed example dbus rule in apparmor.d(5) man page
Remove extra closing parenthesis.

Bug: https://launchpad.net/bugs/1838991
Fixes: 46586a6334 ("parser: Add example dbus rule for unconfined peers")
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>

(cherry picked from commit 7df48adae5)
Ref: https://gitlab.com/apparmor/apparmor/merge_requests/410
Acked-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2019-08-05 17:12:15 +00:00
Christian Boltz
7ce6ee2a19 Merge branch 'cboltz-unbalanced-parenthesis' into 'master'
Fix crash on unbalanced parenthesis in filename

See merge request apparmor/apparmor!402

Seth Arnold <seth.arnold@canonical.com> for 2.10..master

(cherry picked from commit db1f391844)

8f74ac02 Fix crash on unbalanced parenthesis in filename
2019-07-09 19:45:57 +00:00
Christian Boltz
e6477cfe66 Merge branch 'cboltz-2.13-certbot' into 'apparmor-2.13'
[2.10..2.13] Add for Certbot on openSUSE Leap

See merge request apparmor/apparmor!398

Acked-by: John Johansen <john.johansen@canonical.com> for 2.10..2.13

(cherry picked from commit 14a11e67a5)

8b766451 Add for Certbot on openSUSE Leap
2019-06-30 07:15:06 +00:00
John Johansen
119e761bab Release: Bumper version for the 2.11.3 release
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-06-18 02:21:11 -07:00
Christian Boltz
8d183e67b8 syslog-ng: add abstractions/python for python-parser
When running syslog-ng with a defined python-parser, it needs access to
python libraries.

For details about python-parser, see
https://www.syslog-ng.com/community/b/blog/posts/format-your-log-messages-in-python

References: https://github.com/balabit/syslog-ng/issues/2625
PR: https://gitlab.com/apparmor/apparmor/merge_requests/361
(cherry picked from commit 234a924480)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-06-13 17:42:27 -07:00
Jörg Sommer
348411b19f parser: Fix parsing of arrow “px -> …”
The parser failed to read the profile name after the the arrow. Rules with
`-> foo-bar;` failed with “Found unexpected character: '-'”. Rules with
`-> @{tgt};` compiled fine, but failed at runtime with “profile transition
not found”.

The patch was written by sbeattie and published on
https://paste.ubuntu.com/p/tzxxmVwGJ8/

https://matrix.to/#/!pNJIrowvqsuGgjXsEY:matrix.org/$15477566201815716pmube:matrix.org?via=matrix.org&via=alea.gnuu.de
PR: https://gitlab.com/apparmor/apparmor/merge_requests/334
(cherry picked from commit 0e0663e99e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-06-13 17:37:14 -07:00
John Johansen
557aa290c3 libapparmor python: Fix 'aa_log_record' object has no attribute '__getattr__'
When building with swig 4 we are seeing the error

AttributeError: 'aa_log_record' object has no attribute '__getattr__'

Which forces swig to use modern classes which do not generate __getattr__
methods.

issue: https://gitlab.com/apparmor/apparmor/issues/33
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit a6ac6f4cfc)
2019-06-04 21:52:21 -07:00
John Johansen
97e50749af tests/regression: fix mount test to use next available loop device
looping through the first 16 loop devices to find a free device will
fail if those mount devices are taken, and unfortunately there are
now services that use an excessive amount of loop devices causing
the regression test to fail.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/379
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
(cherry picked from commit ab0f2af1da)
2019-05-11 22:27:52 -07:00
Christian Boltz
0907446dbb Merge branch 'cboltz-fix-deny-hat' into 'apparmor-2.13'
[2.11..2.13] handle_children: Fix denying of adding a hat

See merge request apparmor/apparmor!378

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit d2e83231f0)

87f91864 handle_children: Fix denying of adding a hat
2019-05-02 22:19:34 +00:00
Christian Boltz
832a0c2ddb Merge branch 'cboltz-link-man' into 'master'
Drop 'to' option for link rules from manpage

See merge request apparmor/apparmor!368

Acked-by: Eric Chiang <ericchiang@google.com>

(cherry picked from commit 041cd95a98)

115a1d89 Drop 'to' option for link rules from manpage
2019-04-29 19:22:35 +00:00
Christian Boltz
c9241c1d93 Merge branch 'cboltz-gitignore' into 'master'
Add several libapparmor/swig/ruby files to gitignore

See merge request apparmor/apparmor!366

(cherry picked from commit 9c11ce37c6)

7ed1a16a Add several libapparmor/swig/ruby files to gitignore
2019-04-26 16:16:49 +00:00
Goldwyn Rodrigues
f1aa1e9183 identd: Add network netlink dgram
identd requires access to network netlink dgram.

(cherry picked from commit 1d75abba3f)
PR: https://gitlab.com/apparmor/apparmor/merge_requests/353
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-03-29 01:08:36 -07:00
Simon Deziel
bc1fb4dab4 dovecot: master SIGTERM child that are slow to die
When doing a service reload, I noticed the following:

    ```Mar 22 15:52:27 smtp dovecot: master: Warning: SIGHUP received - reloading configuration
    Mar 22 15:52:27 smtp dovecot: imap(simon): Server shutting down. in=35309 out=232805
    Mar 22 15:52:27 smtp dovecot: imap(simon): Server shutting down. in=24600 out=1688166
    Mar 22 15:52:27 smtp dovecot: imap(simon): Server shutting down. in=14026 out=95516
    Mar 22 15:52:27 smtp dovecot: imap(simon): Server shutting down. in=13776 out=141513
    Mar 22 15:52:33 smtp dovecot: master: Warning: Processes aren't dying after reload, sending SIGTERM.
    Mar 22 15:52:33 smtp dovecot: master: Error: service(imap): kill(5806, 15) failed: Permission denied
    Mar 22 15:52:33 smtp dovecot: master: Error: service(imap-login): kill(5804, 15) failed: Permission denied
    Mar 22 15:52:33 smtp dovecot: master: Error: service(config): kill(506, 15) failed: Permission denied
    Mar 22 15:52:33 smtp kernel: [65542.184326] audit: type=1400 audit(1553284353.609:82): apparmor="DENIED" operation="signal" profile="dovecot" pid=414 comm="dovecot" requested_mask="send" denied_mask="send" signal=term peer="/usr/lib/dovecot/imap"
    Mar 22 15:52:33 smtp kernel: [65542.197596] audit: type=1400 audit(1553284353.625:83): apparmor="DENIED" operation="signal" profile="dovecot" pid=414 comm="dovecot" requested_mask="send" denied_mask="send" signal=term peer="/usr/lib/dovecot/imap-login"
    Mar 22 15:52:33 smtp kernel: [65542.197635] audit: type=1400 audit(1553284353.625:84): apparmor="DENIED" operation="signal" profile="dovecot" pid=414 comm="dovecot" requested_mask="send" denied_mask="send" signal=term peer="/usr/lib/dovecot/config"
    Mar 22 15:52:36 smtp dovecot: imap(simon): Server shutting down. in=17882 out=104004
    ```

The server was heavily loaded which is probably why it ended up trying to SIGTERM those.

Signed-off-by: Simon Deziel <simon@sdeziel.info>
(cherry picked from commit f01fd38ca0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-03-22 16:07:55 -07:00
Christian Boltz
c461e09e70 Merge branch 'cboltz-subshell' into 'master'
remove_profiles(): Fix returning $retval

See merge request apparmor/apparmor!352

Acked-by: Eric Chiang <ericchiang@google.com> for 2.11..master

(cherry picked from commit c9148a304c)

be02f008 remove_profiles(): Fix returning $retval
2019-03-18 17:46:45 +00:00
John Johansen
e0faaa4c4b parser: Fix parser failing to handle errors when setting up work
The parser is not correctly handling some error conditions when
dealing with work units. Failure to spawn work, access files, etc
should be returned where appropriate, and be able to abort processing
if abort_on_error is set.

In addition some errors are leading to a direct exit without checking
for abort_on_error.

BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=921866
BugLink: http://bugs.launchpad.net/bugs/1815294

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Eric Chiang <ericchiang@google.com>
(cherry picked from 2.12 commit 7cd903dd20)
2019-02-22 02:48:53 -08:00
Christian Boltz
628b32b79b Merge branch 'dovecot-fixes-no-doveadm' into 'master'
misc dovecot fixes (take #2)

See merge request apparmor/apparmor!336

Acked-by: Christian Boltz <apparmor@cboltz.de> for master..2.10

(cherry picked from commit e68beb988a)

a57f01d8 dovecot: allow FD passing between dovecot and dovecot's anvil
d0aa863f dovecot: allow chroot'ing the auth processes
9afeb225 dovecot: let dovecot/anvil rw the auth-penalty socket
17db8f38 dovecot: auth processes need to read from postfix auth socket
6a7c49b1 dovecot: add abstractions/ssl_certs to lmtp
2019-02-17 21:04:59 +00:00
Marius Tomaschewski
c513fc5a92 abstractions/nameservice: allow /run/netconfig/resolv.conf
Latest netconfig in openSUSE writes /run/netconfig/resolv.conf, and only
has a symlink to it in /etc

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1097370
Acked-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit b0bacba9db)
2019-01-24 02:46:13 -08:00
Jamie Strandboge
7ec06ad58c Merge branch 'update-fonts' into 'master'
Update fonts for Debian and openSUSE

- Allow to read conf-avail dir itself.
- Add various openSUSE-specific font config directories.

See merge request !96 (merged) for details.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/309
(cherry picked from commit 7bd3029f25)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2019-01-23 20:12:04 -08:00
Christian Boltz
cb0be22f71 Merge branch 'fix-compose-cache' into 'master'
qt5-compose-cache-write: fix anonymous shared memory access

See merge request apparmor/apparmor!301

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 027dcdb23f)

12504024 qt5-compose-cache-write: fix anonymous shared memory access
2019-01-14 20:51:43 +00:00
Christian Boltz
8927707d3d Merge branch 'fix-qt5-settings' into 'master'
qt5-settings-write: fix anonymous shared memory access

See merge request apparmor/apparmor!302

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 3e3c90152f)

f1200873 qt5-settings-write: fix anonymous shared memory access
8f6a8fb1 Refactor qt5-settings-write
2019-01-14 20:48:55 +00:00
Christian Boltz
bbff85af4c Merge branch 'var-lib-dehydrated' into 'master'
abstractions/ssl_{certs,keys}: dehydrated uses /var/lib on Debian

See merge request apparmor/apparmor!299

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 1f53de174d)

1306f9a6 abstractions/ssl_{certs,keys}: dehydrated uses /var/lib on Debian
c5a89d5d abstractions/ssl_{certs,keys}: sort the alternation for dehydrated and drop...
04b2842e abstractions/ssl_{certs,keys}: allow reading ocsp.der maintained by dehydrated for OCSP stapling
2019-01-03 17:33:24 +00:00
John Johansen
5afe0f8889 Release: Bump revisions in preparation for 2.11.2 release
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-12-21 04:09:23 -08:00
Christian Boltz
9c7e71358c dovecot: allow reading /proc/sys/fs/suid_dumpable
This is needed if a dovecot child process segfaults - in this case,
dovecot provides a helpful error message like

dovecot[6179]: auth-worker: Fatal: master: service(auth-worker): child 8103 killed with signal 11 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2)

which involves reading the current value in suid_dumpable.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/286
(cherry picked from commit 2202a8a267)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-12-08 00:34:11 -08:00
Christian Boltz
d39706edf7 Ignore *.orig and *.rej files when loading profiles
or: get rc.apparmor.functions in sync with the tools and libapparmor.

This was "accidently" reported by Ralph on the opensuse-support
mailinglist.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/282
(cherry picked from commit 228b92ce5a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-12-08 00:19:06 -08:00
Petr Vorel
0e8d4e09f8 dnsmasq: Add pid file used by NetworkManager
PR: https://gitlab.com/apparmor/apparmor/merge_requests/288
Signed-off-by: Petr Vorel <pvorel@suse.cz>
(cherry picked from commit 49848b9081)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-12-07 22:29:13 -08:00
Petr Vorel
1765cbdc15 dnsmasq: Adjust pattern for log files to comply SELinux
i.e. move '*' from beginning to before suffix.

Commit 025c7dc6 ("dnsmasq: Add permission to open log files") added
pattern, which is not compatible with SELinux. As this pattern has been
in SELinux since 2011 (with recent change to accept '.log' suffix +
logrotate patterns which are not relevant to AppArmor) IMHO it's better
to adjust our profile.

Fixes: 025c7dc6 ("dnsmasq: Add permission to open log files")
PR: PR: https://gitlab.com/apparmor/apparmor/merge_requests/288
Signed-off-by: Petr Vorel <pvorel@suse.cz>
(cherry picked from commit 3ef8df6ac0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-12-07 22:29:01 -08:00
Christian Boltz
bee5ed218a Merge branch 'certbot' into 'master'
Add /etc/letsencrypt/archive to ssl_key abstraction

See merge request apparmor/apparmor!283

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 0a666b8e48)

cb468786 Add /etc/letsencrypt stuff to ssl_keys/ssl_certs abstraction
2018-11-30 15:44:43 +00:00
Vincas Dargis
be0fdfb03c Merge branch 'backport-vulkan' into 'apparmor-2.13'
Backport: Add vulkan abstraction

See merge request apparmor/apparmor!266

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..2.13

(cherry picked from commit 6249579842)

31461701 Add vulkan abstraction
2018-11-22 17:36:43 +00:00
John Johansen
ccc744b9ff Merge branch 'cboltz-gitignore-2.11' into 'apparmor-2.11'
[2.10+2.11] Backport lots of .gitignore additions from 2.12

The only entries that wouldn't be needed in 2.11 are

cscope.*
libraries/libapparmor/src/PMurHash.lo
libraries/libapparmor/src/PMurHash.o

but they don't hurt, and keeping .gitignore in sync in all branches makes things easier.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/260
Acked-by: John Johansen <john.johansen@canonical.com>
2018-11-09 01:47:21 +00:00
Christian Boltz
8bba589d2d Backport lots of .gitignore additions from 2.12
The only entries that wouldn't be needed in 2.11 are

- cscope.*
- libraries/libapparmor/src/PMurHash.lo
- libraries/libapparmor/src/PMurHash.o

but they don't hurt, and keeping .gitignore in sync in all branches
makes things easier.
2018-11-06 23:26:53 +01:00
Christian Boltz
9c9b79faed Merge branch 'cboltz-strict-todo-check' into 'master'
error out on superfluous TODOs

See merge request apparmor/apparmor!197

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 39a2031487)

4b26850e error out on superfluous TODOs
2018-11-06 21:15:12 +00:00
Christian Boltz
3c53ad55df Merge branch 'cboltz-disable-some-abi-tests' into 'master'
disable abi/ok_10 and abi/ok_12 tests

See merge request apparmor/apparmor!259

(cherry picked from commit 608af94dff)

a3305b51 disable abi/ok_10 and abi/ok_12 tests
2018-11-06 20:43:36 +00:00
Christian Boltz
68b8bbeada Merge branch 'cboltz-fixed-todos' into 'master'
Remove TODO notes from no-longer-failing tests

See merge request apparmor/apparmor!180

Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: intrigeri <intrigeri@debian.org>

(cherry picked from commit c98d8570ee)

d15bdaba Remove TODO notes from no-longer-failing tests
2018-11-06 17:51:29 +00:00
Christian Boltz
509f56e22c Merge branch 'cboltz-postalias' into 'master'
allow locking /etc/aliases.db

See merge request apparmor/apparmor!250

Acked-by: intrigeri <intrigeri@debian.org>

(cherry picked from commit 473d1f5daa)

f74edd5d allow locking /etc/aliases.db
2018-10-26 14:40:04 +00:00
Christian Boltz
52c3b487d0 aa-notify man page: update user's configuration file path
This is a backport of !239

    commit 2209e09aef
    Author: nl6720 <nl6720@gmail.com>

    aa-notify man page: update user's configuration file path

    Signed-off-by: nl6720 <nl6720@gmail.com>

PR: https://gitlab.com/apparmor/apparmor/merge_requests/243
(backported from commit 2209e09aef)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-21 19:40:43 -07:00
John Johansen
a91c1e4329 parser: ignore feature abi rules
AppArmor 3.0 requires policy to use a feature abi rule for access to
new features. However some policy may start using abi rules even if
they don't have rules that require new features.  This is especially
true for out of tree policy being shipped in other packages.

Add enough support to older releases that the parser will ignore the
abi rule and warn that it is falling back to the apparmor 2.x
technique of using the system abi.

If the profile contains rules that the older parser does not
understand it will fail policy compilation at the unknown rule instead
of the abi rule.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/196
(backported form commit 83df7c4747)
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2018-10-21 19:40:26 -07:00
John Johansen
e4fc384ae2 Merge branch 'cboltz-2.11-revert-sbin-bin' into 'apparmor-2.11'
[2.11] revert {bin,sbin} and some more profile name changes

Revert two commits that changed the profile name (which also meens signal peer=... rules need to be changed), which is something we should avoid in an old branch.
revert backport of https://gitlab.com/apparmor/apparmor/merge_requests/149 (merged):

PR: https://gitlab.com/apparmor/apparmor/merge_requests/248
Acked-by: John Johansen <john.johansen@canonical.com>
2018-10-22 02:09:48 +00:00
Christian Boltz
002fda8718 Revert "profiles: support distributions which merge sbin into bin"
This changed the profile names and needs adjustments to "signal
peer=..." rules, which is something we should avoid in an old branch.

The reverted commit is

commit 0ce15469ec
Author: Cameron Nemo <camerontnorman@gmail.com>
Date:   Wed Jul 25 14:07:35 2018 -0700

    profiles: support distributions which merge sbin into bin

    Closes #8

    (cherry picked from commit 9ab45d811e)
    Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-21 13:32:07 +02:00
Christian Boltz
e5a72e8efb revert "profiles: support void-specific binary names for openntpd, traceroute, and ping"
This reverts the following commit which changes the profile names -
something we should avoid on an old branch.

commit ae3e230b053e0521f54ea1590326dae895b7642c
Author: Cameron Nemo <camerontnorman@gmail.com>
Date:   Tue Sep 11 09:54:33 2018 -0700

    profiles: support void-specific binary names for openntpd, traceroute, and ping

    (cherry picked from commit 6e28a94ace)
    Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-21 13:25:36 +02:00
Christian Boltz
eaa7f03064 Merge branch 'test-includes' into 'apparmor-2.12'
profiles/Makefile: test abstractions against apparmor_parser

See merge request apparmor/apparmor!244

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10, 2.11 and 2.12.

(cherry picked from commit 500b857d24)

93ccf15c profiles/Makefile: test abstractions against apparmor_parser
2018-10-18 17:15:07 +00:00
Christian Boltz
904536f7cf Add most abi/bad_*.sd tests to "exception not raised" list
Interestingly, abi/bad_6.sd is detected as invalid, and therefore not
added to the list.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/238
(cherry picked from commit 5c54f66279)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-13 14:35:29 -07:00
John Johansen
8248e01591 Merge branch 'cboltz-nmbd-systemd' into 'master'
References: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1719354
(comment 8)

PR: https://gitlab.com/apparmor/apparmor/merge_requests/236
Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit 924d4e87ad)

d4afbccb nmbd profile: allow writing to /run/systemd/notify
2018-10-12 23:17:37 +00:00
John Johansen
18d8ffe41e parser: do not output cache warning for stdin if not using cache
Currently if stdin is used the warning
  apparmor_parser: cannot use or update cache, disable, or force-complain via stdin

is always displayed but if caching has been disabled there is no need for
this message.

(backported from commit c421a29c61)
PR: https://gitlab.com/apparmor/apparmor/merge_requests/233
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2018-10-11 22:17:25 -07:00
Christian Boltz
69d3d71cd9 Merge branch 'cboltz-mergeprof-hasher-fun' into 'master'
Fix aa-mergeprof crash caused by accidentially initialzed hat

See merge request apparmor/apparmor!234

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 93445ca02d)

bc492533 Fix aa-mergeprof crash caused by accidentially initialzed hat
2018-10-11 19:50:05 +00:00
Christian Boltz
299953ab7b .gitignore profiles/apparmor.d/local/* except README
The old patter *.* doesn't match lsb_release and nvidia_modprobe, and
the only file we ship in local is a README. This patch adjusts the
pattern to ignore everything except README.

(cherry picked from commit aeee9a1aab)
PR: https://gitlab.com/apparmor/apparmor/merge_requests/227
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-11 10:28:02 -07:00
Christian Boltz
2b447d3fce add new location for ssl-params file
(probably Ubuntu-only? The ssl-params file doesn't exist on my openSUSE
installation)

References: https://bugs.launchpad.net/apparmor-profiles/+bug/1796966
(cherry picked from commit 16a98d26d0)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-09 16:55:56 -07:00
John Johansen
c8ca044d28 libapparmor: Finish removing LD_RUN_PATH from Makefile.perl
commit 94dfe15b28 attempted to remove
LD_RUN_PATH unfortunately

   But all it actually does is cause the Makefile.perl to embed the rpath
    "" instead. Which is still an rpath, only I guess an even worse one.

    --
    Eli Schwartz
    Arch Linux Bug Wrangler and Trusted User

This is because it cleared the setting of the variable LD_RUN_PATH
which was expanded in the command

$(INST_DYNAMIC) : $(OBJECT) $(MYEXTLIB) $(INST_ARCHAUTODIR)$(DFSEP).exists $(EXPORT_LIST) $(PERL_ARCHIVEDEP) $(PERL_ARCHIVE_AFTER) $(INST_DYNAMIC_DEP)
	$(RM_F) $@
	 LD_RUN_PATH="$(LD_RUN_PATH)" $(LD)  $(LDDLFLAGS) $(LDFROM) $(OTHERLDFLAGS) -o $@ $(MYEXTLIB) \
	  $(PERL_ARCHIVE) $(LDLOADLIBS) $(PERL_ARCHIVE_AFTER) $(EXPORT_LIST) \
	  $(INST_DYNAMIC_FIX)
	$(CHMOD) $(PERM_RWX) $@

resulting in LD_RUN_PATH="" being passed to the command.

Finish removing LD_RUN_PATH from Makefile.perl by removing it from
the command invocation if it is present.

Note: we use \x24 instead of $ in the regex as there seems to be a bug
and no level of escaping $ would allow it to be used.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/207
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
(cherry picked from commit 958cc28876)
2018-10-09 16:46:27 -07:00
Christian Boltz
108e8afe6b Merge branch 'sys-by-default' into 'master'
Make @{sys} available by default

See merge request apparmor/apparmor!228

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 772a8702e0)

aa065287 Make @{sys} available by default
2018-10-09 22:30:46 +00:00
Petr Vorel
1bb6223de4 dnsmasq: Add permission to open log files
--log-facility option needs to have permission to open files.
Use '*' to allow using more files (for using more dnsmasq instances).

Signed-off-by: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Jamie Strandboge <jamie@canonical.com>
(cherry picked from commit 025c7dc6a1)
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2018-10-09 09:07:50 -07:00
Christian Boltz
4f8eaf8782 Merge branch 'fix-bison' into 'master'
parser: fix Makefile hardcoded paths to flex and bison

Closes #4

See merge request apparmor/apparmor!224

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 34cf085036)

17e059a2 parser: fix Makefile hardcoded paths to flex and bison
2018-10-05 19:04:07 +00:00
John Johansen
3e527d903f Merge branch 'cboltz-2.11-utils-abi' into 'apparmor-2.11'
2.11: Add basic support for abi rules to the tools

Add basic "understand and keep" support for abi rules, where
"understand" means to not error out when seeing an abi rule, and "keep"
simply means to keep the original abi rule when serializing a profile.

On the long term, abi rules should be parsed (similar to include rules),
but for now, this patch is the smallest possible changeset and easy to
backport.

Note that the only added test is via cleanprof_test.* which is used by
minitools_test.py - and does not run if you do a 'make check'.
Oh, and of course the simple_tests/abi/ files also get parsed by
test-parser-simple-tests.py.

BTW: Even serialize_profile_from_old_profile() can handle abi rules ;-)

This is a backport of 072d3e04 / !202 (merged) to
2.11 (with some adjustments because that commit didn't appy cleanly)

I propose this patch for 2.10 and 2.11.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/223
Acked-by: John Johansen <john.johansen@canonical.com>
2018-10-05 07:09:46 +00:00
John Johansen
72232e0919 Merge branch 'cboltz-2.11-cache.d' into 'apparmor-2.11'
2.11/2.10: is_skippable_dir(): add 'cache.d' to exclude list

This excludes the /etc/apparmor.d/cache.d/ directory from aa-logprof
parsing because parsing the binary cache, well, takes a while :-/
Reported on the opensuse-factory mailinglist by Frank Krüger and
confirmed by others.

(cherry picked from commit 5b9497a8)

While this isn't strictly needed for 2.10 or 2.11 userspace, it makes testing these branches easier ;-)

I propose this cherry-pick for 2.11 (= this merge request) and 2.10.

https://gitlab.com/apparmor/apparmor/merge_requests/222
Acked-by: John Johansen <john.johansen@canonical.com>
2018-10-05 07:04:46 +00:00
John Johansen
7c6a592ceb Merge branch 'cboltz-2.11-utils-tests' into 'apparmor-2.11'
make 2.11 utils tests green

- switch minitools_test.py to a profile without alternation
- remove non-failing tests from unknown_line exception
- exclude several #include "does not exist" examples

PR: https://gitlab.com/apparmor/apparmor/merge_requests/220
2018-10-05 06:59:44 +00:00
nl6720
b0f55894f8 aa-notify: Read user's configuration file from XDG_CONFIG_HOME
Legacy path ~/.apparmor/notify.conf is preferred if it exists, otherwise
$XDG_CONFIG_HOME/apparmor/notify.conf, with fallback to
~/.config/apparmor/notify.conf, is used.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/215
Signed-off-by: nl6720 <nl6720@gmail.com>
(cherry picked from commit 1fb9acc59e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-04 23:40:13 -07:00
Christian Boltz
70ecff9962 Merge branch 'profile-usr.sbin.smbd' into 'master'
Add missing paths to usr.sbin.nmbd, usr.sbin.smbd and abstractions/samba

See merge request apparmor/apparmor!210

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit f76a718f28)

80e98f2d Update usr.sbin.nmbd & usr.sbin.smbd
2018-10-04 20:34:41 +00:00
Christian Boltz
8a32ae5143 2.11: Add basic support for abi rules to the tools
Add basic "understand and keep" support for abi rules, where
"understand" means to not error out when seeing an abi rule, and "keep"
simply means to keep the original abi rule when serializing a profile.

On the long term, abi rules should be parsed (similar to include rules),
but for now, this patch is the smallest possible changeset and easy to
backport.

Note that the only added test is via cleanprof_test.* which is used by
minitools_test.py - and does _not_ run if you do a 'make check'.
Oh, and of course the simple_tests/abi/ files also get parsed by
test-parser-simple-tests.py.

BTW: Even serialize_profile_from_old_profile() can handle abi rules ;-)

This is a backport of 072d3e0451 / !202 to
2.11 (with some adjustments because that commit didn't appy cleanly)
2018-10-03 21:28:44 +02:00
Christian Boltz
cdaf5075cb is_skippable_dir(): add 'cache.d' to exclude list
This excludes the /etc/apparmor.d/cache.d/ directory from aa-logprof
parsing because parsing the binary cache, well, takes a while :-/

Reported on the opensuse-factory mailinglist by Frank Krüger and
confirmed by others.

(cherry picked from commit 5b9497a8c6)
2018-10-03 20:25:33 +02:00
Christian Boltz
9fb21a702c switch minitools_test.py to a profile without alternation
... instead of backporting support for alternations in profile names to
2.11
2018-10-03 19:35:11 +02:00
Christian Boltz
d55d99cbf1 remove non-failing tests from unknown_line exception
bare_include_tests/ok_30.sd and ok_31.sd don't fail with the 2.11 tools.
Remove them from the unknown_line exception.

(Interestingly newer branches fail on these tests, but I didn't check why.)
2018-10-03 19:31:55 +02:00
Christian Boltz
e07ec63313 exclude several #include "does not exist" examples
These tests were added with the cherry-picked commit 4184b0c363

They are expected to fail, but don't fail with the 2.11 tools because
the regex only matches   #include <...>   which means   #include "..."
is considered to be a comment.
2018-10-03 19:27:24 +02:00
Christian Boltz
09050a8a8b Merge branch 'cboltz-2.12-fix-utils-po' into 'apparmor-2.12'
Remove accidently added text from utils/po/Makefile

See merge request apparmor/apparmor!217

Acked-by: Tyler Hicks <tyhicks@canonical.com>

(cherry picked from commit fa82a51523)

15770576 Remove accidently added text from utils/po/Makefile
2018-10-03 16:30:11 +00:00
Vincas Dargis
5260be0518 Add qt5-compose-cache-write abstraction
Qt GUI applications that uses "platforminputcontexts"-class of plugins
might need reading and/or writing compose cache. Add read-only rule in
qt5 abstraction and create new writing dedicated for compose cache
writing.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/159
(cherry picked from commit 67816c42cf)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-02 23:08:16 -07:00
Vincas Dargis
7bf4f3a9a0 Add qt5-write abstraction
Qt-based applications stores QFileDialog (latest browsed directory) and
other shared user settings inside ~/.config/QtProject.conf. Currently
available qt abstraction only allows to read it (by design), so this
patch introduces abstraction that grants permissions for writing.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/159
(cherry picked from commit 69c4cabb93)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-02 23:08:16 -07:00
Vincas Dargis
9af6d0ec0c Add qt5 abstraction
Create abtractions/qt5 with common rules needed for Qt5-based
applications.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/99
(cherry picked from commit 6a85ffe00e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-02 23:08:16 -07:00
Vincas Dargis
b631b209f5 Include qt5 into kde abstraction
Currently, kde abstraction has rules relevant to Qt 3 and Qt 4
libraries, but are missing rules against latest Qt 5.

Include read-only Qt 5 abstraction to fix styling and similar issues for
software running on KDE 5 desktop.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/209
Fixes https://bugs.launchpad.net/apparmor/+bug/1787201
(cherry picked from commit bd33cdd19a)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-01 08:53:02 -07:00
Vincas Dargis
d1dd46d767 Add uid and uids kernel var placeholders
Add @{uid} and @{uids} variables to allow migrating profiles in advance
while awaiting path mediation implementation, based on current user id,
in kernel side.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/208
(cherry picked from commit cba10db7e7)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-10-01 08:53:02 -07:00
John Johansen
f6b497dd0c Merge branch 'harden-abstractions-part-ii' into 'apparmor-2.11'
Harden abstractions part ii

- abstractions/private-files: disallow access to the dirs of private files
- private-files{,-strict}: disallow writes to parent dirs too
- user-files: disallow writes to parents dirs

PR: https://gitlab.com/apparmor/apparmor/merge_requests/206
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-27 13:51:29 -07:00
Jamie Strandboge
0e79f739be similar change for user-files 2018-09-27 13:51:11 -07:00
Jamie Strandboge
b8063e3342 private-files{,-strict}: disallow writes to parent dirs too 2018-09-27 13:51:11 -07:00
Emerson Bernier
660de9d4c3 abstractions/private-files: disallow access to the dirs of private files
Reference:
https://launchpad.net/bugs/1794820
2018-09-27 13:51:11 -07:00
Vincas Dargis
d0ffb0fb48 ubuntu-email: allow running Thunderbird wrapper script
gio-launch-desktop helper tries to execute /usr/bin/thunderbird wrapper
script, not the /usr/lib/thunderbird... directly.

Add rule allowing to execute /usr/bin/thunderbird.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/204
(cherry picked from commit cee9527fa8)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-27 12:23:38 -07:00
Vincas Dargis
a055c41207 Update abstraction for new Thunderbird executable path
* Add -bin suffix to reach new Thunderbird executable.

(cherry picked from commit 7546413b43)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-27 12:23:21 -07:00
John Johansen
582479235f Merge branch 'harden-abstractions' into 'apparmor-2.11'
Harden abstractions

    remove antiquated abstractions/launchpad-integration
    abstractions/private-files-strict: disallow access to the dirs of private files
    abstractions/private-files: disallow writes to thumbnailer dir (LP: #1788929)
    ubuntu-browsers.d/user-files: disallow access to the dirs of private files

    Nominating launchpad-integration and opencl-nvidia for 2.13. Nominating private-files-strict, private-files and user-files for 2.10 and higher

PR: https://gitlab.com/apparmor/apparmor/merge_requests/203
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-27 10:57:46 -07:00
Jamie Strandboge
4b178140d5 we don't need to adjust keyring**. Thanks cboltz 2018-09-27 10:56:45 -07:00
Jamie Strandboge
eb5f435c78 ubuntu-browsers.d/user-files: disallow access to the dirs of private files 2018-09-27 10:56:45 -07:00
Jamie Strandboge
2fa87eb12e abstractions/private-files: disallow writes to thumbnailer dir (LP: #1788929) 2018-09-27 10:56:45 -07:00
Jamie Strandboge
0a4a66a014 abstractions/private-files-strict: disallow access to the dirs of private files
Reference:
https://launchpad.net/bugs/1794820
2018-09-27 10:56:45 -07:00
Jamie Strandboge
6c889d3a35 remove antiquated abstractions/launchpad-integration 2018-09-27 10:56:45 -07:00
Christian Boltz
ca5386c09e Merge branch 'zsh' into 'master'
add zsh to logprof.conf

See merge request apparmor/apparmor!201

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 7e22b0a894)

00871696 add zsh to logprof.conf
2018-09-24 17:35:31 +00:00
nl6720
65c7a474e7 usr.sbin.dnsmasq: add paths for NetworkManager connection sharing
Also add /usr/share/dnsmasq/, DNSSEC trust anchors are kept there.

(cherry picked from commit 5bc7a9fbd6)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-19 00:12:22 -07:00
nl6720
4a817d423b usr.sbin.ntpd: add openntpd drift and socket files
(cherry picked from commit b3c4a73e2f)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-19 00:12:22 -07:00
Cameron Nemo
ae4e230b05 profiles: support void-specific binary names for openntpd, traceroute, and ping
(cherry picked from commit 6e28a94ace)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-19 00:12:22 -07:00
Cameron Nemo
0ce15469ec profiles: support distributions which merge sbin into bin
Closes #8

(cherry picked from commit 9ab45d811e)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-19 00:12:19 -07:00
Christian Boltz
c0328fc460 add python3.7 to logprof.conf
(cherry picked from commit db096135eb)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-14 16:57:31 -07:00
John Johansen
64b8fdaa52 Documentation: Move README to README.md and sync with master branch
Move README to README.md to provide better integration with gitlab
and sync changes from master branch so we have badges, build info
etc.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-13 15:55:15 -07:00
Steve Beattie
46fd2b39d1 infrastructure: support make tarball for gitlab patch
This patch supports rolling a tarball for a release, as well as doing
'make tag'. Only stuff that's been committed should get incorporated
into the tarball.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 0b719e4f86)
2018-09-13 15:53:13 -07:00
Tyler Hicks
ed2090a875 README: Point to the security vuln section of the wiki
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
68d8fc0df7 README: Point to the new email address for security bug reports
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
cb37d500df README: Improve the bug reporting instructions
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
44094c6514 README: Move project contact info into the main README
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
1dc9f297e6 parser: Remove mention of wiretrip vulnerability handling policy
It looks as if the wiretrip domain has changed hands. The linked policy
page no longer exists.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
3350d482fe utils: Point to the correct Profiles wiki page
The URL redirect ends up at a page in the new wiki that doesn't exist.
We have to link directly to the gitlab URL here since the current URL
redirect doesn't let us use a wiki.apparmor.net URL and still reach the
expected Profiles page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Tyler Hicks
7d3c022651 all: Use HTTPS links for apparmor.net
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2018-09-13 11:52:11 -07:00
Christian Boltz
fe621b37c4 abstractions/php: allow ICU (unicode support) data tables
Reported by darix on IRC, and also something I noticed in my own usage
of PHP.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/184
(cherry picked from commit e396f9dae9)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-11 18:28:05 -07:00
Christian Boltz
c5bec9c0b5 remove unused exception binding in sandbox.py
pyflakes 2.0 is more strict and found that 'e' is never used.

References: https://build.opensuse.org/request/show/629206 (comment
section)

PR: https://gitlab.com/apparmor/apparmor/merge_requests/178
(cherry picked from commit 51482c33f5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-09-11 18:28:05 -07:00
Christian Boltz
9962cee942 add dehydrated certificate location to ssl_* abstractions
I don't use dehydrated myself, therefore this is based on the comments
on https://build.opensuse.org/request/show/533380

(cherry picked from commit 2e8b902248)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-08-07 23:56:40 -07:00
Christian Boltz
6c81024701 aa-genprof: don't crash if setting printk_ratelimit fails
When running aa-genprof in a lxd instance, printk_ratelimit is readonly
and writing to it fails. Instead of crashing with a backtrace, only
print a warning.

References: https://bugs.launchpad.net/apparmor/+bug/1785391
(cherry picked from commit 961e69afe5)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-08-07 03:05:32 -07:00
Steve Beattie
ccc86d8036 coverity build: capture separate log files for each coverity invocation
Each coverity command writes its debugging output to
cov-int/build-log.txt, which means that multiple runs of cov-build
overwrite previous logs, resulting in only the last invocation's output
remaining at the end of the build, making debugging why failures to
capture coverity output difficult. Fix this by renaming the build-log to
per-directory log files.

(This would still be an issue even if we had a single build command
for the entire tree, as capturing python and other interpreted
files requires a second invocation of cov-build to scan for those
file types.)

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/145
(cherry picked from commit fed101920b)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-08-07 02:44:43 -07:00
Christian Boltz
e82683d3f5 make message about notify-send package cross-distro compatible
PR: !144
References: https://bugzilla.opensuse.org/show_bug.cgi?id=1100779
(cherry picked from commit 44ee1d5090)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-08-07 02:32:31 -07:00
Christian Boltz
b1e19b7563 Merge branch 'add-path-to-abstractions-python' into 'master'
Allow /usr/local/lib/python3/dist-packages in abstractions/python

See merge request apparmor/apparmor!160

Acked-by: John Johansen <john.johansen@canonical.com>

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.10..master

(cherry picked from commit 763a6787d8)

6a10f076 Allow /usr/local/lib/python3/dist-packages in abstractions/python
2018-08-06 18:12:12 +00:00
Christian Boltz
6e068f9e25 comment out use_group to remove group restrictions
use_group is only honored if it is defined.

The "real" permission check is reading the logfile - the group check
in aa-notify is just an annoying additional check, and the default
"admin" only works on Ubuntu (other distributions typically use
"wheel").

This commit comments out use_group in the default config, which allows
everybody to use aa-notify. Permissions for reading the log file are of
course still needed.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/82
References: https://bugzilla.opensuse.org/show_bug.cgi?id=1058787
(cherry picked from commit 86ec3dd658)
Acked-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-07-11 22:45:42 -07:00
Christian Boltz
9f0d4cb5b4 profiles: adjust abstractions/python for python 3.7
Python 3.7 was released yesterday - and to make the abstraction
future-proof, also cover 3.8 and 3.9 in advance ;-)

(cherry picked from commit 01f41fbff8)

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/139
2018-06-29 11:25:13 -07:00
Christian Boltz
84b9b46fb0 Merge branch 'cboltz-nested-child-error' into 'master'
parse_profile_start(): Error out on nested child profiles

See merge request apparmor/apparmor!136

Acked-by: John Johansen <john.johansen@canonical.com> for 2.10..master

(cherry picked from commit b7a4f37cbb)

8462c39b parse_profile_start(): Error out on nested child profiles
2018-06-21 10:20:52 +00:00
Christian Boltz
11770f1702 profiles: update samba profiles
- allow smbd to load new shared libraries
- allow winbindd to read and write new kerberos cache location

Based on a patch by "Samuel Cabrero" <scabrero@suse.com>

(cherry picked from commit 23b5f29b80)

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1092099

Acked-by: Steve Beattie <steve@nxnw.org>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/121
2018-05-09 14:13:45 -07:00
Christian Boltz
93922246df utils: fix writing alias rules
write_pair() ignored the 'tail' parameter, which resulted in writing
invalid alias rules (without the trailing comma).

Also add an alias to test/cleanprof.* to ensure it doesn't break again.

(cherry picked from commit ae4ab62855)

Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/119
2018-05-08 08:00:33 -07:00
Christian Boltz
ae29fb0749 utils: fix writing "link subset" rules
Writing a "link subset" rule missed a space, which resulted in something
like
  link subset/foo -> /bar,

Also add a test rule to tests/cleanprof.* to ensure this doesn't break
again.

(cherry picked from commit 514535608f)

Acked-by: Steve Beattie <steve@nxnw.org>
PR: https://gitlab.com/apparmor/apparmor/merge_requests/117
2018-05-06 22:40:28 -07:00
Steve Beattie
a90e1eda2b mount regression test: convert mount test to use MS_NODEV
The mount regression test passes MS_MANDLOCK to the mount(2) syscall in
the test program. When the kernel is configured without
CONFIG_MANDATORY_FILE_LOCKING set, attempting to mount a filesystem with
this option always fails with EPERM. To fix, convert the test program to
use the MS_NODEV option instead.

(cherry picked from commit 49ba6af2bf)

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>

Bug: https://bugs.launchpad.net/apparmor/+bug/1765025
PR: https://gitlab.com/apparmor/apparmor/merge_requests/109
2018-04-30 13:38:02 -07:00
John Johansen
39399257ea Merge branch 'cboltz-dovecot-config' into 'master'
dovecot/config: allow dac_read_search and reading ssl-parameters.dat

See merge request apparmor/apparmor!95

Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit 5d973c2657)

c4e60719 dovecot/config: allow dac_read_search and reading ssl-parameters.dat
2018-04-14 21:24:28 +00:00
Christian Boltz
fdde7c9f74 Merge branch 'cboltz-dovecot-profiles' into 'master'
Dovecot profile updates

See merge request apparmor/apparmor!90

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 6b78daf25b)

36bdd6ea add dovecot/stats profile, and allow dovecot to run it
26a8b722 allow dovecot/auth to write /run/dovecot/old-stats-user
2018-04-13 13:57:15 +00:00
Christian Boltz
aabcfa51d8 Merge branch 'master' into 'master'
Fix typo in apparmor_parser.pod

See merge request apparmor/apparmor!85

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..master

(cherry picked from commit 47da50b7e6)

50ee50f9 Fix typo in apparmor_parser.pod
2018-03-26 19:50:56 +00:00
Christian Boltz
46ef60e979 Merge branch 'cboltz-fix-make-C-profiles' into 'master'
Fix $(PWD) when using "make -C profiles"

See merge request apparmor/apparmor!80

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 14096cb3a7)

20893382 Fix $(PWD) when using "make -C profiles"
2018-03-18 18:28:58 +00:00
Christian Boltz
3bdb7b1754 Merge branch 'cboltz-utils-test-ignore-include-if-exists' into 'master'
utils tests: ignore tests for 'include if exists'

See merge request apparmor/apparmor!78

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit e6ef536957)

dc7c7021 utils tests: ignore tests for 'include if exists'
2018-03-16 21:38:38 +00:00
Christian Boltz
c0786268f3 Merge branch 'cboltz-skip-git-dir' into 'master'
ignore .git in is_skippable_dir()

See merge request apparmor/apparmor!77

Acked-by: John Johansen <john.johansen@canonical.com>

(cherry picked from commit 3b5683be29)

f9eb3fea ignore .git in is_skippable_dir()
2018-03-16 21:36:20 +00:00
Steve Beattie
b40e1eefbd tests: Allow shell helper test read the locale
Merge branch 'sh-helper-read-locale' into 'master'

See merge request apparmor/apparmor!76

Signed-off-by: Steve Beattie <steve@nxnw.org>

(cherry picked from commit 130958a4a4)

2bc64070 tests: Allow shell helper test read the locale
2018-03-09 15:01:28 +00:00
Steve Beattie
e66ecb79e5 build: support coverity python scan
Coverity now supports scanning python (and other languages). Apply the
fs-capture-search option to the libapparmor and utils directpries to
capture the python source.

Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
(backported from commit d66720ef07)
2018-03-06 00:09:14 -08:00
Kees Cook
236c851bfe aa-status: split profile from exec name
Right now, if you have a named profile with regular expressions to
match binaries, the profile will be shown in aa-status under the
"process list", which doesn't make sense. Instead, show the actual
executable name, and if the profile name differs, report it at the
end (or as a separate field in the json output mode).

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-03-01 15:57:34 -08:00
Steve Beattie
892d113ba4 mlmmj-sub: fix moderated subscription
Merge branch 'cboltz-mlmmj-sub' into 'master'

See merge request apparmor/apparmor!70

Acked-by: Steve Beattie <steve@nxnw.org>

(cherry picked from commit 41b6182019)

8ef7b594 mlmmj-sub: fix moderated subscription
2018-02-22 23:06:10 +00:00
Christian Boltz
65c010ccc3 Merge branch 'cboltz-notify-dbus-env' into 'master'
set DBUS_SESSION_BUS_ADDRESS, needed by notify-send

See merge request apparmor/apparmor!53


Acked-by: intrigeri <intrigeri@debian.org> for 2.9..master

(cherry picked from commit 0eefeeb0e7)

cb5cdf26 set DBUS_SESSION_BUS_ADDRESS, needed by notify-send
2018-02-17 16:03:46 +00:00
Christian Boltz
2fdc5ca603 Merge branch 'fix-nvidia-dir' into 'master'
Allow to create .nv directory

See merge request apparmor/apparmor!69

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..master

(cherry picked from commit 21b0d14ea4)

11e7dab9 Allow to create .nv directory
2018-02-17 15:58:58 +00:00
Christian Boltz
872d3f3bc2 Merge branch 'update-base-abstraction' into 'master'
Update base abstraction for ld.so.conf and friends.

See merge request apparmor/apparmor!62

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..master

(cherry picked from commit e88af93322)

6d22c871 Update base abstraction for ld.so.conf and friends.
2018-02-15 20:15:09 +00:00
intrigeri
54725ee516 apparmor(7): clarify the effect of reloading a profile.
LP: #1608075

Partly fixes: https://bugs.debian.org/826218

(cherry picked from commit 967d394ef4)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-01-31 11:00:14 +01:00
Christian Boltz
4a76852648 tools: Mark profiles with multiple rules in one line as known-failing
The tools don't support having multiple rules in one line (they expect
\n after each rule), therefore mark some of the bare_include_tests as
known failures.

(cherry picked from commit 26af640fda)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-01-24 00:19:18 -08:00
Christian Boltz
c78752911e Merge branch 'cboltz-ntpd' into 'master'
allow access to ntp clockstats

See merge request apparmor/apparmor!54

(cherry picked from commit 85f8cace12)

1b58f226 allow access to ntp clockstats
2018-01-23 23:02:54 +00:00
Christian Boltz
7f074b6677 Merge branch 'master' into 'master'
abstractions/gnupg: allow pubring.kbx

See merge request apparmor/apparmor!58

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..trunk

(cherry picked from commit e1929298ac)

8fc3dcb3 abstractions/gnupg: allow pubring.kbx
2018-01-20 22:59:55 +00:00
John Johansen
1fe48e09dd regression tests: fix regression tests to pass on 4.14 upstream kernel
Some of the regression tests are missing conditionals or have the
wrong conditionals so that they fail on current upstream kernels.

Fix this by adding and changing conditionals and requires where
appropriate. With the patches the tests report passing on 4.14 and
4.15 kernels.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Time out
(cherry picked from commit 6f1d054468)
2018-01-20 01:47:02 -08:00
John Johansen
fa1d2a1fc1 parser: add support for conditional includes
This is a minimal patch to add conditional includes to the profile
language.

The syntax for conditional includes is similar to regular includes
except with the addition of "if exists" after "include"

  include if exists <foo/bar>
  include if exists "foo/bar"
  include if exists "/foo/bar"
  include if exists foo/bar

Note: The patch is designed to be backportable with minimum
effort. Cleanups and code refactoring are planned for follow up
patches that won't be back ported.

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 2ea3309942)
2018-01-20 00:46:50 -08:00
John Johansen
5e6948d2f9 parser tests: fix includes to allow white space
includes were not handling WS in path names correctly. Allow WS within
quotes. Eg
  include "foo bar"
  include <"foo bar">

BugLink: http://bugs.launchpad.net/bugs/1738880
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 8d142809f5)
2018-01-20 00:46:37 -08:00
John Johansen
4184b0c363 parser tests: add tests for relative path includes
Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit efd8eedd52)
2018-01-20 00:46:20 -08:00
Thorsten Kukuk
d97a8034fc disable write cache if filesystem is read-only
... and don't bail out

Patch by Thorsten Kukuk <kukuk@suse.com>

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1069906
            https://bugzilla.opensuse.org/show_bug.cgi?id=1074429

(cherry picked from commit 924983e702)
Signed-off-by: John Johansen <john.johansen@canonical.com>
2018-01-16 11:34:59 -08:00
John Johansen
41f29cbe1c parser: fix parser so that cache creation failure doesn't cause load failure
This is a minimal patch so that it can be backported to 2.11 and 2.10
which reverts the abort on error failure when the cache can not be
created and write-cache is set.

This is meant as a temporary fix for
https://bugzilla.suse.com/show_bug.cgi?id=1069906
https://bugzilla.opensuse.org/show_bug.cgi?id=1074429

where the cache location is being mounted readonly and the cache
creation failure is causing policy to not be loaded. And the
thrown parser error to cause issues for openQA.

Note: A cache failure warning will be reported after the policy load.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz apparmor@cboltz.de
(cherry picked from commit 42b68b65fe1861609ffe31e05be02a007d11ca1c)
2018-01-05 01:26:48 -08:00
John Johansen
1a3c0cd277 aa-decode: add the ability to support PROCTITLE string
buglink: https://bugs.launchpad.net/apparmor/+bug/1736841

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit 3afbfed9ee)
2017-12-24 00:26:17 -08:00
John Johansen
6cb59226bf profile: fix syslog-ng startup for some configurations
buglink: https://bugs.launchpad.net/bugs/1739909

Signed-off-by: John Johansen <john.johansen@canonical.com>
(cherry picked from commit e55583ff27)
2017-12-24 00:26:01 -08:00
John Johansen
2997b7d912 Merge branch 'cboltz-netstat' into 'master'
netstat: allow capability sys_ptrace,

See merge request apparmor/apparmor!46

(cherry picked from commit a3693f56f3)

81ca52d9 netstat: allow capability sys_ptrace,
2017-12-22 21:07:59 +00:00
John Johansen
6ffe9f5fda Merge branch 'cboltz-xauth' into 'master'
abstractions/X: add another location for .Xauthority

See merge request apparmor/apparmor!39

Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit bcfb735b9a)

bb96e38a abstractions/X: add another location for .Xauthority
2017-12-22 20:21:29 +00:00
John Johansen
8518a39a4b Merge branch 'cboltz-dovecot' into 'master'
Update /usr/lib/dovecot/* profiles

See merge request apparmor/apparmor!42

Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit f8b208ee80)

06928db1 Update /usr/lib/dovecot/* profiles
2017-12-22 20:20:29 +00:00
Christian Boltz
14ce11f608 Merge branch 'fix-pulse-config' into 'master'
Fix local pulseaudio config file access

See merge request apparmor/apparmor!38


Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..trunk

(cherry picked from commit 6713f9d94a)

f73627cb Fix local pulseaudio config file access
2017-12-17 16:20:05 +00:00
Christian Boltz
2b7313cdd2 Merge branch 'dovecot-signals' into 'master'
Fix signal sending for usr.sbin.dovecot

See merge request apparmor/apparmor!36

Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9..trunk

(cherry picked from commit 6db30f8faf)

9f24650e Fix signal sending for usr.sbin.dovecot
2017-12-16 17:26:54 +00:00
John Johansen
0ecc171de9 Merge branch 'cboltz-inherit-mr' into 'master'
handle_children(): automatically add m permissions on ix rules

See merge request apparmor/apparmor!22

Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit b2df42f55b)

7a49f37c handle_children(): automatically add m permissions on ix rules
2017-12-12 22:53:27 +00:00
John Johansen
d4218f6ca4 Merge branch 'cboltz-file-w-covered-by-a' into 'master'
FileRule: detect that 'a' is covered by 'w'

See merge request apparmor/apparmor!23

Acked-by: John Johansen <john.johansen@canonical.com>


(cherry picked from commit 6483c627d2)

1857f07d test-file.py: Document that w doesn't cover a yet
a0d4e246 FileRule: detect that 'a' is covered by 'w'
2017-12-12 22:52:10 +00:00
Tyler Hicks
d7bbfeee53 Merge branch 'cherry-pick-debc4e3f' into 'apparmor-2.11'
See merge request apparmor/apparmor!28

Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-12-05 18:45:30 +00:00
Tyler Hicks
e9287e066b Merge branch 'exit-from-Makefile-shell-snippets' into 'master'
binutils, parser, utils: Exit from Makefile shell snippets

See merge request apparmor/apparmor!27

Acked-by: Christian Boltz <apparmor@cboltz.de>

(cherry picked from commit debc4e3ffe)

2c04f44a binutils, parser, utils: Exit from Makefile shell snippets
2017-12-05 17:47:29 +00:00
Tyler Hicks
1872c52c6d Merge branch 'utils-check-depends-on-parser-2.11' into 'apparmor-2.11'
Utils check depends on parser

See merge request apparmor/apparmor!26

Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-12-05 17:40:14 +00:00
Tyler Hicks
da42248a95 README: Document that the parser should be built before the utils
The utils have tests that rely on the in-tree parser to be built so it
should be documented that the parser should be built first.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2017-12-04 23:12:14 +00:00
Tyler Hicks
fca085a352 utils: Gracefully handle a missing parser in the check target
The test-aa-easyprof.py script relies on the parser to be built so the
check target of the utils/test/Makefile should detect if the parser
exists before running any tests.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Christian Boltz <apparmor@cboltz.de>
2017-12-04 23:12:14 +00:00
Christian Boltz
2d0ab611b2 Merge branch 'cherry-pick-794d1c4a' into 'apparmor-2.11'
Merge branch 'cboltz-double-read-inactive' into 'master'

See merge request apparmor/apparmor!19

Acked-by: Seth Arnold seth.arnold@canonical.com for trunk, 2.11 and 2.10
2017-12-01 22:24:32 +00:00
Steve Beattie
8316d34b2b dovecot: allow capability dac_read_search
Merge branch 'cboltz-dovecot-caps' into 'master'

See merge request 
https://gitlab.com/apparmor/apparmor/merge_requests/16

(cherry picked from commit ca983811fb)

4ef505a6 dovecot: allow capability dac_read_search
2017-12-01 21:20:33 +00:00
Christian Boltz
bfbda33038 Merge branch 'cboltz-remove-unknown-newline' into 'master'
Don't print a literal '\n' in aa-remove-unknown help

See merge request apparmor/apparmor!21

Acked-by: Tyler Hicks tyhicks@canonical.com for 2.9..trunk

(cherry picked from commit 3d40bc6f23)

4d4228d1 Don't print a literal '\n' in aa-remove-unknown help
2017-12-01 10:09:58 +00:00
Christian Boltz
b4310a9366 Merge branch 'cboltz-double-read-inactive' into 'master'
Let read_inactive_profiles() do nothing when calling it the second time

See merge request apparmor/apparmor!17

(cherry picked from commit 794d1c4a07)

b307e535 Let read_inactive_profiles() do nothing when calling it the second time
2017-11-28 21:56:38 +00:00
Christian Boltz
67be2e9e9b Merge branch 'cboltz-dovecot-auth' into 'master'
allow dac_read_search and dac_override for dovecot/auth

See merge request apparmor/apparmor!14


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk

(cherry picked from commit 42bd81df01)

6f6b3c57 allow dac_read_search and dac_override for dovecot/auth
2017-11-27 21:38:14 +00:00
Christian Boltz
d1da150d97 Merge branch 'patch-1' into 'master'
Allow to read pulseaudio config subdirectories

See merge request apparmor/apparmor!12


Acked-by: Christian Boltz <apparmor@cboltz.de> for 2.9, 2.10, 2.11 and trunk

(cherry picked from commit 4b8b08562a)

9658471d Allow to read pulseaudio config subdirectories
2017-11-18 17:25:56 +00:00
Christian Boltz
16c83927c0 Merge branch 'utils_save_profiles_2.11' into 'apparmor-2.11'
utils: fix and improve "save profiles"

See merge request apparmor/apparmor!11
2017-11-14 20:28:03 +00:00
Christian Boltz
535b3074ab Remember selected profile in save_profiles()
After using "view changes", the selection got reset to the first changed
profile. This could mislead the user into saving the wrong profile.

This patch ensures the selection is kept.

Cherry-picked from master 051be5dec0
(+ whitespace adjustments)

Acked-by: Tyler Hicks <tyhicks@canonical.com> for master and 2.11
2017-11-14 21:19:25 +01:00
Christian Boltz
50b7db4e3d Fix sorted() regression in save_profiles()
The last change in save_profiles() sorted() the order in which the
changed profiles get displayed. However, it did not honor the sorting
when displaying changes or saving the selected profile, leading to the
wrong profile displayed or saved.

This patch fixes picking the selected profile, and at the same time
replaces the duplicated code for doing this with a single instance.

Note that the 2.11 branch needs a slightly different patch (different
indentation).

Also note that this regression made it into 2.11.1, so distributions
shipping 2.11.1 should add this patch.

Cherry-picked from master fe1fb7caa3
(+ whitespace adjusted)

Acked-by: Tyler Hicks <tyhicks@canonical.com> for master and 2.11
2017-11-14 21:19:17 +01:00
Steve Beattie
f993585e77 git conversion: move .bzrignore to .gitignore
Signed-off-by: Steve Beattie <steve.beattie@canonical.com>
2017-10-27 22:46:03 -07:00
Simon Deziel
728f02bf3c profiles: update wireshark profile for modern releases
MErge from trunk commit 3728

Acked-by: Steve Beattie <steve@nxnw.org>
2017-10-26 17:02:24 -07:00
intrigeri
831c93294f profiles: allow OpenAL HRTF support in audio abstraction
Merge from trunk commit 3726

The files are "head-related transfer function" data sets, used by
OpenAL for better spatialization of sounds when headphones are detected.

Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874665
2017-10-26 10:24:07 -07:00
intrigeri
89f3fb70a2 binutils: honor ${CFLAGS} and ${CPPFLAGS}
Merge from trunk revision 3723.

Acked-by: Steve Beattie <steve@nxnw.org>
2017-10-26 00:50:00 -07:00
Vincas Dargis
a29704b445 profiles: tunables/global - accept seven digit pids
[Merge from trunk revision 3722]

On 64bit systems, /proc/sys/kernel/pid_max can be set to PID_MAX_LIMIT,
(2^22), which results in seven digit pids. Adjust the @{PID} variable in
tunables/global to accept this.

Acked-by: intrigeri <intrigeri@boum.org>
Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://bugs.launchpad.net/apparmor/+bug/1717714
2017-10-25 23:22:36 -07:00
Christian Boltz
90e086986d Add python3.6 line to utils/logprof.conf
This is a backport of trunk r3718 by intrigeri


Acked-by: John Johansen <john.johansen@canonical.com> for 2.11 and 2.10 (on IRC)
2017-10-23 20:05:39 +02:00
Christian Boltz
0eedfe8319 Allow reading /etc/netconfig in abstractions/nameservice
/etc/netconfig is required by the tirpc library which nscd and several
other programs use.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062244


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk
2017-10-20 22:54:21 +02:00
John Johansen
8b81fe065f bump release version to 2.11.1 2017-10-19 02:13:37 -07:00
Steve Beattie
a8f5b8f0db libapparmor: fix swig test_apparmor.py for zero length ptrace records
Merge from trunk revision 3715

The added testcase for a ptrace target with an empty string
(ptrace_garbage_lp1689667_1.in) was causing the swig python test script
to fail. The generated python swig record for libapparmor ends up
setting a number of fields to None or other values that indicate the
value is unset, and the test script was checking if the value in the
field didn't evaluate to False in a python 'if' test.

Unfortunately, python evaluates the empty string '' as False in 'if'
tests, resulting in the specific field that contained the empty string
to be dropped from the returned record. This commit fixes that by
special case checking for the empty string.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2017-10-18 17:06:28 -07:00
John Johansen
878ebd4b33 Fix af_unix downgrade of network rules
with unix rules we output a downgraded rule compatible with network rules
so that policy will work on kernels that support network socket controls
but not the extended af_unix rules

however this is currently broken if the socket type is left unspecified
(initialized to -1), resulting in denials for kernels that don't support
the extended af_unix rules.

cherry-pick: lp:apparmor r3700
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: timeout
2017-10-18 14:31:16 -07:00
Christian Boltz
bc5634f2af Fix save_profiles() for YaST
YaST has two issues in the "save changed profiles" dialog:
- when using "save selected", the list of profiles doesn't get updated.
  Update q.options inside the loop to fix this.
- the list of profiles is displayed as "["/usr/bin/foo", true]" instead
  of just "/usr/bin/foo". Use changed.keys() instead of changed to fix
  this. (text-mode aa-logprof doesn't change, it always displayed
  "/usr/bin/foo" and continues to do so.)

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1062667 part a)


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.11.

Note that 2.11 needs a slightly different patch (whitespace diff).
2017-10-12 13:28:51 +02:00
Christian Boltz
7c217b7413 Allow /var/run/dovecot/login-master-notify* in dovecot imap-login profiles
Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.11, 2.10 and 2.9.
2017-09-28 17:48:13 +02:00
Christian Boltz
86037e0a23 abstractions/freedesktop.org: support /usr/local/applications; support subdirs of applications folder
Merge request by Cameron Norman 2015-06-07
https://code.launchpad.net/~cameronnemo/apparmor/abstraction-fdo-applications-fixups/+merge/261336

Acked-by: Christian Boltz <apparmor@cboltz.de> for trunk, 2.11, 2.10 and 2.9
2017-09-10 12:28:30 +02:00
Christian Boltz
1f82a98029 Add network 'smc' keyword in NetworkRule and apparmor.d manpage
'smc' seems to be new in kernel 4.12.


Note that the 2.10 apparmor.d manpage also misses the 'kcm' keyword, so
the patch also adds it there.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.11 and 2.10.
2017-08-30 11:06:56 +02:00
Christian Boltz
7adbc4b3ee Samba profile updates for ActiveDirectory / Kerberos
The Samba package used by the INVIS server (based on openSUSE) needs
some additional Samba permissions for the added ActiveDirectory /
Kerberos support.

As discussed with Seth, add /var/lib/sss/mc/initgroups read permissions
to abstractions/nameservice instead of only to the smbd profile because
it's probably needed by more than just Samba if someone uses sss.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk.
2017-08-29 13:32:03 +02:00
Christian Boltz
5199e44ef0 update some Postfix profiles
- change abstractions/postfix-common to allow /etc/postfix/*.db k
- add several permissions to postfix/error, postfix/lmtp and postfix/pipe
- remove superfluous abstractions/kerberosclient from all postfix
  profiles - it's included via abstractions/nameservice


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10, 2.11 and trunk
2017-08-22 12:43:52 +02:00
Steve Beattie
32e76985c9 libapparmor: fix ptrace regression test failure
Merge from trunk revision 3692

In http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/3659,
a testcase was added that where the expected output file did not match
the input source name, cause libapparmor's regression tests to fail:

  Output doesn't match expected data:
  --- ./test_multi/ptrace_no_denied_mask.out    2017-08-18 16:35:30.000000000 -0700
  +++ ./test_multi/out/ptrace_no_denied_mask.out  2017-08-18 16:35:38.985863094 -0700
  @@ -1,5 +1,5 @@
   START
  -File: ptrace_1.in
  +File: ptrace_no_denied_mask.in
   Event type: AA_RECORD_DENIED
   Audit ID: 1495217772.047:4471
   Operation: ptrace
  FAIL: ptrace_no_denied_mask

This patch corrects the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-08-18 17:16:27 -07:00
Steve Beattie
54bdfd3565 user abstractions: fix for non-latin file/directory names
Merge from trunk commit 3691
Merge from Vincas Dargis, approved by intrigeri
Fix user-write and user-download abstractions for non-latin file names.

Acked-by: Steve Beattie <steve@nxnw.org>
2017-08-09 12:48:18 -07:00
Steve Beattie
bd68cd2d69 traceroute profile: support TCP SYN for probes, quite net_admin request
Merge from trunk revision 3690
Merge from Vincas Dargis, approved by intrigeri.
fix traceroute denies in tcp mode

Acked-by: Steve Beattie <steve@nxnw.org>
2017-08-09 09:35:34 -07:00
Steve Beattie
f076497f89 abstractions/gnome: allow reading GLib schemas.
Merge from trunk revision 3687

Merge from intrigeri based on original work by Cameron Norman.

Acked-by: Steve Beattie <steve@nxnw.org>
2017-08-07 10:40:35 -07:00
Steve Beattie
5089a941c8 wayland abstraction: allow wayland-cursor-shared-*
Merge from trunk revision 3686

Merge from intrigeri.

Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870807
Acked-by: Steve Beattie <steve@nxnw.org>
2017-08-07 10:28:30 -07:00
Christian Boltz
3b490f9450 Prevent 'wa' conflicts for file rules
get_file_perms() and propose_file_rules() happily collect all file
permissions. This could lead to proposing 'wa' permissions in
aa-logprof, which then errored out because of conflicting permissions.

This patch adds a check to both functions that removes 'a' if 'w' is
present, and extends the tests to check this.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.11.

Note: Both functions (including this bug) were introduced together with
FileRule, so older releases are not affected.
2017-08-04 22:27:16 +02:00
Christian Boltz
66928660f5 Carry over all autodep-generated rules in handle_children()
When creating a new child profile, handle_children() did only copy over
include and path rules. While this was correct in the past, path rules
got changed to FileRule in the meantime and were therefore lost.
(In practise, this means the "$binary mr," rule wasn't added to the new
child profile, causing a "superfluous" question in aa-logprof.)

This patch changes handle_children() to carry over the complete new
child profile instead of only cherry-picking include and path rules.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.11.

Older versions (with path as hasher) are not affected.
2017-08-02 13:26:49 +02:00
Jamie Strandboge
d2fc6ff1cc update aa-status.pod for updated podchecker
Bug-Ubuntu: https://launchpad.net/bugs/1707614

Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-07-31 10:22:33 -05:00
Jamie Strandboge
39fc9dc40f Adjust python abstraction for python3.6
Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-07-26 15:10:24 -05:00
Christian Boltz
a90238e7c6 Add --no-reload to various utils manpages
This option exists in several aa-* tools since 2.9, but isn't mentioned
in the manpage.

Also drop some trailing whitespace in the manpages.


Acked-by: John Johansen <john.johansen@canonical.com>
for 2.9, 2.10, 2.11 and trunk.
2017-07-23 21:30:56 +02:00
Christian Boltz
5246203c9e dovecot profile: add the attach_disconnected flag
Reported by pfak on IRC

[...] apparmor="DENIED" operation="sendmsg" info="Failed name lookup - disconnected path" error=-13 profile="/usr/sbin/dovecot" name="run/systemd/journal/dev-log" pid=20313 comm="dovecot" requested_mask="w" denied_mask="w" fsuid=0 ouid=0


Acked-by <timeout> for 2.9, 2.10, 2.11 and trunk.
2017-06-29 22:54:17 +02:00
Jamie Strandboge
4b99f16b49 Origin: r3669 from trunk
Description: adjust the multiarch alternation rule in the perl abstraction for
 modern Debian and Ubuntu systems which store some modules under the
 architecture-specific perl-base directory instead of perl or perl5.

Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-06-26 14:43:13 -05:00
Christian Boltz
7777b1418e Ignore ptrace log events without denied_mask
This fixes a crash in the tools.

Reported by peetaur on IRC.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.11.
2017-05-20 01:06:39 +02:00
Christian Boltz
9d5934f5ff Add two parser files to .bzrignore
- parser/libapparmor_re/parse.cc is autogenerated during build
- parser/tst_lib gets compiled during "make check"

Both files get deleted by make clean.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.11.
2017-05-20 01:04:10 +02:00
Christian Boltz
962d4afb3d Fix aa-logprof crash on ptrace garbage log events
(garbage) ptrace events like
    ... apparmor="DENIED" operation="ptrace" profile="/bin/netstat" pid=1962 comm="netstat" target=""
cause an empty name2 field, which leads to a crash in the tools.

This patch lets logparser.py ignore such garbage log events, which also
avoids the crash.

As usual, add some testcases.

test-libapparmor-test_multi.py needs some special handling to ignore the
empty name2 field in one of the testcases.


References: https://bugs.launchpad.net/apparmor/+bug/1689667


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.11.

Older releases can't handle ptrace log events and therefore can't crash ;-)
2017-05-19 22:47:36 +02:00
Tyler Hicks
eb8acf4b45 libapparmor: Don't print shell commands that check for test failures
Error messages should only show up in build logs when the error has been
encountered. This patch silences these shell commands from being printed
before they're interpreted.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-04-21 13:52:44 +00:00
Tyler Hicks
8217eb04af libapparmor: Fix parallel make dependency issue in testsuite
A multi job `make check` command could fail due to check-local running
before the check-DEJAGNU target, which is automatically generated by
automake, would complete. This would result in a build failure due to
libaalogparse.log not yet existing.

Fix the issue by depending on the check-DEJAGNU target.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2017-04-21 13:52:42 +00:00
Christian Boltz
26e1200324 Ignore test failures about duplicated conditionals in dbus rules
Since r3634, the tools allow any order of dbus conditionals.

Quoting the r3634 patch description:

  This patch eases the restriction on the ordering at the expense of the
  utils no longer being able to detect and reject a single attribute that
  is repeated multiple times. In that situation, only the last occurrence
  of the attribute will be honored by the utils.

It seems nobody tested with all test profiles generated ;-) so we have to
add some exceptions to the "does not raise an exception" list now.



Acked-by <timeout> for trunk and 2.11

Bug: https://launchpad.net/bugs/1658239
2017-04-20 13:07:06 +02:00
Steve Beattie
4181b187c3 profiles: abstractions/base - Allow sysconf(_SC_NPROCESSORS_CONF)
Merge Simon McVittie's patch to allow querying the number of configured
processors in the base abstraction.

Acked-by: Steve Beattie <steve@nxnw.org>
2017-04-14 16:08:03 -07:00
John Johansen
485798c4f8 Update REPO_URL to 2.11 branch 2017-04-13 13:56:20 -07:00
Jamie Strandboge
766f5e160e aa-notify currently calls notify-send with urgency of 'critical'. In gnome-shell
critical urgency notifications result in a notification that must be explictly
clicked to dismiss (ie, they don't time out) and gnome-shell does not honor --
expire-time with (at least) critical urgency. In other popular DEs critical
urgency notifications time out. This patch updates the urgency to 'normal' to
obtain intended behavior across DEs.

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-04-12 15:57:31 -05:00
Simon McVittie
1b15425ea3 abstractions/base: Allow sysconf(_SC_NPROCESSORS_CONF)
glibc implements this by doing a readdir() and filtering.
We already allowed sysconf(_SC_NPROCESSORS_ONLN), which is
basically a read from /sys/devices/system/cpu/online.

Signed-off-by: Simon McVittie <smcv@collabora.com>
2017-04-12 18:35:10 +01:00
Christian Boltz
68cba4fe27 update dovecot-lda profile
dovecot-lda needs
- the attach_disconnected flags
- read access to /usr/share/dovecot/protocols.d/
- rw for /run/dovecot/auth-userdb

References: https://bugs.launchpad.net/bugs/1650827


Acked-by: Steve Beattie <steve@nxnw.org> for 2.9, 2.10 and trunk.
2017-04-07 00:12:53 +02:00
Steve Beattie
5452095203 tests: readdir - test both getdents() and getdents64() if available
In commit 3649, Colin King fixed the readdir test build issue where
aarch64 only supports getdetns64(), not getdents(). Realistically,
however, we want to ensure mediation occurs on both syscalls where
they exist. This patch changes the test to attempt performing both
versions of getdents(). Because we want to catch the situation where
the result of getdents differs from getdents64, we now pass in the
expected result.

Also add a test to verify that having write access does not grant
the ability to read a directory's contents.

Bug: https://bugs.launchpad.net/bugs/1674245

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2017-04-05 21:34:24 -07:00
Colin King
929b1acf6f tests: where necessary use getdents64 to fix arm64 build failure
https://launchpad.net/bugs/1674245
  
arm64 build of the tests breaks because getdents is not available.
Where available, use gendents64 as the preferred choice.
  
Fixes:
  
cc -g -O0 -Wall -Wstrict-prototypes readdir.c -lapparmor -o readdir
readdir.c: In function ‘main’:
readdir.c:45:14: error: ‘SYS_getdents’ undeclared (first use in this function)
if (syscall(SYS_getdents, fd, &dir, sizeof(struct dirent)) == -1){
            ^~~~~~~~~~~~
readdir.c:45:14: note: each undeclared identifier is reported only once for each function it appears in
<builtin>: recipe for target 'readdir' failed
make: *** [readdir] Error 1

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2017-04-04 15:40:16 +00:00
Tyler Hicks
e04b50ce95 utils: Add aa-remove-unknown utility to unload unknown profiles
https://launchpad.net/bugs/1668892

This patch creates a new utility, with the code previously used in the
init script 'restart' action, that removes unknown profiles which are
not found in /etc/apparmor.d/. The functionality was removed from the
common init script code in the fix for CVE-2017-6507.

The new utility prints a message containing the name of each unknown
profile before the profiles are removed. It also supports a dry run mode
so that an administrator can check which profiles will be removed before
unloading any unknown profiles.

If you backport this utility with the fix for CVE-2017-6507 to an
apparmor 2.10 release and your backported aa-remove-unknown utility is
sourcing the upstream rc.apparmor.functions file, you'll want to include
the following bug fix to prevent the aa-remove-unknown utility from
removing child profiles that it shouldn't remove:

  r3440 - Fix: parser: incorrect output of child profile names

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2017-03-24 05:08:01 +00:00
Tyler Hicks
8901b3e835 parser: Preserve unknown profiles when restarting apparmor init/job/unit
CVE-2017-6507

https://launchpad.net/bugs/1668892

The common AppArmor 'restart' code used by some init scripts, upstart
jobs, and/or systemd units contained functionality that is no longer
appropriate to retain. Any profiles not found /etc/apparmor.d/ were
assumed to be obsolete and were unloaded. That behavior became
problematic now that there's a growing number of projects that maintain
their own internal set of AppArmor profiles outside of /etc/apparmor.d/.
It resulted in the AppArmor 'restart' code leaving some important
processes running unconfined. A couple examples are profiles managed by
LXD and Docker.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2017-03-24 05:06:07 +00:00
Seth Arnold
1285d81547 parser: Fix delete after new[] -- patch from Oleg Strikov <oleg.strikov@gmail.com> 2017-03-21 12:09:59 -07:00
Tyler Hicks
8ce02c20fa profiles: Update nvidia abstraction for newer nvidia drivers
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Jamie Strandboge <jamie@ubuntu.com>
2017-03-16 02:51:03 +00:00
Olivier Tilloy
71566d36e3 Specify device nodes instead of being too permissive. 2017-03-06 19:59:43 +01:00
Olivier Tilloy
fe421f6952 Update nvidia abstraction for newer nvidia drivers. 2017-03-06 19:46:43 +01:00
Christian Boltz
566b053bdf Fix regressions caused by init_aa()
With the init_aa() patch series commited, minitools_test.py showed
several test failures - which effectively means the -d option of
aa-complain, aa-cleanprof etc. was broken.

These failures were caused by
- calling init_aa() too late in tools.py - _after_ setting the
  profiledir, which then got overwritten by init_aa()
- calling init_aa() twice (because apparmor.aa gets imported in two
  modules used by aa-cleanprof), which overwrote the manually set values
  on the second run

This patch fixes the call order in tools.py and adds a check to
init_aa() so that it only runs once and ignores additional calls.


Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-03 13:14:55 +01:00
Christian Boltz
054d8f795f test-parser-simple-tests.py: No longer skip testing generated_perms_leading profiles
FileRule understands leading permissions, so the reason to skip those
(generated) test profiles in test-parser-simple-tests.py is gone.

However, the gen-xtrans.pl script generates profiles with a not-so-valid
mix of uppercase and lowercase, for example "Pux" and "Cux". The parser
accepts this, but the tools complain about such rules. Therefore add the
affected profiles to the exception list.

In total, this means we now test 319 of the 380 generated_perms_leading
test profiles.

The patch also moves some lines around to get the \-escaped profiles
out of the mixed uppercase/lowercase exec rule section.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-03 13:14:03 +01:00
Tyler Hicks
9a8c6885cb utils: Fix apparmor.easyprof import in test-aa-easyprof.py
The test-aa-easyprof.py script was attempting to do its own special
setup to import the in-tree easyprof module. However, this proved to be
very flaky and resulted in the test periodically failing due to an
AttributeError the first time easyprof.parse_args() was called.

This patch removes the flakiness by trusting that PYTHONPATH is set up
appropriately before the test script is ran. PYTHONPATH is already
initialized appropriately by utils/test/Makefile according to the
USE_SYSTEM make variable.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-03-02 21:25:01 +00:00
Tyler Hicks
7ab65fa5f1 utils: Set parser executable path according to USE_SYSTEM make variable
if USE_SYSTEM is not set, the utils make check target will instruct
test-aa-easyprof.py to provide the path of the in-tree parser executable
to aa-easyprof.

If USE_SYSTEM is set, the default parser path (/sbin/apparmor_parser or
the result of `which apparmor_parser`) is used.

The test-aa-easyprof.py script receives the parser path by checking the
__AA_PARSER environment variable. This environment variable is strictly
used by the test script and not any user-facing code so two leading
underscores were used.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-02 21:24:33 +00:00
Tyler Hicks
b98e9df766 utils: Add option to aa-easyprof to specify the apparmor_parser path
When testing against a clean system without the apparmor_parser binary
installed, the test-aa-easyprof.py script ends up skipping profile
verification because it can't find the parser binary. This even causes a
test failure due to the test_genpolicy_invalid_template_policy test.

Adding a --parser option to aa-easyprof is the first step in addressing
this problem.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-02 21:24:05 +00:00
Tyler Hicks
7066649144 utils: Set parser base path according to USE_SYSTEM make variable
If USE_SYSTEM is not set, the utils make check target will instruct
test-aa-easyprof.py to provide the path of the in-tree
profiles/apparmor.d directory to aa-easyprof as the parser base
directory.

If USE_SYSTEM is set, the default base directory (/etc/apparmor.d) is
used.

The test-aa-easyprof.py script receives the base path by checking the
__AA_BASEDIR environment variable. This environment variable is strictly
used by the test script and not any user-facing code so two leading
underscores were used.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

Bug: https://launchpad.net/bugs/1538306
2017-03-02 21:23:32 +00:00
Tyler Hicks
361b63d30b utils: Accept parser base and include options in aa-easyprof
https://launchpad.net/bugs/1521031

aa-easyprof accepts a list of abstractions to include and, by default,
execs apparmor_parser to verify the generated profile including any
abstractions. However, aa-easyprof didn't provide the same flexibility
as apparmor_parser when it came to where in the filesystem the
abstraction files could exist.

The parser supports --base (defaulting to /etc/apparmor.d) and --Include
(defaulting to unset) options to specify the search paths for
abstraction files. This patch adds the same options to aa-easyprof to
aide in two different situations:

 1) Some Ubuntu packages use aa-easyprof to generate AppArmor profiles
    at build time. Something that has been previously needed is a way
    for those packages to ship their own abstractions file(s) that are
    #included in the easyprof-generated profile. That's not been
    possible since the abstraction file(s) have not yet been installed
    during the package build.

 2) The test-aa-easyprof.py script contains some tests that specify
    abstractions that should be #included. Without the ability to
    specify a different --base or --Include directory, the abstractions
    were required to be present in /etc/apparmor.d/abstractions/ or the
    tests would fail. This prevents the Python utils from being able to
    strictly test against in-tree code/profiles/etc.

I don't like the names of the command line options --base and --Include.
They're not particularly descriptive and the capital 'I' is not user
friendly. However, I decided to preserve the name of the options from
apparmor_parser.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-02 21:22:57 +00:00
Tyler Hicks
ea0732becc utils: Require apparmor.aa users to call init_aa()
Introduce an apparmor.aa.init_aa() method and move the initialization
code of the apparmor.aa module into it. Note that this change will break
any external users of apparmor.aa because global variables that were
previously initialized when importing apparmor.aa will not be
initialized unless a call to the new apparmor.aa.init_aa() method is
made.

The main purpose of this change is to allow the utils tests to be able
to set a non-default location for configuration files. Instead of
hard-coding the location of logprof.conf and other utils related
configuration files to /etc/apparmor/, this patch allows it to be
configured by calling apparmor.aa.init_aa(confdir=PATH).

This allows for the make check target to use the in-tree config file,
profiles, and parser by default. A helper method, setup_aa(), is added
to common_test.py that checks for an environment variable containing a
non-default configuration directory path prior to calling
apparmor.aa.init_aa(). All test scripts that use apparmor.aa are updated
to call setup_aa().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Suggested-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-03-02 21:21:53 +00:00
Tyler Hicks
f30ab46af7 utils: Update the logprof.conf in the test dir to point to in-tree paths
The utils tests should make use of the logprof.conf that resides in
utils/test/ when testing against the in-tree parser and profiles. When
testing against the system, it the utils tests should continue to use
the system logprof.conf.

This patch updates the parser and profiles paths to point to the in-tree
paths. Another patch is needed to get aa.py to honor a non-hardcoded
search path for logprof.conf and other configuration files.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-02 21:21:21 +00:00
Tyler Hicks
2db1b83869 utils: Improve error messages when profiles/parser is not found
When aa.py is imported, it looks for a set of profiles and it also looks
for the parser. Both of these paths are configured by logprof.conf but
it isn't always obvious which logprof.conf file was used and, therefore,
it isn't always obvious where aa.py is looking. This patch includes the
paths in the error messages.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-03-02 21:20:45 +00:00
Tyler Hicks
8935457c63 utils: Don't enforce ordering of dbus rule attributes
https://launchpad.net/bugs/1628286

The utils were enforcing that the dbus rule attributes were strictly
ordered in the following fashion:

 bus -> path -> interface -> member -> peer

However, the parser has always accepted the attributes in any order. If
the system contained a profile which did not use the strict ordering
enforced by the utils, the utils would refuse to operate at all.

This patch eases the restriction on the ordering at the expense of the
utils no longer being able to detect and reject a single attribute that
is repeated multiple times. In that situation, only the last occurrence
of the attribute will be honored by the utils.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2017-02-28 23:04:24 +00:00
Tyler Hicks
d4d4d50d84 utils: Fix failing tests in test-aa.py
The merged /usr patches to the policy broke some utils tests due to a
change in the expected output.

Fixes: r3600 update lots of profiles for usrMerge
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-02-28 23:03:25 +00:00
Christian Boltz
984ed2801e Ignore change_hat events with error=-1 and "unconfined can not change_hat"
That's much better than crashing aa-logprof ;-)  (use the log line in
the added testcase if you want to see the crash)

Reported by pfak on IRC.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2017-02-23 01:00:36 +01:00
Christian Boltz
633f833a6e Remove re.LOCALE flag
Starting with python 3.6, the re.LOCALE flag can only be used with byte
patterns, and errors out if used with str. This patch removes the flag
in get_translated_hotkey().


References: https://bugs.launchpad.net/apparmor/+bug/1661766


Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2017-02-21 18:46:36 +01:00
Steve Beattie
20817ef77b regression tests: fix environ fail case
In the environ regression test, when the exec() of the child process
fails, we don't report FAIL to stdout, so the regression tests consider
it an error rather than a failure and abort, short-circuiting the
test script.

This commit fixes this by emitting the FAIL message when the result
from the wait() syscall indicates the child process did not succeed.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-02-01 21:41:52 -08:00
Christian Boltz
20091ca87d Rename global variable "pid" to "log_pid"
aa.py has a global variable "pid", but it also has several functions
that use "pid" as a local variable name. do_logprof_pass() even uses
both - first, it passes the global variable to ReadLog, and then it
creates a local variable in the "for pid in ..." loop.

This patch renames the global variable to log_pid to get rid of the
confusion.

Note that the global variable is only handed over to ReadLog, and the
only case where its previous content _might_ be used is aa-genprof which
does multipe do_logprof_pass() runs.

Maybe we could even get rid of this variable in aa.py and make it local
to the ReadLog class, but I'm not sure if that would affect aa-genprof
in interesting[tm] ways.


Acked-by: John Johansen <john.johansen@canonical.com>
2017-01-30 20:48:50 +01:00
Christian Boltz
2eee4d6acb Dovecot profile: change Px to mrPx for /usr/lib/dovecot/*
Some of the /usr/lib/dovecot/* rules already have mrPx permissions,
while others don't.

With a more recent kernel, I noticed that at least auth, config, dict,
lmtp, pop3 and ssl-params need mrPx instead of just Px (confirmed by the
audit.log and actual breakage caused by the missing mr permissions).

The mr additions for anvil, log and managesieve are just a wild guess,
but I would be very surprised if they don't need mr.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2017-01-30 20:43:47 +01:00
Christian Boltz
04240fe6de Dovecot profile update
Add several permissions to the dovecot profiles that are needed on ubuntu
(surprisingly not on openSUSE, maybe it depends on the dovecot config?)

As discussed some weeks ago, the added permissions use only /run/
instead of /{var/,}run/ (which is hopefully superfluous nowadays).


References: https://bugs.launchpad.net/apparmor/+bug/1512131


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2017-01-26 21:41:38 +01:00
Kees Cook
2c4119d98c glibc uses /proc/*/auxv and /proc/*/status files, too
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-20 17:01:50 -08:00
Kees Cook
2e3a871b11 Apache2 profile updates for proper signal handling, optional saslauth,
and OCSP stapling

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-20 16:58:46 -08:00
Christian Boltz
50623fca92 Drop unused global variables in aa.py
Grepping through the code shows that running_under_genprof,
unimplemented_warning, ALL, t, seen and skip are unused, so drop them.


Acked-by: Steve Beattie <steve@nxnw.org>


Also drop a '#    t = hasher()" comment, as noticed by Steve.
2017-01-20 01:20:41 +01:00
Kees Cook
f5384469b5 pass LDFLAGS fully into build
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2017-01-19 23:04:34 +00:00
Christian Boltz
85178293f5 [7/7] Drop most of aa-mergeprof ask_the_questions()
Replace most of aa-mergeprof ask_merge_questions() with a call to
aa.py ask_the_questions() (which is, besides some small exceptions that
are not relevant for aa-mergeprof, in sync with the dropped code).

The remaining part gets renamed to ask_merge_questions() to avoid
confusion with the function name in aa.py. Also drop the (now
superfluous) parameter.

aa.py ask_the_questions() needs to allow 'merge' as aamode.
While on it, replace the fatal_error() call for unknown aamode with
raising an AppArmorBug.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:54:47 +01:00
Christian Boltz
d1fa70ac22 [6/7] make log_dict a parameter of ask_the_questions()
This allows to hand over any source instead of using the global variable.

Now that the function expects its input as parameter,  get rid of the
global log_dict, which means
- change collapse_log() to initialize log_dict as local variable and
  return it
- change do_logprof_pass() to catch collapse_log()'s return value and
  hand it over to ask_the_questions()
- drop all references to the global log_dict variable
- update test-libapparmor-test_multi to follow the changes

Also fix an if condition that would fail if aa[profile][hat] does not
exist - get() defaults to None if the requested item doesn't exist, and
None.get('file') will raise an Exception.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:52:38 +01:00
Christian Boltz
4ec82daa00 [5/7] move ask_conflict_mode() to aa.py
The function is an exact copy of the code in aa-mergeprof (except
removing the 'self' function parameter and changing the whitespace
level)

Also add a ask_conflict_mode() call to aa.py ask_the_questions().
This is needed for aa-mergeprof, and won't hurt in aa-logprof mode
because handle_children() already handles all exec events.


Acked-by: Seth Arnold <seth.arnold@canonical.com>

Bug: https://launchpad.net/bugs/1522938
2017-01-19 16:48:44 +01:00
Christian Boltz
627856d6b4 [4/7] Copy code to ask for adding hats to aa.py ask_the_questions()
Everything below "if aamode == 'merge':" is an exact copy of the code in
aa-mergeprof (with whitespace changed).

aa-logprof and aa-mergeprof will continue to ignore events from unknown
hats and subprofiles.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:47:35 +01:00
Christian Boltz
cfa0a37e58 [3/7] Copy code to ask for adding includes to aa.py ask_the_questions()
This is an exact copy of the code in aa-mergeprof (with whitespace changed).


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:47:05 +01:00
Christian Boltz
ca093f7223 [2/7] replace other.aa with log_dict['merge']
Set log_dict['merge'] = other.aa and aamode = 'merge', and use
log_dict[aamode] everywhere.

This brings aa-mergeprof ask_the_questions() closer to the code in aa.py.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:46:23 +01:00
Christian Boltz
1cae419b4d [1/7] drop traces of 3-way-merge in aa-mergeprof
3-way-merge was never really implemented.

This patch drops all traces of it to make the code more readable and
easier to maintain.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2017-01-19 16:45:29 +01:00
Christian Boltz
dd27256bb3 sshd profile: drop local/ include
The local/ include in the sshd profile in extras causes some trouble:
- it breaks "make check" because the parser can't find the local/ file
- it results in a broken profile if someone uses this profile as
  starting point, but doesn't notice it needs the local include


Acked-by: Steve Beattie <steve@nxnw.org>
2017-01-12 22:01:11 +01:00
Christian Boltz
67b75e84d0 Update /etc/cron.daily/logrotate profile
Thanks to Daniel Curtis for working on this!


Acked-by: Seth Arnold <seth.arnold@canonical.com> for whichever branches
it makes sense for

-> trunk (includes 2.11) only - if we want it in 2.10 and 2.9, we'll
   also need to backport the usrMerge changes
2017-01-11 18:34:37 +01:00
John Johansen
6732ab19b8 AppArmor Release Version 2.11.0 2017-01-08 20:48:43 -08:00
Christian Boltz
71f385fc83 Handle ldd $? == 1 in get_reqs()
ldd exits with $? == 1 if a file is 'not a dynamic executable'.
This is correct behaviour of ldd, so we should handle it instead of
raising an exception ;-)

Also extend fake_ldd and add a test to test-aa.py to cover this.


Note that 2.10 and 2.9 don't have tests for get_reqs() nor fake_ldd,
so those branches will only get the aa.py changes.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9.
2016-12-31 00:48:41 +01:00
Steve Beattie
86e30539cf utils/aa-unconfined: whitespace cleanups for pep8 consistency.
This is what this patch looks like when diff'ed ignoring spacing
changes:

 $ quilt diff | diffstat
  aa-unconfined |   18 +++++++++---------
  1 file changed, 9 insertions(+), 9 deletions(-)
 $ quilt diff --diff 'diff -uw'
 $

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-12-30 12:22:58 -08:00
Steve Beattie
b72cd7914a utils/aa-unconfined: allow specifying ss/netstat binary locations
This patch allows a user to specify a specific location for ss or
netstat in the invocations of get_pids_ss() or get_pids_netstat().

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-12-30 12:20:01 -08:00
Steve Beattie
e4f22f5e27 utils/aa-unconfined: avoid using cat(1) to read /proc/PID/cmdline
This patch adjusts aa-unconfined to avoid using cat(1) to read
/proc/PID/cmdline entries, and instead opens them for reading directly.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@caanonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-12-30 12:18:14 -08:00
Steve Beattie
4da5adbce4 utils/aa-unconfined: fix netstat usage, use ss(8) by default
It was reported that converting the netstat command to examine
processes bound to ipv6 addresses broke on OpenSUSE due to the version
of nettools not supporting the short -4 -6 arguments.

This patch switches to use the ss(8) utility from iproute2 by default
(if ss is found) as netstat/net-tools is deprecated. Unfortunately,
ss's '--family' argument does not accept multiple families, nor
does passing '--family' multiple times with different arguments work
either, so aa-unconfined invokes ss multiple times to gather the
different socket families.

It also fixes the invocation of netstat to use the "--protocol
inet,inet6" arguments instead, which should return the same results
as the short options.

This patch provides command line arguments to manually switch using
one tool or the other, as well as converting the invocations of ss
and netstat to not use a shell, and documents these options in the
aa-unconfined man page.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-12-30 12:15:16 -08:00
Christian Boltz
49fe1f712c Update dovecot profiles
The dovecot/auth profile needs access to /run/dovecot/anvil-auth-penalty
and /var/spool/postfix/private/auth.

The dovecot/log profile needs the attach_disconnected flag.

Refences: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1652131


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-12-27 17:46:07 +01:00
Christian Boltz
444dbb4a23 Update nmbd profile and abstractions/samba
nmbd needs some additional permissions:
- k for /var/cache/samba/lck/* (via abstractions/samba)
- rw for /var/cache/samba/msg/ (the log only mentioned r, but that
  directory needs to be created first)
- w for /var/cache/samba/msg/* (the log didn't indicate any read access)

Reported by FLD on IRC, audit log on https://paste.debian.net/902010/



Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-12-13 22:16:00 +01:00
Christian Boltz
27b0a727ea Add change_onexec log example to test_multi
Found in https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1648143 comment 1



Acked-by: John Johansen <john.johansen@canonical.com> for 2.9, 2.10, head

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-12-12 22:17:22 +01:00
Steve Beattie
d80596a3c4 documentation: add Makefile to generate pdfs from odt files
The odt files in the documentation directory are hard to consume
in that form. This adds a Makefile that generates pdfs from the
odt files, using the unoconv tool, based on the idea/github tree
https://github.com/jessfraz/apparmor-docs from
Jessica Frazelle <me@jessfraz.com>.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-12-10 11:29:15 -08:00
Steve Beattie
55214a8b8d documentation: rename odt files so make(1) can work with them
Rename th odt files to no longer contain spaces in their names, as
make(1) does not work well with such files.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-12-10 11:23:30 -08:00
Steve Beattie
106396289a build: make documentation at tarball creation time, not during build
The latex based techdoc in the parser/ tree adds a number of build
dependencies for downstreams to create it; it also is the primary
element to make the builds unrepeatable. Creating the techdoc and other
documentation when generating a tarball for distribution avoids all
that.

* Makefile: build documentation as part of the tarball creation. Skip
  the libraries/libapparmor directory as it needs to have configure run
  before the manpages can be made.
* changehat/mod_apparmor/Makefile, changehat/mod_apparmor/Makefile,
  utils/Makefile, profiles/Makefile: create separate docs target,
  some of them dummies.
* parser/Makefile: pull the techdoc out of the default build target, add
  an extra_docs target to create it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-12-10 10:25:31 -08:00
Steve Beattie
6a0f18a2b7 build: stop tarball builds on error
The snapshot/tarball builds use some shell constructs that end
up causing failures at various stages to be ignored. This commit
addresses that.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-12-10 10:14:23 -08:00
Christian Boltz
5bdf25816d update lots of profiles for usrMerge
Merge lp:~intrigeri/apparmor/usrMerge:
  intrigeri@boum.org 2016-12-07 Adjust white-space back to "tabular style" and make one merged-/usr related rule look like the others.
  intrigeri@boum.org 2016-12-03 abstractions/base: drop 'ix' for ld-*.so and friends.
  intrigeri@boum.org 2016-12-03 abstractions/base: revert ix→Pix.
  intrigeri@boum.org 2016-12-03 abstractions/base: turn remaining ix rules into Pix.
  intrigeri@boum.org 2016-12-03 abstractions/base: turn merged-/usr-enabled ix rules into Pix, to avoid conflicts with other profiles.
  intrigeri@boum.org 2016-12-03 abstractions/base: drop obsolete rule, supersede by @{multiarch} a while ago.
  intrigeri@boum.org 2016-12-03 Make policy compatible with merged-/usr.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>



Additionally, I did some whitespace fixes in the dhclient and procmail
profile before commiting the merge.
2016-12-09 19:54:30 +01:00
Christian Boltz
d8ccde28d3 nscd profile: allow reading libvirt/dnsmasq/*.status
References: https://bugzilla.opensuse.org/show_bug.cgi?id=1014463


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9

Bug: https://launchpad.net/bugs/1322780
2016-12-09 17:49:54 +01:00
Christian Boltz
f6201926b5 abstractions/php: make comment version-independent
Note that this is needed only for trunk - in 2.10 and 2.9 the comment
already is version-independent.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-12-07 21:24:30 +01:00
intrigeri
2cb322ff59 Adjust white-space back to "tabular style" and make one merged-/usr related rule look like the others.
Thanks to Christian Boltz <apparmor@cboltz.de> for noticing these :)
2016-12-07 20:00:06 +01:00
Christian Boltz
e0e3cdd61e abstractions/php: adjust PHP7 paths for openSUSE
openSUSE uses "php7" (not just "php") in several paths, so also allow that.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9.
2016-12-07 13:10:45 +01:00
John Johansen
ff80b8c858 Add backwards compatibility php5 abstraction
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-12-07 02:46:59 -08:00
John Johansen
1ee574deea Update php abstraction
Signed-off-by: kees cook <kees@outflux.net>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-12-07 02:45:32 -08:00
Christian Boltz
5c26296b9f logparser.py: improve file vs. network event recognition
Sometimes network events come with an operation keyword looking like
file_perm which makes them look like file events. Instead of ignoring
these events (which was a hotfix to avoid crashes), improve the type
detection.

In detail, this means:
- replace OPERATION_TYPES (which was basically a list of network event
  keywords) with OP_TYPE_FILE_OR_NET (which is a list of keywords for
  file and network events)
- change op_type() parameters to expect the whole event, not only the
  operation keyword, and rebuild the type detection based on the event
  details
- as a side effect, this simplifies the detection for file event
  operations in parse_event_for_tree()
- remove workaround code from parse_event_for_tree()

Also add 4 new testcases with log messages that were ignored before.


References:

a) various bugreports about crashes caused by unexpected operation keywords:
   https://bugs.launchpad.net/apparmor/+bug/1466812
   https://bugs.launchpad.net/apparmor/+bug/1509030
   https://bugs.launchpad.net/apparmor/+bug/1540562
   https://bugs.launchpad.net/apparmor/+bug/1577051
   https://bugs.launchpad.net/apparmor/+bug/1582374

b) the summary bug for this patch
   https://bugs.launchpad.net/apparmor/+bug/1613061



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.
2016-12-06 22:24:56 +01:00
intrigeri
2d3c95ef09 abstractions/base: drop 'ix' for ld-*.so and friends.
This should solve the "overlapping rules with conflicting 'x'
modifiers" problem (introduced with r3594) entirely.

The other options I could think of were:

 * ix → Pix, adjust all profiles that do 'ix' accordingly, and leave
   alone those that do Pix already; downsides: requires updating quite
   a few profiles all around the place, and breaks a mere "file," rule;

 * ix → Pix, adjust all profiles that do 'ix' accordingly, and change
   the "file," rule semantics to imply Pix; downside: very intrusive,
   and likely to break random existing policy in ways that are hard
   to predict;

 * stick to ix, and adjust all profiles that do anything else with
   overlapping rules, to do ix instead; downside: in some cases this means
   removing the 'P' modifier, which can cause regressions in how we confine
   stuff.

I've looked up in the bzr history to understand why execution rights
would be needed, and… the answer predates the move to bzr.
Looking into the SVN history, if it's even available anywhere, is
a bit too much for me, so I've tested this change and the few
applications I've tried did not complain. Of course, more testing will
be needed.
2016-12-03 16:52:47 +01:00
intrigeri
b6aeae70dc abstractions/base: revert ix→Pix.
It simply breaks too much stuff, such as a mere "file," rule.
2016-12-03 16:51:55 +01:00
intrigeri
a8ac2b4ccb abstractions/base: turn remaining ix rules into Pix.
Having consistent x modifiers in this abstraction is needed
to allow profiles including abstractions/base to apply x rules
overlapping with several of the rules from the base abstraction.

E.g. one may need to have rules applying to /**, for example because
a mere "file," conflicts with the ix→Pix change I did in r3596.
2016-12-03 16:03:56 +01:00
intrigeri
b3768dce8d abstractions/base: turn merged-/usr-enabled ix rules into Pix, to avoid conflicts with other profiles.
Example conflicts that are solved by this commit include:

 abstractions/ubuntu-helpers:
  /usr/{,local/}lib*/{,**/}* Pixr,
2016-12-03 14:45:56 +01:00
intrigeri
d73143db0d abstractions/base: drop obsolete rule, supersede by @{multiarch} a while ago.
It causes conflicts in x modifiers when compiling usr.sbin.cupsd.
2016-12-03 13:00:35 +01:00
intrigeri
f9ca24c293 Make policy compatible with merged-/usr. 2016-12-03 10:59:01 +01:00
Steve Beattie
8cc7b73552 In testing, I did notice one thing not getting turned up, from
netstat -nlp46 output:

  raw6       0      0 :::58                   :::*                    7        1326/NetworkManager

which when asking netstat to display name resolution ends up being:

  raw6       0      0 [::]:ipv6-icmp          [::]:*                  7        1326/NetworkManager

Of course, aa-unconfined doesn't show this, the following patch adds
that, by adding the raw keyword as an alternative to tcp|udp and
accepting a number as an alternative to LISTEN.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-12-01 17:32:52 -08:00
John Johansen
79ae8fe55a aa-unconfined currently does not check/display ipv6 fix this
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-12-01 17:29:03 -08:00
Steve Beattie
d913f20f48 abstractions/X: yet another location for Xauthority
Add access to /{,var/}run/user/*/X11/Xauthority.

Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845250

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-12-01 16:03:37 -08:00
Seth Arnold
dd719db1a9 Add more wayland paths, suggested by Simon McVittie in
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1507469
2016-11-30 15:16:32 -08:00
Christian Boltz
897df9af45 dovecot profile: allow capability sys_resource
On servers with not too much memory ("only" 16 GB), dovecot logins fail:

Nov 25 21:35:15 server dovecot[28737]: master: Fatal: setrlimit(RLIMIT_DATA, 268435456): Permission denied
Nov 25 21:35:15 server dovecot[28731]: master: Error: service(auth): command startup failed, throttling for 2 secs
Nov 25 21:35:15 server dovecot[28737]: auth: Fatal: master: service(auth): child 25976 returned error 89 (Fatal failure)

audit.log messages are:
... apparmor="DENIED" operation="capable" profile="/usr/sbin/dovecot" pid=25000 comm="dovecot" capability=24  capname="sys_resource"
... apparmor="DENIED" operation="setrlimit" profile="/usr/sbin/dovecot" pid=25000 comm="dovecot" rlimit=data value=268435456

After allowing capability sys_resource, dovecot can increase the limit
and works again.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-11-29 21:35:14 +01:00
Christian Boltz
561da60cc7 Update abstractions/gnome with versioned gtk paths
References: https://bugs.debian.org/845005


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-11-22 00:30:42 +01:00
Christian Boltz
e9b7c3ff60 logparser.py parse_event(): always store family, protocol and sock_type
Storing these event details depending on the operation type only makes
things more difficult because it's hard to differenciate between file
and network events.

Note that this happens at the first log parsing stage (libapparmor log
event -> temporary python array) and therefore doesn't add a serious
memory footprint. The event tree will still only contain the elements
relevant for the actual event type.

This change means that lots of testcases now get 3 more fields (all
None) when testing parse_event(), so update all affected testcases.
(test-network doesn't need a change for probably obvious reasons.)

Also rename a misnamed test in test-change_profile.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
2016-11-19 10:55:03 +01:00
Christian Boltz
b3d7e84fb2 Allow /var/lib/nscd in abstractions/nameservice and nscd profile
The latest glibc (including nscd) in openSUSE Tumbleweed comes with
    glibc-2.3.3-nscd-db-path.diff: Move persistent nscd databases to
    /var/lib/nscd

This needs updates (adding /var/lib/nscd/) to abstractions/nameservice
and the nscd profile.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-11-18 20:17:43 +01:00
Christian Boltz
df022e3431 Allow /var/cache/samba/lck/* in abstractions/samba
nmbd, winbindd (and most probably also smbd - but it has a more
permissive profile that already allows this) need rw access to
/var/cache/samba/lck/* on Debian 8.6.

Reported by FLD on IRC.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-11-18 20:12:43 +01:00
Christian Boltz
d8de3a1e20 Fix 'alias' rule description in apparmor.d manpage
The apparmor.d description about alias rules was broken in multiple
ways. The manpage
- didn't include the   alias   keyword
- listed alias rules in the "COMMA RULES" section - while that's correct
  for the comma requirement, it's also wrong because COMMA RULES is
  meant to be inside a profile
- didn't list alias rules in the PREAMBLE section

This patch fixes this.

It also moves the definition of VARIABLE, VARIABLE ASSIGNMENT (both
unchanged) and ALIAS RULE next to PREAMBLE.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10
2016-11-16 20:38:54 +01:00
Christian Boltz
cb67bae6b2 Allow "network unspec dgram," in ntpd profile
A while ago, support for "network unspec" was added. However, nobody
updated the ntpd profile (at least not the profile in upstream bzr)
which was the main reason for adding "unspec".

References: https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1546455
            (the original bugreport about "unspec")

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1009964
            (about the ntpd profile)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-11-15 00:41:53 +01:00
Steve Beattie
cc1873442f libapparmor python bindings: use __init__.py to import from LibAppArmor.py
Fix import errors with swig > 3.0.8 with the libapparmor python
bindings. Do this by removing the code to rename the generated
LibAppArmor.py, and instead use a stub __init__.py that automatically
imports everything from LibAppArmor.py. Also adjust bzrignore to
compensate for the autogenerated file name changing.

Bug: https://bugzilla.opensuse.org/show_bug.cgi?id=987607

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-11-14 14:06:41 -08:00
Christian Boltz
25613a43a8 Add m permissions to mlmmj profiles
Newer kernels need m permissions for the binary the profile covers,
so add it before someone hits this problem in the wild ;-)

Also add a note that the mlmmj-recieve profile is probably superfluous
because upstream renamed the misspelled binary.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-11-09 19:44:35 +01:00
Christian Boltz
17210f21a2 Update mlmmj profiles
This patch updates the mlmmj profiles in the extras directory to the
profiles that are used on lists.opensuse.org now. Besides adding lots
of trailing slashes for directories, several permissions were added.
Also, usr.bin.mlmmj-receive gets added - it seems upstream renamed
mlmmj-recieve to fix a typo.

These profiles were provided by Per Jessen.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=1000201


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-11-08 21:34:15 +01:00
Christian Boltz
0fd2b9835c Beautify RlimitRule coverage report
Some conditions in RlimitRule can never be hit under normal
circumstances, so this patch adds some "pragma: no cover" and
"pragma: no branch" comments to beautify the coverage report.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-11-08 21:23:27 +01:00
Seth Arnold
dcd2298aec intrigeri@boum.org 2016-11-06 dnsmasq: allow libvirt_leaseshelper "m" permission on itself. 2016-11-07 11:57:08 -07:00
Seth Arnold
c2c9034db5 intrigeri@boum.org 2016-11-06 gnome abstraction: grant read access to ~/.config/gtk-3.0/*. 2016-11-07 11:17:30 -07:00
intrigeri
d8278f51ec dnsmasq: allow libvirt_leaseshelper "m" permission on itself.
Without this, on current Debian unstable, libvirt_leaseshelper crashes
when dnsmasq starts it.
2016-11-06 10:48:34 +01:00
intrigeri
ab1d5d2ffd gnome abstraction: grant read access to ~/.config/gtk-3.0/*.
E.g. Totem needs access to ~/.config/gtk-3.0/settings.ini.
2016-11-06 10:23:51 +01:00
Christian Boltz
193bc28c15 Add a test_multi testcase for dbus eavesdrop
The log line (with a different profile=...) was sitting around on my
disk since a year, so let's do something useful with it ;-)


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-11-02 21:56:43 +01:00
Christian Boltz
bb403893ac More test_multi profiles
This patch adds profiles for all log sniplets that are expected to
result in a profile rule.

This also means some changes in test-libapparmor-test_multi.py are
needed:
- split off log_to_profile_skip from log_to_profile_known_failures to
  - only skip tests in log_to_profile_skip (causing a crash or requiring
    user interaction)
  - run tests in log_to_profile_known_failures, but expect a non-equal
    result (caused by not added rules etc.)
- add quite some tests to log_to_profile_known_failures - they were
  skipped before because they didn't have a *.profile file.
- add handling for hats to shorten list of known failures
  This fixes testcase24 and testcase33 (after adjusting the profiles)
  and lots of the new *.profile files.
- since we now have *.profile files for all log events that should result
  in a profile rule, no longer ignore FileNotFoundError


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-11-01 21:40:29 +01:00
Christian Boltz
65ebf07f4b dnsmasq profile: more lxd additions
Besides dnsmasq.leases, dnsmasq.pid needs to be written. Also read
access for some files is needed (currently dnsmasq.raw and
dnsmasq.hosts - using dnsmasq.* makes this more future-proof when
more files get added)

References: https://bugs.launchpad.net/apparmor/+bug/1634199 (again)


Acked-by: John Johansen <john.johansen@canonical.com>

Bug: https://launchpad.net/bugs/1403468
2016-10-21 13:07:14 +02:00
Christian Boltz
01e4927791 Add new dnsmasq.leases location for lxd to dnsmasq profiles
References: https://bugs.launchpad.net/bugs/1634199


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-10-18 13:22:53 +02:00
Christian Boltz
2de8d20bd9 Test log to profile "translation"
This patch adds TestLogToProfile to test-libapparmor-test_multi.py which
"translates" the test_multi log sniplets to a profile, and checks if it
matches the expected profile.

The expected profile for one log event will obviously contain only one
rule, and gets added as *.profile to the test_multi directory.

This patch includes 33 test_multi profiles - which means 83 more need to
be created. Whenever you have some time, add one or two! (Please write
those test_multi profiles manually, without using the tools.)

I know some parts of the test code looks complicated. Unfortunately this
is how things work - compare it with do_logprof_pass() in aa.py...

While on it, set tests = 'invalid' which ensures a failure in case
parse_test_profiles() doesn't set the tests array, and move printing
the test name out of parse_test_profiles() to avoid printing it twice.

A nice side effect of this patch is increased test coverage:
- 30% -> 40% in aa.py (= 250 more lines)
- 52% -> 78% in aamode.py (= 23 more lines)
- 26% -> 68% in logparser.py (= 120 more lines)
- total coverage increases from 57% to 62%


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-17 21:04:05 +02:00
Christian Boltz
d975b2db21 fix typo in "reasonable" in apparmor_parser manpage
(merge request by intrigeri)


Acked-By: <Christian Boltz> for trunk, 2.10 and 2.9
2016-10-15 19:27:45 +02:00
intrigeri
095e9eea82 Fix typo: s/resonable/reasonable/. 2016-10-15 11:33:50 -05:00
Christian Boltz
35a17557b8 allow reading /tmp/.X11-unix/* in abstractions/X
This is needed when starting X with "-nolisten local".


References: https://bugs.launchpad.net/apparmor/+bug/1589823


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-10-14 20:34:09 +02:00
Christian Boltz
e0134514e2 add network 'kcm' keyword to apparmor.d manpage
I already did this in the python code a month ago, and now realized that
we should also update the apparmor.d manpage ;-)


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
2016-10-14 20:32:48 +02:00
Christian Boltz
d48c41c2d7 Drop unused 'found' counter from aa.py ask_the_questions()
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-14 20:24:56 +02:00
Christian Boltz
38cdaa1f6a Drop seen_events counter from aa.py
seen_events is a global variable in aa.py that gets increased at several
places, but isn't used (read or printed) anywhere. Since I can't imagine
how it could become useful, simply drop it.

Also drop an outdated comment in handle_children that lived next to a
seen_events line.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-14 20:24:10 +02:00
Steve Beattie
af6dad767f Profile abstractions: add wayland/weston abstraction
Merged from intrigeri@boum.org, thanks!

Bug: https://bugs.debian.org/827335
2016-10-14 09:57:42 -07:00
Christian Boltz
051a54889f syslog-ng profile: allow writing *.qf files
These files are needed for disk-based buffering (added in syslog-ng 3.8).
This was reported to me by Peter Czanik, one of the syslog-ng developers.

Note: I'm not sure about adding @{CHROOT_BASE} to this rule, so for now
I prefer not to do it - adding it later is easy, but finding out if it
could be removed is hard ;-)


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9.
2016-10-13 20:29:17 +02:00
Christian Boltz
38580e82c6 Rename config_test.py to test-config.py
This little change means that the tests will run as part of 'make check'.


This commit is only a 'bzr mv utils/test/config_test.py utils/test/test-config.py'
without any changes in the file content.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-10 23:27:19 +02:00
Christian Boltz
b0b895c51b Move str_to_mode() tests to test-aamode.py
aa_test.py doesn't run in 'make check' because its filename doesn't
match the 'test-*.py' pattern, so this move means the tests now actually
get run.

While on it, migrate test-aamode.py to use the AATest base class, and
migrate the str_to_mode() tests to a tests[] array.

After this move, aa_test.py doesn't do anything anymore, so delete it.


Acked-by: Steve Beattie <steve@nxnw.org>.


Also add another test proposed by Steve:
    (None,  set()),
2016-10-10 23:25:07 +02:00
Christian Boltz
304804addb Drop loadincludes() and mode_to_str() tests from aa_test.py
aa_test.py doesn't run in 'make check' because its filename doesn't
match the 'test-*.py' pattern.

mode_to_str() was dropped as part of the FileRule series, so it's
pointless to keep its tests. (The replacement is totally different and
has full test coverage already.)

loadincludes() still exists, but only testing if the function runs
without errors is not really helpful, so drop this test.

Also drop unused imports and add an explicit import for apparmor.aamode.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-10 23:09:41 +02:00
Christian Boltz
93d1539f4f move globbing tests to test-aare.py
aa_test.py doesn't run in 'make check' because its filename doesn't
match the 'test-*.py' pattern.

Move tests for globbing ("plain" globbing and globbing with ext) to
test-aare.py to make sure those tests actually run.

Note: This isn't an exact move - I adjusted some of the tests to make
them more useful, and added some more tests.

Also, glob_path() and glob_path_withext() no longer exist in aa.py.
They moved to the AARE class as part of the FileRule patch series.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-10 23:07:16 +02:00
Christian Boltz
65844a5e1f complete test coverage for FileRule
Add a testcase with exec-only permissions (which get ignored by
get_perms_for_path()) to increase FileRule test coverage to 100%.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-10 22:08:15 +02:00
Christian Boltz
8f9d61af1d Add missing permissions to dovecot profiles
- dovecot/auth: allow to read stats-user
- dovecot/config: allow to read /usr/share/dovecot/**
- dovecot/imap: allow to ix doveconf, read /etc/dovecot/ and
  /usr/share/dovecot/**

These things were reported by Félix Sipma in Debian Bug#835826
(with some help from sarnold on IRC)

References: https://bugs.debian.org/835826


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.



Also allow reading ~/.dovecot.svbin (that's the default filename in the
dovecot config) in dovecot/lmtp profile.
(*.svbin files can probably also appear inside @{DOVECOT_MAILSTORE}, but
that's already covered by the existing rules.)

References: https://bugs.debian.org/835826 (again)


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9
2016-10-05 20:46:03 +02:00
John Johansen
d20969d7fe test for 4.8 semantic change due to binfmt_elf changing when it does mmap
exec_stack picked up a fix to address a semantic change introduced in
4.8 kernels.

However older kernels don't need the extra permission and the exec_stack
test is the only test we currently have that caught the semantic change.

Keep exec_stack to the minimum set of permissions needed for a given
kernel. Which allows us to use exec_stack as a test to detect the
semantic change showing up in unexpected place until we have a test
specifically designed for this.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-10-05 10:49:49 -07:00
Christian Boltz
01dc04c9f9 Drop unused matchregexp(), commonsuffix() and commonprefix() from aa.py
matchregexp() was the last user of convert_regexp() in aa.py, so we
don't need to import it anymore.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-03 21:04:24 +02:00
Christian Boltz
164faa3f17 Drop CMD_CONTINUE from ui.py (twice)
The latest version of pyflakes (1.3.0 / python 3.5) complains that
CMD_CONTINUE is defined twice in ui.py (with different texts).

Funnily CMD_CONTINUE isn't used anywhere, so we can just drop both.



Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-10-03 21:01:29 +02:00
Christian Boltz
1c4a885e27 Switch utils to python3
As discussed a while ago, switch the utils (including their tests) to
use python3 by default. While on it, drop usage of "env" to always get
the system python3 instead of a random one that happens to live
somewhere in $PATH.

In practise, this patch doesn't change much - AFAIK openSUSE, Debian and
Ubuntu already patch aa-* to use python3.

Also add a note to README to officially deprecate Python 2.x.
(I won't break Python 2.x support intentionally - unless some future
change gives me a very good reason to finally drop Python 2.x support.)



Acked-by: Seth Arnold <seth.arnold@canonical.com>
(since 2016-08-23, but the commit had to wait for the FileRule series
 because it touches test-file.py)
2016-10-01 20:57:09 +02:00
Christian Boltz
ac6fe7f2e4 [42/38] Drop more unused functions from aa.py
After looking at matchliteral(), I found out that it's only user is
rematchfrag(), which is only called in a) an "if False:" block and
b) match_include_to_path() - and that is only called by the also unused
match_prof_incs_to_path() function.

This patch drops some dead code (like the mentioned "if False:" block)
and the now unused functions
- matchliteral()
- rematchfrag()
- match_include_to_path()
- match_prof_incs_to_path()


This patch is also THE ANSWER to the question when I'll finally consider
this patch series complete.

42. It can't become better than that! ;-)



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:22:27 +02:00
Christian Boltz
c9a1a02c83 [41/38] let aa-mergeprof ask about new hats and subprofiles
If a merged profile contains additional hats or subprofiles, the "old"
aa-mergeprof silently created them as additional hasher elements (partly
buggy, because subprofiles would end up as '^/subprofile' instead of
'profile /subprofile'). After switching to FileRule, aa-mergeprof crashes
on new hats or subprofiles.

This patch adds code to ask the user if the new hat or subprofile should
be added - which means this patch replaces two bugs (crash + silently
adding subprofiles and hats) with a new feature ;-)


The new questions also add a new text CMD_ADDSUBPROFILE in ui.py.

Finally, the new "button" combinations get added to test-translations.py.



If you want to test, try to aa-mergeprof this profile (the subprofile
and hat are dummies, nothing ping would really require):


#include <tunables/global>
/{usr/,}bin/ping {
  #include <abstractions/base>
  #include <abstractions/consoles>
  #include <abstractions/nameservice>

  capability net_raw,
  capability setuid,
  network inet raw,
  network inet6 raw,

  /{,usr/}bin/ping mixr,
  /etc/modules.conf r,

  ^hat {
    /bin/hat r,
    /bin/bash px,
  }

  profile /subprofile {
    /bin/subprofile r,
    /bin/bash px,
 }

  # Site-specific additions and overrides. See local/README for details.
  #include <local/bin.ping>
}



Note that this patch is not covered by unittests, but it passed all my
manual tests.



Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://launchpad.net/bugs/1507469
2016-10-01 20:21:06 +02:00
Christian Boltz
71f67354f3 [40/38] Load all includes in aa-mergeprof ask_the_questions()
aa-mergeprof empties 'includes' when running reset_aa(). The result is
    KeyError: 'abstractions/newly_added_abstraction'
if an include file gets added because it isn't part of 'includes' at
this time. Note that you'll need to add another rule after adding the
include to trigger checking the includes for superfluous rules.


This fixes the regression found by Steve - which isn't really a
regression, "just" one more thing that got more visible with the new
code. Before, it was just an ill-addressed hasher that didn't complain ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:20:27 +02:00
Christian Boltz
7e86ad1602 [39/38] Ignore exec events for non-existing profiles
The switch to FileRule made some bugs visible that survived unnoticed
with hasher for years.

If aa-logprof sees an exec event for a non-existing profile _and_ a
profile file matching the expected profile filename exists in
/etc/apparmor.d/, it asks for the exec mode nevertheless (instead of
being silent). In the old code, this created a superfluous entry
somewhere in the aa hasher, and caused the existing profile to be
rewritten (without changes).

However, with FileRule it causes a crash saying

      File ".../utils/apparmor/aa.py", line 1335, in handle_children
        aa[profile][hat]['file'].add(FileRule(exec_target, file_perm, exec_mode, rule_to_name, owner=False, log_event=True))
    AttributeError: 'collections.defaultdict' object has no attribute 'add'

This patch makes sure exec events for unknown profiles get ignored.



Reproducer:

    python3 aa-logprof -f <(echo 'type=AVC msg=audit(1407865079.883:215): apparmor="ALLOWED" operation="exec" profile="/sbin/klogd" name="/does/not/exist" pid=11832 comm="foo" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 target="/sbin/klogd//null-1"')

This causes a crash without this patch because
/etc/apparmor.d/sbin.klogd exists, but has
    profile klogd /{usr/,}sbin/klogd {



References: https://bugs.launchpad.net/bugs/1379874



Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-10-01 20:17:11 +02:00
Christian Boltz
7aca12bb12 [38/38] Drop old path regexes
FileRule uses RE_PROFILE_FILE_ENTRY, which also means
RE_PROFILE_PATH_ENTRY, RE_PROFILE_BARE_FILE_ENTRY and RE_OWNER are now
unused.

This patch drops these regexes and their tests in test-regex_matches.py.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:16:36 +02:00
Christian Boltz
5dbb283af5 [37/38] Drop severity rank() dispatcher
rank() in severity.py is a dispatcher that calls the needed function
(rank_path(), rank_capability()) based on the parameter. Since all
calling code knows what rule type it is handling, this dispatcher is
superfluous - the calling code can call rank_path() or rank_capability()
directly.

This patch drops rank() and switches the remaining users of rank() to
call the rank_*() functions directly. For the tests, this means to drop
the CAP_ prefix because rank_capability doesn't expect this prefix.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:15:45 +02:00
Christian Boltz
265fd4a708 [36/38] Drop several now unused functions and variables from aamode.py
After switching to FileRule, several functions in aamode.py are no
longer used and can be deleted:
- print_mode()
- sub_mode_to_str()
- is_user_mode()
- split_mode()
- mode_to_str()
- flatten_mode()
- owner_flatten_mode()
- mode_to_str_user()
- log_str_to_mode()

The AA_EXEC_TYPE and ALL_AA_EXEC_TYPE variables are also unused now.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:15:21 +02:00
Christian Boltz
95f47ba9ff [35/38] Drop old path code from aa.py and aa-mergeprof
Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:14:44 +02:00
Christian Boltz
3ed80a9ed4 [34/38] logprof, mergeprof: cleanup superfluous rules when user adds a new rule
When an user adds a new rule to a profile, cleanup / delete existing
rules that are covered by the new rule, and report the number of deleted
rules.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:13:49 +02:00
Christian Boltz
9a6c3430d0 [33/38] Add cleanup flag to *Ruleset.add()
Adding a rule to *Ruleset means it simply gets added. This also means
that then-superfluous rules will be kept.

This patch adds an optional cleanup flag to add(). If set, rules covered
by the new rule will be deleted. The difference to delete_duplicates()
is that cleanup only deletes rules that are covered by the new rule, but
keeps other, unrelated superfluous rules.

Also return the number of deleted rules to give the UI a chance to
report this number.

Finally, adjust the existing tests for FileRuleset to ensure default
mode (without cleanup) doesn't delete any rules, and add a test using
the cleanup flag.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:13:06 +02:00
Christian Boltz
6ccdd27937 [32/38] Re-implement exec conflict handling in aa-mergeprof
Replace the old (hasher-based) conflict_mode() with the new
(FileRule-based) ask_conflict_mode() function. If it detects conflicting
exec rules, it asks the user which one to keep.

Also call ask_conflict_mode() from ask_the_questions() so that it is
actually used.

Note: This patch isn't covered by unittests, but I did some manual
testing to make sure it works as expected.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:12:30 +02:00
Christian Boltz
d1347051f4 [31/38] FileRule: add get_exec_rules_for_path() and get_exec_conflict_rules()
get_exec_rules_for_path() returns a FileRuleset with all rules matching
the given path.

get_exec_conflict_rules() returns a FileRuleset with all exec rules that
conflict with the given oldrule. This will be used by aa-mergeprof to
ask the user which rule he wants to keep.

Also add tests for both functions.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:12:01 +02:00
Christian Boltz
a3586e614e [30/38] Re-enable clear_common() call in aa-mergeprof
The clear_common() call was disabled because it crashed in
delete_path_duplicates(). With the switch to FileRule, this function
no longer exists and therefore it can't crash ;-)

This patch re-enables the clear_common() call to avoid asking
superfluous questions.

References: https://bugs.launchpad.net/apparmor/+bug/1382236


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:09:36 +02:00
Christian Boltz
95404bb2f3 [29/38] let _is_covered_aare() check against the AARE instead of the (str) regex
This is the correct way of doing AARE matches. However, this check is
more strict when matching against an AARE containing wildcards etc.
(which can "by luck" match when doing str matching)

To avoid breaking DbusRule, PtraceRule and SignalRule (especially their
tests), introduce _is_covered_aare_compat() which keeps the previous
behaviour of doing str matching, and use it in these classes.

On the long term, _is_covered_aare_compat() needs to go away, but doing
the changes needed in DbusRule, PtraceRule and SignalRule (or ideally
just in AARE) are out of scope for the FileRule patch series.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:08:10 +02:00
Christian Boltz
dde4609f22 [28/38] AARE: let match() handle plain path regexes as non-regex
When matching an AARE against another AARE, most AARE objects don't
contain orig_regex (only AARE instances originating from a log event
contain orig_regex).

In this case, match() will use is_equal() to error out on the safe side.
Unfortunately this also means that there are lots of false negative
cases where match() returns False errornously.

With this patch, match() checks the given AARE regex and, if it doesn't
contain any special characters (wildcards, alternations or variables),
handles it as plain path. This avoids most of the false negatives.

Also extend the AARE tests to check a bunch of plain path regexes using
AARE matching instead of only str matching.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:07:17 +02:00
Christian Boltz
06d880d1ff [27/38] Implement FileRule logprof_header()
Merge the existing and requested permissions into a nice set of headers
that can be displayed by aa-logprof. This will look like:

	Path:      /foo
	Old Mode:  r + owner w
	New Mode:  rw

Also split off a _join_given_perms() function off _joint_perms() so that
we can use the permission string merging for things not stored in self.*.

Finally add some tests for logprof_header().



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:06:38 +02:00
Christian Boltz
b78e65824c [26/38] Avoid crash in aa-logprof on events for non-existing profiles
If the audit.log contains an event for a non-existing profile (this can
happen when running with a foreign log or if the user manually deleted a
profile or hat), propose_file_rules() crashes because rule_obj is None
instead of a profile_storage() struct.

This patch adds a check that skips events for non-existing profiles and
hats.

Note: I'm quite sure this happens only for file events (because the
other rule types don't have something similar to propose_file_rules()),
therefore no backport to older versions is needed.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:05:58 +02:00
Christian Boltz
541977c91b [25/38] Set audit mode for all options
Add set_options_audit_mode() to switch the audit mode in all options
offered by aa-logprof and aa-mergeprof, not only the "original" rule
(in aa-logprof, this means the non-globbed rule_obj).

As usual, add some tests to ensure the function works as expected.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:05:27 +02:00
Christian Boltz
20161471be [24/38] Add propose_file_rules() to propose globbed etc. file rules in aa-logprof
aa.py:
- add propose_file_rules() - will propose matching paths from existing
  rules in the profile or one of the includes
- save user_globs if user selects '(N)ew' (will be re-used when
  proposing rules)
- change user_globs to a dict so that it can carry the human-readable
  path and an AARE object for it
- change order_globs() to ensure the original path (given as parameter)
  is always the last item in the resulting list
- add a ruletype switch to ask_the_questions() so that it uses
  propose_file_rules() for file events (I don't like this
  ruletype-specific solution too much, but everything else would make
  things even more complicated)

Also keep aa-mergeprof ask_the_questions() in sync with aa.py.

In FileRule, add original_perms (might be set by propose_file_rules())

Finally, add some tests to ensure propose_file_rules() does what it promises.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:04:42 +02:00
Christian Boltz
f2a60f67e3 [23/38] Add get_file_perms() to aa.py
get_file_perms() collects the existing permissions for a file from
various rules (exact matches, wildcards) in the main profile and the
included abstractions.

It will be used to get displaying the current permissions back, and
also to propose rules with merged permissions (next patch).

Also add some tests to make sure it does what it promises ;-)



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:03:44 +02:00
Christian Boltz
435281f018 [22/38] Add get_perms_for_path() and get_rules_for_path() to FileRuleset
- get_rules_for_path() returns all rules matching the given path
  (both exact matches and AARE matches)
- get_perms_for_path() returns the merged permissions for the given
  path and a list of paths used in the matching rules

Also add tests for these two functions.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:03:07 +02:00
Christian Boltz
8dc09bd643 [21/38] Add severity support to FileRule
Also add a rank_path() function to severity.py and change rank() to call
rank_path() for paths.
Long-term goal: get rid of the type "guessing" in rank()

Finally add some tests, mostly based on test-severity.py SeverityTest


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:02:34 +02:00
Christian Boltz
875f9cf7d9 [20/38] Re-add '(N)ew' to aa-logprof
This brings back the edit option for the path of file rules.

Also add it to aa-mergeprof to keep ask_the_questions() in sync.

Note: aa-mergeprof will ask about path mismatchs basically always.
That's because AARE is too careful on the matching - something to be
fixed in a later patch.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:01:53 +02:00
Christian Boltz
0fe9ed8960 [19/38] Add support for editing paths to FileRule
This means adding
- self.can_edit - True if editing via '(N)ew' should be possible (will
  be False for bare file rules)
- edit_header() - returns the prompt text and the current path
- validate_edit() - checks if the new path matches the original one
- store_edit() - changes the path to the new one (even if it doesn't
  match the old one)

self.can_edit and the 3 functions are also added to BaseRule:
- can_edit is False by default
- the functions raise a NotImplementedError


Also add tests for the added code.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 20:00:32 +02:00
Christian Boltz
fa7e25530d [18/38] Re-add globbing support for file rules to aa-logprof
This change also needs some other changes in ask_the_questions():
- set q.options and q.selected inside the loop (because glob() and
  glob_ext() add another option)
- set 'selection' outside the if block to avoid doing it in nearly every
  if branch
- make sure to add the selected rule, not just rule_obj (which doesn't
  contain a modified, for example globbed, rule)
- skip 'deny' if an #include is selected
- re-add handling for CMD_GLOB and CMD_GLOB_EXT (was lost when switching
  to FileRule)
- add selection_to_rule_obj() helper function
- add glob and glob with ext buttons in available_buttons() if
  rule_obj.can_glob or rule_obj.can_glob_ext

Also apply the changes in ask_the_questions() to aa-mergeprof to keep it
in sync with aa.py, and disable the old path handling in aa-mergeprof.

Note: in its current state, aa-mergeprof will ask for some "superfluous"
file permissions, and doesn't check for 'x' conflicts. One of the
following patches will fix that.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:58:40 +02:00
Christian Boltz
f0ddee648d [17/38] Implement globbing in FileRule
Add the glob() and glob_ext() functions to FileRule, and set
self.can_glob and self.can_glob_ext. Also add some tests (just enough to
make sure the FileRule integration works - the globbing is handled
inside AARE,and the AARE tests contain more testcases).

Note that the implementation differs from the original plan (which was
to have globbing in *Ruleset). Therefore add can_glob and can_glob_ext
to BaseRule (both default to False), and add a comment to BaseRuleset
that globbing needs to be removed from all *Ruleset classes.


Acked-by: Steve Beattie <steve@nxnw.org>


As discussed, I added a pointer to the test-aare.py globbing tests in
test-file.py.
2016-10-01 19:57:30 +02:00
Christian Boltz
9d6b525899 [16/38] move glob_path() and glob_path_ext() to AARE
glob_path() and glob_path_ext() modify a (path) regex, so move them to
AARE. Also change them to use self.regex instead of the newpath
parameter, and to return a new AARE object.

While on it, also add several tests to test-aare.py.


Note: There are still glob_path() and glob_path_ext() calls in aa.py,
but those calls are in a (since the middle of this patch series) dead
code section. pyflakes will complain about them nevertheless ;-)



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:56:31 +02:00
Christian Boltz
ee7560d6ef [15/38] Change handle_children() and ask_the_questions() to FileRule
This patch changes handle_children() (which asks about exec events) and
ask_the_questions() (which asks everything else) to FileRule. This
solves the "brain split" introduced by the previous patch.

This means aa-logprof and aa-genprof ask useful questions again, and
store the answers at the right place.

In detail, this means (with '-' line number from the diff)
- (391) handle_binfmt(): use FileRule. Also avoid breakage if glob_common()
  returns an empty result.
- (484) profile_storage(): drop profile['allow']['path'] and
  profile['deny']['path']
- (510) create_new_profile(): switch to FileRule
- (1190..1432) lots of changes in handle_children():
  - drop escaping (done in FileRule)
  - don't add events with 'x' perms to prelog
  - use is_known_rule() instead of profile_known_exec()
  - replace several regexes for the selected CMD_* with more readable
    'in' clauses. While on it, drop unused parts of the regex.
  - use plain 'ix', 'px' (as str) instead of str_to_mode() format
  - call handle_binfmt() for the interpreter in ix, Pix and Cix rules
- (1652) ask_the_questions(): disable the old file-specific code
  (not dropped because some features aren't ported to FileRule yet)
- (2336) collapse_log():
  - convert file log events to FileRule (and add some workarounds and
    TODOs for logparser.py behaviour that needs to change)
  - disable the old file-specific code (not dropped because merging of
    existing permissions isn't ported to FileRule yet)
- (2403) drop now unused validate_profile_mode() and the regexes it used
- (3374) drop now unused profile_known_exec()

Test changes:
- adjust fake_ldd to handle /bin/bash
- change test-aa.py AaTest_create_new_profile to expect FileRule instead
  of a path hasher. Also copy the profiles to the tempdir and load the
  abstractions that are needed by the test.
  (These tests get skipped on py2 because changing
  apparmor.aa.cfg['settings']['ldd'] doesn't work for some unknown reason)


Important: Some nice-to-have features are not yet implemented for
FileRule:
- globbing
- (N)ew (allowing the user to enter a custom path)
- displaying and merging of permissions already existing in the profile

This means: aa-logprof works, but it's not as user-friendly as before.
The next patches will fix that ;-)

Also note that pyflakes will fail for ask_the_questions_OLD_FILE_CODE()
because of undefined symbols (aamode, profile, hat). This will be fixed
when the old code gets dropped in one of the later patches.


Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://launchpad.net/bugs/1569316
2016-10-01 19:55:58 +02:00
Christian Boltz
aaa244c5ec [14/38] Use FileRule and FileRuleset
Change aa.py to use FileRule and FileRuleset for parsing and saving
profiles.

In detail, this means:
- add 'file' to the list of rule classes to enable it at various places
- store file rules in aa[profile][hat]['file'] (not 'path' as before)
  to be consistent with the FileRule name
- drop the no longer needed delete_path_duplicates() - this is now
  handled by FileRuleset like in all other rule classes.
  (same change in cleanprofile.py)
- replace usage of RE_PROFILE_BARE_FILE_ENTRY and RE_PROFILE_PATH_ENTRY
  with FileRule.match()
- drop write_path_rules() and write_paths() and replace them with the
  new write_file() function.
- adjust several code sections to use write_file() and 'file' instead of
  'path'

FileRule doesn't drop optional keywords ('allow' and 'file'), therefore
adjust cleanprof_test.out to the changed behaviour. (If someone insists
on dropping optional keywords in aa-cleanprof, that's something for a
future patch.)

Also adjust the list of known failures in test-parser-simple-tests.py -
switching to FileRule avoids several test failures (and introduces a few
new ones ;-)




IMPORTANT:

This patch introduces a "brain split" which means
- parsing and writing the profile and aa-cleanprof use the new location
  (aa[profile][hat]['file'])
- aa-logprof and aa-genprof still save data to the old location
  (aa[profile][hat]['allow']['path']) and probably ask superfluous
  questions because there are no rules existing in the old location

TL;DR: don't try aa-logprof or aa-genprof with only this patch applied.

I know this isn't ideal, but still better than an even bigger and
totally unreadable patch ;-)



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:54:48 +02:00
Christian Boltz
c1fc2c9011 [13/38] Add ANY_EXEC to FileRule
aa-logprof needs to check if an exec rule for a given path exists.

This patch adds a __FileAnyExec class to FileRule, as well as ANY_EXEC
(which should be used externally, similar to ALL), and adjusts several
checks to allow it as a special execute mode.

This will allow to use is_covered() (or aa.py is_known_rule()) to find
out if execute is permitted, which replaces aa.py profile_known_exec()
in one of the following patches.

As usual, also add some tests.



Acked-by: Steve Beattie <steve@nxnw.org>


Note: as discussed, I adjusted the comment for 'pass' around line 240.
2016-10-01 19:53:38 +02:00
Christian Boltz
991d55d1dd [12/38] Change RE_PROFILE_BARE_FILE_ENTRY and RE_PROFILE_PATH_ENTRY imports in test-regex_matches.py
Patch 14 will drop the RE_PROFILE_PATH_ENTRY and
RE_PROFILE_BARE_FILE_ENTRY import from apparmor.aa.
This would break test-regex_matches.py, therefore
import these regexes from apparmor.regex.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:52:57 +02:00
Christian Boltz
5431db744f [11/38] FileRule: Handle duplicated exec permissions
The parser accepts duplicated execute permissions as long as they don't
conflict. For example,
	/bin/foo pxpxpxpx,
is a valid rule.

This patch changes FileRule to also accept those duplicated permissions,
even if it's unlikely to hit them outside of the parser tests ;-)

Also add some tests to make sure the parsing works as expected.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:52:12 +02:00
Christian Boltz
68ccc4eea5 [10/38] RE_PATH: allow to match '/'
RE_PATH expected (simplified) '/.+', however this excludes a plain '/'
that can appear in path rules.

This patch changes the regex so that it also matches '/'.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:51:36 +02:00
Christian Boltz
b84877b900 [09/38] Drop contains() in aamode.py
After dropping the dead code in handle_children(), there's only one use
of contains() left in log_str_to_mode().

This patch changes log_str_to_mode to use mode_contains() and drops the
now unused contains() function.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:50:57 +02:00
Christian Boltz
b8171d547e [08/38] Drop dead code in aa.py handle_children()
The 'exec' handling in handle_children starts with

     if do_execute:
         if profile_known_exec(...)
            continue

which means if profile_known_exec() returns True, the rest of the loop
will be skipped. profile_known_exec() will return True if it finds an
exec rule in the profile or an include (independent of the exec type,
and (thanks to rematchfrag()) even if the path is globbed.

Later in the loop, there are checks for various exec modes - but those
checks can only be reached without an existing x rule, so they'll never
be hit.

This patch removes the dead code in the handle_children() / 'exec' / 'no
existing x rule found' section.

I confirmed that this code is really dead by
a) reading the code and, after being confused
b) two manual aa-logprof runs with coverage enabled - in one of them, I
   added some ix, Px and Cx rules, and in the second one, no more exec
   rules were needed/asked.

After dropping the dead code, combinedmode and combinedaudit are no
longer used, so we can also drop the code that sets those variables.


Sidenote: this patch drops 2% of the lines in aa.py ;-)



Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:49:50 +02:00
Christian Boltz
c8e98de53a [07/38] Add tests for FileRule
As usual, we have 100% test coverage - at least until patch 22, which
introduces one 'partial' ;-)


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:49:00 +02:00
Christian Boltz
05e57e3932 [06/38] Add FileRule and FileRuleset
These classes handle file rules, including file rules with leading
perms, and are meant to replace lots of file rule code in aa.py and
aa-mergeprof.

Note: get_glob() and logprof_header_localvars() don't even look
finalized and will be changed in a later patch. (Some other things will
also be changed or added with later patches - but you probably won't
notice them while reviewing this patch.)


Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Kshitij Gupta <kgupta8592@gmail.com> (with some suggestions for a follow-up patch)



v1.1: remove 'and not deny' from a condition in split_perms() to get
more helpful error messages for rules like "deny /foo pix,"

Acked-by: Steve Beattie <steve@nxnw.org>
2016-10-01 19:47:52 +02:00
Christian Boltz
8a875d84d2 [05/38] Make sanity check in _is_covered_list() optional
_is_covered_list() has a sanity check that raises an exception if both
other_value and other_all evaluate to False. This breaks when using
_is_covered_list() for FileRule.perms which can be empty if exec_perms
are specified.

This patch adds an optional parameter that allows to skip the sanity
check.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:47:19 +02:00
Christian Boltz
9eb7ce5992 [04/38] Add detailed regex for file rules
For now, use an additional regex RE_PROFILE_FILE_ENTRY to avoid
breakage of the existing code by the added match groups.

The regex includes support for file rules with leading and trailing
permissions as well as bare file rules.

Note: even with the restriction to the permission letters we actually
use, it's in theory still possible that a future additional rule type or
permission letter might lead to additional matches for other rule types.
Therefore the parsing code should check for all other rule types before
matching for file rules.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:46:37 +02:00
Christian Boltz
1302c5cf96 [03/38] check_and_split_list(): allow 'lst' parameter to be a set
list, tuple, set - does python offer even more array types? ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-10-01 19:46:15 +02:00
Christian Boltz
f1ecae9d4e [02/38] check_and_split_list: optionally allow empty list
File permissions can be an empty list (if only exec permissions are
specified). This patch adds the optional allow_empty_list parameter so
that the function can handle this case.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:45:51 +02:00
Christian Boltz
46350f7e27 [01/38] Pass 'strict' flag from is_equal to is_equal_localvars
File rules contain some optional details (like leading permissions and
the file keyword) which should be ignored in non-strict mode.

This patch passes through the 'strict' parameter to is_equal_localvars
and adds it as function parameter in all existing rule classes.
It also adjusts test-baserule.py to test with the additional parameter.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-10-01 19:45:16 +02:00
Tyler Hicks
27f03e8097 libapparmor: Be consistent with the type used for buffer sizes
The features_struct.size variable is used to hold a buffer size and it
is also passed in as the size parameter to read(). It should be a size_t
instead of an int.

A new helper function, features_buffer_remaining(), is created to handle
the two places where the remaining bytes in the features buffer are
calculated.

This patch also changes the size parameter of load_features_dir() to a
size_t to match the same parameter of load_features_file() as well as
the features_struct.size change described above.

Two casts were needed when comparing signed types to unsigned types.
These casts are safe because the signed value is checked for "< 0"
immediately before the casts.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-09-30 15:03:07 -05:00
Tyler Hicks
6ada9b01b4 libapparmor: Fix overflowed return value
The load_features_file() function returned an int but calculated the
value by subtracting two pointers. On 64 bit systems, that results in a
64 bit value being represented as a 32 bit type.

Coverity CID #55992

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-09-30 15:03:02 -05:00
Christian Boltz
196f344270 Allow both paths in traceroute profile
In 2011 (r1803), the traceroute profile was changed to also match
/usr/bin/traceroute.db:
    /usr/{sbin/traceroute,bin/traceroute.db} {

However, permissions for /usr/bin/traceroute.db were never added.
This patch fixes this.


While on it, also change the /usr/sbin/traceroute permissions from
rmix to the less confusing mrix.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-09-30 00:07:26 +02:00
Tyler Hicks
8edb9ec529 tests: Fix exec_stack.sh errors under 4.8 and newer kernels
https://launchpad.net/bugs/1628745

The following upstream kernel commit changed the semantics of the exec
permission check in the 4.8 kernel:

 commit 9f834ec18defc369d73ccf9e87a2790bfa05bf46
 Author: Linus Torvalds <torvalds@linux-foundation.org>
 Date: Mon Aug 22 16:41:46 2016 -0700

     binfmt_elf: switch to new creds when switching to new mm

That change means that the target profile of an exec transition must
have permission to map the binary being executed. This patch fixes
regression test failures while the exec_stack.sh test is running against
4.8 and newer kernels by granting mapping permission to the target
profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-09-28 23:11:29 -05:00
Steve Beattie
4492e7cb2d utils/test/test-aa.py: skip tests that break with python2.7
For reasons that aren't entirely clear, the action to set
apparmor.aa.cfg['settings']['ldd'] to './fake_ldd' does not actually
work on python2.7, get_reqs() tries to use /usr/bin/ldd anyway (printing
out the contents of apparmor.aa.cfg['settings']['ldd'] after the set
operation shows it to still contain '/usr/bin/ldd' o.O). Therefore, skip
these two tests when running under python2.7.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>

Bug: https://launchpad.net/bugs/1522938
2016-09-21 11:52:42 -07:00
Tyler Hicks
5cdc45deab libapparmor: Force libtoolize to replace existing files
Fixes build error when attempting to build and test the 2.10.95 release
on Ubuntu 14.04:

 $ (cd libraries/libapparmor/ && ./autogen.sh && ./configure && \
   make && make check) > /dev/null
 ...
 libtool: Version mismatch error.  This is libtool 2.4.6 Debian-2.4.6-0.1, but the
 libtool: definition of this LT_INIT comes from libtool 2.4.2.
 libtool: You should recreate aclocal.m4 with macros from libtool 2.4.6 Debian-2.4.6-0.1
 libtool: and run autoconf again.
 make[2]: *** [grammar.lo] Error 63
 make[1]: *** [all] Error 2
 make: *** [all-recursive] Error 1

The --force option is needed to regenerate the libtool file in
libraries/libapparmor/.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-09-14 12:48:58 -05:00
Christian Boltz
b6734696ea Allow 'kcm' in network rules
This is probably
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/plain/Documentation/networking/kcm.txt


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.

Bug: https://launchpad.net/bugs/1513880
2016-09-12 23:34:11 +02:00
intrigeri
d482d1a26c Include the wayland abstraction from the gnome one.
This is the least invasive solution to the problem I'm trying to solve
right now (Evince not starting in GNOME on Wayland, and probably
similar issues for other GNOME applications I suppose).

At some point, we will probably want to source the wayland abstraction
from other desktop environments' abstractions, or simply from the
X one. Let's come back to it once people using these other desktop
environments on Wayland with AppArmor enabled tell us what policy
change is needed to make it work for them.
2016-09-11 23:03:24 +02:00
intrigeri
c636d1771e Add a basic wayland abstraction.
It's good enough to allow starting Evince in GNOME on Wayland,
on current Debian unstable.

References: https://bugs.debian.org/807880
2016-09-11 23:03:01 +02:00
John Johansen
6e1ed4ba3f Previously a stack with unconfined would cause the mode to be reported as mixed
profile_A//&:ns1://unconfined (mixed)

this is confusing and can even break some trusted helpers. The unconfined
profile has been special cased and now will report enforce when stacking
with unconfined
  profile_A//&:ns1://unconfined (enforce)

This patch fixes the regression tests to work with this change

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

Bug: https://launchpad.net/bugs/1521400
2016-09-02 18:22:19 -07:00
Seth Arnold
706afb93af gnome abstraction: allow reading file type associations from another place where it can live on Debian.
In Debian, gnome-session (3.20.1-2)'s changelog reads:

        If /etc/gnome/defaults.list was modified by the system administrator,
        the file is moved to /etc/xdg/gnome-mimeapps.list during the upgrade.

    So we want to at least support /etc/xdg/gnome-mimeapps.list. And
    while we're at it, let's support *-mimeapps.list instead of just
    gnome-mimeapps.list, in case other desktop environments or derivatives
    need such customizations.
2016-08-25 12:06:18 -07:00
intrigeri
7870b2c326 gnome abstraction: allow reading file type associations from another place where it can live on Debian.
In Debian, gnome-session (3.20.1-2)'s changelog reads:

    If /etc/gnome/defaults.list was modified by the system administrator,
    the file is moved to /etc/xdg/gnome-mimeapps.list during the upgrade.

So we want to at least support /etc/xdg/gnome-mimeapps.list. And while
we're at it, let's support *-mimeapps.list instead of just gnome-mimeapps.list,
in case other desktop environments or derivatives need such customizations.
2016-08-25 12:12:56 +02:00
Christian Boltz
e2039f021e Fix aa-logprof "add hat" endless loop
This turned out to be a simple case of misinterpreting the promptUser()
result - it returns the answer and the selected option, and
"surprisingly" something like
    ('CMD_ADDHAT', 0)
never matched
    'CMD_ADDHAT'
;-)

I also noticed that the new hat doesn't get initialized as
profile_storage(), and that the changed profile doesn't get marked as
changed. This is also fixed by this patch.


References: https://bugs.launchpad.net/apparmor/+bug/1538306



Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-08-15 22:02:55 +02:00
Christian Boltz
c8bc128039 type_is_str(): make pyflakes3 happy
pyflakes3 doesn't check sys.version and therefore complains about
'unicode' being undefined.

This patch defines unicode as alias of str to make pyflakes3 happy, and
as a side effect, simplifies type_is_str().


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
2016-08-12 12:02:20 +02:00
Christian Boltz
9a76e33e9b delete_duplicates(): don't modify self.rules while looping over it
By calling self.delete() inside the delete_duplicates() loop, the
self.rules list was modified. This resulted in some rules not being
checked and therefore (some, not all) superfluous rules not being
removed.

This patch switches to a temporary variable to loop over, and rebuilds
self.rules with the rules that are not superfluous.

This also fixes some strange issues already marked with a "Huh?" comment
in the tests.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.

Note that in 2.10 cleanprof_test.* doesn't contain a ptrace rule,
therefore the cleanprof_test.out change doesn't make sense for 2.10.
2016-08-08 23:14:33 +02:00
Christian Boltz
6d9e55a8a3 winbindd profile: allow dac_override
This is needed to delete kerberos ccache files, for details see
https://bugzilla.opensuse.org/show_bug.cgi?id=990006#c5


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.
2016-08-03 21:51:54 +02:00
Christian Boltz
00026d74ca logparser: store network-related params if an event looks like network
Network events can come with an operation= that looks like a file event.
Nevertheless, if the event has a typical network parameter (like
net_protocol) set, make sure to store the network-related flags in ev.

This fixes the test failure introduced in my last commit.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
2016-07-31 17:13:57 +02:00
Christian Boltz
89c9a8cdc5 logparser.py: ignore network events with 'send receive'
We already ignore network events that look like file events (based on
the operation keyword) if they have a request_mask of 'send' or
'receive' to avoid aa-logprof crashes because of "unknown" permissions.
It turned out that both can happen at once, so we should also ignore
this case.

Also add the now-ignored log event as test_multi testcase.


References: https://bugs.launchpad.net/apparmor/+bug/1577051 #13


Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk, 2.10 and 2.9.
2016-07-30 00:41:43 +02:00
Seth Arnold
36244d4872 add ld.so.preload to <abstractions/base>, thanks to Uzair Shamim 2016-07-29 11:44:17 -07:00
John Johansen
b7bfa2303a Add 4.4 kernel patches
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-29 02:46:38 -07:00
John Johansen
ebd527db70 Add 4.5 out of tree kernel patches
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-29 02:01:03 -07:00
John Johansen
71181796e3 Add patches for 4.6 kernel
Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-29 01:29:02 -07:00
John Johansen
dafcbfb4b6 Add patches for 4.7 upstream kernel
patches
0001-0022 are backports of fixes from the 4.8 pull-request
0023-0025 are the out of tree feature patches

Signed-off-by: John Johansen <john.johansen@canonical.com>
2016-07-28 19:31:34 -07:00
Martin Pitt
f065286d27 Allow dbus-user-session D-Bus path
https://launchpad.net/bugs/1604872

dbus-user-session uses the file based Unix socket in $XDG_RUNTIME_DIR/bus.
Extend the dbus-session-strict abstraction to also allow that.

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-07-26 22:49:51 -05:00
Christian Boltz
366b3dfdad Allow mr for /usr/lib*/ldb/*.so in samba abstractions
This is needed for winbindd (since samba 4.4.x), but smbd could also need it.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=990006


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-07-26 21:12:35 +02:00
Tyler Hicks
cbaa772320 utils: Handle the safe/unsafe change_profile exec modes
https://launchpad.net/bugs/1584069

This patch adds support for the safe and unsafe exec modes for
change_profile rules. The logic is pretty simple at this point because
the kernel's default for exec modes changed in newer versions.
Therefore, this patch simply retains any specified exec mode in parsed
rules. If an exec mode is not specified in a rule, there is no attempt
to force the usage of "safe" because older kernels do not support it.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-07-20 17:24:11 -05:00
Tyler Hicks
d0e49476a9 tests: Fix onexec.sh races by using the transition test program
The onexec.sh test has periodically exhibited unexplicable failures that
are possibly due to race conditions when onexec.sh is verifying the
/proc/PID/attr/{current,exec} values of the process under test. This
patch attempts to solve the flaky test failures by removing the need for
IPC to coordinate between the test script and the test program.

The old onexec test program is removed and the transition test program
is used instead. This allows for the test script to tell the transition
test program what its current and exec procattr labels should be via
command line options.

Since IPC is no longer needed, the signal:ALL allow rule can be dropped
from the test profile. A new allow rule is needed to grant reading of
/proc/*/attr/{current,exec} since transition must verify the contents of
these files.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-06-25 10:25:28 -05:00
Tyler Hicks
af1d141f0a tests: Add transition test options to verify exec procattr
Add optional command line parameters to the transition test program that
can be used to verify a certain label and/or mode that should be found
in /proc/self/attr/exec.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-06-25 10:24:36 -05:00
Steve Beattie
e69ab01670 profiles: ubuntu-browsers abstraction: support Debian's firefox-esr
Merged from intrigeri@boum.org; thanks!
2016-06-24 11:45:40 -07:00
Seth Arnold
23df2d4e85 intrigeri@boum.org 2016-06-24 mod_apparmor manpage: fix "documenation" typo. 2016-06-24 10:32:03 -07:00
intrigeri
7c1087b20f ubuntu-browsers abstraction: re-implement Debian's firefox-esr support in a way that does not affect other Firefox browsers. 2016-06-24 17:34:55 +02:00
intrigeri
4536281a90 mod_apparmor manpage: fix "documenation" typo. 2016-06-24 09:10:15 +02:00
Seth Arnold
787ced1969 From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Tue, 21 Jun 2016 18:18:45 +0100
Subject: abstractions/nameservice: also support ConnMan-managed resolv.conf

Follow the same logic we already did for NetworkManager,
resolvconf and systemd-resolved. The wonderful thing about
standards is that there are so many to choose from.

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2016-06-22 15:15:49 -07:00
Christian Boltz
939587178b Drop unused escape() function from aa.py
Besides being unused, this function contains a broken regex.


References: https://bugs.launchpad.net/bugs/1593324


Acked-by: Steve Beattie <steve@nxnw.org>
2016-06-17 13:26:40 +02:00
Kshitij Gupta
242bbfbbeb Re-order imports in aa-mergeprof and rule/capability.py
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-06-10 01:18:32 +05:30
Christian Boltz
9ab68b9225 Add a note about still enforcing deny rules to aa-complain manpage
This behaviour makes sense (for example to force the confined program to
use a fallback path), but is probably surprising for users, so we should
document it.

References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=826218#37


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9
2016-06-05 23:43:29 +02:00
Christian Boltz
db093de5ff honor 'chown' file events in logparser.py
Also add a testcase to libapparmor's log collection


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
2016-06-05 20:06:43 +02:00
Jamie Strandboge
5a2be35287 profiles: Create abstraction for mozc input method editor
An abstraction to allow mozc clients to connect to the mozc-server.

Signed-off-by: Jamie Strandboge <jamie@ubuntu.com>
[tyhicks: Wrote commit message]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-06-04 00:28:03 -05:00
Jamie Strandboge
140234a408 profiles: Create abstractions for fcitx input method framework
Create a set of strict and non-strict abstractions, much like the
existing dbus abstractions, for connecting to the fcitx bus.

Signed-off-by: Jamie Strandboge <jamie@ubuntu.com>
[tyhicks: Wrote commit message]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-06-04 00:27:59 -05:00
John Johansen
40e193e623 Fix: make sure overlapping safe and unsafe exec rules conflict
BugLink: https://launchpad.net/bugs/1588069

Currently

  change_profile /** -> A,
  change_profile unsafe /** -> A,

do not conflict because the safe rules only set the change_profile
permission where the unsafe set unsafe exec. To fix this we have the
safe version set exec bits as well with out setting unsafe exec.
This allows the exec conflict logic to detect any conflicts.

This is safe to do even for older kernels as the exec bits off of the
2nd term encoding in the change_onexec rules are unused.

Test files
  tst/simple_tests/change_profile/onx_no_conflict_safe1.sd
  tst/simple_tests/change_profile/onx_no_conflict_safe2.sd
by Christian Boltz <apparmor@cboltz.de>

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-06-02 22:24:22 -07:00
Christian Boltz
c3bcdc32fb Document aliases for dbus send and receive in apparmor.d
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-06-01 22:55:14 +02:00
Christian Boltz
fd17ff0daa aa-genprof: ask about profiles in extra dir (again)
Thanks to reading the wrong directory in read_inactive_profiles()
(profile_dir instead of extra_profile_dir), aa-genprof never asked about
using a profile from the extra_profile_dir.

Sounds like an easy fix, right? ;-)

After fixing this (last chunk), several other errors popped up, one
after the other:
- get_profile() missed a required parameter in a serialize_profile() call
- when saving the profile, it was written to extra_profile_dir, not to
  profile_dir where it (as a now-active profile) should be. This is
  fixed by removing the filename from existing_profiles{} so that it can
  pick up the default name.
- CMD_FINISHED (when asking if the extra profile should be used or a new
  one) behaved exactly like CMD_CREATE_PROFILE, but this is surprising
  for the user. Remove it to avoid confusion.
- displaying the extra profile was only implemented in YaST mode
- get_pager() returned None, not an actual pager. Since we have 'less'
  hardcoded at several places, also return it in get_pager()

Finally, also remove CMD_FINISHED from the get_profile() test in
test-translations.py.


(test-translations.py is only in trunk, therefore this part of the patch
is obviously trunk-only.)




Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk
Acked-by: John Johansen <john.johansen@canonical.com> for trunk + a 50% ACK for 2.10 and 2.9
Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
2016-06-01 21:04:13 +02:00
Tyler Hicks
fe14a337ef parser: Clean up exec mode parsing
The opt_unsafe token was being used to represent 'safe' and 'unsafe' so
it is renamed to opt_exec_mode. Create helpfully named macros to compare
opt_exec_mode's value against instead of hard-coded '0', '1', and '2'
values.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:38:36 -05:00
Tyler Hicks
138a9bf9ef parser: Document change_profile exec modes in apparmor.d man page
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:38:36 -05:00
Tyler Hicks
ab1cabf94e tests: Regression tests for change_profile exec modes
Add logic to the at_secure.sh test script to verifies that the parser is
new enough to support change_profile exec modes and determine what the
kernel's support for change_profile exec modes before verifying that
AT_SECURE is set correctly after various exec transitions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:38:36 -05:00
Tyler Hicks
cb4b6115b4 tests: Support change_profile exec modes in mkprofile.pl
The gen_change_profile() function must be changed to allow the extra
condition in change_profiles rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:38:36 -05:00
Tyler Hicks
b5d7154100 parser: Add tests for rules with change_profile exec modes
Simple tests that validate the parser's ability to handle change_profile
rules containing an exec mode.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:38:36 -05:00
John Johansen
0fe6e1955a parser: combine SUB_ID and SUB_ID_WS to reduce code duplication
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-05-31 15:38:36 -05:00
Tyler Hicks
0c4c975509 parser: Allow change_profile rules to accept an exec mode modifier
https://launchpad.net/bugs/1584069

This patch allows policy authors to specify how exec transitions should
be handled with respect to setting AT_SECURE in the new process'
auxiliary vector and, ultimately, having libc scrub (or not scrub) the
environment.

An exec mode of 'safe' means that the environment will be scrubbed and
this is the default in kernels that support AppArmor profile stacking.
An exec mode of 'unsafe' means that the environment will not be scrubbed
and this is the default and only supported change_profile exec mode in
kernels that do not support AppArmor profile stacking.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-31 15:32:08 -05:00
Tyler Hicks
d5322575f5 tests: Adjust parser_supports() to accept test rules with spaces
Quote $@ so that the for loop doesn't iterate on the space-delimited
version of the rule(s) under test. This allows more complex rules such
as "change_profile foo -> bar," to be tested where, before this patch,
only "change_profile," could be tested.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-28 12:00:50 -05:00
Tyler Hicks
0801b3a72f parser: Simplify change_profile grammar rules
Make future modifications to the change_profile grammar rules easier by
simplifying things. First, the change_profile rule handling is collapsed
into a single grammar rule. The inputs to the grammar rule are given
helpful variable names to make it harder to mix up which variable we're
dealing with. Finally, the two separate calls to new_entry() are unified
into a single call.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-28 11:58:41 -05:00
Tyler Hicks
8d6e3d9df9 tests: Regression tests to verify AT_SECURE across exec transitions
The AT_SECURE value in the kernel's per-process auxiliary vector is what
signals to libc that the process' environment should be scrubbed. This
new set of regression tests checks the AT_SECURE value after performing
the various types of exec transitions that AppArmor supports (file rules
with different exec access modes and change_profile rules).

Different versions of the kernel handle AT_SECURE differently with
respect to change_profile rules. This change in behavior was introduced
in the AppArmor profile stacking kernel support and the tests are
conditionalized to account for this change.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-28 11:58:41 -05:00
Tyler Hicks
b3fbd5806c tests: Add profile change support to the transition test program
Extend the transition test program to allow for changing to a new
profile. This change will be useful in test scripts that need to test
operations across profile stacks and/or profile changes.

The calls to aa_stack_onexec() and aa_stack_profile() are build-time
conditionalized on whether or not the libapparmor being used has
implemented those functions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-28 11:58:41 -05:00
Tyler Hicks
c71d0fc592 tests: Rename stacking.c to transition.c
This test will soon be made to do more than just stack a new profile.
It will be extended to allow for changing to a new profile and,
therefore, should be renamed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-05-28 11:58:41 -05:00
Christian Boltz
016668437d Update change_profile highlighting in apparmor.vim
This patch includes several changes and fixes in change_profile highlighting:
- allow audit and deny keywords
- allow bare change_profile rules
- allow change_profile rules without '-> ...' part
- allow usage of the new 'safe' and 'unsafe' keywords
- ensure the exec condition starts with / or @


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-27 20:05:21 +02:00
Steve Beattie
4d5a4675d8 translations: fix up msgfmt warnings
This commit touches up the .po files that generate warnings
when msgfmt processes them to create .mo files, at least with gettext
0.19.7-2ubuntu3 in Ubuntu 16.04 LTS. Example warning types cleaned up
include:

  ce.po:7: warning: header field 'Last-Translator' still has the initial default value
  ce.po:7: warning: header field 'Language' missing in header
  de.po:6: warning: header field 'Language-Team' still has the initial default value

This commit also fixes up po files where the Report-Msgid-Bugs-To:
field had not been updated, setting it with the email address
'AppArmor list <apparmor@lists.ubuntu.com>'

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-05-24 13:08:06 -07:00
Steve Beattie
ad65a4467e merge translations update from launchpad 2016-05-23 15:30:36 -07:00
Christian Boltz
e4cbcb4c85 Ignore file events with a request mask of 'send' or 'receive'
Those events are actually network events, so ideally we should map them
as such. Unfortunately this requires bigger changes, so here is a hotfix
that ignores those events and thus avoids crashing aa-logprof.

References: https://bugs.launchpad.net/apparmor/+bug/1577051
            https://bugs.launchpad.net/apparmor/+bug/1582374


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9
2016-05-23 23:31:43 +02:00
Christian Boltz
80bfb955ac [9/9] Add support for dbus events to aa-logprof
In detail, this means:
- handle ptrace events in logparser.py
- "translate" those events in aa.py - from log (logparser.py readlog())
  to prelog (handle_children()) to log_dict (collapse_log()))
- finally ask the user about the ptrace in ask_the_questions()
  (no code change needed there)

Note that these changes are not covered by tests, however they worked in
a manual test with the log examples in the libapparmor testsuite.
Unfortunately there's no example log for eavesdrop, so it might be a
good idea to a) add such a log line and b) test with it

Acked-by: Seth Arnold <seth.arnold@canonical.com>


Note: as discussed on #apparmor, I changed the mapping of peer_profile so
that it ends up in peer=(label=...) instead of the wrong peer=(name=...).
2016-05-23 23:24:30 +02:00
Christian Boltz
c91fd7688a [8/9] Add support for handling dbus rules everywhere
"Everywhere" means aa-mergeprof and aa-cleanprof. In theory also
aa-logprof, but that needs some code that parses dbus log events ;-)

Also add some dbus rules to the aa-cleanprof test profiles to ensure
superfluous dbus rules get deleted.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:21:13 +02:00
Christian Boltz
c32e4d8b84 [7/9] Remove the DBUS_Rule class
DBUS_Rule (in rules.py) was added in r2424 as a "this is how it should
look like" proof of concept, but was never used.

We have a "real" class for dbus rules now, so we can drop the proof of
concept class.


Also remove a commented, old version of RE_DBUS_ENTRY from aa.py


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:19:59 +02:00
Christian Boltz
a293f066b5 [6/9] Use DbusRule and DbusRuleset
Change aa.py to use DbusRule and DbusRuleset in profile_storage,
parse_profile_data() and write_dbus. This also means we can drop the
now unused parse_dbus_rule() and write_dbus_rules() functions.

Raw_DBUS_Rule in rules.py is now also unused and can be dropped.


Also shorten the list of known-failing tests in
test-parser-simple-tests.py. Even if the list of removals doesn't look
too long, the generated_dbus/* removals mean 1989 tests now cause the
expected failures.

OTOH, I had to add 4 tests to the known-failing list:
- 3 tests with a "wrong" order of the conditionals which the parser
  accepts (which is slightly surprising, because usually we enforce the
  order of rule parts)
- one test fails because the path in the path= conditional doesn't start
  with / or a variable. Instead, it starts with an alternation, which
  wouldn't be allowed in file rules.

Those 4 failures need more investigation, but shouldn't block this
patchset.


Finally, adjust test-regex_matches.py to import RE_PROFILE_DBUS from
apparmor.regex instead of apparmor.aa.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:17:37 +02:00
Christian Boltz
e924168708 [5/9] Add tests for DbusRule and DbusRuleset
The tests include the two tests from test-dbus_parse.py, therefore
delete this file.

As usual, we have 100% coverage :-)

Also addd an explicit str() conversion to common_test.py to avoid
    TypeError: not all arguments converted during string formatting


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:15:19 +02:00
Christian Boltz
3ebc9d9bb3 [4/9] Add support for dbus events in parse_event()
Add the dbus-specific details to the event data returned by parse_event().


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:14:09 +02:00
Christian Boltz
3e1ef00d47 [3/9] Add DbusRule and DbusRuleset classes
Those classes will be used to parse and handle dbus rules.
They understand the syntax of dbus rules.

Note that get_clean() doesn't output superfluos things, so
  dbus ( send ),
will become
  dbus send,


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:13:19 +02:00
Christian Boltz
18b5894888 [2/9] Add strip_parenthesis() to regex.py
Some dbus rule conditionals come with optional parenthesis. Instead of
making the regex even more complicated, use a small function to strip
those parenthesis.

Also add some tests for strip_parenthesis() to test-regex.py.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-05-23 23:12:07 +02:00
Christian Boltz
2e2aa861d2 [1/9] add a named match group to RE_PROFILE_DBUS
As a preparation for the DbusRule class, add a <details> match group
to RE_PROFILE_DBUS.

Also adjust test-regex_matches.py for the added group.

Note: RE_PROFILE_DBUS is only used in aa.py, and only matches[0..2]
are used. 0 and 1 are audit and allow/deny and 2 is and stays the whole
rule (except audit and allow/deny). Therefore no aa.py changes are
needed.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-23 23:10:48 +02:00
Christian Boltz
bdf5a2facc Document empty quotes ("") as empty value of a variable
Acked-by: Seth Arnold <seth.arnold@canonical.com> for all branches where this makes sense :)
2016-05-22 14:51:19 +02:00
Christian Boltz
08471c5b08 allow inet6 in ping profile
The latest iputils merged ping and ping6 into a single binary that does
both IPv4 and IPv6 pings (by default, it really does both).
This means we need to allow network inet6 raw in the ping profile.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=980596
            (contains more details and example output)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9
2016-05-18 21:18:10 +02:00
Christian Boltz
472d534a0d test-translations.py: add two button sets used in aa-mergeprof
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-14 13:25:15 +02:00
Seth Arnold
d3774684c0 dbus-session-strict: allow access to the user bus socket
From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Wed, 4 May 2016 13:48:36 +0100
Subject: dbus-session-strict: allow access to the user bus socket

If dbus is configured with --enable-user-bus (for example in the
dbus-user-session package in Debian and its derivatives), and the user
session is started with systemd, then the "dbus-daemon --session" will be
started by "systemd --user" and listen on $XDG_RUNTIME_DIR/bus. Similarly,
on systems where dbus-daemon has been replaced with kdbus, the
bridge/proxy used to provide compatibility with the traditional D-Bus
protocol listens on that same socket.

In practice, $XDG_RUNTIME_DIR is /run/user/$uid on all systemd systems,
where $uid represents the numeric uid. I have not used /{var/,}run here,
because systemd does not support configurations where /var/run and /run
are distinct; in practice, /var/run is a symbolic link.

Based on a patch by Sjoerd Simons, which originally used the historical
path /run/user/*/dbus/user_bus_socket. That path was popularized by the
user-session-units git repository, but has never been used in a released
version of dbus and should be considered unsupported.

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2016-05-11 16:01:41 -07:00
Seth Arnold
5781ad05aa syscall_sysctl test: correctly skip if CONFIG_SYSCTL_SYSCALL=n
From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Wed, 11 May 2016 13:52:56 +0100
Subject: syscall_sysctl test: correctly skip if CONFIG_SYSCTL_SYSCALL=n

This test attempts to auto-skip the sysctl() part if that syscall
was not compiled into the current kernel, via
CONFIG_SYSCTL_SYSCALL=n. Unfortunately, this didn't actually work,
for two reasons:

* Because "${test} ro" wasn't in "&&", "||", a pipeline or an "if",
  and it had nonzero exit status, the trap on ERR was triggered,
  causing execution of the error_handler() shell function, which
  aborts the test with a failed status. The rules for ERR are the
  same as for "set -e", so we can circumvent it in the same ways.
* Because sysctl_syscall.c prints its diagnostic message to stderr,
  but the $() operator only captures stdout, it never matched
  in the string comparison. This is easily solved by redirecting
  its stderr to stdout.

Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2016-05-11 15:52:58 -07:00
Christian Boltz
f6d2ef85f5 load variables in ask_the_questions()
Variables can be used in several rule types (from the existing *Rule
classes: change_profile, dbus, ptrace, signal). It seems nobody uses
variables with those rules, otherwise we'd have received a bugreport ;-)

I noticed this while working on FileRule, where usage of variables is
more common. The file code in bzr (not using a *Rule class) already
loads the variables, so old versions don't need changes for file rule
handling.

However, 2.10 already has ChangeProfileRule and therefore also needs
this fix.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10.
2016-05-10 14:32:46 +02:00
Christian Boltz
b7449494de Run utils tests with C locale
While running test-translations.py with the fixed german translations,
I noticed that I still get errors about hotkey conflicts

It turned out that test-translations.py reads the system-wide
apparmor-utils.mo in addition to the in-tree translations.
(I have the 2.11 beta1 translations installed, which contain hotkey
conflicts for the german translations).

This is surprising because test-translations.py explicitely sets the
locale path. Interestingly, this happens only 4 times (checked with a
temp profile with audit for those files) while test-translations.py has
9 tests).

(Any idea if this behaviour is normal or a bug?)


This patch adds LC_ALL=C to the make check and make coverage commandline
so that the system-wide translations don't get used.

I checked with a modified de.po that in-tree hotkey conflicts still get
detected.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-10 14:31:25 +02:00
Launchpad Translations on behalf of apparmor-dev
584f63d56b Launchpad automatic translations update. 2016-05-07 04:31:30 +00:00
Christian Boltz
a1e4212d12 Add a test to check for hotkey conflicts
This test builds and installs the apparmor-utils translations into a
tempdir, and then checks if there's any hotkey conflict in one of the
languages. This is based on a manually maintained list of "buttons" that
are displayed at the same time.

To make things a bit easier to test, add CMD_CANCEL to ui.py CMDS[].
Also replace hardcoded usage of '(Y)es', '(N)o' and '(C)ancel' with
CMDS['CMD_YES'], CMDS['CMD_NO'] and CMDS['CMD_CANCEL'].



Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-05-06 22:19:34 +02:00
Christian Boltz
e4219861e6 accept hostname with dots
Some people have the full hostname in their syslog messages, so
libapparmor needs to accept hostnames that contain dots.


References: https://bugs.launchpad.net/apparmor/+bug/1453300 comments
            #1 and #2 (the log samples reported by scrx in #apparmor)



Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
for trunk, 2.10 and 2.9.
2016-05-05 11:57:57 +02:00
Seth Arnold
43cc512e51 Simon Deziel 2016-04-29 usr.sbin.sshd: allow reading blacklisted host keys 2016-04-29 14:55:00 -07:00
Simon Deziel
6bdd2c34dc usr.sbin.sshd: allow reading blacklisted host keys 2016-04-29 14:25:53 -04:00
Launchpad Translations on behalf of apparmor-dev
47aa6baad3 Launchpad automatic translations update. 2016-04-29 05:14:00 +00:00
intrigeri
fdbdf26b33 ubuntu-browsers abstraction: simplify rule.
Thanks to Christian Boltz <apparmor@cboltz.de> for the suggestion!
2016-04-24 19:34:58 +02:00
intrigeri
221a8681c0 ubuntu-browsers abstraction: support path used by Debian's firefox-esr. 2016-04-24 16:24:42 +02:00
Launchpad Translations on behalf of apparmor-dev
99d189d8e2 Launchpad automatic translations update. 2016-04-22 05:13:38 +00:00
Simon Deziel
5931538103 usr.sbin.sshd: deny net_admin that is not strictly required
Matthew Dawson explained why:

> sshd doesn't actually require the net_admin capability. libpam-systemd tries
> to use it if available to set the send/receive buffers size, but will fall
> back to a non-privileged version if it fails.

https://lists.ubuntu.com/archives/apparmor/2016-April/009586.html
2016-04-21 17:58:04 -04:00
John Johansen
22738991ac Fix: parser: incorrect output of child profile names
BugLink: http://bugs.launchpad.net/bugs/1551950

The apparmor_parser is incorrectly outputting the names of child profiles
and hats, by adding a : between the parent and the child profile name

  Eg.
    /usr/sbin/httpd{,2}-prefork
    /usr/sbin/httpd{,2}-prefork://DEFAULT_URI
    /usr/sbin/httpd{,2}-prefork://HANDLING_UNTRUSTED_INPUT

  instead of what it should be
    /usr/sbin/httpd{,2}-prefork
    /usr/sbin/httpd{,2}-prefork//DEFAULT_URI
    /usr/sbin/httpd{,2}-prefork//HANDLING_UNTRUSTED_INPUT

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-04-18 13:26:53 -07:00
Seth Arnold
c9f254610b Simon Deziel 2016-04-14 abstractions/user-mail: /var/mail/* should only be accessible to their owners 2016-04-14 14:42:37 -07:00
Simon Deziel
2829aaf87b abstractions/user-mail: /var/mail/* should only be accessible to their owners 2016-04-14 15:15:36 -04:00
Simon Deziel
bb981d54f0 usr.bin.wireshark: refresh for Xenial
Bug: https://launchpad.net/bugs/1665535
2016-04-13 16:52:32 -04:00
Seth Arnold
341143c956 Merge samba fixes from Simon Deziel 2016-04-13 11:12:44 -07:00
Simon Deziel
c68d1b5795 usr.sbin.smbd: new lock dir used by recent versions (4.3.8) 2016-04-13 09:24:46 -04:00
Simon Deziel
245dd9b1b9 usr.sbin.smbd: give access to multiarch libs 2016-04-13 09:23:07 -04:00
Simon Deziel
9e680bd14f usr.sbin.smbd: sys_admin is needed when forcing ownership 2016-04-13 09:20:14 -04:00
Simon Deziel
0255afc67b usr.sbin.smbd: audit_write is needed when forcing perms 2016-04-13 09:19:51 -04:00
Tyler Hicks
184e2f8df8 profiles: Add attach_disconnected flag to dnsmasq profile
https://launchpad.net/bugs/1569316

When Ubuntu made the jump from network-manager 1.0.4 to 1.1.93, the
dnsmasq process spawned from network-manager started hitting a
disconnected path denial:

  audit: type=1400 audit(1460463960.943:31702): apparmor="ALLOWED"
    operation="connect" info="Failed name lookup - disconnected path"
    error=-13 profile="/usr/sbin/dnsmasq"
    name="run/dbus/system_bus_socket" pid=3448 comm="dnsmasq"
    requested_mask="wr" denied_mask="wr" fsuid=65534 ouid=0

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-04-12 16:36:43 -05:00
John Johansen
26b3bc5799 Enable dynamically scaling max jobs if new resources are brought online
BugLink: http://bugs.launchpad.net/bugs/1566490

This patch enables to parser to scale the max jobs if new resources are
being brought online by the scheduler.

It only enables the scaling check if there is a difference between the
maximum number of cpus (CONF) and the number of online (ONLN) cpus.

Instead of checking for more resources regardless, of whether the online
cpu count is increasing it limits its checking to a maximum of
MAX CPUS + 1 - ONLN cpus times. With each check coming after fork spawns a
new work unit, giving the scheduler a chance to bring new cpus online
before the next check.  The +1 ensures the checks will be done at least
once after the scheduling task sleeps waiting for its children giving
the scheduler an extra chance to bring cpus online.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-04-11 16:22:12 -07:00
Christian Boltz
8b271d00d0 merge lp:~sdeziel/apparmor/dnsmasq-lxd-bridge:
Simon Deziel 2016-04-08 usr.sbin.dnsmasq: add lxd-bridge rules


Acked-by: Christian Boltz <apparmor@cboltz.de>

References: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1566944
2016-04-09 00:24:13 +02:00
Simon Deziel
3d6843d975 usr.sbin.dnsmasq: add lxd-bridge rules 2016-04-08 16:23:47 -04:00
Christian Boltz
3e51e656b6 dovecot/auth: allow access to /var/run/dovecot/stats-user
Since the latest openSUSE Tumbleweed update (dovecot 2.2.21 -> 2.2.22),
dovecot/auth writes to /var/run/dovecot/stats-user.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-04-07 00:53:06 +02:00
Tyler Hicks
e815226675 parser: Fix dependency in Makefile
parser 'make install' failed if 'make' wasn't run before. This patch
adds the missing dependency 'install-indep: indep'.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-04-06 12:23:48 -05:00
Christian Boltz
cd38c9d111 Fix dependency in binutils Makefile
binutils 'make install' failed if 'make' wasn't run before.
This patch adds the missing dependency 'install-indep: indep'


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-04-05 22:38:42 +02:00
Simon Deziel
cb011cd974 usr.sbin.sshd: remove commented-out hat related rules 2016-04-05 15:47:54 -04:00
Simon Deziel
3c21cd8a40 usr.sbin.sshd: allow ptrace tracing to cope with recent kernel/AA changes 2016-04-05 15:46:26 -04:00
Simon Deziel
aedce34542 usr.sbin.sshd: add cgroup-related rules 2016-04-05 15:46:05 -04:00
Christian Boltz
425b76f3f1 Move binutils manpages to section 1
The binutils (aa-enabled and aa-exec) get installed into /usr/bin/ and
are meant to be used by non-root users. Therefore the manpages should be
in section 1 instead of 8 (which is for sysadmin commands).


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-04-05 21:15:14 +02:00
Launchpad Translations on behalf of apparmor-dev
9d839b2512 Launchpad automatic translations update. 2016-04-04 05:14:55 +00:00
Launchpad Translations on behalf of apparmor-dev
d0871bf2a8 Launchpad automatic translations update. 2016-03-30 05:13:33 +00:00
Tyler Hicks
e313eb5d1f tests: Allow stacking tests to use system programs and libraries
The stacking tests worked fine when using in-tree programs and libraries
but the tests unexpectedly failed when USE_SYSTEM=1 was specified. This
patch makes use of the addimage:$test argument to mkprofile.pl to
generate the correct file permissions needed to use the system binaries.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-29 11:17:53 -05:00
Christian Boltz
733d5faa78 Don't store exec modes in transtions[]
exec choices are stored in transitions[], but that's never used
(and I don't see a need for it), therefore stop storing it.


Note: hat choices (CMD_ADDHAT, CMD_USEDEFAULT and CMD_DENY) get still
stored in transitions[], and that information is used if the same hat
name appears again.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-29 12:58:15 +02:00
Christian Boltz
86017c770d Update abstractions/ssl_* for acmetool-generated certificates
acmetool is an alternative client for Let's Encrypt.
(https://github.com/hlandau/acme/)

It stores the certificates etc. in the following directory layout:

    /var/lib/acme/live/<domain> -> ../certs/<hash>
    /var/lib/acme/certs/<hash>/cert
    /var/lib/acme/certs/<hash>/chain
    /var/lib/acme/certs/<hash>/privkey -> ../../keys/<hash>/privkey
    /var/lib/acme/certs/<hash>/url
    /var/lib/acme/certs/<hash>/fullchain
    /var/lib/acme/keys/<hash>/privkey

This patch adds the needed permissions to the ssl_certs and ssl_keys
abstractions so that the certificates can be used.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-03-28 21:42:39 +02:00
Steve Beattie
3fb3b1054b Merge JSON output options for aa-status.
Thanks to Max Timchenko <maxvt@pagerduty.com> for the patch.

Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-25 12:18:52 -07:00
Tyler Hicks
f82344d7ff parser: Allow debugedit to work on apparmor_parser
https://launchpad.net/bugs/1561939

The debugedit program is unable to cope with the extra slash in the
LIBAPPARMOR_SRC variable.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Suggested-by: Christian Svensson <blue@cmd.nu>
2016-03-25 10:28:52 -05:00
Tyler Hicks
7c142666db tests: Adjust stacking tests build check for 2.11 Beta 1 release
I configured the stacking test binary to only be built when libapparmor
2.11 is present. The versioning of the 2.11 Beta 1 release (2.10.95)
causes that check to fail and the stacking tests to not be used.

This patch adjusts the libapparmor version check to be aware of the 2.11
Beta 1 versioning.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-03-24 11:59:11 -05:00
Max Timchenko
cefadd8da1 Add a JSON output option to aa-status
Automated infrastructure management tools, such as Chef, Puppet, and so
on, could use a way to check AppArmor status that is both high-level
(meaning it does not rely on kernel interfaces in /proc) and machine-
readable (meaning it does not require the complexity of parsing output 
of tools originally intended for human consumption).

Adding a JSON variant of the standard aa-status output achieves both.
2016-03-24 10:59:45 -04:00
Christian Boltz
fa35aaa1c4 nscd profile: allow paranoia mode
In /etc/nscd.conf there is an option allowing to restart nscd after a
certain time. However, this requires reading /proc/self/cmdline -
otherwise nscd will disable paranoia mode.


References: https://bugzilla.opensuse.org/show_bug.cgi?id=971790


Acked-By: Jamie Strandboge <jamie@canonical.com> for trunk, 2.10 and 2.9
2016-03-21 21:30:19 +01:00
Launchpad Translations on behalf of apparmor-dev
e279d428e1 Launchpad automatic translations update. 2016-03-21 05:15:48 +00:00
Launchpad Translations on behalf of apparmor-dev
1cbdd17c11 Launchpad automatic translations update. 2016-03-20 05:16:46 +00:00
Steve Beattie
9196102dfd periodic translations branch sync-up with trunk 2016-03-19 10:51:10 -07:00
Steve Beattie
95321544b1 Merge utils/ DE translations from Launchpad. 2016-03-19 04:06:57 -07:00
Steve Beattie
8a03fe54dc Update version in preparation for 2.11 beta release (aka 2.10.95) 2016-03-19 04:05:21 -07:00
Steve Beattie
4dcfa7db35 parser: eliminate redundant/dead code
The debugging code for profile entries contains a check to ensure that
it's not NULL, but the list iterator macro already ensures that the
iteration will stop if the item is NULL, making the check redundant.

Coverity CID #55983

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:52:45 -07:00
Steve Beattie
90b352c2ae Subject: libapparmor: don't close invalid fd
It's possible to end up unreferencing a kernel_interface object that
has ->dirfd set to -1. This patch avoids calling close(2) on that fd.
(close(-1) will just return EBADF anyway.)

Coverity CIDs #55996 and #55997

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:51:00 -07:00
Steve Beattie
e69891c222 man page touchups
This makes some of the references to functions in the aa_query_label(2)
manpage more consistent and fixes a couple of grammar issues. It also
tries to make the qualifying statements in apparmor.d(5) more distinct,
and also fixes some typos there as well.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:48:11 -07:00
Steve Beattie
fd8ccd3dd7 tests: support more complex change_profile tests
This adds support to the profile generator script for change_profile
rules, giving the ability to write the 3 factor version of the rule
(e.g. "change_profile /t -> A_PROFILE") which was significantly more
difficult using straight raw rules, which is why we don't have any 3
factor rule tests.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:39:07 -07:00
Steve Beattie
37f5eab9b1 tests: onexec test needs signal permission to stop itself
Now that the onexec test program notices that it failed to send SIGSTOP
to itself, causing a whole bunch of tests to be detected as failing,
grant the ability to send and receive signals to the onexec tests.
(The onexec tests are not tests intended to verify signal mediation.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:37:46 -07:00
Steve Beattie
0e2bbc98b8 tests: onexec - check and report signal failure
The onexec test was ignoring errors from the kill() call, so it didn't
notice when it had failed to send SIGSTOP to itself.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:35:42 -07:00
Steve Beattie
b6e42015a6 tests: check for early task exit in onexec tests
Based on a patch by John Johansen <john.johansen@canonical.com>

(I converted the check to look for the process directory in /proc
rather than sending signal 0 to the task, as John had done in a patch
sent to me, to prevent failures in signal delivery from blocking the
check from working correctly.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:34:18 -07:00
Steve Beattie
91022dae85 tests: add more details when reporting onexec failures
Based on a patch by John Johansen <john.johansen@canonical.com>

Add more details to the checks in the regression tests onexec tests,
to make debugging failures easier. Also, use more local variables
to indicate what and how many arguments are expected to the onexec
check_* functions.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-03-19 01:32:40 -07:00
Tyler Hicks
c8fe0b2518 profiles: Allow CAP_CHOWN in usr.lib.apache2.mpm-prefork.apache2
https://launchpad.net/bugs/1210514

It looks plausible to me that prefork_open_logs() ->
ap_proc_mutex_create() -> ap_unixd_set_proc_mutex_perms() -> chown().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:10:00 -05:00
Tyler Hicks
f16e6ad89a profiles: Add deluge-{gtk,console} to ubuntu-bittorrent-clients abstraction
https://launchpad.net/bugs/1501913

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:08:52 -05:00
Tyler Hicks
e9f8ba9e3b libapparmor: prepare libtool versioning for impending 2.11 release
The aa_stack_profile() and aa_stack_onexec() functions were added to
libapparmor since 2.10.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:03:18 -05:00
Tyler Hicks
a23dd56e03 parser: Update features.all file for new kernel features
The audit_read capability, mpls address family, and profile stacking are
all new features advertised by the latest AppArmor kernel features file.

Without this change, the parser tests will fail because parsing profiles
that utilize stacking results in an error when the features file
indicates that stacking is not supported by the kernel.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:03:18 -05:00
Tyler Hicks
cdbe3f088b tests: Conditionalize when to build/run stacking tests
The stacking test binary links against libapparmor for
aa_stack_profile() and aa_stack_onexec(), which will be present in 2.11.
This means that regression test builds using the system libapparmor
should not build the stacking test binary unless the libapparmor 2.11 or
newer is present.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:03:18 -05:00
Tyler Hicks
6050d110e1 tests: Mark cross policy ns changeprofile test as xpass on older kernels
Policy namespaces are not well supported in older parsers and kernels.
This is a case where the kernel support doesn't seem to be working.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:03:18 -05:00
Tyler Hicks
fc4941d6b0 tests: Add exec_stack regression tests
Add tests for px stacking transitions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 03:03:06 -05:00
Tyler Hicks
86cf1c7b22 tests: Add stackonexec regression tests
Add tests for the aa_stack_onexec() libapparmor function.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 02:29:22 -05:00
Tyler Hicks
04d1f17445 tests: Add stackprofile regression tests
Add tests for the aa_stack_profile() libapparmor function.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Bug: https://launchpad.net/bugs/1507469
2016-03-19 01:45:13 -05:00
Tyler Hicks
e7d21c1cf8 tests: Create a program for stacking tests to use
Stacking is a complex feature and, in order to sufficiently test all
aspects of stacking, a relatively complex test program is needed.

This patch adds a program that can call
aa_stack_onexec()/aa_stack_profile(), perform file IO on a given file
path, verify that the current confinement context is what it is expected
to be, and/or execute itself or another program.

The confinement context verification can handle stacked labels with any
ordering.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 01:44:51 -05:00
Tyler Hicks
e9895c70aa tests: Clean up do_open() in changehat.h
Some tidying up is needed in order to reuse do_open(). This patch
eliminates the chance of returning 0 due to errno being not set. It also
adjusts the file string to be const.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 01:02:51 -05:00
Tyler Hicks
5ae1275eec tests: Add changeprofile regression tests for stacking
The idea is that the $test profile grants $file access and the
$othertest profile grants $subfile access. Both profiles grant
$stacktest access. The tests verify that after changing to the stacked
$othertest//&$test profile, only $stacktest can be accessed.

Similar tests are also added for stacking with a namespaced profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-03-19 01:02:51 -05:00
Launchpad Translations on behalf of apparmor-dev
a5b8ebebb4 Launchpad automatic translations update. 2016-03-19 05:19:32 +00:00
Tyler Hicks
974e2a693b tests: Adjust expected errno upon aa_change_profile() failure
The kernel patches that implement AppArmor profile stacking made changes
that allow the the backed for change_profile to detect if the target
profile does not exist prior to checking if the current profile allows
the change_profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:51 -05:00
Tyler Hicks
1a7663e89a parser: Check kernel stacking support when handling stacked transitions
Check if the current kernel supports stacking. If not, ensure that named
transitions (exec, change_profile, etc.) do not attempt to stack their
targets.

Also, set up the change_profile vector according to whether or not the
kernel supports stacking. Earlier kernels expect the policy namespace to
be in its own NUL-terminated vector element rather than passing the
entire label (namespace and profile name) as a single string to the
kernel.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-03-18 17:28:51 -05:00
Tyler Hicks
00fb4e94ab parser: Support stacking in exec and change_profile rules
Allow for a leading '&' character to be present in the named transition
target strings to indicate that the transition should stack the current
profile with the specified profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:51 -05:00
Tyler Hicks
a83d03a6a7 parser: Stop splitting the namespace from the named transition targets
The parser was splitting up the namespace and profile name from named
transition targets only to rejoin it later when creating the binary
policy. This complicated the changes needed to support the stacking
identifier '&' in named transition targets.

To keep the stacking support simple, this patch keeps the entire named
transition target string intact from initial profile parsing to writing
out the binary.

All of these changes are straightforward except the hunk that removes
the namespace string addition to the vector in the process_dfa_entry()
function. After speaking with John, kernels with stacking have support
for consuming the namespace with the profile name.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:51 -05:00
Tyler Hicks
a49c988c03 parser: Create a label parsing function that doesn't exit or malloc
This patch separates the label parsing functionality from the program
termination and memory allocation duties of parse_label(). This will
ultimately help in creating simple helper functions that simply need to
check if a label contains a namespace.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:51 -05:00
Tyler Hicks
280b6107a6 parser: parser clean up add_named_transition()
The add_named_transition function was written in a way that is difficult
to understand while attempting to read the function. This patch attempts
to clean it up.

First, this patch removes this confusing code flow issue:

  if (!entry->ns) { ... }
  if (entry->ns) { ... } else { ... }

It then unifies the way that the ns and nt_name strings of the cod_entry
struct are handled prior to calling add_entry_to_x_table() and/or
returning. ns and nt_name are now guaranteed to be NULL before
performing either of those actions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:50 -05:00
Tyler Hicks
f8535c1d09 parser: Copy the named transition when copying a cod_entry
The copy_cod_entry() function was not copying the nt_name field of the
cod_entry struct.

This was discovered during code review and I'm not certain if it causes
any real world bugs.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:50 -05:00
Tyler Hicks
97a064ba6c libapparmor: Implement aa_stack_profile and aa_stack_onexec
Based on the existing implementations of aa_change_profile(2) and
aa_change_onexec(2).

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:50 -05:00
Tyler Hicks
405f89610d libapparmor: Create man page for aa_stack_profile()/aa_stack_onexec()
Modeled after the aa_change_profile(2) man page, this profile defines
the libapparmor and kernel interfaces for the in-progress profile
stacking feature.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-03-18 17:28:50 -05:00
Steve Beattie
d0e3ec97ee Merge launchpad translations 2016-03-18 14:05:14 -07:00
Steve Beattie
0b1d0aa723 utils: make aa-status(8) work without python3-apparmor
Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1480492

If python3-apparmor is not installed, aa-status aborts due to the added
import to handle fancier exception handling failing. This patch makes
aa-status(8) work even in that case, falling back to normal python
exceptions, to keep its required dependencies as small as possible.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-03-18 13:29:47 -07:00
Launchpad Translations on behalf of apparmor-dev
1654c32b34 Launchpad automatic translations update. 2016-03-18 05:17:26 +00:00
Launchpad Translations on behalf of apparmor-dev
4553653b38 Launchpad automatic translations update. 2016-03-14 05:15:44 +00:00
Launchpad Translations on behalf of apparmor-dev
5f3d3a7fee Launchpad automatic translations update. 2016-03-11 05:18:17 +00:00
Jamie Strandboge
0c6d50b81a profiles/apparmor.d/abstractions/ubuntu-unity7-base: update to use dbus
abstractions instead of repeating the rules here
2016-03-10 16:53:24 -06:00
Launchpad Translations on behalf of apparmor-dev
866a68994f Launchpad automatic translations update. 2016-03-06 05:15:53 +00:00
Launchpad Translations on behalf of apparmor-dev
40f2fc7089 Launchpad automatic translations update. 2016-03-05 05:16:59 +00:00
Launchpad Translations on behalf of apparmor-dev
0cfac98031 Launchpad automatic translations update. 2016-03-04 04:35:25 +00:00
Christian Boltz
125dc5fd18 Fix wrong usage of write_prof_data in serialize_profile_from_old_profile()
write_prof_data[hat] is correct (it only contains one profile, see bug 1528139),
write_prof_data[profile][hat] is not and returns an empty (sub)hasher.

This affects RE_PROFILE_START and RE_PROFILE_BARE_FILE_ENTRY.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.9 and 2.10
2016-03-01 21:24:10 +01:00
Tyler Hicks
4ae6ad03ba parser: Clean up pivot_root target parsing
Instead of reusing opt_named_transition and be forced to reconstruct the
target path when is looks like ":odd:target", create simpler grammer
rules that have nothing to do with named transitions and namespaces.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-02-26 18:44:16 -06:00
Christian Boltz
885cd1f7b8 Change log_dict to use profile_storage() and simplify log translation
a) change log_dict to profile_storage()

Change collapse_log() to initialize log_dict[aamode][profile][hat]
as profile_storage() instead of a hasher().

This also means path events need to go into
    log_dict[aamode][profile][hat]['allow']['path']
instead of
    log_dict[aamode][profile][hat]['path']
to match the profile_storage() layout.


b) Simplify log translation

The translation from logparser.py's output to *Rule events was more ugly
than needed. This patch removes one step.

Instead of translating log_dict to log_obj in ask_the_questions(), add
*Rule objects to log_dict and adjust ask_the_questions() to use log_dict
instead of log_obj.

This also means log_obj in ask_the_questions() is now superfluous and
can be removed.


c) Other small changes:

- use is_known_rule() instead of .is_covered() for capability events,
  which means included files are also checked now.

- remove the "if rule_obj.log_event != aamode:" check, because
  a) it depends on the content of *Rule.log_event (which means it
     ignores events with log_event != 'ALLOWING' or 'REJECTING'
  b) it's superfluous because the whole code section is wrapped in a
     "for aamode in sorted(log.dict.keys())" which means we have
     separate loops for enforce and complain mode already



Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 22:13:19 +01:00
Christian Boltz
b24ef74f9a aa.py get_output(): raise exception on non-executable or non-existing programs
If the program specified as get_output param isn't executable or doesn't
exist at all, get_output() returns with ret = -1.

Raising an exception looks like a better option, especially because
other possible exec failures already raise an exception ("Unable to
fork").

Note: get_output is only used by get_reqs() which also does the
os.access() check for x permissions (and raises an exception), so in
practise raising an exception in get_output() doesn't change anything.


This change also allows to rewrite and simplify get_output() quite a bit.


Another minor change (and fix) is in the removal of the last line. The
old code removed the last line if output contained at least two items.
This had two not-so-nice effects:
- an empty output resulted in [''] instead of []
- if a command didn't add a \n on the last line, this line was deleted
  nevertheless

The patch changes that to always remove the last line if it is empty,
which fixes both issues mentioned above.


Also add a test to ensure the exception is really raised, and adjust the
test that expects an empty stdout.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 21:48:57 +01:00
Christian Boltz
5e54e43435 Add tests for aa.py get_output() and get_reqs()
To make these tests independent from the underlaying system, add a
fake_ldd script that provides hardcoded ldd output for the "known"
executables and libraries.

To avoid interferences with the real system (especially symlinks), all
paths in fake_ldd have '/AATest' prepended.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 21:48:09 +01:00
Christian Boltz
9f569d285f Add more ruletypes to the cleanprof test profiles
To ensure aa-cleanprof works as expected (and writing the rules works
as expected), add some rules for every rule class to the cleanprof.in
and cleanprof.out test profiles.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 21:34:31 +01:00
Christian Boltz
bdf264a9be Make sure 'x' log events always come with type 'exec'
According to a discussion with John on IRC, denied_mask="x" can only
happen for 'exec' log events. This patch raises an exception if John
is wrong ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 20:43:58 +01:00
Christian Boltz
19c098be04 handle_binfmt: resolve symlinks in library paths
This should happen rarely, but nevertheless it can happen - and since
AppArmor needs the symlink target in the profile, we have to resolve all
symlinks.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 20:11:13 +01:00
Christian Boltz
cba73b8966 Drop unused function split_name() in aa.py
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-21 20:10:19 +01:00
Christian Boltz
2ed916c178 Prevent crash caused by serialize_profile_from_old_profile()
If a profile file contains multiple profiles and one of those profiles
contains a rule managed by a *Ruleset class,
serialize_profile_from_old_profile() crashes with an AttributeError.

This happens because profile_data / write_prof_data contain only one
profile with its hats, which explodes if a file contains multiple
profiles, as reported in lp#1528139

Fixing this would need lots of
    write_prof_data[hat] -> write_prof_data[profile][hat]
changes (and of course also a change in the calling code) or, better
option, a full rewrite of serialize_profile_from_old_profile().

Unfortunately I don't have the time to do the rewrite at the moment (I
have other things on my TODO list), and changing write_prof_data[hat] ->
write_prof_data[profile][hat] is something that might introduce more
breakage, so I'm not too keen to do that.

Therefore this patch wraps the serialize_profile_from_old_profile() call
in try/except. If it fails, the diff will include an error message and
recommend to use 'View Changes b/w (C)lean profiles' instead, which is
known to work.

Note: I know using an error message as 'newprofile' isn't an usual way
to display an error message, but I found it more intuitive than
displaying it as a warning (without $PAGER).


References: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1528139



Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10
2016-02-20 13:32:36 +01:00
Christian Boltz
9a0157cffd dovecot-lda profile: allow tempfiles and executing sendmail
dovecot-lda needs to read and write /tmp/dovecot.lda.*.

It also needs to be able to execute sendmail to send sieve vacation
mails.

For now, I'm using a child profile for sendmail to avoid introducing a
new profile with possible regressions. This child profile is based on
the usr.sbin.sendmail profile in extras and should cover both postfix'
and sendmail's sendmail.
I also mixed in some bits that were needed for (postfix) sendmail on my
servers, and dropped some rules that were obsolete (directory rules not
ending with a /) or covered by an abstraction.

In the future, we might want to provide a stand-alone profile for
sendmail (based on this child profile) and change the rule in the
dovecot-lda profile to Px.


References: https://bugzilla.opensuse.org/show_bug.cgi?id=954959
            https://bugzilla.opensuse.org/show_bug.cgi?id=954958



Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-02-20 01:15:20 +01:00
Launchpad Translations on behalf of apparmor-dev
125ad9fdcd Launchpad automatic translations update. 2016-02-19 05:10:01 +00:00
Christian Boltz
c3c13b1f2d Add simple_tests/profile/profile_ns_bad8.sd to utils test exception list
parser/tst/simple_tests/profile/profile_ns_bad8.sd was added in r3376
(trunk) / r3312 (2.10 branch) and contains the profile name ':ns/t'
which misses the terminating ':' for the namespace.

Unfortunately the tools don't understand namespaces yet and just use the
full profile name. This also means this test doesn't fail as expected
when tested against the utils code.

This patch adds profile_ns_bad8.sd to the exception list of
test-parser-simple-tests.py.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.
2016-02-19 00:22:59 +01:00
Tyler Hicks
e7accd8485 parser: Properly parse named transition targets
https://launchpad.net/bugs/1540666

Reuse the new parse_label() function to initialize named_transition
structs so that transition targets, when used with change_profile, are
properly seperated into a profile namespace and profile name.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Bug: https://launchpad.net/bugs/1379874
2016-02-18 15:58:11 -06:00
Tyler Hicks
349b4a4ba1 parser: Allow the profile keyword to be used with namespaces
https://launchpad.net/bugs/1544387

Don't split namespaces from profile names using YACC grammar. Instead,
treat the entire string as a label in the grammer. The label can then be
split into a namespace and a profile name using the new parse_label()
function.

This fixes a bug that caused the profile keyword to not be used with a
label containing a namespace in the profile declaration.

Fixing this bug uncovered a bad parser test case at
simple_tests/profile/profile_ns_ok1.sd. The test case mistakenly
included two definitions of the :foo:unattached profile despite being
marked as expected to pass. I've adjusted the name of one of the
profiles to :foo:unattached2.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-02-18 15:58:06 -06:00
Tyler Hicks
9b2aa90b06 parser: Allow AF_UNSPEC family in network rules
https://launchpad.net/bugs/1546455

Don't filter out AF_UNSPEC from the list of valid protocol families so
that the parser will accept rules such as 'network unspec,'.

There are certain syscalls, such as socket(2), where the LSM hooks are
called before the protocol family is validated. In these cases, AppArmor
was emitting denials even though socket(2) will eventually fail. There
may be cases where AF_UNSPEC sockets are accepted and we need to make
sure that we're mediating those appropriately.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Suggested-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
[cboltz: Add 'unspec' to the network domain keywords of the utils]
2016-02-18 12:35:35 -06:00
Christian Boltz
83977cf7f4 Fix aa-mergeprof crash with files containing multiple profiles
If a profile file contains multiple profiles, aa-mergeprof crashes on
saving in write_profile() because the second profile in the file is not
listed in 'changed'. (This happens only if the second profile didn't
change.)

This patch first checks if 'changed' contains the profile before
pop()ing it.

Reproducer: copy utils/test/cleanprof_test.in to your profile directory
and run   aa-mergeprof utils/test/cleanprof_test.out. Then just press
's' to save the profile.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
2016-02-12 22:09:16 +01:00
Christian Boltz
c2a7d975de Remove pname to bin_name mapping in autodep()
If autodep() is called with a pname starting with / (which can happen
for (N)amed exec depending on the user input), this pname is mapped to
bin_name.

This might look like a good idea, however if the given pname doesn't
exist as file on-disk, autodep() returns None instead of a (mostly
empty) profile. (Reproducer: choose (N)amed, enter "/foo/bar")

Further down the road, this results in two things:
a) the None result gets written as empty profile file (with only a "Last
   modified" line)
b) a crash if someone chooses to add an abstraction to the None, because
   None doesn't support the delete_duplicates() method for obvious
   reasons ;-)


Unfortunately this patch also introduces a regression - aa-logprof now
fails to follow the exec and doesn't ask about the log events for the
exec target anymore. However this doesn't really matter because of a) -
asking and saving to /dev/null vs. not asking isn't a real difference ;-)


Actually the patch slightly improves things - it creates a profile for
the exec target, but only with the depmod() defaults (abstractions/base)
and always in complain mode.

I'd prefer a patch that also creates a complete profile for the exec
target, but that isn't as easy as fixing the issues mentioned above and
therefore is something for a future fix. To avoid we forget it, I opened
https://bugs.launchpad.net/apparmor/+bug/1545155


Note: 2.9 "only" writes an empty file and doesn't crash - but writing
an empty profile is still an improvement.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9
2016-02-12 21:56:27 +01:00
Christian Boltz
7cdc098c2f Handle quoted peers when parsing ptrace rules
This patch adds handling for quoted ptrace peer values and two
testcases for it.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-12 21:45:38 +01:00
Christian Boltz
f139b522ef apparmor.d.pod: document 'deny x'
deny rules don't allow ix, Px, Ux etc. - only 'deny /foo x,' is allowed.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.10


Note: Seth mentioned in the mail that he doesn't like the 'deny x'
section too much, but we didn't find a better solution when discussing
it on IRC. Therefore I keep the patch unchanged, but will happily
review a follow-up patch if someone sends one ;-)
2016-02-12 21:43:00 +01:00
Tyler Hicks
8887aebbad parser: Move failing test to TODO
This test causes `make check` to fail but it is known bug so mark it as
a TODO test.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-02-11 16:01:13 -06:00
Christian Boltz
c61a75c91a Error out if the log contains an exec event for a directory
According to the discussion with John on IRC, exec log events for
directories should never happen, therefore let handle_children()
raise an exception.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2016-02-10 19:13:51 +01:00
Christian Boltz
322c5f04f8 logparser.py: do sanity check for all file events
Most probably-file log events can also be network events. Therefore
check for request_mask in all events, not only file_perm, file_inherit
and (from the latest bugreport) file_receive.

References: https://bugs.launchpad.net/apparmor/+bug/1540562


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk, 2.10 and 2.9.
2016-02-10 19:09:16 +01:00
Jamie Strandboge
8d0d84164b merge from intrigeri
support systems that use libnl-3-200 via libnss-gw-name.

Patch initially proposed by Simon McVittie <smcv@debian.org>.

Bug-Debian: #810888

Acked-By: Jamie Strandboge <jamie@canonical.com>
2016-02-10 10:02:52 -06:00
Jamie Strandboge
63ff41dfdb merge from intrigeri
support systems with NetworkManager but no resolvconf where /etc/resolv.conf is
a symlink to /var/run/NetworkManager/resolv.conf

Patch proposed by Simon McVittie <smcv@debian.org>.
Bug-Debian: #813835

Acked-By: Jamie Strandboge <jamie@canonical.com>
2016-02-10 09:57:58 -06:00
intrigeri
438ee9df26 abstractions/nameservice: support systems that use libnl-3-200 via libnss-gw-name.
Patch initially proposed by Simon McVittie <smcv@debian.org>.
Closes: Debian#810888
2016-02-10 11:19:04 +01:00
intrigeri
de9c5ed33b abstractions/nameservice: factorize to de-duplicate a bit. 2016-02-10 11:09:24 +01:00
intrigeri
4564d82d52 abstractions/nameservice: support systems with NetworkManager but no resolvconf where /etc/resolv.conf is a symlink to /var/run/NetworkManager/resolv.conf.
Patch proposed by Simon McVittie <smcv@debian.org>.
Closes: Debian#813835
2016-02-10 11:06:38 +01:00
Christian Boltz
911b3b8f24 Drop unused suggest_incs_for_path() in aa.py
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-02-06 21:28:37 +01:00
Launchpad Translations on behalf of apparmor-dev
d47c37c5fd Launchpad automatic translations update. 2016-02-02 05:11:30 +00:00
Tyler Hicks
195dfe1cf2 pam_apparmor: Don't leak /dev/urandom fd
If reading /dev/urandom failed, the corresponding file descriptor was
leaked through the error path.

Coverity CID #56012

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-02-01 10:34:18 -06:00
Tyler Hicks
e162f60003 libapparmor: Fix -Wunused-but-set-variable GCC warning
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-02-01 09:40:25 -06:00
Tyler Hicks
f58c8e3b5c libapparmor: Fix -Wunused-variable GCC warning
The variable was only referenced by commented section of code so move
the declaration into the comment.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-02-01 09:40:22 -06:00
Tyler Hicks
38859cb204 README: Document Coverity support
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-27 15:47:09 -06:00
Tyler Hicks
47d0045ff8 Makefile: Add coverity target
Add a target that uses cov-build, which must be found in $PATH, to
generate an intermediate Coverity directory called cov-int. The
intermediate Coverity directory will be based on a clean snapshot of the
last commit in the bzr tree. Finally, the intermediate directory is
converted to a compressed tarball, stored in
apparmor-<SNAPSHOT_VERSION>-cov-int.tar.gz, and is suitable for
uploading to scan.coverity.com.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-27 15:47:05 -06:00
Tyler Hicks
4c1b7fe0b4 Makefile: Convert shell variables into reusable make variables
Turn REPO_VERSION and SNAPSHOT_DIR into make variables that may be
reused by future targets that specify the snapshot target as a
prerequisite. This prevents us from having to repeatedly call out to
potentially slow commands on bound bzr branches, such as the bzr
version-info command stored in the REPO_VERSION_CMD make variable.

The new REPO_VERSION make variable is turned into a "simply expanded"
variable as to not require a callout to bzr each time it is expanded.

The SNAPSHOT_DIR shell variable is renamed to SNAPSHOT_NAME as a make
variable. The new name may be slightly more descriptive in the future as
the variable will be reused in other ways besides a simple directory
name.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-27 15:46:40 -06:00
Tyler Hicks
8516aa9b5a common: Simplify REPO_VERSION_CMD in Make.rules
bzr version-info supports directly printing the bare revno to stdout so
we should use that instead of parsing the default verbose output.

This change simplifies the shell snippet used to assign the
REPO_VERSION_CMD make variable. It was also tested to work with the bzr
present in Ubuntu 12.04.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-27 15:46:40 -06:00
Tyler Hicks
5e0eb13842 Makefile: Reorder DIRS variable according to build order
Order the DIRS variable according to build order. This allows the DIRS
variable to be iterated over to build libapparmor, binutils, parser,
utils, etc., without having to reorder the list.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-01-27 15:46:28 -06:00
Tyler Hicks
8eda3a787a libapparmor: Correct meaning of EPERM in aa_change_profile man page
I suspect that the incorrect description of EPERM was copied from
the aa_change_hat man page, where it is possible to see EPERM if the
application is not confined by AppArmor.

This patch corrects the description by documenting that the only
possible way to see EPERM is if a confined application has the
no_new_privs bit set.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-27 12:40:49 -06:00
Tyler Hicks
d22c744acc libapparmor: Open fds may be revalidated after aa_change_profile()
It is possible that file descriptors will be revalidated after an
aa_change_profile() but there is a lot of complexity involved that
doesn't need to be spelled out in the man page. Instead, mention that
revalidation is possible but the only way to ensure that file
descriptors are not passed on is to close them.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-27 12:40:34 -06:00
Tyler Hicks
482f572137 libapparmor: Remove incorrect statement in aa_change_profile man page
The statement was meant to convey the difference between aa_change_hat()
and aa_change_profile(). Unfortunately, it read as if there was
something preventing a program from using aa_change_profile() twice to
move from profile A to profile B and back to profile A, even if profiles
A and B contained the necessary rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-01-27 12:40:13 -06:00
Steve Beattie
db00c37351 utils: handle versioned ruby interpreters
On Debian and Ubuntu it's possible to have multiple ruby interpreters
installed, and the default to use is handled by the ruby-defaults
package, which includes a symlink from /usr/bin/ruby to the versioned
ruby interpreter.

This patch makes aa.py:get_interpreter_and_abstraction() take that into
account by using a regex to match possible versions of ruby. Testcases
are included. (I noticed this lack of support because on Ubuntu the ruby
test was failing because get_interpreter_and_abstraction() would get the
complete path, which on my 16.04 laptop would get /usr/bin/ruby2.2.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-01-25 22:54:53 -08:00
Steve Beattie
61a7b23757 parser: fix memory leaks in variable failure cases
This patch frees some leaked memory that occur when errors are
detected while adding variables to the parser's symbol table. While not
a significant issue currently due to the parser exiting on failures, as
the process of library-ifying the parser continues, these need to be
addressed. It also makes it easier to use tools like Address Sanitizer
on the parser against our test suite.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2016-01-25 15:27:16 -08:00
Christian Boltz
2a81e30d5b utils/test/Makefile: print test filenames in 'make check' and 'make coverage'
This makes it easier to find the file that contains a failing test.



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.
2016-01-25 23:49:26 +01:00
Christian Boltz
8c7f4a9323 Split off logprof_value_or_all()
The rule classes have lots of

        if self.all_foo:
            foo_txt = _('ALL')
        else:
            foo_txt = self.foo


in logprof_header_localvars().

To avoid repeating this over and over, split it off to a
logprof_value_or_all() function.

This function can handle
- str (will be returned unmodified
- AARE (.regex will be used)
- sets/lists/tuples (will be ' '.join()ed and sorted)

Other types are returned unmodified.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-25 23:48:34 +01:00
Christian Boltz
728c01505e Better error message on unknown profile lines
When hitting an unknown line while parsing a profile, it's a good idea
to include that line in the error message ;-)


Note: 2.9 would print a literal \n because it doesn't have apparmor.fail,
so it will get a slightly different patch with spaces instead of \n.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.
2016-01-25 23:45:25 +01:00
Christian Boltz
abb4491ab8 split off _is_equal_aare()
Checking if two AARE objects are equal is not hard, but also not a
one-liner.

Since we need to do this more than once (and even more often in other
outstanding rule classes), split that code into an _is_equal_aare()
function and change PtraceRule and SignalRule to use it.

To make things even more easier, the parameters to use match the
_is_covered_aare() syntax.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-25 23:43:13 +01:00
Christian Boltz
e0e23e437e Improve __repr__() for *Ruleset
If a *Ruleset is empty, let __repr__() print/return

    <FooRuleset (empty) />

instead of

    <FooRuleset>
</FooRuleset>



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.
2016-01-25 23:42:13 +01:00
Christian Boltz
52e76efea7 Use list check in PtraceRule and SignalRule is_covered_localvars()
PtraceRule 'access' and SignalRule 'access' and 'signal' can contain
more than one value. Therefore adjust is_covered_localvars() in both
to use the list (subset) instead of the plain (exactly equal) check.

Also add a testcase for each to ensure the list/subset check works as
expected.


Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-25 23:40:52 +01:00
Christian Boltz
3519ef38a9 split off _is_covered_*() helper functions
is_covered_localvars() in the rule classes need the same set of checks
again and again. This patch adds the helper functions _is_covered_list(),
_is_covered_aare() and _is_covered_plain() to check against lists, AARE
and plain variables like str.

The helpers check if the values from the other rule are valid (either
ALL or the value need to be set) and then check if the value is covered
by the other rule's values.

This results in replacing 7 lines with 2 in the rule classes and avoids
repeating code over and over.

Note that the helper functions depend on the *Rule.rule_name variable in
the exception message, therefore rule_name gets added to all rule
classes.



Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-25 23:38:04 +01:00
Steve Beattie
fcafc08500 parser: fix uninitialized field in convert_aaregex_to_pcre()
The first entry in the grouping_count array is never initialized to 0;
subsequent depths are. This patch initializes the whole array.

Issue found with valgrind.

Signed-off-by: Steve Beattie <steve@nxnw.org> (with improvement from Seth)
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-01-25 12:48:34 -08:00
Steve Beattie
f0607be838 parser: fix memory leaks in unit tests
This patch fixes the unit test memory leaks found
by intrigeri using AddressSanitizer in the following email thread:

 https://lists.ubuntu.com/archives/apparmor/2015-August/008491.html

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-01-25 12:05:50 -08:00
Steve Beattie
28f072bfb2 Merge from apparmor trunk; fixed up conflict due to imported indonesian
.po file.
2016-01-25 10:55:41 -08:00
Steve Beattie
2443abda9d regression tests: define arch specific bits for s390x
bug: https://bugs.launchpad.net/bugs/1531325

This patch defines the arch specific registers struct for s390 for the
ptrace regression test.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-21 13:16:10 -08:00
Launchpad Translations on behalf of apparmor-dev
2bf7b2ef5d Launchpad automatic translations update. 2016-01-21 05:11:44 +00:00
Christian Boltz
33dd6776dc AARE: escape exclamation mark
'!' is a reserved symbol and needs to be escaped in AARE.


Note: aare.py only exists in trunk, therefore this part is trunk-only.



Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9 as needed.
2016-01-20 21:50:20 +01:00
Seth Arnold
5d99b5fdb5 Fix Coverity issue 56025 -- Uninitialized scalar field
Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-19 15:07:04 -08:00
Christian Boltz
b57c4240ee Fix a missing comma in parser_misc.c capnames
The capnames list missed a comma, which lead to the funny
"mac_overridesyslog" capability name.

__debug_capabilities() seems to be the only user of capnames, which
might explain why this bug wasn't noticed earlier.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-01-16 11:26:52 +01:00
John Johansen
a7bcffd9c6 Fix: segfault when processing directories
BugLink: http://bugs.launchpad.net/bugs/1534405

Patch -r 2952 switched over to using the library kernel interface, and
added a kernel_interface parameter to the dir_cb struct, that is
used to process directories.

Unfortunately kernel_interface parameter of the dir_cb struct is not being
properly initialized resulting in odd failures and sefaults when the parser
is processing directories.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-14 17:26:26 -08:00
John Johansen
3cb1477f5d parser: add basic support for parallel compiles and loads
This adds a basic support for parallel compiles. It uses a fork()/wait
model due to the parsers current dependence on global variables and
structures. It has been setup in a similar manner to how cilk handles
multithreading to make it easy to port to a managed thread model once
the parser removes the dependence on global compute structures in the
backend.

This patch adds two new command line flags
  -j <n> or --jobs <n>
     which follows the make syntax of specifying parallel jobs currently
     defaults to -jauto
     -j8     or  --jobs=8	allows for 8 parallel jobs
     -jauto  or  --jobs=auto	sets the jobs to the # of cpus
     -jx4    or  --jobs=x4	sets the jobs to # of cpus * 4
     -jx1 is equivalent to -jauto

     Note: unlike make -j must be accompanied by an option

--max-jobs=<n>
    allows setting hard cap on the number of jobs that can be specified
    by --jobs. It defaults to the number of processors in the system * 8.
    It supports the "auto" and "max" keywords, and using x<n> for a
    multiple of the available cpus.

additionally the -d flag has been modified to take an optional parameter
and
  --debug=jobs
will output debug information for the job control logic.

In light testing on one machine the job control logic provides a nice
performance boost.  On an x86 test machine with 60 profiles in the
/etc/apparmor.d/ directory, for the command
  time apparmor_parser -QT /etc/apparmor.d/

  old (equiv of -j1):
     real  0m10.968s
     user  0m10.888s
     sys   0m0.088s

  ubuntu parallel load using xargs:
     real  0m8.003s
     user  0m21.680s
     sys   0m0.216s

  -j:
     real  0m6.547s
     user  0m17.900s
     sys   0m0.132s

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2016-01-13 17:10:57 -08:00
Christian Boltz
9af80ebc09 split off _aare_or_all()
We need to check a rule part if it is *Rule.ALL or a string at various
places. Therefore split off the checks in PtraceRule's and SignalRule's
__init__() to the new _aare_or_alll() function in BaseRule.

This also makes the *Rule __init__() much more readable because we now
have one line to set self.foo and self.all_foo instead of 10 lines of
nested if conditions.


Acked-by: Steve Beattie <steve@nxnw.org>.
2016-01-12 19:54:28 +01:00
Christian Boltz
e41079b9b3 More useful logparser failure reports
If parse_event_for_tree() raises an AppArmorException (for example
because of an invalid/unknown request_mask), catch it in read_log() and
re-raise it together with the log line causing the Exception.



Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.
2016-01-12 19:48:55 +01:00
Simon Deziel
1fcdad4f1e usr.sbin.sshd: refresh profile and add libpam-systemd abstractions 2016-01-08 20:43:56 -05:00
Tyler Hicks
b7ef7ba31d libapparmor: Fix minor formatting issue in the aa_query_label(2) man
Remove extra leading parenthesis from some of the function prototypes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-08 14:59:39 -06:00
Tyler Hicks
910e402965 libapparmor: Reorder SYNOPSIS section of aa_query_label(2) man
Swap aa_query_link_path_len() and aa_query_link_path() to match the
order of aa_query_file_path() and aa_query_file_path_len().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-08 14:59:24 -06:00
Tyler Hicks
a4721c058f libapparmor: Fix line wrapping of the aa_query_label(2) man
Doing manual line wraps resulted in an unreadable SYNOPSIS section.
Allow man to handle line wrapping the function prototypes itself.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-08 14:59:08 -06:00
Tyler Hicks
397e6ed5e1 libapparmor: Add funcs to the NAME section of the aa_query_label(2) man
aa_query_file_path, aa_query_file_path_len, aa_query_link_path, and
aa_query_link_path_len were omitted from the NAME section.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2016-01-08 14:58:45 -06:00
Christian Boltz
bff4127641 Add some simple_tests ("deny dbus name=(SomeService)," and "deny file,")
Acked-by: Steve Beattie <steve@nxnw.org>
2016-01-07 23:39:56 +01:00
Christian Boltz
aaa5b2862a Fix handling of link events in aa-logprof
handle_children() has some special code for handling link events with
denied_mask = 'l'. Unfortunately this special code depends on a regex
that matches the old, obsolete log format - in a not really parsed
format ("^from .* to .*$").

The result was that aa-logprof did not ask about events containing 'l'
in denied_mask.

Fortunately the fix is easy - delete the code with the special handling
for 'l' events, and the remaining code that handles other file
permissions will handle it :-)


References: Bugreport by pfak on IRC


Testcase (with hand-tuned log event):

    aa-logprof -f <( echo 'Jan  7 03:11:24 mail kernel: [191223.562261] type=1400 audit(1452136284.727:344): apparmor="ALLOWED" operation="link" profile="/usr/sbin/smbd" name="/foo" pid=10262 comm=616D617669736420286368362D3130 requested_mask="l" denied_mask="l" fsuid=110 ouid=110 target="/bar"')

should ask to add '/foo l,' to the profile.



Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2016-01-07 21:23:43 +01:00
Jamie Strandboge
13ee637c55 allow read on /run/systemd/resolve/resolv.conf for systems using networkd
(LP: #1529074)

Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2016-01-05 17:03:06 -06:00
Christian Boltz
478eed9336 merge https://code.launchpad.net/~sdeziel/apparmor/dnsmasq.d-available/+merge/277075
by Simon Deziel:
  Allow reading conf snippets from /etc/dnsmasq.d-available

Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-12-30 22:23:42 +01:00
Christian Boltz
9e6be07e7d merge https://code.launchpad.net/~intrigeri/apparmor/dnsmasq-better-confine-libvirt-leaseshelper/+merge/267822
from intrigery:
  dnsmasq profile: extract confinement of libvirt_leaseshelper into a dedicated sub-profile.

Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-12-30 22:09:07 +01:00
Christian Boltz
514977f779 Implement __deepcopy__() for aare
Thanks to http://bugs.python.org/issue10076, we need to implement this
ourself :-/

Also add some tests to ensure __deepcopy__() works as expected.

I found this bug while testing the dbus patch series, which crashed
aa-cleanprof with
    TypeError: cannot deepcopy this pattern object


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 16:15:08 +01:00
Christian Boltz
7a25fef5f6 Set log_event flag in collapse_log()
collapse_log() creates temporary SignalRule etc. objects which are then
checked against the existing profile content.

These temporary objects are based on log events, therefore flag them as
such. This will ensure proper handling and escaping by the AARE class.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:25:17 +01:00
Christian Boltz
d813ae657d Add support for ptrace log events to aa-logprof
In detail, this means:
- handle ptrace events in logparser.py
- "translate" those events in aa.py - from log (logparser.py readlog())
  to prelog (handle_children()) to log_dict (collapse_log()) to
  log_obj (ask_the_questions())
  (yes, really! :-/ - needless to say that this is ugly...)
- finally ask the user about the ptrace in ask_the_questions()

Also add a logparser test to test-ptrace.py to ensure the logparser step
works as expected.

Note that the aa.py changes are not covered by tests, however they
worked in a manual test.


If you want to test manually, try this (faked) log line:
    msg=audit(1409700683.304:547661): apparmor="DENIED" operation="ptrace" profile="/usr/sbin/smbd" pid=22465 comm="ptrace" requested_mask="trace" denied_mask="trace" peer="/foo/bar"


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:22:51 +01:00
Christian Boltz
813dbef2aa Add support for handling ptrace rules everywhere
"Everywhere" means aa-mergeprof and aa-cleanprof. In theory also
aa-logprof, but that needs some code that parses ptrace log events ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:21:46 +01:00
Christian Boltz
a7179191f9 Use PtraceRule
Change aa.py to use PtraceRule and PtraceRuleset in profile_storage(),
parse_profile_data() and write_ptrace(). This also means we can drop the
now unused parse_ptrace_rule() and write_ptrace_rules() functions.

Raw_Ptrace_Rule in rules.py is now also unused and can be dropped.

Also adjust logparser.py to include the peer in the result, and shorten
the list of known-failing tests in test-parser-simple-tests.py.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:20:37 +01:00
Christian Boltz
8981c102e1 Add tests for PtraceRule and PtraceRuleset
As usual, we have 100% test coverage :-)

Those tests include all tests from test-ptrace_parse.py, therefore
delete this file.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:18:50 +01:00
Christian Boltz
c303214286 Adjust test-ptrace_parse.py to use PtraceRule
The tests in test-ptrace_parse.py used aa.parse_ptrace_rule(), which is
based on Raw_Ptrace_Rule (= regex check + "just store it").

This patch changes the tests to test against PtraceRule.get_clean().
Since get_clean does some cleanups, the expected result slightly differs
from the original rule.

Finally switch to the AATest class and setup_all_loops() we use in most
tests.


Also change test-regex_matches.py to import RE_PROFILE_SIGNAL directly
from apparmor.regex instead of apparmor.aa (where it will vanish soon).


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:16:55 +01:00
Christian Boltz
5d6ca98af6 Add PtraceRule and PtraceRuleset classes
Those classes will be used to parse and handle ptrace rules.
They understand the syntax of ptrace rules.

Note that get_clean() doesn't output superfluos things, so
  ptrace ( trace ),
will become
  ptrace trace,


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:16:12 +01:00
Christian Boltz
902584437f Add a 'details' group to RE_PROFILE_PTRACE
As a preparation for the PtraceRule class, add a <details> match group
to RE_PROFILE_PTRACE.

Also adjust test-regex_matches.py for the added group.

Note: RE_PROFILE_PTRACE is only used in aa.py, and only matches[0..2]
are used. 0 and 1 are audit and allow/deny and 2 is and stays the whole
rule (except audit and allow/deny). Therefore no aa.py changes are
needed.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-27 01:14:54 +01:00
Tyler Hicks
fad61aeef3 binutils: Remove --file option from aa-exec(8) man page
The new C based aa-exec does not implement the --file option.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 19:20:10 -06:00
Tyler Hicks
18c3bc9f4d binutils: Replace Perl aa-exec with C aa-exec
Remove the Perl aa-exec implementation, move the aa-exec(8) man page to
binutils/, and point the regression test to the C based aa-exec in
binutils/.

Note that the new C aa-exec does not implement the --file option which
was present in the Perl aa-exec. It encouraged running programs as root,
since root privileges were required to load the specified profile.

All other features of the Perl aa-exec are present in the C aa-exec.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 19:19:23 -06:00
Tyler Hicks
b75cbff332 binutils: Add the --namespace option to C based aa-exec
Switch to the policy in the namespace specified by the --namespace
option.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 19:18:37 -06:00
Tyler Hicks
897fa17b0d binutils: Add --immediate option to C based aa-exec
Call aa_change_profile(), instead of aa_change_onexec(), when
--immediate is passed in.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 19:18:12 -06:00
Tyler Hicks
984a696ed3 binutils: Initial implementation of aa-exec in C
Create a simple aa-exec implementation, written in C, matching the
--help, --debug, --verbose, and --profile options present in the current
Perl implementation.

The new aa-exec sources reside in the binutils/ directory.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 19:17:30 -06:00
Tyler Hicks
54ced32caa binutils: Install to /usr/bin instead of /sbin
aa-enabled should live in /usr/bin, rather than /sbin, since it is not
used in early boot and requires no root privileges.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-12-17 18:23:25 -06:00
Christian Boltz
04c2a69699 Write unix rules when saving a profile
r2637 added support for parsing unix rules, but forgot to add write
support. The result was that a profile lost its unix rules when it was
saved.

This patch adds the write_unix_rules() and write_unix() functions (based
on the write_pivot_root() and write_pivot_root_rules() functions) and
makes sure they get called at the right place.

The cleanprof testcase gets an unix rule added to ensure it's not
deleted when writing the profile. (Note that minitools_test.py is not
part of the default "make check", however I always run it.)


References: https://bugs.launchpad.net/apparmor/+bug/1522938
            https://bugzilla.opensuse.org/show_bug.cgi?id=954104



Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk, 2.10 and 2.9.
2015-12-17 23:47:08 +01:00
Christian Boltz
254398e375 Fix a test name in test-signal.py
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-12-17 23:46:09 +01:00
Christian Boltz
726fa53eeb Adjust test-aa.py for python2
This means:
- expect unicode (instead of str) when reading from a file in py2
- convert keys() result to a set to avoid test failures because of
  dict_keys type

After this change, all tests work for both py2 and py3.


Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk and 2.10.
2015-12-17 23:44:18 +01:00
Christian Boltz
6f63cf3664 Adjust type(x) == str checks in the rule classes for py2
python 3 uses only the 'str' type, while python 2 also uses 'unicode'.
This patch adds a type_is_str() function to common.py - depending on the
python version, it checks for both. This helper function is used to keep
the complexity outside of the rule classes.

The rule classes get adjusted to use type_is_str() instead of checking
for type(x) == str, which means they support both python versions.

As pointed out by Tyler, there are also some type(...) == str checks in
aare.py and rule/__init__.py which should get the same change.

Finally, add test-common.py with some tests for type_is_str().


References: https://bugs.launchpad.net/apparmor/+bug/1513880


Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk and 2.10

Note: 2.10 doesn't contain SignalRule, therefore it doesn't get that
part of the patch.
2015-12-17 23:33:36 +01:00
Tyler Hicks
3073160aca tests: Add regression tests for aa-exec
Add regression tests for the --profile, --namespace, and --immediate
options of aa-exec.

A new variable is added to uservars.inc to point to the in-tree or
system aa-exec depending on the presence of the USE_SYSTEM=1 make
variable at build time.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-17 16:07:51 -06:00
Tyler Hicks
0ccfb7f52e binutils: Remove distro install targets from Makefile
Clean up the Makefile by removing distro-related install targets. These
should not be needed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-12-17 09:38:31 -06:00
Tyler Hicks
504ac5c741 binutils: Add newline to aa-enabled(8) man page
Trivial change to separate the "OPTIONS" header from the section's
content.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-12-16 18:53:34 -06:00
Tyler Hicks
6944d137c0 binutils: Add aa-enabled program to check AppArmor status
The new aa-enabled program can be used as a barebones replacement for
`aa-status --enabled`. It is written in C, rather than Python, which
keeps its dependencies to a minimum.

By default, aa-enabled prints a human-readable status of AppArmor's
availability to stdout. It supports a --quiet option which allows for
functionality equivalent to `aa-status --enabled`, which does not print
any messages.

The aa-enabled exit statuses mimic the behavior documented in the
aa-status(8) man page.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Incorporated feedback from the code review process]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-12-16 18:35:09 -06:00
Tyler Hicks
e493338add utils: Use apparmor.fail for AppArmorException handling in aa-easyprof
Don't catch AppArmorExceptions in aa-easyprof any longer and rely on
apparmor.fail to print the exception to stderr.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-12-16 16:12:43 -06:00
Christian Boltz
2f70c5a1bc Let the apparmor.fail error handler print to stderr
The patch also switches to using error() instead of a plain print() for
AppArmorException, which means prefixing the error message with 'ERROR: '



References: https://bugs.launchpad.net/apparmor/+bug/1521400


Acked-by: Tyler Hicks <tyhicks@canonical.com> for trunk and 2.10.
2015-12-16 11:59:10 +01:00
Tyler Hicks
67eb25939d parser: Honor the --namespace-string commandline option
https://launchpad.net/bugs/1526085

Revno 2934 'Add fns to handle profile removal to the kernel interface'
introduced a regression in the parser's namespace support by causing the
--namespace-string option to be ignored. This resulted in the profile(s)
being loaded into the global namespace rather than the namespace
specified on the command line.

This patch fixes the bug by setting the Profile object's ns member, if
the --namespace-string option was specified, immediately after the
Profile object is allocated.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-12-15 16:41:38 -06:00
Christian Boltz
e51ad3c632 ignore log event if request_mask == ''
We already check for None, but '' != None ;-)


References: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1525119


Acked-by: John Johansen <john.johansen@canonical.com> for 2.9, 2.10 and trunk.
2015-12-12 13:30:43 +01:00
Christian Boltz
451ab0d8f0 Fix logparser.py crash on change_hat events
'change_hat' events have the target profile in 'name2', not in 'name'
(which is None and therefore causes a crash when checking if it contains
'//')

Also add the log event causing this crash to the libapparmor testsuite.

References: https://bugs.launchpad.net/apparmor/+bug/1523297


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9.
2015-12-12 13:05:14 +01:00
Christian Boltz
6756a0771d Several fixes for variable handling
Parsing variables was broken in several ways:
- empty quotes (representing an intentionally empty value) were lost,
  causing parser failures
- items consisting of only one letter were lost due to a bug in RE_VARS
- RE_VARS didn't start with ^, which means leading garbage (= syntax
  errors) was ignored
- trailing garbage was also ignored

This patch fixes those issues in separate_vars() and changes
var_transform() to write out empty quotes (instead of nothing) for empty
values.

Also add some tests for separate_vars() with empty quotes and adjust
several tests with invalid syntax to expect an AppArmorException.

var_transform() gets some tests added.

Finally, remove 3 testcases from the "fails to raise an exception" list
in test-parser-simple-tests.py.



Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.9
(which also implies 2.10)

Note: 2.9 doesn't have test-parser-simple-tests.py, therefore it won't
get that part of the patch.
2015-12-12 12:59:13 +01:00
Christian Boltz
7334048e5e error out on failing libapparmor test_multi tests
This patch adds a check-local target to libapparmor/testsuite/Makefile.am
that checks the logfile generated by the test_multi tests
(libaalogparse.log) and errors out if
- the logfile doesn't exist (which might mean that dejagnu isn't installed
- the logfile contains 'ERROR'

This isn't the best solution I can imagine, but it's the only/easiest
way I found that doesn't need changing of autogenerated files.


Also extend clean-local to delete libaalogparse.{log,sum}

Finally, add test_multi/testcase_syslog_read.err (empty file) to avoid
make check fails.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-12 12:56:06 +01:00
Christian Boltz
d2dc08e78c Change SignalRule to use AARE instead of plain strings
Also adjust test-signal.py for AARE (it needs a change in _compare_obj())
and enable the regex-based tests.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-09 23:23:32 +01:00
Christian Boltz
441d3d2ae2 Add AARE class
The AARE class is meant to handle the internals of path AppArmor regexes
at various places / rule types (filename, signal peer etc.). The goal is
to use it in rule classes to hide all regex magic, so that the rule
class can just use the match() method.

If log_event is given (which means handing over a raw path, not a regex),
the given path is converted to a regex in convert_expression_to_aare().
(Also, the raw path is used in match().)

BTW: The reason for delaying re.compile to match() is performance - I'd
guess a logprof run calls match() only for profiles with existing log
events, so we can save 90% of the re.compile() calls.


The patch also includes several tests.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-12-09 23:19:57 +01:00
Christian Boltz
6ee8cc6203 Move check_and_split_list() to BaseRule
We'll need this function in more rule classes ;-)



Acked-by: Seth Arnold <seth.arnold@canonical.com>

Bug: https://launchpad.net/bugs/1604872
2015-12-04 12:02:33 +01:00
Christian Boltz
fce7d080df Centralize the 'ruletypes' list
Having a list of rule types/classes at several places is annoying and
error-prone. This patch centralizes the list in aa.py.

This also means ask_the_question() in aa.py will now (in theory) support
'change_profile' and 'rlimit'. In practise, that doesn't change anything
because logparser.py doesn't support change_profile events yet - and
rlimit doesn't cause any log events.

Also add some long overdue copyright headers.



Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-12-04 12:01:32 +01:00
Christian Boltz
1d51eef8ca Add realtime signals to SIGNALS list in apparmor.d
Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk, 2.10 and 2.9.
2015-12-02 22:05:21 +01:00
Christian Boltz
c1082b7b13 Add realtime signal example to the apparmor.d manpage
Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.
2015-12-02 20:09:47 +01:00
Launchpad Translations on behalf of apparmor-dev
24c9a27722 Launchpad automatic translations update. 2015-11-29 05:04:51 +00:00
Christian Boltz
5755576b17 Add missing variables to the apparmor.d manpage
@{pids} and @{apparmorfs} was not mentioned in the apparmor.d manpage.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk, 2.10 and 2.9
2015-11-28 21:44:51 +01:00
Christian Boltz
7123ff41f6 Add support for signal log events to aa-logprof
In detail, this means:
- handle signal events in logparser.py
- "translate" those events in aa.py - from log (logparser.py readlog())
  to prelog (handle_children()) to log_dict (collapse_log()) to
  log_obj (ask_the_questions())
  (yes, really! :-/ - needless to say that this is ugly...)
- finally ask the user about the signal in ask_the_questions()

Also add a logparser test to test-signal.py to ensure the logparser step
works as expected.

Note that the aa.py changes are not covered by tests, however they
worked in a manual test.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-11-26 23:20:43 +01:00
Christian Boltz
dcf3b91a8d Change abstract methods in BaseRule to use NotImplementedError
As Kshitij mentioned, abstract methods should use NotImplementedError
instead of AppArmorBug.

While changing this, I noticed that __repr__() needs to be robust against
NotImplementedError because get_raw() is not available in BaseRule.
Therefore the patch changes __repr__() to catch NotImplementedError.

Of course the change to NotImplementedError also needs several
adjustments in the tests.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
(long before branching off 2.10, therefore I'll also commit to 2.10)
2015-11-24 00:16:35 +01:00
Christian Boltz
4364a3781e Move all tests from test-signal_parse.py to test-signal.py
It's pointless to keep a separate file for those tests - they integrate
well in test-signal.py.

After the move, test-signal_parse.py is empty and will be deleted.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-11-24 00:15:27 +01:00
Christian Boltz
f1e08d0684 Add support for rlimit and signal rules to aa-mergeprof
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-11-24 00:11:56 +01:00
Christian Boltz
593cbf993f Update cleanprof to also delete superfluous signal etc. rules
Besides 'signal', also 'change_profile' and 'rlimit' cleanup was missing
for the main profile.

In aa.py delete_duplicates() (used to check includes), only 'signal' was
missing.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-11-24 00:11:15 +01:00
Christian Boltz
3a6087bef6 Change aa.py to use SignalRule and SignalRuleset
This means:
- import the classes instead of RE_PROFILE_SIGNAL
- simplify signal rule parsing a lot
- drop the (now unused) functions parse_signal_rule() and write_signal_rules()
- change write_signal() to use the SignalRuleset class

Also drop the now unused Raw_Signal_Rule from rules.py.

Finally, drop most parser signal tests from the "known wrong results"
blacklist in test-parser-simple-tests.py because those tests succeed
with SignalRule.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-11-24 00:09:37 +01:00
Christian Boltz
964462ab54 Adjust test-signal_parse.py to use SignalRule
The tests in test-signal_parse.py used aa.parse_signal_rule(), which is
based on Raw_Signal_Rule (= regex check + "just store it").

This patch changes the tests to test against SignalRule.get_clean().
Since get_clean() does some cleanups, the expected result slightly
differs from the original rule.

Finally switch to the AATest class and setup_all_loops() we use in most
tests.


Also change test-regex_matches.py to import RE_PROFILE_SIGNAL directly
from apparmor.regex instead of apparmor.aa (where it will vanish soon).



Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-11-24 00:07:06 +01:00
Christian Boltz
6bf9249694 Add SignalRule and SignalRuleset classes
Those classes will be used to parse and handle signal rules.
They understand the (surprisingly complex) syntax of signal rules.

Note that get_clean() doesn't output superfluos things, so
  signal ( send ) set = ( int ),
will become
  signal send set=int,

Also add a set of tests (100% coverage :-) to make sure everything works
as expected.


This is a merged commit of the following patches:
- 07-add-SignalRule-and-SignalRuleset.diff
- 13-test-signal-compare_obj.diff
- 17-signal-rule-cleanup.diff
- 21-test-signal-rename-tests.diff
- 22-signal-rule-adjustments.diff
- 24-signal-rule-fix-error-message.diff


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
(all patches in this commit)
2015-11-24 00:03:10 +01:00
Christian Boltz
cddc66a325 add a named match group to RE_PROFILE_SIGNAL
As a preparation for the SignalRule class, add a <details> match group
to RE_PROFILE_SIGNAL.

Also adjust test-regex_matches.py for the added group.

Note: RE_PROFILE_SIGNAL is only used in aa.py, and only matches[0..2]
are used. 0 and 1 are audit and allow/deny and 2 is and stays the whole
rule (except audit and allow/deny). Therefore no aa.py changes are
needed.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.10
2015-11-23 23:46:32 +01:00
Christian Boltz
6a6f63a595 Map c (create) log events to w instead of a
Creating a file is in theory covered by the 'a' permission, however
discussion on IRC brought up that depending on the open flags it might
not be enough (real-world example: creating the apache pid file).

Therefore change the mapping to 'w' permissions. That might allow more
than needed in some cases, but makes sure the profile always works.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for 2.9, 2.10 and trunk
2015-11-19 21:23:02 +01:00
Christian Boltz
00cd706086 Also add python 3.5 to logprof.conf
Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for 2.9, 2.10 and trunk
2015-11-19 20:22:40 +01:00
Jamie Strandboge
c2865a92ae Description: update python abstraction for python 3.
Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-11-19 08:51:05 -06:00
Christian Boltz
801f3d596b Add debug info to profile_storage()
For debugging, it's helpful to know which part of the code initialized a
profile_storage and for which profile and hat this was done.

This patch adds an 'info' array with that information, adds the
corresponding parameters to profile_storage() and changes the callers to
deliver some useful content.


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.10
2015-11-18 22:01:19 +01:00
Christian Boltz
28d46e96ab Fix parsing/storing bare file rules
We replaced parse_audit_allow() with parse_modifiers() in r2833, but
overlooked that parse_modifiers() returns allow/deny as boolean. This
resulted in storing bare file rules in aa[profile][hat]['path'][False]
instead of aa[profile][hat]['path']['allow'] (or True instead of 'deny'
for 'deny file,' rules), with the user-visible result of loosing bare
file rules when saving the profile.

This patch converts the boolean value from parse_modifiers back to a
string.

Note: 2.9 is not affected because the old parse_audit_allow() returns
'allow' or 'deny' as string, not as boolean.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk and 2.10
2015-11-18 21:31:14 +01:00
Christian Boltz
98841b102a update PYMODULES in tools/Makefile
PYMODULES is used for generating *.pod, so it should include rule/*.PYMODULES


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk and 2.10
2015-11-18 21:28:53 +01:00
Christian Boltz
5e40adea06 utils/test/Makefile: add libapparmor to PYTHONPATH
The last utils/test/Makefile change switched to using the in-tree
libapparmor by default (unless USE_SYSTEM=1 is given). However, I missed
to add the swig/python parts of libapparmor to PYTHONPATH, so the
system-wide LibAppArmor/__init__.py was always used.

This patch adds the in-tree libapparmor python module to PYTHONPATH.

I'm sorry for the interesting[tm] way to find out that path, but
a) I don't know a better / less ugly way and
b) a similar monster already works in libapparmor/swig/python/test/ ;-)


Acked-by: John Johansen <john.johansen@canonical.com> for 2.9 and trunk
(that also implies 2.10 ;-)
2015-11-18 13:44:45 +01:00
Christian Boltz
b7c2ee19b7 Add python to the "no Px rule" list in logprof.conf
To make things more interesting, /usr/bin/python and /usr/bin/python[23]
are symlinks to /usr/bin/python[23].[0-9], so we have to explicitely
list several versions.


Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9, 2.10 and trunk
2015-11-18 13:39:07 +01:00
Steve Beattie
182755554a Update version in preparation for a 2.11 release 2015-11-18 01:34:50 -08:00
John Johansen
1890c13f8a bump parser abi version to force policy recompilation
2.9.x and 2.10 had some time stamp bugs around cache handling that
result in the cache getting a wrong time stamp, and then not getting
correctly updated when policy changes.

Force cache recompiles for these versions by bumping the parser abi

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-11-17 16:21:46 -08:00
Christian Boltz
c97fd38b92 syslog-ng profile: allow /run/log/journal/
syslog-ng needs to access both the permanent /var/log/journal/ and the
non-permanent /run/journal/.

I also included /var/run/journal/ to stay consistent with supporting
both /run/ and /var/run/.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-11-11 16:44:47 +01:00
Simon Deziel
a88d86b988 Allow reading conf snippets from /etc/dnsmasq.d-available
Some packages like libvirt-bin and lxc drop conf snippets in /etc/dnsmasq.d-available
and make them available through symlinks in /etc/dnsmasq.d created during postinst.
2015-11-09 20:05:25 -05:00
Christian Boltz
37ab41bb13 Add __repr__() functions to BaseRule and BaseRuleset
This makes print()ing a class object much more helpful - instead of
    <apparmor.rule.network.NetworkRule object at 0x7f416b239e48>
we now get something like
    <NetworkRule> network inet stream,
(based on get_raw())

A NetworkRuleset will be printed as (also based on get_raw())

<NetworkRuleset>
  network inet stream,
  allow network inet stream, # comment
</NetworkRuleset>

Also add tests to test-network.py to ensure that __repr__() works as
expected.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-10-28 22:58:56 +01:00
Christian Boltz
cc9cf967b2 Add (abstract) get_clean() method to baserule
Also add a test to ensure it raises an AppArmorBug.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-10-28 22:52:07 +01:00
Christian Boltz
e700eb04d4 let logparser.py ignore file_inherit events without request_mask
That's not nice, but still better than a crash ;-)

References: https://bugs.launchpad.net/apparmor/+bug/1466812/


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for trunk and 2.9
2015-10-28 21:00:23 +01:00
Christian Boltz
df57b802f8 Add several files created during libapparmor build to .bzrignore
Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.9
2015-10-21 21:40:35 +02:00
Christian Boltz
756d622db3 Re-enable check-logprof in profiles 'make check' target
aa-logprof is able to parse all profiles, so there is no longer a
reason to skip this test.

This patch reverts r2097 and r2098 from 2013-01-02.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: John Johansen <john.johansen@canonical.com>
(and now that the tests work even if logprof.conf doesn't exist,
Steve's NACK is no longer valid)
2015-10-20 23:42:41 +02:00
Christian Boltz
274a98d8aa Let 'make check' work without logprof.conf
This patch checks if the cfg object is empty (happens if logprof.conf
doesn't exist). If so, it adds some empty sections to prevent various
failures in code that expects those sections to exist.

Another source of failures was using cfg['section']['setting']. The
patch changes various places to cfg['section'].get('setting') to prevent
those failures. (Those places all have a 'or ...' fallback.)

Finally, find_first_file() in config.py crashed if file_list was Null.
This is fixed by adding an "if file_list:" check before trying to
split() it.

With all those changes applied, 'make check' will work even if
/etc/apparmor/logprof.conf doesn't exist.


The patch also fixes the default value for inactive_profiledir
(I missed aa.py when I changed it to /usr/share/apparmor/extra-profiles/)


References: https://bugs.launchpad.net/apparmor/+bug/1393979


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-20 23:21:51 +02:00
Christian Boltz
bdd8884ab4 Fix handling of interpreters with parameters
If a script contains a hashbang like
    #! /usr/bin/perl -w
aa-autodep created a profile entry like
    "/usr/bin/perl -w" ix,
which is obviously incorrect.

This patch fixes this (by using only the first part of the hashbang line)
and also adds some tests for it.

References: https://bugs.launchpad.net/apparmor/+bug/1505775


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>

Bug: https://launchpad.net/bugs/1393979
2015-10-20 23:18:43 +02:00
Christian Boltz
d5e9a7ec70 merge script handling into get_interpreter_and_abstraction()
Both create_new_profile() and handle_children() check if the given exec
target is a script and add permissions for the interpreter and a
matching abstraction.

This patch merges that into the get_interpreter_and_abstraction()
function and changes create_new_profile() and handle_children() to use
this function.

A nice side effect is that handle_children() now knows more abstractions
(its original list was incomplete).
The behaviour of create_new_profile() doesn't change.

Also add tests for get_interpreter_and_abstraction() to make sure it
does what we expect.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>

Bug: https://launchpad.net/bugs/1505775
2015-10-20 23:16:41 +02:00
Christian Boltz
19d3b63db3 Add tests for create_new_profile()
These tests ensure that create_new_profile() sets the expected basic
permissions for scripts and non-script files.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-20 23:14:42 +02:00
Christian Boltz
58782184a4 Change /bin/ paths in profiles to also match on /usr/bin/
oftc_ftw reported on IRC that Arch Linux has a symlink /bin -> /usr/bin.
This means we have to update paths for /bin/ in several profiles to also
allow /usr/bin/


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.9
2015-10-20 23:12:35 +02:00
Christian Boltz
3e5e0c11a0 Change utils/test/Makefile to use the in-tree libapparmor
Also add support for the USE_SYSTEM variable, which means:
- test against the in-tree libapparmor and python modules by default
- test against the system libapparmor and python modules if USE_SYSTEM
  is set

The old behaviour was a mix of both - it always used the in-tree python
modules and the system libapparmor.

For obvious reasons, you'll need to build libapparmor before running the
tests (unless you specify USE_SYSTEM=1 as parameter to make check).


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.9
2015-10-20 23:04:23 +02:00
Christian Boltz
3fa19feb43 Parse all parser simple_tests with the utils code
Add a testcase that parses all tests in the parser/tst/simple_tests/
directory with parse_profile_data() to ensure that everything with valid
syntax is accepted, and that all tests marked as FAIL raise an
exception.

This already resulted in
- several patches to fix low-hanging fruits (including some bugs in the
  parser simple_tests itsself)
- a list of tests that don't behave as expected. Those files get their
  expected result reverted to make sure we notice any change in the
  tools behaviour, especially changing to the really expected resulted.
  This method also makes sure that the testcase doesn't report any of
  the known failures.
- a 5% improvement in test coverage - mostly caused by nearly completely
  covering parse_profile_data.
- addition of some missing testcased (as noticed by missing coverage),
  for example several "rule outside of a profile" testcases.

As indicated above, the tools don't work as expected on all test
profiles - most of the failures happen on expected-to-fail tests that
pass parse_profile_data() without raising an exception. There are also
some tests failing despite valid syntax, often with rarely used syntax
like if conditions and qualifier blocks.

Most of the failing (generated) tests are caused by features not
implemented in the tools yet:
- validating dbus rules (currently we just store them without any parsing)
- checks for conflicting x permissions
- permissions before path ("r /foo,")
- 'safe' and 'unsafe' keywords for *x rules
- 'Pux' and 'Cux' permissions (which actually mean PUx and CUx, and get
  rejected by the tools - ideally the generator script should create
  PUx and CUx tests instead)

skip_startswith excludes several generated tests from being run. I know
that skip_startswith also excludes tests that would not fail, but the
generated filenames (especially generated_x/exact-*) don't have a
pattern that I could easily use to exclude less tests - and I'm not too
keen to add a list with 1000 single filenames ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-20 23:00:56 +02:00
Christian Boltz
7c02bef563 Get rid of global variable 'logger'
The global variable 'logger' in aa.py is only used by aa-genprof.

This patch changes aa_genprof to use the (new) logger_path() function,
and moves the code for finding the logger path to that function.

Also make the error message more helpful if logger can't be found.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-20 22:03:58 +02:00
Christian Boltz
52c0494c2f make 'ldd' variable non-global
The 'ldd' variable in aa.py is only used by get_reqs(), therefore move
setting it (based on the configfile) into the function.

get_reqs() doesn't run too often (only called by create_new_profile(),
which means aa-genprof or when adding a Px or Cx rule to a non-existing
profile). This might even lead to a minor performance win - on average,
I'd guess not every aa-logprof run will lead to a completely new profile
or child profile. And, more important, we get rid of a global variable.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-20 20:37:17 +02:00
Christian Boltz
0bc880e3fa Add tests for various rules outside of a profile
All of those tests are expected to fail.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-10-19 21:13:48 +02:00
Christian Boltz
0dc861ef6d Fix missing profile init in create_new_profile()
create_new_profile() didn't init missing required_hats as
profile_storage(), which might lead to crashes when creating a profile
for an application listed in the required_hats config option (= in very
rare cases).

This patch adds the missing profile_storage() call.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-10-18 22:24:15 +02:00
Christian Boltz
cdc6f74f7e Store filename for includes and hats
This also means the duplicate detection can use the hat's filename instead
of the (possibly wrong) main profile's filename.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-10-18 22:12:53 +02:00
Christian Boltz
2c00e6de9b dnsmasq profile update: allow /dev/tty
This patch is based on a SLE12 patch to allow executing the
--dhcp-script. We already have most parts of that patch since r2841,
except /dev/tty rw which is needed for the shell's stdout and stderr.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=940749 (non-public)


Acked by Seth Arnold on IRC (with "owner" added)
2015-10-16 21:50:21 +02:00
Steve Beattie
768f11b497 parser: revert changes from commit rev 3248
The changes to the parser made in commit rev 3248 were accidental and
not intended to be committed.
2015-10-14 13:49:26 -07:00
Christian Boltz
a1482f37d8 Add AARE tests for [chars] and [^chars] style globbing to test-aare.py.
With this addition, all globbing styles (as documented in apparmor.d(5))
are covered in the convert_regexp() tests.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-10-14 13:03:16 +02:00
John Johansen
99322d3978 Add LSS presentations about apparmor security model 2015-10-13 15:39:17 -07:00
Christian Boltz
75e3a212f1 load_include(): use include_dir_filelist()
load_include() used a custom os.listdir call instead of
include_dir_filelist() for directory includes, which means it also read
skippable files like *.rpmnew or README. (It seems nobody created a
README inside an included directory, otherwise we'd have seen a
bugreport ;-)

This patch changes load_include() to use include_dir_filelist(). This
function is used in some more places already and removes skippable files
from the file list.


Acked-by <timeout>
2015-10-11 20:34:02 +02:00
Christian Boltz
643ab7dde9 remove unused code from load_include()
load_include() has a "if not incdata:" block which would be entered if
parse_profile_data() returns None. However, parse_profile_data() always
returns a hasher with [incfile][incfile] = profile_storage(), so that
"if not incdata:" never matches.


Acked-by <timeout>
2015-10-11 20:32:22 +02:00
Christian Boltz
b6fc279676 load_include(): avoid loading directory includes multiple times
The "already loaded?" check in load_include() was done at the beginning
of the function, before entering the loop and before the individual
files of directory includes were added to the filelist. This resulted in
a (wrong) "Conflicting profiles" error for directory includes.

This patch moves the "alreay loaded?" check inside the loop, so that
it's executed for all files, including those of directory includes.


Acked-by <timeout>
2015-10-11 20:30:26 +02:00
Christian Boltz
06885e9377 Reset aa and original_aa in read_profiles()
TL;DR: aa-genprof crashes with a wrong 'Conflicting profiles' error.

aa-genprof uses autodep() to create a basic profile, which is then
stored in aa and original_aa. After that, read_profiles() is called,
which reads all profiles (including the new one) from disk, causing a
(wrong) 'Conflicting profiles' error in attach_profile_data() because
the autodep()-generated profile is already there.

Therefore this patch resets aa and original_aa in read_profiles() to
avoid that problem.


Acked-by <timeout>
2015-10-11 20:28:17 +02:00
Christian Boltz
ea9f9aeff2 move tests for convert_regexp() to (new) test-aare.py
The tests for convert_regexp() were hidden in common_test.py, where they
were never executed.

This patch moves them to the new file test-aare.py and also converts the
regex_tests.ini to a tests[] array to have the test data inside the test
file. (All tests from regex_tests.ini are in test-aare.py, and two tests
with prepended and appended path segments were added.)

Also add some tests that check the raw behaviour of convert_regexp() -
the tests "by example" are probably more useful and for sure more
readable ;-) but I want to have some examples of the converted regexes
available.


Acked-by <timeout>
2015-10-11 20:19:35 +02:00
Christian Boltz
807c2dccf0 several additions for the syslog-ng profiles
The latest syslog-ng version needs some more permissions:
- abstractions/openssl (for reading openssl.conf)
- reading /etc/syslog-ng/conf.d/
- reading the journal
- reading /etc/machine-id (it's unclear why this is needed, therefore
  I don't want abstractions/dbus-session-strict for now)
- write access to /run/syslog-ng.ctl

References: https://bugzilla.opensuse.org/show_bug.cgi?id=948584
            https://bugzilla.opensuse.org/show_bug.cgi?id=948753


Acked-By: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.9
2015-10-07 22:18:22 +02:00
Christian Boltz
9a13402170 Add a new test that was posted on IRC to the test_multi set
This should have been part of the previous commit, but I forgot to add
the files ;-)
2015-10-03 20:22:06 +02:00
Christian Boltz
ddc56bf3ac Accept more log formats in logparser.py
logparser.py does a regex check on log lines as performance improvement
so that it only hands over lines that look like AppArmor events to
LibAppArmor parsing. Those regexes were incomplete and didn't cover all
log formats LibAppArmor accepts, with the end result of "overlooking"
events.

This patch splits off common parts of the regex, adds more regexes for
several log types and finally merges everything into one regex.

test-libapparmor-test_multi.py now also checks all test_multi log lines
against the regex to ensure logparser.py doesn't silently ignore events.

test-logparser.py gets adjusted to the merged RE_LOG_ALL regex.

Finally, add a new test that was posted on IRC to the test_multi set.


As already threatened nearly a month ago,
   Acked by <timeout> for trunk and 2.9
2015-10-03 20:18:54 +02:00
Ash Wilson
1a0294129e Fix remount with bind
The parser is incorrectly screening off the bind flags on remount. The
following patch by Ash Wilson fixes this issue

BugLink: http://bugs.launchpad.net/bugs/1272028

Signed-off-by: Ash Wilson <smashwilson@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-09-21 12:20:19 -07:00
Christian Boltz
562c98d77c dnsmasq profile - also allow /bin/sh
This patch is based on a SLE12 patch to allow executing the
--dhcp-script. We already have most parts of that patch since r2841,
however the SLE bugreport indicates that /bin/sh is executed (which is
usually a symlink to /bin/bash or /bin/dash), so we should also allow
/bin/sh

References: https://bugzilla.opensuse.org/show_bug.cgi?id=940749 (non-public)


Acked-by: Seth Arnold <seth.arnold@canonicalc.com> for trunk and 2.9
2015-09-18 19:06:47 +02:00
Christian Boltz
dbcb634e2e Allow ntpd to read directory listings of $PATH
For some reasons, it needs to do that to find readable, writeable and
executable files.

See also https://bugzilla.opensuse.org/show_bug.cgi?id=945592


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-09-15 14:24:57 +02:00
Christian Boltz
9fe6f652ec Update the /sbin/dhclient profile
Add some permissions that I need on my system:
- execute nm-dhcp-helper
- read and write /var/lib/dhcp6/dhclient.leases
- read /var/lib/NetworkManager/dhclient-*.conf
- read and write /var/lib/NetworkManager/dhclient-*.conf


Looks-good-by: Steve Beattie <steve@nxnw.org>
Acked-by: <timeout> for trunk and 2.9
2015-09-09 00:00:23 +02:00
Launchpad Translations on behalf of apparmor-dev
29cd792642 Launchpad automatic translations update. 2015-09-07 05:11:42 +00:00
Launchpad Translations on behalf of apparmor-dev
c00c4c9bf3 Launchpad automatic translations update. 2015-09-06 05:10:41 +00:00
Launchpad Translations on behalf of apparmor-dev
7415d319f3 Launchpad automatic translations update. 2015-09-05 05:10:42 +00:00
Christian Boltz
4794c7c488 Test libapparmor test_multi tests against logparser.py
This testcase will parse all libraries/libapparmor/testsuite/test_multi
tests and compare the result with the *.out files.

It also include a "ToDo list" of keywords that are not yet supported in
the python code - those are typically related to rule types not
supported in the tools yet (dbus, signal etc.).

An interesting special case are exec events with network details:
    testcase01.in, testcase12.in, testcase13.in
which might be hand-made, invalid logs, but nobody remembers ;-)


Acked-by <timeout>
2015-09-05 01:23:43 +02:00
Launchpad Translations on behalf of apparmor-dev
9bf465993e Launchpad automatic translations update. 2015-09-04 05:10:54 +00:00
Christian Boltz
a0b9c4c600 Dovecot imap needs to read /run/dovecot/mounts
Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-09-03 18:27:00 +02:00
Steve Beattie
48801f3290 parser: fix uninitialized policy_cache variable
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-09-01 03:12:08 -07:00
Steve Beattie
1a06c13493 parser: fix cache reference leak
Drop the reference to the libapparmor policy_cache pseudo object when
the parser is done.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-08-31 13:26:14 -07:00
Steve Beattie
cf43130314 libapparmor: fix log parsing memory leaks
Fix memory leaks when parsing dmesg timestamps as well as when handling
message the library does not understand.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-31 13:20:22 -07:00
Steve Beattie
0ff3f14666 libapparmor: fix memory leaks in aalogmisc unit tests.
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-08-27 13:47:52 -07:00
Steve Beattie
9a315c9ef0 parser: make caching tests not fail w/python <= 3.2
In recent commits, Tyler fixed some problems with the caching behavior
of the parser, as well as adjusting and improving the caching test
script to verify these behaviors.

In doing so, the test script adjusts the mtime of various
files and ensures that the written files have the expected mtime
timestamp. Unfortunately, the os.utime() function used to adjust mtime
in python 3.2 (as included in Ubuntu 12.04 LTS) does not update with
nanosecond precision, even though the timestamps returned by os.stat()
do have precision to nanoseconds. This causes the tests to fail when
running under python 3.2 with errors like the following:

  ======================================================================
  FAIL: test_abstraction_newer_rewrites_cache (__main__.AAParserCachingTests)
  ----------------------------------------------------------------------
  Traceback (most recent call last):
    File "/��PKGBUILDDIR��/parser/tst/testlib.py", line 50, in new_unittest_func
      return unittest_func(self)
    File "./caching.py", line 424, in test_abstraction_newer_rewrites_cache
      self._set_mtime(self.abstraction, abstraction_mtime)
    File "./caching.py", line 238, in _set_mtime
      self.assertEquals(os.stat(path).st_mtime, mtime)
  AssertionError: 1440337039.40212 != 1440337039.4021206

The following patch creates a new time stamp equality assertion
function that detects if it's running on python 3.2 or earlier, and
loosens the equality bounds when comparing the passed timestamps. On
python 3.3 and newer, where writing timestamps with nanosecond precision
is supported, the strict equality assertion is used.

(Note: I did not convert all time stamp comparisons, just ones where
the timestamp written and checked could be based on a timestamp
derived from os.stat().)

Reference: https://bugs.python.org/issue12904

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-26 17:39:34 -07:00
Steve Beattie
486e42b221 utils/aa-logprof.pod: fix typo in manpage
Bug: https://bugs.launchpad.net/bugs/1485855
2015-08-25 14:53:55 -07:00
Christian Boltz
318f7d2cb2 Make.rules: sort capabilities with LC_ALL=C
This is needed to make building apparmor.vim reproducable - otherwise
the sorting depends on the locale.

Found by the Debian reproducible project,
https://reproducible.debian.net/rb-pkg/unstable/amd64/apparmor.html


Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-08-25 22:44:58 +02:00
Christian Boltz
68854c5faa Add network mpls and ib to rule/network.py and the apparmor.d manpage
Those two showed up in apparmor.vim when building on latest openSUSE
tumbleweed.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-08-25 13:27:18 +02:00
Christian Boltz
1078a9f141 add /usr/share/locale-bundle/ to abstractions/base
/usr/share/locale-bundle/ contains translations packaged in
bundle-lang-* packages in openSUSE.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-08-23 15:20:20 +02:00
Tyler Hicks
77d3dcf1cf parser: Don't skip cleanup when the test was skipped
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-18 10:59:21 -05:00
Tyler Hicks
97591bb512 parser: Run caching tests even when apparmorfs is not mounted
The contents of the policy cache files varies based on kernel feature
support found in apparmorfs but the caching tests are mostly about
whether or not a cache file was generated and with the right timestamps.

This patch makes it so that the tests are not entirely skipped when
apparmorfs is not available. Instead, a flat features file will be used
in most cases and only the specific tests that require apparmorfs will
be skipped.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-18 10:59:11 -05:00
Jamie Strandboge
586806907d parser/apparmor_parser.pod: fix typo "sinlge" should be "single"
Bug: https://launchpad.net/bugs/1485530

Signed-Off-By: Jamie Strandboge <jamie@canonical.com>
2015-08-17 09:03:05 -05:00
Tyler Hicks
7c937bb370 parser: Verify cache file mtime in caching tests
This makes several improvements to the parser caching tests to verify
that the parser is properly consuming the mtime of profiles and
abstractions when dealing with the policy cache.

It introduces a simple abstraction file and tests the mtime handling by
changing the mtime on the profile, abstraction, apparmor_parser, and
cache file in various combinations to check the parser's behavior.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-12 12:24:26 -05:00
Tyler Hicks
5c58cdd351 parser: Fix cache file mtime regression
This patch fixes a regression in setting the cache file's timestamp
handling that was introduced in r3079:

  Set cache file tstamp to the mtime of most recent policy file tstamp

The previously used utimes(2) syscall requires a two element timeval
array. The first element in the array is the atime to be used and the
second element is the mtime. The equivalent of a one element timeval
array was being passed to it, resulting in garbage being used for the
mtime value. The utimes(2) syscall either failed, due to the invalid
input, or set mtime to an unexpected value. The return code wasn't being
checked so the failure went unknown.

This patch switches to utimensat(2) for a couple reasons. The UTIME_OMIT
special value allows us to preserve the inode's atime without calling
stat(2) to fetch the atime. It also allows for nanosecond precision
which better aligns with what stat(2) returns on the input profile and
abstraction files. That means that we can have the exact same mtime on
the input profile or abstraction file and the output cache file.

https://launchpad.net/bugs/1484178

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-08-12 12:22:41 -05:00
intrigeri
036e3adfa1 dnsmasq profile: extract confinement of libvirt_leaseshelper into a dedicated sub-profile.
... and add a few mostly innocuous permissions in there, that are not
strictly needed for a seemingly functional setup, but the lack thereof
triggers denial logs, that could indicate that the software falls back
to some degraded operation mode.
2015-08-12 16:25:56 +02:00
Steve Beattie
842a592b0d regression tests: make sysctl(2) test a bit more resiliant
In testing against the 4.1 kernel, the syscall_sysctl testcase started
failing even in the unconfined case. What the test program does is
attempt to adjust the kernel.threads-max sysctl to be slightly larger
and see if the operation succeeds by reading the value back out. It
also attempts to save the original value and restore it. The test
was failing because (in VMs at least) the default value chosen by
the kernel for the kernel.threads-max setting was high enough that
attempts to increase it would be ignored (likely to prevent too much
use of kernel memory by threads), helpfully without any message being
report to dmesg. Thus, the initial read of the current value would
succeed, the write of that value + 1024 would appear to succeed,
but then reading the value back out and comparing it to the expected
value would fail, as it would still be the original value, not the
expected new value.

This patch attempts to address this by first attempting to raise
the value, and if that does not appear to work, to then attempt
to lower it.  It also refactors the code a bit by creating helper
functions to perform the actual sysctl(2) calls to make the code a
bit easier to read.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-08-10 14:06:49 -07:00
Christian Boltz
6ce88bb695 map socket_create events to 'net' events
See libapparmor test_multi testcase24.* and testcase33.* for example logs.


Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-08-10 21:30:22 +02:00
Launchpad Translations on behalf of apparmor-dev
1c63019006 Launchpad automatic translations update. 2015-08-07 05:13:48 +00:00
Launchpad Translations on behalf of apparmor-dev
76f9c72ea9 Launchpad automatic translations update. 2015-08-06 05:12:47 +00:00
Christian Boltz
c9e16d874e Check for duplicate profiles
Having two profiles for the same binary is "technically allowed", but it
leads to interesting[tm] behaviour because one of them "wins" depending
on the load order. To make things even more interesting, the kernel load
order can be different from the tools load order, leading to even more
fun.

Short version: you do _not_ want that situation ;-)

This patch adds a duplicate check to attach_profile_data() so that it
errors out if it finds duplicate profiles or hats, and lists the profile
files that contain them.



Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for both trunk and 2.9.
2015-08-03 01:17:53 +02:00
Christian Boltz
426edf3233 Fix name_to_prof_filename() error behaviour
In some cases, the return value of name_to_prof_filename() is undefined.
This happens when deleting the to-be-confined binary while running
aa-genprof and leads to a not-too-helpful
    File "/usr/lib/python3/dist-packages/apparmor/aa.py", line 265, in enforce
	      prof_filename, name = name_to_prof_filename(path)
	TypeError: 'NoneType' object is not iterable

(reported by maslen on IRC)

This patch makes sure name_to_prof_filename() always returns None, None
(instead of undefined aka just None) so that at least the caller can
successfully split it into two None values.

For the exotic aa-genprof usecase given above, this at least improves
the error message to
    Can't find $binary_name
(raised by enforce() via fatal_error())


The patch also changes fatal_error() to display the traceback first, and
the human-readable message at the end, which makes it more likely that
the user actually notices the human-readable message.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for both trunk and 2.9.
2015-08-03 01:14:38 +02:00
Christian Boltz
fd129e1802 Change RE_PROFILE_START to accept variables
Profile name and attachment can contain variables, so the
RE_PROFILE_START regex should accept it.
(Note: the variable content isn't checked.)

Also add some tests with variables.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-08-03 00:16:23 +02:00
Christian Boltz
61735c60b0 Split logparser.py add_event_to_tree() into multiple functions
add_event_to_tree() is a hard-to-test function because it hands over its
result to add_to_tree().

This patch converts add_event_to_tree() to a simple wrapper function and
moves the main code into parse_event_for_tree() and map_log_type(). These
two new functions return their results and are therefore easier to test.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-08-02 23:58:16 +02:00
Christian Boltz
d95dc87ee7 winbindd profile: allow k for /etc/samba/smbd.tmp/msg/*
References: https://bugzilla.opensuse.org/show_bug.cgi?id=921098 starting at comment 15


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-07-30 22:03:02 +02:00
Christian Boltz
8d66d8015f skype profile: allow reading @{PROC}/@{pid}/net/dev
References: https://bugzilla.opensuse.org/show_bug.cgi?id=939568


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.9
2015-07-28 01:15:31 +02:00
Jamie Strandboge
0ce3f95f8f profiles/apparmor.d/usr.sbin.avahi-daemon: allow write access to
/run/systemd/notify which is needed on systems with systemd

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-07-24 15:03:30 -05:00
Jamie Strandboge
4d4fea77de profiles/apparmor.d/abstractions/X: also allow unix connections to
@/tmp/.ICE-unix/[0-9]*, needed by (at least) firefox and thunderbird

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-07-24 15:01:46 -05:00
Jamie Strandboge
df27a58931 profiles/apparmor.d/usr.sbin.dnsmasq: allow /bin/dash in addition to /bin/bash
Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-07-24 13:56:27 -05:00
Christian Boltz
986bbf90f9 Fix aa_log_end_msg() in rc.apparmor.suse
"rcapparmor kill" results in a funny error message:
    /lib/apparmor/rc.apparmor.functions: line 441: return: -v: invalid option
    return: usage: return [n]

SLE12 includes a patch that prevents this error message, but also
prevents that $? is handed over correctly to rc_status. This means that
"rcapparmor kill" will happily display "done" even with a compiled-in
apparmor module that can't be unloaded.

This patch is the improved version - it adds a small helper function to
set $? (as handed over to aa_log_end_msg()) and then calls rc_status -v.
This means that "rcapparmor kill" now shows "failed" because it's
impossible to unload something that is compiled directly into the
kernel.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=862170 (non-public)


Acked-by: Seth Arnold <seth.arnold@canonical.com> for 2.9 and trunk
2015-07-24 00:06:57 +02:00
Jamie Strandboge
86f5725c8f [ intrigeri ]
dconf abstraction: allow reading /etc/dconf/**.
That's needed e.g. for Totem on current Debian Jessie.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2015-07-20 10:16:18 -05:00
intrigeri
bdb6855dd3 dconf abstraction: allow reading /etc/dconf/**.
That's needed e.g. for Totem on current Debian Jessie.
2015-07-19 15:42:54 +02:00
Christian Boltz
67da39ff10 drop shebang from apparmor/rule/*.py
The '#!/usr/bin/env python' line in apparmor/rule/*.py is superfluous
and causes "non-executable script" rpmlint warnings on openSUSE.


Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-07-17 21:57:26 +02:00
Steve Beattie
942aaaaa2c common/Version: prepare for 2.10 release 2015-07-14 11:35:33 -07:00
Christian Boltz
7cf219a4b3 Initialize child profile in handle_children()
TL;DR: the answer is "yes" ;-)
(see the patch for the question...)

Long version:
When creating a new child profile with aa-logprof or aa-genprof, the
child profile wasn't properly initialized in handle_children(), which
lead to a crash in delete_duplicates() later because capability etc.
was not set to a CapabilityRuleset etc. class and therefore
profile['capability'] didn't have a .delete_duplicates() method.

Funnily there was already a comment "do we need to init the profile here?"

This patch replaces the question in the comment with the answer.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-14 20:05:40 +02:00
John Johansen
2d1fc26f54 With the export of more AA_MAY_ defines from apparmor.h
The local defines in the link_subset test collide and result in build
warnings. Replace the defines with a naming that won't collide and
makes it clear a local define for the test is being used.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-14 10:35:01 -07:00
John Johansen
4ff04c991c Fix: query_label regression test failures
1. The test is using the wrong defines: It is using the defines from the
parser for the packed dfa permissions. This set of permissions is not
meant to be exposed to the outside world

2. The kernel is using the wrong mapping function for the permissions
in the file class. This results in partially exposing the packed
permissions, but even then it doesn't fully line up with the packed
permissions, and is not correct for several of the potential permissions.

Attached is a patch that fixes the test, and moves the two tests that
fail due to the kernel to xpass.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-07-14 10:35:01 -07:00
Steve Beattie
1ef4417f5d regression tests: more ptrace adjustments for arm64 upstream changes
In the commit "Rev 3169: regression tests: have
ptrace use PTRACE_GETREGSET by default", I created
some ifdef magic to use the per arch general purpose
register data structures for various architectures,
including arm64.  Unfortunately, in the upstream glibc commit
7d05a8168b
<bits/ptrace.h> is no longer included in the arm64 specific user.h,
which defined the structure as 'struct user_pt_regs'; instead user.h
was converted to define 'struct user_regs_struct'. Because of this, the
ptrace test fails to compile on arm64 when glibc is 2.20 or newer.

This patch adjusts the ptrace test to use the newer structure on arm64
if it's detected that a newer glibc is detected and reverts to using
the older one for older glibcs. It also adds an error when compiling
on architectures that haven't been incorporated yet.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-07-14 10:29:35 -07:00
Steve Beattie
e5cd1ae073 libapparmor: prepare libtool versioning for impending 2.10 release. 2015-07-14 10:19:25 -07:00
Christian Boltz
b30e85ade2 Add --no-reload option to aa-autodep
Besides adding this feature, this also fixes a crash in tools.py __init__():
    AttributeError: 'Namespace' object has no attribute 'do_reload'


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-14 01:45:42 +02:00
Christian Boltz
5d5da52a03 fix create_new_profile() to avoid aa-genprof crash
create_new_profile() created a wrong structure for local_profile, which
resulted in an aa-genprof crash directly at startup (in the autodep
phase).

This patch fixes it to use the correct structure.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-14 01:25:06 +02:00
Steve Beattie
71fb983b39 Merge additional German translations 2015-07-11 15:26:50 -07:00
Christian Boltz
4f9a896fa7 replace some spaces with newline in simple_tests
Some of the newly added simple_tests contain lines like
    profile foo@{FOO} { }
which are not supported by the tools because the '}' is in the same line,
while the tools expect \n as rule separator.

This patch changes those tests to
    profile foo@{FOO} {
    }


Acked-by: John Johansen <john.johansen@canonical.com>
2015-07-12 00:23:40 +02:00
Christian Boltz
45cb3d7ec3 Add cux and CUx to PROFILE_MODE_RE
cux and CUx are valid exec permissions, so they should be accepted
by validate_profile_mode() ;-)


Acked-by: John Johansen <john.johansen@canonical.com> for trunk and 2.9
2015-07-11 22:57:36 +02:00
Christian Boltz
b512d78635 Add DESCRIPTION and EXRESULT to new simple_tests includes
Some of the include files added to simple_tests recently don't live in
one of the main include directories (includes/, includes-preamble/ or
include_tests/) which lets test-parser-simple-tests.py fail because
those files don't contain EXRESULT.

Instead of adding more exceptions to test-parser-simple-tests.py, this
patch adds DESCRIPTION and EXRESULT to those include files.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-07-11 21:54:31 +02:00
Christian Boltz
4acfa81c17 Fix rlimit time units in apparmor.d.pod
- fix double | | between 's' and 'sec'
- remove 'm' which is not supported by the code
- add missing 'd'


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-11 16:56:07 +02:00
Christian Boltz
e59cf31a7b Update RlimitRule to match the parser changes
- allow only a specific set of time units
- optionally allow whitespace between rlimit value and unit
- move check for invalid time units to time_to_int()

Also update the tests:
- add several tests with whitespace between value and unit
- change a test that used the (now invalid) "1m" to "1min"
- change the time_to_int() tests to use 'us' as default unit, and add
  a test with 'seconds' as default unit


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-11 14:05:32 +02:00
Steve Beattie
1a9b613fd5 Add more rlimit equality tests
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-07-10 18:21:07 -07:00
John Johansen
5fd832f004 fix: rlimit unit parsing for time
currently the parser supports ambiguous units like m for time,
which could mean minutes or milliseconds. Fix this and refactor the
time parsing into a single routine.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Steve Beattie <steve@nxnw.org>
2015-07-10 18:16:09 -07:00
John Johansen
28de8fdc40 Fix: Expansion of profile name when it contains aare characters
When @{profile_name} is used within a rule matching expression any
aare expressions should be matched literally and not be interpreted as
aare.

That is
  profile /foo/** { }

needs /foo/** to expand into a regular expression for its attachment
but, /foo/** is also the profiles literal name.  And when trying to
match @{profile_name} in a rule, eg.
  ptrace @{profile_name},

the variable needs to be expaned to
  ptrace /foo/\*\*,

not
  ptrace /foo/**,

that is currently happening.

BugLink: http://bugs.launchpad.net/bugs/1317555

equality tests by
  Tyler Hicks <tyhicks@canonical.com>

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-10 18:11:38 -07:00
John Johansen
2be46bbabc Fix @{profile_name} variable to not be a fqname
The @{profile_name} is incorrectly expanded as a fully qualified path
including its namespace if one was specified in the profile declaration.

ie.
  profile :ns://a {
     ptrace @{profile_name},
     # expands to
     # ptrace :ns://a,
}

This is wrong however because within a profile if a rule refers
to a namespace it will be wrt a sub-namespace.  That is in the above
example the ptrace rule is refering to a profile in a subnamespace
"ns".

Or from the current profile declaration scope
 :ns//ns://a

Instead @{profile_name} should expand into the hname (hierarchical name),
which is the profile hierarchy specification within the namespace the
profile is part of.

In this case
    a

or for a child profile case
  profile :ns://a {
     profile b {
        ptrace @{profile_name},
  }
}

the hname expansion would be
  a//b

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-10 18:11:28 -07:00
John Johansen
835605a647 Add support for variable expansion in profile names, and attachments
allow
  @{FOO}=bar
  /foo@{FOO} { }

to be expanded into
  /foobar { }

and
  @{FOO}=bar baz
  /foo@{FOO} { }

to be expanded into
  /foo{bar,baz} { }
which is used as a regular expression for attachment purposes

Further allow variable expansion in attachment specifications
  profile foo /foo@{FOO} { }

profile name (if begun with profile keyword) and attachments to begin
with a variable
  profile @{FOO} { }
  profile /foo @{FOO} { }
  profile @{FOO} @{BAR} {}

hats
  ^@{FOO}
  hat @{FOO}

and for subprofiles as well

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-10 18:11:17 -07:00
Launchpad Translations on behalf of apparmor-dev
fd474bb5e1 Launchpad automatic translations update. 2015-07-10 05:19:04 +00:00
Christian Boltz
0792e73ee9 Avoid raising an exception for hats in includes in aa-logprof
aa-logprof raises an exception if
- an include file contains a hat
- that file is included in a profile and
- aa-logprof hits an audit log entry for this profile

Reproducer ("works" on 2.9 and trunk):
python3 aa-logprof -f <(echo 'Jun 19 11:50:36 piorun kernel: [4474496.458789] audit: type=1400 audit(1434707436.696:153): apparmor="DENIED" operation="open" profile="/usr/sbin/apache2" name="/etc/gai.conf" pid=2910 comm="apache2" requested_mask="r" denied_mask="r" fsuid=0 ouid=0') -d ../profiles/apparmor.d/

This happens because profiles/apparmor.d/apache2.d/phpsysinfo was
already read when pre-loading the include files.

This patch changes aa.py parse_profile_data() to only raise the
exception if it is not handling includes currently.


Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-07-09 15:12:43 +02:00
John Johansen
50805d80e3 Fix bare include keyword
Fix the regression that caused using 'include' instead of '#include' for
includes to stop working.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-08 17:19:57 -07:00
Christian Boltz
877fd99c7d Add tests for RE_PROFILE_START and parse_profile_start_line() with unusual whitespace around flags
Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-08 22:50:01 +02:00
Christian Boltz
cc4d04a7cc Allow variables in change_profile rules
Now that the parser allows variables in change_profile rules,
the tools should also do that ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-08 22:49:10 +02:00
Christian Boltz
0d842eae34 Handle #include <directory> in is_known_rule()
is_known_rule() ignored directory includes, which resulted in asking for
and adding superfluous rules that are already covered by a file in the
included directory.

This patch looks bigger than it is because it moves quite some lines
into the "else:" branch. Everything inside the "else:" just got an
additional whitespace level.

References: https://bugs.launchpad.net/apparmor/+bug/1471425
(however, trunk didn't crash, it "just" ignored directory includes)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-08 22:46:01 +02:00
Christian Boltz
16de4ee43d is_known_rule(): check includes recursively
is_known_rule() in aa.py checked only direct includes, but not includes
in the included files. As a result, aa-logprof asked about things that
are already covered by an indirect include.

For example, the dovecot/auth profile includes abstractions/nameservice,
and abstractions/nameservice includes abstractions/nis, which contains
"capability net_bind_service,".
Nevertheless, aa-logprof asked to add capability net_bind_service.

Reproducer: (asks for net_bind_service without this patch, should not
ask for anything after applying the patch):
python3 aa-logprof -d ../profiles/apparmor.d/ -f <(echo 'type=AVC msg=audit(1415403814.628:662): apparmor="ALLOWED" operation="capable" profile="/usr/lib/dovecot/auth" pid=15454 comm="auth" capability=13  capname="net_bind_service"')

The patch adds code to check include files included by other include
files. Note that python doesn't allow to change a list while looping
over it, therefore we have to use "while includelist" as workaround.

This fixes a regression for network rules (this patch is based on the
old match_net_include() code). Funnily it "only" fixes capability rule
handling (without the "regression" part) because the old
match_cap_include() didn't do the recursive include handling.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-08 22:43:48 +02:00
Christian Boltz
9e601cb3ac Ignore file_perm events without request_mask
For some (not yet known) reason, we get file_perm events without
request_mask set, which causes an aa-logprof crash.

Reproducer log entry:
Jun 19 12:00:55 piorun kernel: [4475115.459952] audit: type=1400 audit(1434708055.676:19629): apparmor="ALLOWED" operation="file_perm" profile="/usr/sbin/apache2" pid=3512 comm="apache2" laddr=::ffff:193.0.236.159 lport=80 faddr=::ffff:192.168.103.80 fport=61985 family="inet6" sock_type="stream" protocol=6

This patch changes logparser.py to ignore those events.

References: https://bugs.launchpad.net/apparmor/+bug/1466812/


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-07-08 22:32:55 +02:00
Steve Beattie
0e3b8d8fd5 periodic merge from apparmor trunk 2015-07-08 06:44:56 -07:00
Steve Beattie
7307f777c4 AppArmor launchpad translations merge: updates to de.po. 2015-07-08 06:43:20 -07:00
Christian Boltz
ac9f8e2f31 Allow boolean definitions outside profiles, not inside
According to the parser test profiles (which are the only
"documentation" I found about this), definition of boolean variables
is only allowed outside profiles, not inside them.

parse_profile_data() got it the wrong way round, therefore this patch
fixes the condition and updates the error message.


Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-07-08 13:15:54 +02:00
Christian Boltz
8c0fe46718 Split off include_dir_filelist() from parse_profile_data() include handling
We need directory listings for #include <directory> in more than one
place, therefore split it off to its own function.

This is a preparation to fix https://bugs.launchpad.net/apparmor/+bug/1471425


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-07 14:11:11 +02:00
Christian Boltz
9d5c0e1b1f NetworkRule: allow TYPE without DOMAIN
Thanks to a bug in the apparmor.d manpage, NetworkRule rejected rules
that contained only TYPE (for example "network stream,"). A bugreport on
IRC and some testing with the parser showed that this is actually
allowed, so NetworkRule should of course allow it.

Note: not strip()ing rule_details is the easiest way to ensure we have
whitespace in front of the TYPE in TYPE-only rules, which is needed by
the RE_NETWORK_DETAILS regex.

Also adjust the tests to the correct behaviour.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-07-07 14:10:17 +02:00
Christian Boltz
4918107a6f Improve exception handling
Instead of always showing a backtrace,
- for AppArmorException (used for profile syntax errors etc.), print only
  the exceptions value because a backtrace is superfluous and would
  confuse users.
- for other (unexpected) exceptions, print backtrace and save detailed
  information in a file in /tmp/ (including variable content etc.) to
  make debugging easier.

This is done by adding the apparmor.fail module which contains a custom
exception handler (using cgitb, except for AppArmorException).

Also change all python aa-* tools to use the new exception handler.

Note: aa-audit did show backtraces only if the --trace option was given.
This is superfluous with the improved exception handling, therefore this
patch removes the --trace option. (The other aa-* tools never had this
option.)


If you want to test the behaviour of the new exception handler, you can
use this script:

#!/usr/bin/python

from apparmor.common import AppArmorException, AppArmorBug
from apparmor.fail import enable_aa_exception_handler

enable_aa_exception_handler()

# choose one ;-)
raise AppArmorException('Harmless example failure')
#raise AppArmorBug('b\xe4d bug!')
#raise Exception('something is broken!')


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-07-06 22:02:34 +02:00
Christian Boltz
714e75299c Make profile flags more whitespace tolerant
As shown in parser/tst/simple_tests/profile/flags/flags_ok_whitespace.sd,
the parser is quite tolerant to additional or missing whitespace around
flags=, while the tools are more strict.

This patch updates the RE_PROFILE_START regex to follow this tolerance.


Acked-by: Steve Beattie <steve@nxnw.org>.
2015-07-06 14:47:05 +02:00
Christian Boltz
f9cae8b1b7 Improve validate_profile_mode() and drop PROFILE_MODE_NT_RE
The only difference between PROFILE_MODE_RE and PROFILE_MODE_NT_RE
was that the latter one additionally allowed 'x', which looks wrong.
(Standalone 'x' is ok for deny rules, but those are handled by
PROFILE_MODE_DENY_RE.)

This patch completely drops PROFILE_MODE_NT_RE and the related code in
validate_profile_mode().

Also wrap the two remaining regexes in '^(...)+$' instead of doing it
inside validate_profile_mode(). This makes the code more readable and
also results in a 2% performance improvement when parsing profiles.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-07-06 14:45:59 +02:00
Christian Boltz
ece49eefc8 Move file mode regexes and add "pux"
Add the missing "pux" to PROFILE_MODE_RE and PROFILE_MODE_NT_RE.

Also move those regexes and PROFILE_MODE_DENY_RE directly above
validate_profile_mode() which is the only user.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-07-06 14:44:34 +02:00
Christian Boltz
93941ff7af Fix parsing of boolean assignments
Parsing of boolean assignments failed with
    TypeError: '_sre.SRE_Match' object is not subscriptable
because of a missing ".groups()"


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-07-06 14:42:57 +02:00
Christian Boltz
0373df1745 Fix some parser test syntax errors
Errors include typos ("DESCRIPT__ON"), missing value after #=EXRESULT
and #=EXRESULT=PASS (= instead of space).


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-07-06 13:25:38 +02:00
Steve Beattie
5a93959068 regression tests: have ptrace use PTRACE_GETREGSET by default
Bug: https://bugs.launchpad.net/apparmor/+bug/1470985

The ptrace regression test fails to compile on the arm64 platform,
because it uses PTRACE_GETREGS and not the newer PTRACE_GETREGSET
interface for getting access to arch-specific register information[0].
However, fixing it is complicated by the fact that the struct name
for for the general purpose registers is not named consistently
across architectures. This patch attempts to address those issues,
and compiles at least on i386, amd64, arm64, arm (armhf), ppc64,
and ppc64el. The test is verified to continue to function correctly
on i386 and amd64.

[0] https://sourceware.org/ml/archer/2010-q3/msg00193.html

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-07-02 23:24:54 -07:00
Christian Boltz
418241473b Fix rttime default unit in RlimitRule
RlimitRule accidently used 'ms' (milliseconds) as default unit for
rttime rules, but rttime without unit means 'us' (microseconds). This
patch fixes this.

Also add some tests with 'us' as unit, and two more to cover terribly
invalid corner cases (and to improve test coverage by 2 lines ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-27 21:52:09 +02:00
Christian Boltz
5ec6eabcdf Use AATest and tmpdir for minitools test
Change minitools tests to use AATest and work inside a tmpdir.

This results in lots of changes ('./profiles' -> self.profile_dir,
local_profilename -> self.local_profilename etc.) and also moves some
code from the global area to AASetup().

Also drop the no longer needed clean_profile_dir() and add linebreaks
in assert* calls with a long error message specified.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-27 01:29:46 +02:00
Christian Boltz
ada85bf219 Add more set_profile_flags() tests
The existing tests didn't test removing all flags.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-26 23:21:29 +02:00
Christian Boltz
1b670fef6c Fix NETWORK RULE in apparmor.d manpage
It's allowed to only specify a TYPE without specifying a DOMAIN.

Also add a missing "]" for QUALIFIERS.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-26 12:46:46 +02:00
John Johansen
8efb5850f2 Move rule simplification into the tree construction phase
The current rule simplification algorithm has issues that need to be
addressed in a rewrite, but it is still often a win, especially for
larger profiles.

However doing rule simplification as a single pass limits what it can
do. We default to right simplification first because this has historically
shown the most benefits. For two reasons
  1. It allowed better grouping of the split out accept nodes that we
     used to do (changed in previous patches)
  2. because trailing regexes like
       /foo/**,
       /foo/**.txt,
     can be combined and they are the largest source of node set
     explosion.

However the move to unique node sets, eliminates 1, and forces 2 to
work within only the single unique permission set on the right side
factoring pass, but it still incures the penalty of walking the whole
tree looking for potential nodes to factor.

Moving tree simplification into the construction phases gets rid of
the need for the right side factoring pass to walk other node sets
that will never combine, and since we are doing simplification we can
do it before the cat and permission nodes are added reducing the
set of nodes to look at by another two.

We do loose the ability to combine nodes from different sets during
the left factoring pass, but experimentation shows that doing
simplification only within the unique permission sets achieve most of
the factoring that a single global pass would achieve.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-25 16:38:04 -06:00
John Johansen
832455de2c Change expr tree construction so that rules are grouped by perms
Currently rules are added to the expression tree in order, and then
tree simplification and factoring is done. This forces simplification
to "search" through the tree to find rules with the same permissions
during right factoring, which dependent on ordering of factoring may
not be able to group all rules of the same permissions.

Instead of having tree factoring do the work to regroup rules with the
same permissions, pregroup them as part of the expr tree construction.
And only build the full tree when the dfa is constructed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-25 16:38:02 -06:00
John Johansen
5a9300c91c Move the permission map into the rule set
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-25 15:54:15 -06:00
John Johansen
292f3be438 switch away from doing an individual accept node for each perm bit
accept nodes per perm bit where done from the very begining in a
false belief that they would help produce minimized dfas because
a nfa states could share partial overlapping permissions.

In reality they make tree factoring harder, reduce in longer nfa
state sets during dfa construction and do not result in a minimized
dfa.

Moving to unique permission sets, allows us to minimize the number
of nodes sets, and helps reduce recreating each set type multiple
times during the dfa construction.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-25 14:08:55 -06:00
Christian Boltz
f202cc1fd2 profiles: postfix/master also needs lock permissions for master.pid
reported by darix some weeks ago, and also confirmed on my own servers.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.9
2015-06-25 13:16:49 +02:00
Steve Beattie
2cbd6c9880 parser: fix make parser_regex missing dependency
parser_regex.c includes libapparmor_re/aare_rules.h and thus it should
depend on it in the Makefile.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-24 16:18:04 -07:00
Tyler Hicks
b786c64b17 utils: Don't use access() to determine readability of profiles file
LSMs, such as AppArmor, aren't consulted when a program calls access(2).
This can result in access(2) returning 0 but a subsequent open(2)
failing.

The aa-status utility was doing the access() -> open() sequence and we
became aware of a large number of tracebacks due to open() failing for
lack of permissions. This patch catches any IOError exceptions thrown by
open(). It continues to print the same error message as before when
access() failed but also prints that error message when AppArmor blocks
the open of the apparmorfs profiles file.

https://launchpad.net/bugs/1466768

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-22 10:14:14 -05:00
Christian Boltz
140b88b818 Change aa.py delete_duplicates() to loop over rule classes
That's better than doing copy&paste for each added rule class ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 23:27:06 +02:00
Christian Boltz
f9c60c06d7 severity.py: use re_match_include()
load_variables() used a nearly-correct regex. Drop it and use
re_match_include() instead.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:43:19 +02:00
Christian Boltz
2754e2964b Move re_match_include() to regex.py and improve it
The function is basically a wrapper around a regex, so regex.py is a
much better home.

While on it, rename the regex to RE_INCLUDE, change it to named matches,
use RE_EOL to handle comments and compile it outside the function, which
should result in a (small) performance improvement.

Also rewrite re_match_include(), let it check for empty include
filenames ("#include <>") and let it raise AppArmorException in that
case.

Finally, adjust code calling it to the new location, and add some tests
for re_match_include()


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:41:41 +02:00
Christian Boltz
5e5f8f0001 Add profile_storage()
profile_storage() returns an empty, properly initialized profile.
It doesn't explicitly init all keys (yet) and will be extended over
time, with the final goal to get rid of hasher().

Also change various places in aa.py to use it (instead of an empty
hasher or sub-hasher), and remove various "init rule class (if not done
yet)" cases.

This also avoids a crash in aa-cleanprof remove_duplicate_rules().
Hats weren't properly initialized in aa.py parse_profile_data()
(especially rule classes were missing), which caused a crash because
hasher doesn't support the delete_duplicates() method.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:39:56 +02:00
Christian Boltz
94a2db187a Remove support for writing change hat declarations ("^hat,")
Change hat declarations ("^hat,") are no longer supported (see previous
patch for details). Therefore remove support for writing them.

This also means to completely remove the 'declared' flag, which was only
needed for hat declarations, and was (after the previous patch) always
set to False.

Also add a hat to the cleanprof_test.{in,out} test profile to make sure
aa-cleanprof doesn't break hats, and a hat declaration with the same
name to make sure it gets removed and doesn't break the "real" hat.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:25:39 +02:00
Christian Boltz
d37f777858 Ignore change hat declarations when parsing a profile
Hat declarations ("^hat,") were added in 2.3 for declaring external
hats, but in the meantime aren't supported by the parser anymore (tested
with 2.9.2 parser).

Additionally, if a profile contains both a hat declaration and the hat
("^hat { ...}"), the hat declaration can overwrite the content of the
hat on a "last one wins" base.

This is caused by setting 'declared' to True, which means write_piece()
will only write the "^hat," line, but not the "^hat { ... }" block.

Therefore no longer set 'declared' to True, print a warning that hat
declarations are no longer supported, and ignore the rule. This also
means that running aa-cleanprof can make the profile valid again :-)

Also no longer change 'hat' when hitting a profile declaration, which
also looks wrong.


Note: This change removes the only usage of 'declared'. A follow-up
patch (trunk only) will completely remove the 'declared' handling.


Reproducer profile (run aa-cleanprof on it):
(will crash in remove_duplicate_rules() 80% of the time - if so, try
multiple times. One of the next patches will fix that. Or just try 2.9,
which doesn't have the crash in remove_duplicate_rules().)

/usr/bin/true {

  ^FOO {
    capability setgid,
  }

  # deletes the content of ^FOO when saving the profile! (last one wins)
  # additionally, the parser says this is invalid syntax
  ^FOO,

}


See also the "Hat declarations" thread on the ML,
https://lists.ubuntu.com/archives/apparmor/2015-June/008107.html



Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for both 2.9 and trunk.
2015-06-19 21:17:02 +02:00
Christian Boltz
cdb12a9694 Change aa.py to use RlimitRule and RlimitRuleset
Change aa.py to use RlimitRule and RlimitRuleset instead of a sub-hasher
to store and write rlimit rules. In detail:
- drop all rlimit rule parsing from parse_profile_data() and
  serialize_profile_from_old_profile() - instead, just call
  RlimitRule.parse()
- change write_rlimits() to use RlimitRuleset
- add removal of superfluous/duplicate change_profile rules (the old
  code didn't do this)
- update the comment about aa[profile][hat] usage - rlimit and
  change_profile are no longer dicts.

Also cleanup RE_PROFILE_RLIMIT in regex.py - the parenthesis around
'<=' are no longer needed.


Note: This patch is quite small because aa-logprof doesn't ask for
rlimit rules.

I tested all changes manually with aa-cleanprof and aa-logprof (adding
some file rules, rlimit rules kept unchanged)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:12:29 +02:00
Christian Boltz
73dfc75ff4 profiles/Makefile check-parser depends on local/* files
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-19 21:05:49 +02:00
Christian Boltz
7d625e384e check-logprof needs local/* files
check-logprof in profiles/Makefile needs the local/* files.
Add a dependency to make sure they are generated.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-18 22:58:59 +02:00
Tyler Hicks
fa05c2e2e4 libapparmor: Don't apply special SWIG %exception to some functions
Only use the special %exception directive for functions that return a
negative int and set errno upon error.

This prevents, for example, _aa_is_blacklisted() from raising an
exception when it returns -1. This is important because it doesn't set
errno so an exception based on the value of errno would be
unpredictable.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-16 15:51:19 -05:00
Tyler Hicks
d428ef45ea libapparmor: Remove unused path param from _aa_is_blacklisted()
When is_blacklisted() was internal to the parser, it would print an
error message when encountering some file names. If the path parameter
was non-null, the error message would include the file path instead of
the file name.

Now that the function has been moved to libapparmor, callers are
expected to print the appropriate error message if _aa_is_blacklisted()
returns -1. Since the error message printing no longer occurs inside of
_aa_is_blacklisted(), the path parameter can be removed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-16 15:49:51 -05:00
Tyler Hicks
da52144601 libapparmor: Provide privately exported aa_is_blacklisted() through swig
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-16 15:49:24 -05:00
Tyler Hicks
4d60e07a25 libapparmor: Add README files to the file blacklist
Ignore README files when performing an operation on a list of files.

This matches the behavior of the is_skipped_file() function in aa.py.
The hope is that is_skippable_file() can reuse _aa_is_blacklisted().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 23:58:45 -05:00
Tyler Hicks
42a66e64ee libapparmor: Store the string len instead of calling strlen() twice
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 23:58:40 -05:00
Tyler Hicks
3e80c75f57 libapparmor: Perform strlen() test before indexing into the string
It looks odd to access the first character of a string before checking
to see if the string's length is zero. This is actually fine, in
practice, since strlen() looks at the first character of the string for
the presence of '\0' which means this is entirely a cosmetic change.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 23:58:29 -05:00
Tyler Hicks
994eb7e3b9 libapparmor: Make swig aware of aa_splitcon(3)
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 18:16:42 -05:00
Tyler Hicks
cb6b450dbf libapparmor: Use extern specifier for new API functions in apparmor.h
Prepend the function prototypes with extern to match the style of the
existing prototypes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 18:16:42 -05:00
Tyler Hicks
233d553c89 libapparmor: Set errno to EEXIST when only invalid caches are available
The errno values libapparmor's aa_policy_cache_new() uses to indicate
when the cache directory does not exist and when an existing, invalid
cache already exists needed to be separated out. They were both ENOENT
but now the latter situation uses EEXIST.

libapparmor also needed to be updated to not print an error message to
the syslog from aa_policy_cache_new() when the max_caches parameter is
0, indicating that a new cache should not be created, and the cache
directory does not exist. This is an error situation but a debug message
is more appropriate.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 18:16:42 -05:00
Tyler Hicks
2da4200cc0 libapparmor: Create a man page for aa_policy_cache
Create a section 3 man page for the aa_policy_cache family of functions.
Additionally, update the in-code descriptions to match the descriptions
in the man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
b7538a6dda libapparmor: Create a man page for aa_kernel_interface
Create a section 3 man page for the aa_kernel_interface family of
functions. Additionally, update the in-code descriptions to match the
descriptions in the man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
155a1b0d4a libapparmor: Create a man page for aa_features
Create a section 3 man page for the aa_features family of functions.
Additionally, update the in-code descriptions to match the descriptions
in the man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johanse@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
9231d76c35 libapparmor: Migrate aa_policy_cache API to openat() style
The aa_policy_cache_new() and aa_policy_cache_remove() functions are
changed to accept a dirfd parameter.

The cache dirfd (by default, /etc/apparmor.d/cache) is opened earlier in
aa_policy_cache_new(). Previously, the directory wasn't accessed until
later in the following call chain:

  aa_policy_cache_new() -> init_cache_features() -> create_cache()

Because of this change, the logic to create the cache dir must be moved
from create_cache() to aa_policy_cache_new().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
3d18857dae libapparmor: Migrate aa_kernel_interface API to openat() style
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
350e964e30 libapparmor: Migrate aa_features API to openat() style
Instead of only accepting a path in the aa_features API, accept a
directory file descriptor and a path like then openat() family of
syscalls. This type of interface is better since it can operate exactly
like a path-only interface, by passing AT_FDCWD or -1 as the dirfd.
However, using the dirfd/path combination, it can eliminate string
allocations needed to open files in subdirectories along with the
even more important benefits mentioned in the open(2) man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
35f7ab4cdb libapparmor: Clean up function that wraps features dir reading
Make the function prototype for reading a features directory the same
as the function prototype for reading a features file.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
c9c3c09106 libapparmor: Introduce a single function for reading features files
Two different implementations were in use for reading features files.
One for reading a single file and another for reading a single file
after walking a directory. This patch creates a single function that is
used in both cases.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
86de47d08a libapparmor: Use directory file descriptor in _aa_dirat_for_each()
The _aa_dirat_for_each() function used the DIR * type for its first
parameter. It then switched back and forth between the directory file
descriptors, retrieved with dirfd(), and directory streams, retrieved
with fdopendir(), when making syscalls and calling the call back
function.

This patch greatly simplifies the function by simply using directory
file descriptors. No functionality is lost since callers can still
easily use the function after calling dirfd() to retrieve the underlying
file descriptor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-15 15:11:51 -05:00
Tyler Hicks
014e079261 libapparmor: Allow creating a kernel_interface with a NULL kernel_features
The most common case when creating an aa_kernel_interface object will be
to do so while using the current kernel's feature set for the
kernel_features parameter. Rather than have callers instantiate their
own aa_features object in this situation, aa_kernel_interface_new()
should do it for them if they specify NULL for the kernel_features
parameter.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-15 15:11:51 -05:00
Tyler Hicks
611e891631 libapparmor: Allow creating a policy_cache with a NULL kernel_features
The most common case when creating an aa_policy_cache object will be to
do so while using the current kernel's feature set for the
kernel_features parameter. Rather than have callers instantiate their
own aa_features object in this situation, aa_policy_cache_new() should
do it for them if they specify NULL for the kernel_features parameter.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-15 15:11:51 -05:00
Tyler Hicks
0c19c8d596 libapparmor: Improve documentation of aa_policy_cache_replace_all()
Document that the kernel_interface parameter is optional.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-15 15:11:51 -05:00
Tyler Hicks
3c972e27e5 libapparmor: Adjust some aa_policy_cache function comments
The aa_features object that is passed to aa_policy_cache_new() does not
have to represent the currently running kernel. It may represent a
different kernel, such as a kernel that was just installed, that is not
currently running.

This patch adjusts the function comments to remove mentions of
"... the currently running kernel".

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-15 15:11:51 -05:00
Tyler Hicks
5d6eb1a40f libapparmor: Simplify aa_policy_cache API
This patch changes the aa_policy_cache_new() prototype and gets rid of
aa_policy_cache_is_valid() and aa_policy_cache_create().

The create bool of aa_policy_cache_new() is replaced with a 16 bit
unsigned int used to specify the maximum number of caches that should be
present in the specified cache directory. If the number is exceeded, the
old cache directories are reaped. The definition of "old" is private to
libapparmor and only 1 cache directory is currently supported. However,
that will change in the near future and multiple cache directories will
be supported.

If 0 is specified for the max_caches parameter, no new caches can be
created and only an existing, valid cache can be used. An error is
returned if no valid caches exist in that case.

If UINT16_MAX is specified, an unlimited amount of caches can be created
and reaping is disabled.

This means that 0 to (2^16)-2, or infinite, caches will be supported in
the future.

This change allows for the parser to continue to support the
--skip-bad-cache (by passing 0 for max_caches) and the --write-cache
option (by passing 1 or more for max_caches) without confusing
libapparmor users with the aa_policy_cache_{is_valid,create}()
functions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-06-15 15:11:50 -05:00
Christian Boltz
5e0d6456e2 Add quotes around '->' at various places in apparmor.d.pod.
Also fix a Cux that should be CUx.


Acked-By: Seth Arnold <seth.arnold@canonical.com> for 2.9 and trunk
2015-06-13 01:01:55 +02:00
John Johansen
7aae13f3df Fix: the default pattern for missing change_onexec id
The default change_onexec id is slightly wrong, it allows matching
'/' as an executable but it really should be anything under /

This results in the equality tests for change_profile failing as it
is different than what specifying /** in a rule does.

We could define rules need to be {/,}** to be equivalent but since
/ can not be an executable change the default value to match what
/** is converted in to.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
3fab352dc4 Extend change_profile tests
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
f364cd7f6f Refactor change_profile to bring ns and none ns target into one rule
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
731718971f Refactor to use a common ns_id for namespace identifiers
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
d5c815783b Fix: refactor change_profile to deal with unexpected TOK_ID error
bison isn't properly handling the 3 options of

TOK_CHANGE_PROFILE opt_id TOK_END_OF_RULE
TOK_CHANGE_PROFILE opt_id TOK_ARROW TOK_ID TOK_END_OF_RULE
TOK_CHANGE_PROFILE opt_id TOK_ARROW TOK_COLON TOK_ID TOK_COLON TOK_END_OF_RULE

specifying
  change_profile /exec,

results in an unexpected TOK_ID error

refactor so that they share the 3 options share a common head which fixes
the problem.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
899cea3396 Fix screening of change_profile permission from file rule entries
While change_profile rules are always created separately from file
rules. The merge phase can result in change_profile rules merging
with file rules, resulting in the change_profile permission being
set when a file rule is created.

Make sure to screen off the change_profile permission, when creating
a file rule.

Note: the proper long term fix is to split file, link and change_profile
rules into their own classes.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
John Johansen
6707489cdc Update change_profile rules to allow specifying the onexec condition
Note: this patch currently overlays onexec with link_name to take
advantage of code already being used on link_name. Ideally what needs
to happen is entry needs to be split into file, link and change_profile
entry classes.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-12 15:25:10 -07:00
Felix Geyer
95cbbe32e0 Respect $CPPFLAGS
Some parts of the AppArmor build system don't respect $CPPFLAGS.
The attached patch fixes this.

Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-10 12:36:15 -07:00
Christian Boltz
5a0d64a70e Get variable names in aa-mergeprof ask_the_questions() in sync with aa.py
Add two variable references (aa and changed) in aa-mergeprof
ask_the_questions() so that the code can use the short name and be more
in sync with aa.py ask_the_questions().

With this patch applied, the "for ruletype in ['capability', 'network']:"
block is in sync, with the exception of the sections that intentionally
differ:
- the check for the profile mode
- the default button selection based on profile mode
- the seen_events counter

The patch also includes some minor whitespace fixes.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-08 22:25:44 +02:00
Christian Boltz
e68d2c70df Add *.orig to .bzrignore
Applying patches often creates *.orig files, and those files are quite
annoying in the "bzr status" output and also in the "unknown" file list
when commiting.

Note: I intentionally don't want to add *.rej files - while those files
should never end up in bzr, they are important enough to be listed in
bzr status output.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-08 22:23:51 +02:00
Christian Boltz
033a35b7d7 split flags_bad.sd
flags_bad.sd contains multiple failures. Split the file into multiple
files with one failure in each and, while on it, using more helpful
filenames.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-08 22:22:07 +02:00
Kshitij Gupta
27b0a571fc Remove re import from cleanprofile.py
The following patch:
- removes re import
- uses apparmor.re_match_include instead of the regex

which also means to use the correct regex instead of
the slightly wrong one cleanprofile.py had

Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-08 01:18:43 +05:30
Kshitij Gupta
255ee31dd4 cleanup import in cleanprofile.py
The cleanprofile.py has an apparmor import, this patch modifies the import to make it consistent with the rest of modules.

Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-07 23:28:53 +05:30
Kshitij Gupta
39b0ac9ba3 Fix indentation for return command in cleanprofile.py
The following patch:
- Brings the return to the correct indentation
- Adds a sorted call over the set keys of hat in the profile

Acked-by: Christian Boltz <apparmor@cboltz.de> for trunk and 2.9.
2015-06-07 23:05:08 +05:30
Christian Boltz
cc4d4715f1 Update comments in minitools_test.py
After switching to winbindd as test profile, comments about the ntpd
profile don't make sense anymore ;-)

The patch also includes some whitespace fixes.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:40:42 +02:00
Christian Boltz
ee10eacff8 Add tests for RlimitRule and RlimitRuleset
This time we only have 98% coverage (some missing and partial) because
I didn't find corner cases that raise some exceptions ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:39:33 +02:00
Christian Boltz
781133c493 Add RlimitRule and RlimitRuleset classes
The class comes with the usual set of features, so I'll only mention a
special feature: the is_covered() and is_equal() functions can even
compare limits with different units (for example they recognize that
2minutes == 120seconds).

Also change RE_PROFILE_RLIMIT:
- make it a bit more strict (the old one accepted any chars, including
  spaces, for rlimit and value)
- convert it to named matches
- '<=' isn't optional - remove the '?' (but keep the parenthesis to
  avoid breaking parsing in aa.py)
- allow rules with no spaces around '<='


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:38:02 +02:00
Christian Boltz
35c7df4194 split off parse_comment() from parse_modifiers()
This is needed for rule types that don't have modifiers in their regex, for
example rlimit rules.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:32:41 +02:00
Christian Boltz
b28c01c2c3 change aa-cleanprof to use reload_profile()
aa-cleanprof (actually clean_profile() in tools.py) used reload_base()
from aa.py which sends the parser output to /dev/null. This had two
effects:
- aa-cleanprof ignored the --no-reload parameter
- there was no error message because reload_base() /dev/null's the
  parser output

This patch changes clean_profile() to use reload_profile() from tools.py
(which honors the --no-reload option).

Also add a TODO note to aa.py reload_base(), the (AFAIK only) winner of
the 'useless use of cat' award in the AppArmor code.
We should really change it to use reload_profile(), even if that means
moving the function from tools.py to aa.py or common.py. And it should
not /dev/null the apparmor_parser output. ;-)


References: https://bugs.launchpad.net/apparmor/+bug/1443637


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:31:03 +02:00
Christian Boltz
9877075a4b Let aa-complain delete the disable symlink
aa-complain is part of the enforce/complain/disable triple. Therefore
I expect it to actually load a profile in complain mode.

To do this, it has to delete the 'disable' symlink, but set_complain()
in aa.py didn't do this (and therefore kept the profile disabled).


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-06 14:29:44 +02:00
Christian Boltz
76c30b12de Let aa-audit print a warning if a profile is disabled
Users might expect that setting a profile into audit mode also activates
it (which shouldn't happen IMHO because the audit flag is not part of
the enforce/complain/disable triple), so we should at least tell them.

References: https://bugs.launchpad.net/apparmor/+bug/1429448


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-06 14:28:55 +02:00
Christian Boltz
3ccbc2e65d Allow aa-complain etc. to change profiles for non-existing binaries
aa-complain, aa-enforce, aa-disable and aa-audit refused to change
profiles for non-existing binaries. This patch also allows paths
starting with /. This also makes it possible to use
    aa-complain '/{usr/,}bin/ping'
and
    aa-complain /etc/apparmor.d/bin.ping


This patch fixes https://bugs.launchpad.net/apparmor/+bug/1416346

Well, mostly - we still need to decide how we handle wildcards in
profile names:
    aa-complain ping
    aa-complain /usr/bin/ping
will still error out with "Profile not found" because it isn't an exact
match (and matching the wildcard would change more than the user wants).


Oh, and this patch also fixes the last failure in minitools_test.py.



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-06-06 14:25:41 +02:00
Christian Boltz
ac665528ea Fix all tests in minitools_test.py
Change minitools_test.py to use the winbind instead of the ntpd profile
for testing. The tests broke because the ntpd profile has the
attach_disconnected flag set now, and therefore didn't match the
expected flags anymore.

Also replace the usage of filecmp.cmp() in the cleanprof test with
reading the file and using assertEqual - this has the advantage that we
get a full diff instead of just "files differ".

Note: The aa-cleanprof test is still failing because of a bug in
tools.py, but will be fixed by the next patch.
See https://bugs.launchpad.net/apparmor/+bug/1416346 for details.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-06 14:24:12 +02:00
Christian Boltz
2421ded8fe Change minitools_test.py to use aa-* --no-reload
This allows to run minitools_test.py as non-root user.

Also add a check that only creates the force-complain directory if it
doesn't exist yet.


Note: With this patch applied, there are still 4 failing tests, probably
caused by changes in the profiles that are used in the tests.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-06-06 14:23:02 +02:00
Christian Boltz
e88148d0c8 Add --no-reload parameter to minitools
Add a --no-reload parameter to aa-audit, aa-cleanprof, aa-complain,
aa-disable and aa-enforce. This makes it possible to change the
profile flags without reloading the profile.

Also change tools.py to honor the --no-reload parameter.

References: https://bugs.launchpad.net/apparmor/+bug/1458480


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.


--fixes lp:1458480
2015-06-06 14:21:21 +02:00
Christian Boltz
59c5683526 Add support for change_profile rules to aa-mergeprof
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:19:59 +02:00
Christian Boltz
48159853b5 Add logprof_header_localvars() to change_profileRule
The function will return the 'Exec Condition' and the 'Target Profile'
as nice list to use in aa-logprof (once we have support for
change_profile in logparser.py) and aa-mergeprof.

Also add some tests to ensure the correct result.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:19:09 +02:00
Christian Boltz
cac52fbf23 Import some aa.py functions into aa-mergeprof by name
This allows to drop the "apparmor.aa." prefix in ask_the_question() to
get the code more in sync with aa.py ask_the_question().


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:17:25 +02:00
Christian Boltz
41912ec027 Change aa.py ask_the_questions() to use the aa-mergeprof code for network rules
Replace the code in aa.py ask_the_questions() that handles network rules
with the ask_the_questions() code initially copied from aa-mergeprof.

This means to convert the network/netdomain log events to a
NetworkRuleset stored in the log_obj hasher, and then let the code from
aa-mergeprof operate on this hasher.

The user interface is mostly unchanged, with two exceptions:
- options always displayed, even if there is only one option
- some slightly changed texts

If you didn't understand why there's a need for the previous patch, this
one should explain it :-)

This also ends up fixing at least one bug where the 'audit' keyword
wasn't listed as a separate qualifier, but instead showed up smooshed
into the Network Family header.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:15:38 +02:00
Christian Boltz
1ad4ef8221 Change aa.py ask_the_questions() to use the aa-mergeprof code for capabilities
Replace the code in aa.py ask_the_questions() that handles capabilities
with the ask_the_questions() code from aa-mergeprof.

This means to convert the capability log events to a CapabilityRuleset
stored in the (new) log_obj hasher, and then let the code from
aa-mergeprof operate on this hasher.

Most of the code after the "aa-mergeprof also has this code" comment is
a direct copy of the aa-mergeprof code, with the following changes:
- filter for profile mode (enforce/complain)
- set default button (allow or deny) based on profile mode
- keep seen_events counter happy (even if it isn't displayed anywhere)
- replace apparmor.aa.foo with just foo

The user interface is mostly unchanged, with two exceptions:
- options always displayed, even if there is only one option
- some slightly changed texts


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:13:44 +02:00
Christian Boltz
6b0387e21e Fix available buttons after switching network audit flag in aa-logprof
When switching the audit flag for network events in aa-logprof
(technically, it happens in aa.py ask_the_question()), the "(I)gnore"
button gets "lost".

This patch fixes the list of available buttons.


I propose this patch for trunk and 2.9.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-06-06 14:11:29 +02:00
Christian Boltz
8f3688c8d7 aa-mergeprof: move creating the headers for capabilty and network rules inside the loop
Move the code to set q.headers, q.functions and q.default for network
and capability rules inside the "while not done" loop. This ensures to
always have valid headers (for example, after changing the audit
qualifier, the severity was "lost" before) and avoids some duplicated
code.

Also drop a useless "if True:" condition and change the whitespace of
the following lines.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:09:38 +02:00
Christian Boltz
bc259033f9 Replace duplicate code in aa-mergeprof with a loop
Now that the handling for capability and network rules is the same,
wrap the former network rule-only code with
    for ruletype in ['capability', 'network']:
and delete the superfluous ;-) capabiltiy code block.

Needless to say that future updates for other rule types will be
quite easy ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:08:47 +02:00
Christian Boltz
902f88b0bb Add and use logprof_header() and logprof_header_localvars() in *Rule classes
BaseRule:
- add logprof_header() - sets the 'Qualifier' (audit, allow/deny) header
  if a qualifier is specified, calls logprof_header_localvars() and then
  returns an array of headers to display in aa-logprof and aa-mergeprof
- add logprof_header_localvars() - dummy function that needs to be
  implemented in the child classes

NetworkRule: add logprof_header_localvars() - adds 'Network Family'
and 'Socket Type' to the headers

CapabilityRule: add logprof_header_localvars() - adds 'Capability' to
the headers

Also change aa-mergeprof to use rule_obj.logprof_header() for network
and capability rules. This means deleting lots of lines (that moved to
the *Rule classes) and also deleting the last differences between
capabiltiy and network rules.

Finally add tests for the newly added functions.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:04:11 +02:00
Christian Boltz
babebceaf3 Unify code for network and capability rules in aa-mergeprof
This means:

a) for capability rules:
   -  move audit and deny to a new "Qualifier" header (only displayed if
      non-empty)
   -  always display options, even if only one is available
   -  use available_buttons(), which means to add the CMD_AUDIT_* button
   -  add handling for CMD_AUDIT_* button
   -  CMD_ALLOW: only add rule_obj if the user didn't select a #include
   -  move around some code to get it in sync with network rule handling

b) for network rules
   -  move audit and deny to a new "Qualifier" header (only displayed if
      non-empty)
   -  call rule_obj.severity() (not implemented for network rules, does
      nothing)
   -  change messages to generic 'Adding %s to profile.'
   -  move around some code to get it in sync with capability rule
      handling

The only remaining difference is in q.headers[] and the variables
feeding it:
- capability rules show "Capability: foo"
- network rules show "Network Family: foo" and "Socket type: bar"



Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:02:02 +02:00
Christian Boltz
b79fbc9be4 Change aa-logprof and aa-mergeprof to read the severity from CapabilityRule
Note: the   != sev_db.NOT_IMPLEMENTED:   check in aa-mergeprof is
superfluous for capabilities, but will become useful once this code
block is used for other rule types.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 14:01:01 +02:00
Christian Boltz
45cd3618ba Implement severity() in CapabilityRule
Also implement handling for the special capability value '__ALL__' in
severity.py, which is used for 'capability,' rules (aa-mergeprof might
need to display the severity for such a rule).

Finally, add some tests for severity() in test-capability.py and a test
for '__ALL__' in test-severity.py.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 13:59:11 +02:00
Christian Boltz
b067cfc12c Add severity() to BaseRule class
severity() will, surprise!, return the severity of a rule, or
sev_db.NOT_IMPLEMENTED if a *Rule class doesn't implement the severity()
function.

Also add the NOT_IMPLEMENTED constant to severity.py, and a test to
test-baserule.py that checks the return value in BaseRule.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 13:56:26 +02:00
John Johansen
4ed04c8ada add support for rule prefixes to change_profile rules
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-06 01:28:43 -07:00
John Johansen
df568c979a Add support for bare change_profile rule
allow specifying the change_profile keyword

  change_profile,

to grant all permissions change_profile permissions

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-06 01:28:27 -07:00
John Johansen
0b00b5d482 Fix: variable expansion for link target
link rules with a variable in the link target, eg.
   link /foo -> @{var},

do not currently have the variable expanded

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-06 01:28:12 -07:00
John Johansen
9460aa042d Fix: link rules to accept a variable
currently
  link @{foo} -> /bar,
  link /bar -> @{foo}
  link @{foo} -> @{bar},

all fail due to illegal TOK_SET_VAR

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-06 01:27:59 -07:00
John Johansen
b47ac55a9a add query helper for link permissions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-06 01:27:49 -07:00
John Johansen
a6b6c3cf06 add helper fn to query file path permissions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-06 01:26:03 -07:00
John Johansen
0cba060d7a Rename AA_MAY_XXX permission bits that conflict with new layout
The parser currently is still using the old permission layout, the kernel
uses a newer layout that allows for more permission bits. The newer
newer permission layout is needed by the library to query the kernel,
however that causes some of the permission bits to be redefined.

Rename the permission bits that cause redefination warnings to use
AA_OLD_MAY_XXX

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-06 01:25:49 -07:00
John Johansen
5d0e6c26b7 Set cache file tstamp to the mtime of most recent policy file tstamp
Currently the cache file has its mtime set at creation time, but this
can lead to cache issues when a policy file is updated separately from
the cache. This makes it possible for an update to ship a policy file
that is newer than the what the cache file was generated from, but
result in a cache hit because the cache file was local compiled after
the policy file was package into an update (this requires the update
to set the mtime of the file when locally installed to the mtime of
the file in its update archive but this is commonly done, especially
in image based updates).

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-06 01:22:53 -07:00
John Johansen
c2bbe64ab1 Use mtime instead of ctime for cache file
When caching was converted to use mtime instead of ctime, the cache
file timestamp did not get switched over. This means we are comparing
the cache file's ctime against the policy file's mtime. Which can make
the cache look newer than it really is.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-06 01:22:43 -07:00
John Johansen
69868cda18 add man page for aa_query_label
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-04 02:59:32 -07:00
Steve Beattie
23a2d8b68c This patch fixes several formatting issues with the apparmor.d man page:
- missing formatting code prefixes, usually I for BNFish arguments
 - added blank lines before preformatted sections as the html formatter
   wasn't treating them as seperate from the preceding text (also, they
   generated podchecker warnings)
 - fixed a grammar issue
 - fixed link description text block that was mistakenly indented and
   thus treated as preformatted text
 - moved the "Qualifier Blocks" subsection out of the =over/=back as
   all the pod tools did not like this and it caused podchecker to exit
   with an error, breaking builds that ran make check on the parser
   tree.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-02 16:05:37 -07:00
John Johansen
d7436a872c Rename requires_features and have_features
Rename require_features to require_kernel_features and
       have_features to kernel_features

to indicate they are tests for kernel features, as now there are tests
for parser features and in the future there might be library features
as well.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-02 01:00:29 -07:00
John Johansen
119c751951 The regression tests have issue on backport kernels when the userspace
has not been updated. The issue is that the regression tests detect the
kernel features set and generate policy that the parser may not be able
to compile.

Augment the regressions tests with a couple simple functions to test what
is supported by the parser, and update the test conditionals to use them.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-06-02 01:00:29 -07:00
John Johansen
2d31e2c113 add ability to parser dmesg output as a log file
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-02 01:00:29 -07:00
John Johansen
7cc75c44fa Add log parser test for change_profile
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-06-02 01:00:29 -07:00
John Johansen
4afcf91162 Add documentation of qualifier blocks to apparmor.d man page
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-02 01:00:29 -07:00
John Johansen
04dfc5d975 Add missing I<ALIAS RULE> to B<COMMA RULES> pattern
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-02 01:00:29 -07:00
John Johansen
d506ecfd4d apparmor.d.pod: refactor profile file, profile, subprofile, hat patterns
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-02 01:00:29 -07:00
John Johansen
8ffec9357d apparmor.d.pod: create RULES grouping and cleanup profile PROFILE rule
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-06-02 01:00:29 -07:00
Tyler Hicks
631804e8a7 parser: Document the --features-file option in apparmor_parser(8)
This option was previously only documented in the --help output.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-06-01 11:29:37 -05:00
Launchpad Translations on behalf of apparmor-dev
9f670bed0e Launchpad automatic translations update.
Bug: https://launchpad.net/bugs/1466812
2015-06-01 05:08:17 +00:00
Christian Boltz
01a43e5f1b Convert test-capability.py to AATest
I decided to use a "small" solution for now, which basically means
s/unittest.TestCase/AATest/, cleanup of some setUp() and renaming the
remaining setUp() functions to AASetup().

This doesn't mean an instant win (like in test-severity.py), but allows
to add tests with a tests[] array.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 23:43:27 +02:00
Christian Boltz
5eb796044b Change test-severity.py to use 'unknown' as default rank, and fix the bugs it found
To be able to distinguish between severity 10 and unknown severity,
change AASetup to specify 'unknown' as default rank, and change the
expected result to 'unknown' where it's expected.

Also change the "expected rank %d" to "%s" because it can be a string
now, and add a test that contains directories with different severity
in one variable.

After these changes, handle_variable_rank() errors out with
    TypeError: unorderable types: str() > int()
so fix it by
- initializing rank with the default rank (instead of none)
- explicitely check that rank and rank_new are != the default rank before
  doing a comparison

A side effect is another bugfix - '@{HOME}/sys/@{PROC}/overcommit_memory'
is severity 4, not 10 or unknown (confirmed by reading severity.db).


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 23:39:14 +02:00
Christian Boltz
2f6059767e Convert test-severity.py to use the AATest class
This simplifies test-severity.py a lot:
- lots of test functions are replaced with tests[] arrays
- tempdir handling and cleanup is now done automagically

Even if test-severity.py shrunk by 65 lines, all tests are still there.

There's even an addition - SeverityTestCap now additionally verifies the
result of rank_capability().


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 23:31:56 +02:00
Christian Boltz
cf4eb0182c severity.py: change rank_capability() to not expect the CAP_ prefix
Change rank_capability() so that it doesn't expect the CAP_ prefix.
This makes usage easier because callers can simply hand over the
capability name.

Also change rank() to call rank_capability() without the CAP_ prefix.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 23:29:52 +02:00
Christian Boltz
99b2f67d3c severity.py: rename handle_capability() to rank_capability()
It's only used inside severity.py until now, but I plan to change that
and want a better function name ;-)


Acked-by: Steve Beattie <steve@nxnw.org>.
2015-05-29 23:10:11 +02:00
Christian Boltz
0fd30653fd Use generic names in aa-mergeprof
Replace rule-specific names with generic names:
- s/'capability'/ruletype/
- s/cap_obj/rule_obj/
- s/'network'/ruletype/
- s/net_obj/rule_obj/

Also set ruletype at the beginning of each block.

The long-term goal is to have
    for ruletype in ['capability', 'network', ...]:
with common code to handle all rule types, and having common names makes
it easier to compare the blocks.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 23:03:51 +02:00
Christian Boltz
0461c60a6e cleanup superfluous variable assignments in aa-mergeprof
aa-mergeprof has some sections where it first resets the 'deleted'
variable, and then overwrites it again a line or two later.
This patch removes the superfluous variable resets.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 13:01:37 +02:00
Christian Boltz
8d348b328b let parse_profile_data() check for in-file duplicate profiles
Add a check to parse_profile_data() to detect if a file contains two
profiles with the same name.

Note: Two profiles with the same name, but in different files, won't be
detected by this check.

Also add basic tests to ensure that a valid profile gets parsed, and two
profiles with the same name inside the same file raise an exception.

(Sidenote: these simple tests improve aa.py coverage from 9% to 12%,
which also confirms the function is too long ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 13:00:32 +02:00
Christian Boltz
5fa5125fd4 Add tempdir and tempfile handling to AATest
Add writeTmpfile() to AATest to write a file into the tmpdir. If no
tmpdir exists yet, automatically create one.

createTmpdir() is a separate function so that it's possible to manually
create the tmpdir (for example, if a test needs an empty tmpdir).

Also add a tearDown() function to delete the tmpdir again. This function
calls self.AATeardown() to avoid the need for super() in child classes.

Finally, simplify AaTestWithTempdir in test-aa.py to use createTmpdir()
and add an example for AATeardown() to test-example.py.



Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 12:55:38 +02:00
Christian Boltz
78505f3057 drop unused match_net_include() and match_net_includes() from aa.py
aa-mergeprof no longer calls match_net_includes(), which means the
function can be dropped.

After that, match_net_include() is also unused, so also drop it.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 01:41:35 +02:00
Christian Boltz
c795a1f228 Update aa-mergeprof to use the NetworkRule(set) class layout
aa-mergeprof still used the old aa[profile][hat][allow]['netdomain']
which no longer gets populated. This resulted in not asking for merging
any network rules.

This patch changes ask_the_question() to the NetworkRule(set) layout.
Besides that,
- don't ask for network rules that are already covered.
  Using is_known_rule() also fixes
  https://bugs.launchpad.net/apparmor/+bug/1382241
- include the audit keyword in the "Network Family" headline
  (I'd prefer to just use the get_clean() rule, but that's another topic)
- hide "(A)llow" when merging a deny rule
- as a side effect of using NetworkRule, fix crashes for 'network,' and
  'network foo,' rules

To avoid having to repeat the list of available "buttons" and the logic
to update that list, add a available_buttons() function that returns the
list of available buttons depending on rule_obj.deny and rule_obj.audit
to aa.py, and import it into mergeprof.

I tested all changes manually.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-29 01:12:38 +02:00
Christian Boltz
7728556972 Update aa-mergeprof to use the CapabilityRule(set) class layout
aa-mergeprof still used the old aa[profile][hat][allow]['capability']
which no longer gets populated - which resulted in not asking for
merging any capabilities.

Actually (and funnily),
-                if other.aa[profile][hat].get(allow, False):
-                    continue
resulted in never merging capability rules even before the change to
CapabilityRule(set) - this was meant as optimization, but a "not" was
missing in the condition ;-) so it always skipped capability rules.

The patch changes ask_the_question to the CapabilityRule(set) layout.
Besides that,
- include the audit and deny keywords in the "Capability" headline
  (I'd prefer to just use the get_clean() rule, but that's another topic)
- hide "(A)llow" when merging a deny rule
- don't ask for capabilities that are already covered

Also delete match_cap_includes() from aa.py, which is no longer used.


Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://launchpad.net/bugs/1382241
2015-05-29 00:17:02 +02:00
Christian Boltz
534715c2e2 Drop old RE_PROFILE_CHANGE_PROFILE regex from regex.py
Also rename RE_PROFILE_CHANGE_PROFILE_2 to RE_PROFILE_CHANGE_PROFILE
and update apparmor/rule/change_profile.py to use the changed name.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-28 22:26:34 +02:00
Christian Boltz
98383c0816 Change aa.py to use ChangeProfileRule and ChangeProfileRuleset
Change aa.py to use ChangeProfileRule and ChangeProfileRuleset instead
of a sub-hasher to store and write change_profile rules. In detail:
- drop all the change_profile rule parsing from parse_profile_data() and
  serialize_profile_from_old_profile() - instead, just call
  ChangeProfileRule.parse()
- change write_change_profile to use ChangeProfileRuleset
- add removal of superfluous/duplicate change_profile rules (the old
  code didn't do this)

Note that this patch is much smaller than the NetworkRule and
CapabilityRule patches because aa-logprof doesn't ask for adding
change_profile rules - adding that is something for a later patch.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-28 22:25:30 +02:00
Christian Boltz
70f9334cd9 Add tests for ChangeProfileRule and ChangeProfileRuleset
As usual, those classes have 100% test coverage.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-28 22:23:32 +02:00
Christian Boltz
59d4011033 Add ChangeProfileRule and ChangeProfileRuleset classes
Add utils/apparmor/rule/change_profile.py with the ChangeProfileRule and
ChangeProfileRuleset classes. These classes are meant to handle
change_profile rules.

In comparison to the current code in aa.py, ChangeProfileRule has some
added features:
- support for audit and allow/deny keywords (for which John promised a
  parser patch really soon)
- support for change_profile rules with an exec condition


Also add the improved regex RE_PROFILE_CHANGE_PROFILE_2 to regex.py.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-28 22:22:56 +02:00
Christian Boltz
f26b035e90 Let set_profile_flags() change the flags for all hats
It did this in the old 2.8 code, but didn't in 2.9.x (first there was a
broken hat regex, then I commented out the hat handling to avoid
breakage caused by the broken regex).

This patch makes sure the hat flags get set when setting the flags for
the main profile.

Also change RE_PROFILE_HAT_DEF to use more named matches
(leadingwhitespace and hat_keyword). Luckily all code that uses the
regex uses named matches already, which means adding another (...) pair
doesn't hurt.

Finally adjust the tests:
- change _test_set_flags to accept another optional parameter
  expected_more_rules (used to specify the expected hat definition)
- add tests for hats (with '^foobar' and 'hat foobar' syntax)
- add tests for child profiles, one of them commented out (see below)


Remaining known issues (also added as TODO notes):

- The hat and child profile flags are *overwritten* with the flags used
  for the main profile. (That's well-known behaviour from 2.8 :-/ but we
  have more flags now, which makes this more annoying.)
  The correct behaviour would be to add or remove the specified flag,
  while keeping other flags unchanged.

- Child profiles are not handled/changed if you specify the 'program'
  parameter. This means:
  - 'aa-complain smbldap-useradd' or 'aa-complain /usr/sbin/smbldap-useradd'
    _will not_ change the flags for the nscd child profile
  - 'aa-complain /etc/apparmor.d/usr.sbin.smbldap-useradd' _will_ change
    the flags for the nscd child profile (and any other profile and
    child profile in that file)


Even with those remaining issues (which need bigger changes in
set_profile_flags() and maybe also in the whole flags handling), the
patch improves things and fixes the regression from the 2.8 code.



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-05-28 22:14:37 +02:00
Tyler Hicks
5349536ff8 tests: Add query_label.sh tests for file queries
A number of simple query tests based on read and write perms of files
and directories.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-05-28 14:48:53 -05:00
Tyler Hicks
afde1cc53a tests: Adjust query_label.sh to query a different profile
The test program was querying its own profile. Adjust the profile
generation so that a separate profile is generated and have query_label
query the separate profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-05-28 14:48:50 -05:00
Tyler Hicks
a566935d64 tests: Make query_label accept file queries
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-05-28 14:48:46 -05:00
Launchpad Translations on behalf of apparmor-dev
6bcf697731 Launchpad automatic translations update. 2015-05-25 05:09:25 +00:00
Launchpad Translations on behalf of apparmor-dev
ab671b30be Launchpad automatic translations update. 2015-05-21 05:07:49 +00:00
Tyler Hicks
20c2c4c171 libapparmor: Fix pod2man warning in aa_splitcon(3)
*** WARNING: 2 unescaped <> in paragraph at line 43 in file aa_splitcon.pod

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-05-19 21:46:23 -05:00
Tyler Hicks
c6e395c08f libapparmor: Strip a trailing newline character in aa_splitcon(3)
Adjust the internal splitcon() function to strip a single trailing
newline character when the bool strip_newline argument is true.

aa_getprocattr_raw(2) needs to set strip_newline to true since the
kernel appends a newline character to the end of the AppArmor contexts
read from /proc/>PID>/attr/current.

aa_splitcon(3) also sets strip_newline to true since it is unknown
whether the context is originated from a location that appends a newline
or not.

aa_getpeercon_raw(2) does not set strip_newline to true since it is
unexpected for the kernel to append a newline to the the buffer returned
from getsockopt(2).

This patch also creates tests specifically for splitcon() and updates
the aa_splitcon(3) man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:31:53 -05:00
Tyler Hicks
8fffe4c721 libapparmor: Add unit tests for aa_splitcon()
Test confinement context splitting, using aa_splitcon(3), with and
without a valid mode pointer.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:30:39 -05:00
Tyler Hicks
014093dedc libapparmor: Add aa_splitcon() public function
Create a new libapparmor public function that allows external code to
split an AppArmor confinement context.

This is immediately useful for code that retrieves a D-Bus peer's
AppArmor confinement context using the
org.freedesktop.DBus.GetConnectionCredentials bus method.

https://launchpad.net/bugs/1430532

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:28:47 -05:00
Tyler Hicks
4879b46b13 libapparmor: Detect errors when splitting confinement contexts
The parse_confinement_mode() function returned NULL when a confinement
mode was not present (unconfined) and when it could not properly parse
the confinement context. The two situations should be differentiated
since the latter should be treated as an error.

This patch reworks parse_confinement_mode() to split a confinement
context and, optionally, assign the mode string. If a parsing error is
encountered, NULL is returned to indicate error.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:20:51 -05:00
Tyler Hicks
f6df1c7516 libapparmor: Clean up confinement context's unconfined check
Use the passed in confinement context string size to improve the
comparison by only doing the string comparison if the size matches and
removing the possibility of reading past the end of the buffer.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:20:37 -05:00
Tyler Hicks
6d8827594a libapparmor: Don't count NUL terminator byte
When passing the size of the confinement context to
parse_confinement_mode(), don't include the NUL terminator byte in the
size.

It is confusing to count the NUL terminator as part of the string's
length. This change makes it so that, after a few additional changes,
parse_confinement_mode() can be exposed as part of libapparmor's public
API.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 21:20:21 -05:00
Tyler Hicks
81f932531c tests: Verify aa_getpeercon() return value
This patch modifies the socketpair.c test to verify the return value of
aa_getpeercon() based upon the expected label and expected mode lengths.

The test had to be changed slightly so that the returned mode, from
aa_getpeercon(), was preserved. It was being overwritten with the
special NO_MODE value.

This change helps to make sure that future changes to the code behind
aa_getpeercon() does not unintentionally change the function's return
value.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-19 21:19:56 -05:00
Christian Boltz
9b5ff659b0 Update Samba profiles for Samba 4.2
Samba 4.2 needs some more permissions for nmbd and winbindd.

To avoid overcomplicated profiles, change abstractions/samba to allow
/var/lib/samba/** rwk, (instead of **.tdb rwk) - this change already
fixes the nmbd profile.

winbindd additionally needs some more write permissions in /etc/samba/
(and also in /var/lib/samba/, which is covered by the abstractions/samba
change and also results in some profile cleanup)


References: https://bugzilla.opensuse.org/show_bug.cgi?id=921098 and
            https://bugzilla.opensuse.org/show_bug.cgi?id=923201


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-19 01:25:26 +02:00
Christian Boltz
c2973f0b7b Add the attach_disconnected flag to the ntpd profile
I noticed "disconnected path" (run/nscd/*) events for ntpd while
updating to the latest openSUSE Tumbleweed.


Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.9.
2015-05-19 01:20:49 +02:00
Christian Boltz
bb56f039a8 Fix raising AppArmorException in aa-mergeprof
aa-mergeprof failed to fail ;-) when it should raise an AppArmorException.
Instead, it failed with

    AttributeError: 'module' object has no attribute 'AppArmorException'

I confirmed this bug in trunk and 2.9.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-05-18 01:35:51 +02:00
Steve Beattie
c477af77b4 Periodic sync up with apparmor trunk branch. 2015-05-16 10:11:36 -07:00
Steve Beattie
bd3d21e0bc Merge from launchpad translations project. Changes include:
- added and updated Portuguese translations
- added Hungarian, Russian, Polish strings
2015-05-16 10:05:48 -07:00
Christian Boltz
407280c7f5 Delete apparmor/rule/ python cache files in "make clean"
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-11 21:57:55 +02:00
Christian Boltz
481de7e655 move quote_if_needed() to apparmor.rule
quote_if_needed() will be used by the upcoming ChangeProfileRule class,
which means it must be moved out of aa.py to avoid an import loop.
rule/__init__.py looks like a better place.

Also re-import quote_if_needed() into aa.py because it's still needed
there by various functions.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-05-09 13:20:57 +02:00
Christian Boltz
7167632350 Split off RE_PROFILE_NAME and RE_PROFILE_PATH from RE_PROFILE_START
(might get re-used later ;-)

Also add two tests for profile names not starting with / - the quoted
version wasn't catched as invalid before, so this change is actually
also a bugfix.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-05-09 01:09:08 +02:00
Steve Beattie
257bc75aa1 parser: merge fix from intrigeri to techdoc timestamp generator to
ensure reproducible builds across timezone variations.
2015-05-05 08:06:49 -07:00
intrigeri
7cf81576c2 Make techdoc.pdf reproducible even in face of timezone variations. 2015-05-03 13:42:39 +02:00
Steve Beattie
6e77515072 Merge typo fix from intrigeri (issue caught by lintian).
Acked-by: Steve Beattie <steve@nxnw.org>
2015-05-01 11:37:55 -07:00
intrigeri
ff0965eee0 parser/dbus.cc: fix "accesss" typo. 2015-05-01 10:25:57 +02:00
Christian Boltz
606c753501 aa-notify: also display notifications for complain mode events
Change aa-notify parse_message() to also honor complain mode log events.
This affects both modes - desktop notifications and the summary report.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-29 01:03:17 +02:00
Christian Boltz
ea1033926f AATest: don't limit diff length
Add setUp() to AATest that sets "self.maxDiff = None" (unlimited).
This gives us unlimited array diffs everywhere where AATest is used.

Also rename several setUp() functions in test-regex_matches.py to
AASetup() to avoid that the shiny new AATest setUp() gets overwritten.


Acked-by: Steve Beattie <steve@nxnw.org>


As requested by Steve, also add an example AASetup() to test-example.py.
2015-04-28 23:37:49 +02:00
Christian Boltz
b56e7b3dfe Add profiles/apparmor.d/local/*.* to .bzrignore
This ignores the sniplets generated by profiles/Makefile, but doesn't
ignore local/README because it doesn't have a dot in its name.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-04-27 21:38:56 +02:00
Christian Boltz
332ee0cba7 Update list of network domains in apparmor.d manpage
Add several missing network DOMAINs to the apparmor.d manpage.

The list is based on the list that utils/vim/Makefile generates.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-04-27 21:37:47 +02:00
Christian Boltz
412f525d5b usr.lib.dovecot.lmtp: add openssl and ssl_keys abstractions
reported by darix on IRC. This is needed if you have a bigger setup with
dovecot on a different (or multiple) machines


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-04-27 21:33:06 +02:00
Christian Boltz
c9fe061525 Use *Rule.match() in aa.py
Replace usage of RE_PROFILE_CAP and RE_PROFILE_NETWORK with
CapabilityRule.match() and NetworkRule.match() calls.
This also means aa.py doesn't need to import those regexes anymore.

As a side effect of this change, test-regex_matches.py needs a small
fix because it imported RE_PROFILE_CAP from apparmor.aa instead of
apparmor.regex.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-04-26 22:02:01 +02:00
Christian Boltz
6dade51f92 Add match() and _match() class methods to rule classes
Add match() and _match() class methods to rule classes:
- _match() returns a regex match object for the given raw_rule
- match() converts the _match() result to True or False

The primary usage is to get an answer to the question "is this raw_rule
your job?". (For a moment, I thought about naming the function
*Rule.myjob() instead of *Rule.match() ;-)

My next patch will change aa.py to use *Rule.match() instead of directly
using RE_*, which will make the import list much shorter and hide
another implementation detail inside the rule classes.

Also change _parse() to use _match() instead of the regex, and add some
tests for match() and _match().


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-04-26 21:59:12 +02:00
Christian Boltz
f340126ec1 Convert existing code to use NetworkRule and NetworkRuleset
Change aa.py to use NetworkRule and NetworkRuleset instead of a
sub-hasher to store, check and write network rules. In detail:
- drop profile_known_network() and use is_known_rule() instead
- replace match_net_includes() usage with match_includes() calls
- drop delete_net_duplicates(), use the code in NetworkRule and
  NetworkRuleset instead
- make match_net_includes() (still used by aa-mergeprof) a wrapper for
  match_includes()
- drop all the network rule parsing from parse_profile_data() and
  serialize_profile_from_old_profile() - instead, just call
  NetworkRule.parse()
- now that write_net_rules() got fixed, drop it ;-)
- change write_netdomain to use NetworkRuleset
- drop netrules_access_check() - that's is_covered() now
- use 'network' instead of 'netdomain' as storage keyword (log events
  still use 'netdomain')

Also update cleanprofile.py to use the NetworkRuleset class.
This also means to delete the (now superfluous) delete_net_duplicates()
function.

Finally, there are some changes in regex.py:
- change RE_PROFILE_NETWORK in regex.py to named matches and to use
  RE_COMMA_EOL (not only RE_EOL)
- drop the no longer needed RE_NETWORK_FAMILY and RE_NETWORK_FAMILY_TYPE
  (rule/network.py has regexes that check against the list of available
  keywords)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-26 21:54:38 +02:00
Christian Boltz
30688225ab Add tests for NetworkRule
Add utils/test/test-network.py with tests for NetworkRule and
NetworkRuleset.

The tests are hopefully self-explaining, so let me just mention the most
important things:
- I started to play with namedtuple, which looks very useful (see "exp")
- the test loops make the tests much more readable (compare with
  test-capability.py!) and make it easy to add some more tests
- 100% coverage :-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-26 21:53:32 +02:00
Christian Boltz
aae519b2c9 Add NetworkRule and NetworkRuleset classes
Add utils/apparmor/rule/network.py with the NetworkRule and
NetworkRuleset classes. These classes are meant to handle network rules.

In comparison to the existing code in aa.py, relevant news are:
- the keywords are checked against a list of allowed domains, types and
  protocols (these lists are based on what the utils/vim/Makefile
  generates - on the long term an autogenerated file with the keywords
  for all rule types would be nice ;-)
- there are variables for domain and type_or_protocol instead of
  first_param and second_param. (If someone is bored enough to map the
  protocol "shortcuts" to their expanded meaning, that shouldn't be too
  hard.)
- (obviously) more readable code because we have everything at one place
  now
- some bugs are fixed along the way (for example, "network foo," will now
  be kept, not "network foo bar," - see my last mail about
  write_net_rules() for details)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-26 21:50:31 +02:00
Christian Boltz
b83f457c1e Make sure aa-cleanprof de-duplicates capability rules
CleanProf.remove_duplicate_rules() didn't call
  $profile['capability'].delete_duplicates()
because aa-cleanprof sets same_file=True.

Fix this by calling delete_duplicates(None) so that it
only checks the profile against itsself.

Note: this is only needed if the to-be-cleaned profile doesn't
contain any include rules - with includes present, the
"for inc in includes:" block already called delete_duplicates()


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-26 21:49:04 +02:00
Launchpad Translations on behalf of apparmor-dev
831f37b198 Launchpad automatic translations update. 2015-04-25 05:07:37 +00:00
Christian Boltz
764e3b1fc0 Implement in-profile de-duplication in BaseRuleset
Implement in-profile de-duplication in BaseRuleset (currently affects
"only" CapabilityRuleset, but will also work for all future *Ruleset
classes).

Also change 'deleted' to be a simple counter and add some tests that
verify the in-profile deduplication.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-04-24 23:53:21 +02:00
Christian Boltz
f3fe8fcd92 Move test_parse_modifiers_invalid() to test-baserule.py
test_parse_modifiers_invalid() uses a hand-broken ;-) regex to parse
only the allow/deny/audit keywords. This test applies to all rule types
and doesn't contain anything specific to capability or other rules,
therefore it should live in test-baserule.py

Moving that test also means to move the imports for parse_modifiers and
re around (nothing else in test-capability.py needs them).


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-22 22:08:24 +02:00
Christian Boltz
d800f99d9d Add tests for Baserule
Add some tests for the Baserule class to cover the 3 functions that must
be re-implemented in each rule class. This means we finally get 100%
test coverage for apparmor/rule/__init__.py ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-22 22:05:10 +02:00
Christian Boltz
682e23e1cd Enable testloops for nosetests
Ensure nosetests sees all tests in the tests[] tuples. This requires
some name changes because nosetests thinks all function names containing
"test" are tests. (A "not a test" docorator would be an alternative, but
that would require some try/except magic to avoid a dependency on nose.)

To avoid nosetests thinks the functions are a test,
- rename setup_all_tests() to setup_all_loops()
- rename regex_test() to _regex_test() (in test-regex_matches.py)

Also add the module_name as parameter to setup_all_loops and always run
it (not only if __name__ == '__main__').

Known issue: nosetests errors out with
    ValueError: no such test method in <class ...>: stub_test
when trying to run a single test generated out of tests[].
(debugging hint: stub_test is the name used in setup_test_loop().)
But that's still an improvement over not seeing those tests at all ;-)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-04-22 22:01:34 +02:00
Launchpad Translations on behalf of apparmor-dev
1a254613f0 Launchpad automatic translations update. 2015-04-18 05:07:20 +00:00
Christian Boltz
47a811f2f5 Fix typo in CapabilityRule exception message
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-04-17 23:36:00 +02:00
Christian Boltz
57ee8ee5b2 Fix crash in serialize_profile_from_old_profiles()
Assume you have a profile like

    /bin/foo {
      /etc/ r,
      network,
      /usr/ r,
    }

(important: there must be be a non-path rule between the two path blocks)

Then run aa-logprof and add another path event. When choosing (V)iew changes,
it will crash with a misleading

  File ".../utils/apparmor/aamode.py", line 205, in split_mode
      other = mode - user
      TypeError: unsupported operand type(s) for -: 'collections.defaultdict' and 'set'

The reason for this is our beloved hasher, which is playing funny games
another time.

The patch wraps the hasher usage with a check for the parent element to
avoid auto-creation of empty childs, which then lead to the above crash.


BTW: This is another issue uncovered by the LibreOffice profile ;-)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-04-16 13:10:44 +02:00
Steve Beattie
f35a54c169 profiles: update postfix-common abstraction
Update the postfix-common abstraction to cope with signal and unix
socket mediation, update the access to the sasl library locations
in a multiarch compliant way, and allow access to limited bits
of the filesystem paths under which postfix chroots itself to
(/var/spool/postfix/ on Ubuntu).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-15 23:32:50 -07:00
Christian Boltz
cc946bca8d Fix serialize_profile_from_old_profiles() to not crash on "@{var} +="
serialize_profile_from_old_profiles() calls store_list_var() with an
empty hasher. This fails for "+=" because in this case store_list_var()
expects a non-empty hasher with the variable already defined, and raises
an exception because of the empty hasher.

This patch sets "correct = False" if a "+=" operation appears, which
means the variable will be written in "clean" mode instead.

Adding proper support for "add to variable" needs big changes (like
storing a variable's "history" - where it was initially defined and what
got added where).



Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-04-16 02:01:10 +02:00
Christian Boltz
1f9474e653 fix handling of adding to variables
the LibreOffice profile uncovered that handling of @{var} += is broken:

  File ".../utils/apparmor/aa.py", line 3272, in store_list_var
    var[list_var] = set(var[list_var] + vlist)
TypeError: unsupported operand type(s) for +: 'set' and 'list'

This patch fixes it:
- change separate_vars() to use and return a set instead of a list
  (FYI: separate_vars() is only called by store_list_var())
- adoptstore_list_var() to expect a set
- remove some old comments in these functions
- explain the less-intuitive parameters of store_list_var()

Also add some tests for separate_vars() and store_list_var().
The tests were developed based on the old code, but not all of them
succeed with the old code.

As usual, the tests uncovered some interesting[tm] behaviour in
separate_vars() (see the XXX comments and tell me what the really
expected behaviour is ;-)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-04-16 01:58:24 +02:00
Christian Boltz
a108416ae0 logparser.py: change mask only for path events
Move the code that does the c -> a and d -> w replacement in denied_mask
and requested_mask so that it only runs for path and exec events, but not
for other events (like dbus and ptrace). The validate_log_mode() and
log_str_to_mode() calls are also moved.

Technically, this means moving code from parse_event() to the path
and exec sections in add_event_to_tree().

This also means aa-logprof no longer crashes if it hits a ptrace or
dbus event in the log.

The "if dmask:" and "if rmask:" checks are removed - if a path event
doesn't have these two, it is totally broken and worth a aa-logprof
crash ;-)

Also adjust the parse_event() tests to expect the "raw" mask instead of
a set.


This patch fixes
https://bugs.launchpad.net/apparmor/+bug/1426651 and
https://bugs.launchpad.net/apparmor/+bug/1243932


I manually tested that
- c and d log events are still converted to a and w
- aa-logprof handles exec events correctly
- ptrace events no longer crash aa-logprof

Note: add_event_to_tree() is not covered by tests.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-04-16 01:50:35 +02:00
Christian Boltz
8374749f5d Add a missing check in rule class is_covered()
"capability foo".is_covered("deny capability foo") should return False
even if check_allow_deny is False.

Also add some tests with check_allow_deny=False.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-14 00:52:55 +02:00
Christian Boltz
da21e0c006 Add libapparmor test-driver and some Makefile.in to .bzrignore.
Also add libraries/libapparmor/swig/perl/Makefile.perle (noticed and
proposed by Steve)

With these changes, "bzr status" is clean again after "make distclean"


Acked-by: Steve Beattie <steve@nxnw.org>.
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-04-14 00:44:49 +02:00
Christian Boltz
51ce5f2758 write_net_rules() fixes, part 3
Thanks to the used data structure, write_net_rules() replaces bare
'network,' rules with the invalid 'network all,' when saving a profile.
This patch makes sure a correct 'network,' rule is written.

Also reset 'audit' to avoid all (remaining) rules get the audit flag
after writing an audit network rule.

Note: The first section of the function (that claims to be responsible
for bare 'network,' rules) is probably never hit - but I'm not too keen
to remove it and try it out ;-)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-04-11 02:20:31 +02:00
Christian Boltz
6ed926332f Fix doubled arrow in exec rules
When parsing a profile with named exec rules, the exec target included
the arrow. This resulted in two arrows when writing the profile (and one
more each time the profile was updated).

Fix this by using the match group that only contains the exec target
without the arrow in parse_profile_data() and
serialize_profile_from_old_profile().

References: https://bugs.launchpad.net/apparmor/+bug/1437901


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-04-11 02:15:18 +02:00
Steve Beattie
03b5a470bf profiles: allow ubuntu-helpers to generate texlive fonts
When evince opens a dvi file, it updates the user fonts using
texlive commands in /usr/share/texlive/texmf-dist/web2c/ (or possibly
/usr/share/texlive/texmf/web2c/ in older releases). This patch adjusts
the sanitized_helper profile to allow these tools to run.

Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1010909

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2015-04-10 09:14:48 -07:00
Christian Boltz
301449a96e Fix writing network rules, part 2
write_net_rules() doesn't add a space after 'audit' in two of three
cases, leading to invalid network rules.
This patch adds the missing spaces.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
for both trunk and 2.9
2015-04-10 01:53:08 +02:00
Christian Boltz
7189347ace Fix writing network rules
write_net_rules() creates invalid rules for network rules with one
parameter (for example "network bluetooth").
Add a trailing comma to create valid rules.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
for both trunk and 2.9.
2015-04-09 13:27:50 +02:00
Launchpad Translations on behalf of apparmor-dev
a47675d68c Launchpad automatic translations update. 2015-04-04 05:07:07 +00:00
Christian Boltz
a313b674f7 simplify serialize_parse_profile_start()
Change serialize_parse_profile_start() to use parse_profile_start()
instead of using duplicated code.

The behaviour is mostly kept, with the exception that the function is
more strict now and raises exceptions instead of ignoring errors.

In practise, this won't change anything because the profiles are parsed
with parse_profile() (which calls parse_profile_start()) - and that
already errors out.

The tests are updated to match the more strict behaviour.


The next step would be to drop serialize_parse_profile_start()
completely, but this isn't urgent and can/should be done when we have
test coverage for serialize_profile_from_old_profile() one day ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-03 17:32:06 +02:00
Christian Boltz
0dc795d181 fix is_skippable_dir() and add tests
Fix is_skippable_dir() - the regex also matched things like
/etc/apparmor.d/dont_disable, while it should match on the full
directory name.

Also add some tests based on a real-world aa-logprof run (with "print (path)"
in is_skippable_dir()) and some additional "funny"[tm] dirs.

Needless to say that the tests
        ('dont_disable',                False),
        ('/etc/apparmor.d/cache_foo',   False),
will fail with the old is_skippable_dir().


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-03 17:29:44 +02:00
Christian Boltz
20cfa21695 replace RE_PROFILE_START
Replace RE_PROFILE_START with RE_PROFILE_START_2 and adjust all
code sections that used RE_PROFILE_START_2.

The only real change is that test_get_flags_invalid_01 and
test_get_flags_invalid_02 now expect AppArmorException instead of
AppArmorBug.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk
2015-04-03 17:28:03 +02:00
Christian Boltz
a0a044f346 Finally implement attachment handling
This patch implements attachment handling - aa-logprof now works with
profiles that have an attachment defined, instead of ignoring audit.log
entries for those profiles.

Changes:
- parse_profile_start_line(): remove workaround that merged the
  attachment into the profile name
- parse_profile_data(): store attachment when parsing a profile
- update test_parse_profile_start_03, test_serialize_parse_profile_start_03,
  test_set_flags_nochange_09 and some parse_profile_start_line() tests -
  they now expect correct attachment handling


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-03 17:26:26 +02:00
Christian Boltz
bb3c972de9 [patch] make set_profile_flags more strict
this patch makes set_profile_flags more strict:
- raise AppArmorBug if newflags contains only whitespace
- raise AppArmorBug if the file doesn't contain the specified profile or
  no profile at all

The tests are adjusted to expect AppArmorBug instead of a silent
failure. Also, some tests are added for profile=None, which means to
change the flags for all profiles in a file.
- test_set_flags_08 is now test_set_flags_invalid_04
- test_set_flags_invalid_03 is changed to only contain one reason for a
  failure, not two ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-03 17:25:18 +02:00
Christian Boltz
38b1e3d30f rewrite set_profile_flags() to use write_header()
Changes in set_profile_flags():
- rewrite set_profile_flags to use parse_profile_start_line() and
  write_header().
- replace the silent failure for non-existing files with a proper
  exception (using lazy programming - the check is done by removing the
  "if os.path.isfile()" check, open_file_read then raises the
  exception ;-)
- comment out regex_hat_flag and the code that was supposed to handle
  hat flags, which were totally broken. We'll need another patch to fix
  it, and we also need to decide if we want to do that because it
  introduces a behaviour change (currently, aa-complain etc. don't
  change hat flags).

The tests for set_profile_flags() are also updated:
- prepend a space to comments because write_header always adds a space
  between '{' and the comment
- remove a test with superfluous quotes that are no longer kept (that's
  just a profile cleanup, so dropping that test is the easiest way)
- update test_set_flags_10 and test_set_flags_12 to use the correct
  profile name
- enable the tests for invalid (empty) flags
- update the test for a non-existing file

Note: test_set_flags_10, test_set_flags_12 and test_set_flags_nochange_09
will fail with this patch applied. The next patch will fix that.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-03 17:20:14 +02:00
Christian Boltz
b705af0221 Remove 'common' symlinks from .bzrignore
The Makefiles don't create/need the 'common' symlinks since some time,
which also means we no longer need to have them in .bzrignore.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-02 23:48:26 +02:00
Christian Boltz
67ae278436 Tell python2 about math
if 3/2 == 1:
    print("python2 inside")

Add "from __future__ import division" so that python2 returns the
correct result (if needed, as float)

On related news: At least python3 knows how to calculate correctly.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-04-02 23:39:00 +02:00
Christian Boltz
f78f11b3a5 Add all __pycache__ directories to .bzrignore
Luckily .bzrignore supports the ** notation ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-02 22:27:15 +02:00
Christian Boltz
7ad490e266 logparser.py: merge path handling in add_event_to_tree()
Merge path handling for 'inode_*' in add_event_to_tree() with the
handling for other path events.

The code is slightly more strict now - 'inode_' in e['operation'] is
replaced with e['operation'].startswith('inode_').

This patch is a cleanup and also a preparation to fix
https://bugs.launchpad.net/apparmor/+bug/1426651 and
https://bugs.launchpad.net/apparmor/+bug/1243932


Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked for both 2.9 and trunk.
2015-04-02 13:33:14 +02:00
Christian Boltz
df6fce1a91 honor 'chmod' events in logparser.py / aa-logprof
aa-logprof doesn't ask anything for

type=AVC msg=audit(1427633461.202:281): apparmor="DENIED" operation="chmod" profile="/usr/lib64/firefox/plugin-container" name="/home/cb/.config/ibus/bus/" pid=7779 comm="plugin-containe" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000

This patch fixes this by adding 'chmod' to the list of file operation
types in logparser.py.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
for both trunk and 2.9.
2015-04-02 13:31:27 +02:00
Christian Boltz
eb0553f11f [patch] rewrite parse_profile_start()
Rewrite parse_profile_start() in aa.py to a more readable version.
The behaviour remains unchanged (and is covered by tests).

The patch also updates the comment about the internal struct of
aa[profile][hat] - initial_comment was missing.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-04-02 13:30:01 +02:00
Christian Boltz
87c5679b91 add tests for RE_PROFILE_START_2 and parse_profile_start_line()
Also add AANamedRegexTest class that can be used to test a regex with
named match groups.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-02 11:42:28 +02:00
Christian Boltz
6651d4a3ee test new parameters of write_header()
Change the write_header tests so that the 'profile_keyword' and
'header_comment' parameters can be (and are) tested:
- add a None for both to the existing tests
- add some tests that come with the profile keyword and/or a comment


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-02 01:31:22 +02:00
Christian Boltz
b81400185d [patch] extend and partially rewrite write_header()
- add support for prof_data['header_comment'] (comment after '{')
  and prof_data['profile_keyword'] (to force the 'profile' keyword, even
  if it isn't needed) to write_header().
  (set_profile_flags() will be the only user of these two for now)

- fix a crash if depth is not an integer - for example,
      len('   ')/2   # 3 spaces = 1.5
  would cause a crash.
  Also add a test for 1.5 and 1.3 spaces.

- rewrite the handling of flags to avoid we have to maintain two
  different template lines.

- update the tests to set 'profile_keyword' and 'header_comment' to None.
  This avoids big changes in the test code. I'll send another patch that
  makes sure profile_keyword and header_comment are tested ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-02 01:30:01 +02:00
Christian Boltz
e0a8ed7673 add attachment to parse_profile_start() return values
Add the attachment to the parse_profile_start() and
serialize_parse_profile_start() return values, and adjust the functions
calling the *parse_profile_start() functions to save the attachment in
the "attachment" variable (which isn't used yet).

Also adjust the tests for the added return value.

(Sorry for not getting the resultset right from the beginning!)



Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 23:58:29 +02:00
Christian Boltz
0478f6bb11 Add support for attachments to write_header()
Also fix a little bug that added the profile keyword if the path needed
quotes (profile "/foo bar" - but "/foo bar" is enough). This was caused
by a regex that always matched on quoted paths (hint: "/ matches
^[^/] ;-)

Also add some tests with attachments and update the test for the bugfix
mentioned above.


Now the remaining part is to make sure that prof_data['attachment'] gets
set when parsing the profiles :-)



Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 23:50:04 +02:00
Christian Boltz
80e33751c9 add tests for write_header()
Also add loop support to test-aa.py.

BTW: In case you wonder - the need to replace unittest.TestCase with
AATest is intentional. It might look annoying, but it makes sure that
a test-*.py file doesn't contain a test class where tests = [...] is
ignored because it's still unittest.TestCase.
(Technically, setup_all_tests() will error out if a test class doesn't
contain tests = [...] - either explicit or via its parent AATest.)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 23:48:50 +02:00
Christian Boltz
35382be8d0 add tests for set_profile_flags() (and some fun)
Add various tests for set_profile_flags, and document various
interesting[tm] things I discovered while writing the tests (see
the inline comments for details).

Also adds a read_file() function to common_test.py.


The most interesting[tm] thing I found is:
    regex_hat_flag = re.compile('^([a-z]*)\s+([A-Z]*)\s*(#.*)?$')
which matches various unexpected things - but not a hat :-/
(see mailinglist for all funny details)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 23:43:29 +02:00
Christian Boltz
b8f0a5cbb2 convert serialize_parse_profile_start() to use parse_profile_start_line()
Convert serialize_parse_profile_start() to use
parse_profile_start_line(), and adjust a test to expect an AppArmorBug
instead of an AttributeError exception.

Also add two tests (they succeed with the old and the new code).
Note that these tests document interesting[tm] behaviour - I tend to
think that those cases should raise an exception, but I'm not sure about
this because serialize_profile_from_old_profile() is a good example for
interesting[tm] code :-/

I couldn't come up with a real-world test profile that would hit those
cases without erroring out aa-logprof earlier - maybe the (more
sane-looking) parse_profiles() / serialize_parse_profile_start()
protects us from hitting this interesting[tm] behaviour.



Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 10:58:27 +02:00
Christian Boltz
90efcd7a92 add tests for serialize_parse_profile_start() to test-aa.py
to document the function's behaviour.

Acked-by: Steve Beattie <steve@nxnw.org>
2015-04-01 10:57:24 +02:00
Christian Boltz
3ef67876cb add forgotten test-example.py
The commit message for r2976 says:

    [...]
    The patch also adds test-example.py, which is
    - a demo of the code added to common_test.py
    - a template file that we can copy for future test-*.py

    Acked-by: Steve Beattie <steve@nxnw.org>

but I forgot to add test-example.py to bzr, which I hereby do.
2015-04-01 10:55:33 +02:00
Christian Boltz
4ad6f486f8 update test-aa.py to match parse_profile_start() and get_profile_flags() changes
The previous patch slightly changed the behaviour of parse_profile_start()
and get_profile_flags() - they raise AppArmorBug instead of
AppArmorException when specifying a line that is not the start of a
profile and therefore doesn't match RE_PROFILE_START_2.

This patch updates test-aa.py to expect the correct exceptions, and adds
another test with quoted profile name to ensure that stripping the
quotes works as expected.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-31 22:45:45 +02:00
Christian Boltz
da35c243d9 add and use parse_profile_start_line()
Add the parse_profile_start_line() function to regex.py, which is a
wrapper for RE_PROFILE_START_2 and returns an array with named matches.

Also change some places in aa.py from using RE_PROFILE_START to the
parse_profile_start_line() function.

Notes:
- until everything is migrated to the new function, I'll keep the old
  RE_PROFILE_START unchanged - that's the reason to add the new regex
  as RE_PROFILE_START_2
- the patch changes only aa.py sections that are covered by tests already
  (which means some users of RE_PROFILE_START are remaining)
- parse_profile_start_line() merges 'profile' and 'attachment' into
  'profile' (aka the old, broken behaviour) until aa.py can handle the
  attachment properly. The alternative would be to ignore 'attachment',
  which would be worse.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-31 22:44:18 +02:00
Christian Boltz
d0d101779a Convert test-regex_matches.py to the new tests[] loop.
The test behaviour is the same with and without this patch - 166 tests
run, all successful.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-31 22:31:36 +02:00
Christian Boltz
7e8191400f add better loop support to common_test.py
Add better support for looping over a tests[] array to common_test.py:
- class AATest - a base class we can use for all tests, and that will
  probably get more features in the future (for example tempdir
  handling)
- setup_all_tests() - a function that iterates over all classes in the
  given file and calls setup_test_loops() for each of them
- setup_tests_loop() - a function that creates tests based on tests[]
  in the given class. Those tests call the class' _run_test() method for
  each test specified in tests[]  (inspired by setup_regex_tests() ;-)

This means we can get rid of the manually maintained tests list in
test-regex_matches.py and just need to call setup_all_tests() once in
each file.

The patch also adds test-example.py, which is
- a demo of the code added to common_test.py
- a template file that we can copy for future test-*.py


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-31 22:29:06 +02:00
Steve Beattie
573cfb6b04 fix two issues for older releases
The following patch addresses two issues on older releases:

1) In trunk commit 2911, the line 'undefine VERBOSE' was added to
   parser/tst/Makefile so that the equality tests would not generate
   verbose output when $VERBOSE != 1. Unfortunately, the 'undefine'
   keyword was not introduced in GNU Make until version 3.82. On
   distro releases like Ubuntu 12.04 LTS that include versions of Make
   older than that, make check and make clean abort when VERBOSE is
   not set to 1. The patch fixes that by setting VERBOSE to a zero
   length string if does not already equal 1.

2) In trunk commit 2923, a workaround for systemd as init was added
   to the pivot_root regression test. The workaround included a
   call to ps(1) to determine if systemd is pid 1. Unfortunately,
   in older versions of the procps package (such as the version in
   Ubuntu 12.04 LTS), 'ps -hp1' emits the warning

     Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html

   The patch below converts the ps call to 'ps hp1' which does not
   generate the warning.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-31 02:46:45 -07:00
Steve Beattie
60332f87a2 profiles: update dnsmasq profile for lxc support
Merge from Cameron Norman <camerontnorman@gmail.com> based on a patch
from Christian Boltz <apparmor@cboltz.de>.

This patch allows /var/lib/misc/dnsmasq.*.leases rw and
/{,var/}run/lxc/dnsmasq.pid rw for LXC networking setup.

Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-30 22:05:09 -07:00
Cameron Norman
26676135c2 usr.sbin.dnsmasq: add lxc-net paths 2015-03-29 20:49:09 -07:00
Jamie Strandboge
0fda13bfa5 add --include-templates-dir and --include-policy-groups-dir options to easyprof
to support framework policy on Snappy for Ubuntu Core

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>

Bug: https://launchpad.net/bugs/1403468
2015-03-28 07:18:17 -05:00
Jamie Strandboge
4951c29c11 incorporate feedback from Seth Arnold:
- fix typo in comment
- error() instead of warn() if can't find specified group
2015-03-28 07:16:22 -05:00
Jamie Strandboge
316c615644 merge from trunk 2015-03-27 17:25:23 -05:00
Jamie Strandboge
9e33b760cd implement tests for --include-templates-dir and --include-policy-groups-dir 2015-03-27 16:34:32 -05:00
Jamie Strandboge
0438db70b5 utils/aa-easyprof.pod: corrections for --show-templates and
--show-policy-groups
2015-03-27 16:33:35 -05:00
Jamie Strandboge
2652642c27 update copyright year for modified files 2015-03-26 17:14:52 -05:00
Jamie Strandboge
f47c54984d add --include-templates-dir and --include-policy-groups-dir options to
easyprof to support framework policy on snappy
2015-03-26 16:59:05 -05:00
Tyler Hicks
0d06dfa24c libapparmor: Fix FTBFS when secure_getenv() is not available
Allow libapparmor to build on older systems where secure_getenv() is
still named __secure_getenv(). This snippet was taken from the glibc
wiki:

 https://sourceware.org/glibc/wiki/Tips_and_Tricks/secure_getenv

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-26 16:25:16 -05:00
Tyler Hicks
5a17ffb598 libapparmor: Fix memory leak when freeing aa_policy_cache objects
The two internal aa_features objects weren't being unreferenced when the
aa_policy_cache object was being freed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-26 10:19:50 -05:00
Tyler Hicks
6da919d400 tests: Add regression tests for the aa_policy_cache API
The aa_features and aa_kernel_interface APIs get a little bit of
testing, as well.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-26 10:19:46 -05:00
Tyler Hicks
fc8d3d4edc libapparmor: Don't leak memory after a realloc(3) failure
realloc() returns NULL when it fails. Using the same pointer to specify
the buffer to reallocate *and* to store realloc()'s return value will
result in a leak of the previously allocated buffer upon error.

These issues were discovered by cppcheck.

Note that 'buffer' in write_policy_fd_to_iface() has the autofree
attribute so it must not be manually freed if the realloc(3) fails as
it'll be automatically freed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
95bbb0ab3f libapparmor: Remove casts while allocating memory
The libapparmor library is built with gcc, while the parser is built
with g++. The parser code needs to cast pointers returned from the
malloc(3) family of calls. However, code removed from the parser to
libapparmor can drop the casts.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
126472b561 libapparmor: Protect _aa_autofree users from freeing bad pointers
Creates a libapparmor function, _aa_asprintf(), which sets the *strp to
NULL on error. This is needed for all of the users of the _aa_autofree
cleanup attribute because the value of *strp is undefined when
asprintf() fails and that could result in _aa_autofree() being passed a
pointer value that it should not free.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
d862fa8d4c parser: Remove atomic ops
The parser no longer has a need for the atomic operations since all
callers have been moved to libapparmor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
333e3cc8d8 libapparmor: Move the aa_policy_cache API
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
9a073b8f87 parser: Lift globals from create_cache()
With create_cache() headed for libapparmor, we can't use the show_cache
or write_cache globals.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
ae231a8812 libapparmor: Add macro for the gcc "unused" attribute
As code is moved from the parser to libapparmor, the libapparmor code
base will need to have the "unused" macro defined. This macro will need
to be duplicated in the parser and libapparmor due to it being a
compiler-specific macro that shouldn't be exported from libapparmor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
7630b8aeb8 libapparmor: Move the aa_kernel_interface API
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
4b829aa53e libapparmor: Rename kernel_interface.c to kernel.c
The existing kernel_interface.c file collides with the expected file
name of the implementation of the aa_kernel_interface API.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
c8b93aed48 libapparmor: Move the aa_features API
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
1d60aca8a8 parser: Don't use gettext(3) in code that will be moved to libapparmor
Remove the use of the "_" macro, which translates into gettext(3), from
code that will be used from the parser to libapparmor since libapparmor
will not support gettext(3) for debug messages and syslog messages.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
ab181805f7 libapparmor: Temporarily duplicate the parser's atomic ops
The parser's copy of the two atomic operations will be removed once the
new API's (aa_features, aa_policy_cache, aa_kernel_interface) are moved
from the parser to libapparmor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
deec20512b libapparmor: Move over the lib functions needed by cache loading code
The function names must be prepended with "_aa_" since they're going to
be exported from libapparmor. The code bases using the _aa_autofree(),
_aa_autoclose(), and _aa_autofclose() will need to internally alias
those functions to the previously used autofree, autoclose, and
autofclose names.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
6b200b6f08 libapparmor: Add basic logging functionality
This patch adds equivalents of the parser's PDEBUG() and PERROR()
functions to libapparmor.

It does not add gettext(3) support to libapparmor since these are
messages that only developers will see (debug builds with
LIBAPPARMOR_DEBUG=1) or messages that go to the syslog.

PDEBUG() does nothing unless libapparmor is built with --enable-debug.
It prints to stderr if libapparmor is built with --enable-debug and the
LIBAPPARMOR_DEBUG environment variable is set.

PERROR() uses syslog(LOG_ERR, ...) by default. The message is sent to
the syslog and to stderr if libapparmor is built with --enable-debug and
the LIBAPPARMOR_DEBUG environment variable is set.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
27ac220535 libapparmor: Require and build libapparmor with C99 mode
This is needed for some of the parser functionality that will be moved
to libapparmor. In the short term, only the 'bool' type is needed but it
makes sense to simply require a C99 compliant compiler for libapparmor
since the parser is being rewritten in C++. The use of C99 will reduce
future headaches when moving code between the two code bases.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
2879cf217a libapparmor: Create a private API
This patch creates a private API in libapparmor in which upstream
provides no guarantees in regards to ABI stability.

A new header file, <sys/apparmor_private.h>, is created. The "_aa"
prefix will be used for symbols belonging to the private API.

To kick things off, a library friendly version of is_blacklisted() is
moved into libapparmor.

The purpose of a private libapparmor API is to prevent duplicated code
between the parser and libapparmor. This becomes an issue as we prepare
to move chunks of the parser into libapparmor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
7e218b758d parser: Add aa_policy_cache function to replace all policies
This may be useful for something like an init daemon that simply wants
to load all cached binaries without worrying about any sort of policy
compilation.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:27 -05:00
Tyler Hicks
9aa29f4117 parser: Finalize the aa_kernel_interface API
Create new, ref, and unref functions for aa_kernel_interface. The "new"
function allows for the caller to pass in an aa_features object that is
then used to check if the kernel supports set load operations.
Additionally, the "new" function allows for the apparmorfs path to be
discovered once instead of during every policy load.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
f2154ca65d parser: Use aa_kernel_interface API in parser_interface.c
__sd_serialize_profile() had a duplicated implementation for writing to
apparmorfs interface files after a profile compilation. This patch
migrates it to the new aa_kernel_interface API.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
a23b6a1f81 parser: Shove binary file and fd reading into kernel_interface.c
This is the start of the kernel_interface API that allows callers to
specify a buffer, a file path, or a file descriptor that should be
copied to the proper kernel interface for loading, replacing, or
removing in-kernel policies.

Support exists for reading from a file path or file descriptor into a
buffer and then writing that buffer to the appropriate apparmorfs
interface file.

An aa_kernel_interface_write_policy() function is also provided for
callers that want to route a buffer to an arbitrary file descriptor
instead of to an apparmorfs file. This is useful when an admin instructs
apparmor_parser to write to stdout or a file.

Additionally, it removes some parser-specific globals from the
kernel_interface.c file, such as OPTION_{ADD,REPLACE,REMOVE}, in
preparation for moving the code into a library.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
8553727414 parser: Add policy cache function for cache removal
This function allows for a policy cache to be removed without having a
previously instatiated aa_policy_cache object. It simply works off of a
path.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
f0fcf23231 parser: Create initial interface for policy cache
This API has the same look-and-feel of the previous aa_features API.

The cache setup code was heavily dependent on globals set by CLI
options. Options such as "skip the read cache", or "skip the write
cache", or "don't clear the cache if it isn't valid", won't be useful
for all aa_policy_cache API users so some of that logic was lifted out
of the API. The constructor function still provides a bool parameter
that specifies if the cache should be created or not.

If the policy cache is invalid (currently meaning that the cache
features file doesn't match the kernel features file), then a new
aa_policy_cache object is still created but a call to
aa_policy_cache_is_valid() will return false. The caller can then decide
what to do (create a new valid cache, stop, etc.)

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
d93d00cca9 parser: Deprecate the --create-cache-dir option
This option adds unneeded complexity to the parser CLI and the upcoming
aa_policy_cache API. Get rid of it and simply create the cache dir if
--write-cache is specified.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
5b85282e9f parser: Create aa_features function to write features to a file
This patch removes the final dependency on callers needing access to the
features string so aa_features_get_string() can go away.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
4d1fa49c37 parser: Add functions for features support tests
Defines a function that can be called to test features support. It is
string based which allows the support tests to work with new kernel
features without any changes.

The use of global variables in the parser to store and check features
support is still preserved. The parser should probably move over to
passing the aa_features object around but that's left for later.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
0742edf5ba parser: Add features comparison function
This is a simple aa_features equality test. Placing it behind a function
call allows us to do something more complex than a simple string
comparison later.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
f896a64152 parser: Remove exits from features code
This is done in preparation for moving the features code to a library.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
45ac621f26 parser: Begin to flesh out library interface for features
The aa_features_new_*() functions create an aa_features object. They can
be thought of as the constructor of aa_features objects. A number of
constructors are available depending on whether the features are coming
from a file in the policy cache, a string specified on the command line,
or from apparmorfs.

The aa_features_ref() and aa_features_unref() functions are used to grab
and give up references to an aa_features. When the ref count hits zero,
all allocated memory is freed. Like with free(), aa_features_unref() can
be called with a NULL pointer for convenience.

Pre-processor macros are hidden behind functions so that they don't
become part of our ABI when we move this code into libapparmor later on.

A temporary convenience function, aa_features_get_string(), is provided
while code that uses aa_features is migrated from expecting raw features
string access to something more abstract. The function will be removed
in an upcoming patch.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
3091940d31 parser: Clean up snprintf_buffer()
snprintf_buffer() needed to be modified in order to properly return error
conditions up the stack, instead of exiting, but there were some other
cleanups that it could use.

It was obviously implemented with the features_struct in mind so this
patch simplifies the input parameters by directly accepting a
features_struct pointer. Also, the name is changed to reflect that it is
intended to work on a features_struct instead of an arbritrary buffer.

A quick sanity check is added to make sure that the features_struct.pos
value isn't pointing past the end of the buffer.

The printf(3) family of functions can return a negative value upon error
so a check of the return value of vsnprintf(3) is added.

Finally, the return values of the function are simplified to 0 on
success or -1, with errno set, on error. This is possible since
features_struct.pos can be internally updated after a successful
vsnprintf(3).

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
a417a51724 parser: Add support for atomic inc and dec
These operations will be used for grabbing and releasing references to
objects. They leverage the GCC builtins for atomic operations.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
22993081c8 parser: Lift force_clear_cache handling from setup_cache()
This keeps us from having to use the force_clear_cache global in
policy_cache.c.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
d2e3f806c0 parser: Don't use the basedir global in setup_cache()
Require the caller of setup_cache() to pass in a valid cache location
string. This removes the use of the basedir global from the
policy_cache.c file.

Additionally, it is no longer necessary to return the "cache dir" path
from setup_cache() since it will always be the same as the input path.
The return value is changed to an int so an error code can be returned
instead of using exit().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
d02bb58b70 parser: Get rid of the cacheloc global
Modify setup_cache() to accept the user-supplied cacheloc and return the
validated or created cache directory. The caller must then track that
variable and pass it into any parser/policy_cache.c functions that need
it.

The main reason for this change is that the cache location and the cache
directory will soon be two different paths. The cache location will
typically be the parent of the cache directory.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
Tyler Hicks
0f12effabf parser: Move policy cache initialization code into its own function
This patch moves the logic that sets up the policy into a new function
in policy_cache.c

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
2a082ee543 parser: Move policy cache functionality into policy_cache.c
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Fixed build failures]
[tyhicks: Fixed bug where a warning was being printed when it shouldn't]
[tyhicks: Forward ported to trunk]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
4970d40e0d Add fns to handle profile removal to the kernel interface
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Forward ported patch to trunk]
[tyhicks: remove commented out code]
[tyhicks: fix use after free]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
4e712f6c8d split routines for loading binary policy into its own file
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Handle inverted return from find_subdomainfs_mountpoint()]
[tyhicks: Link test progs to libapparmor to fix make check build fail]
[tyhicks: Migrate from opendir() to open() for opening apparmorfs]
[tyhicks: Make some of the split out functions static]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
076bc6be7a With the auto cleanup changes we can now directly return the value if we have a cache hit.
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Forward ported patch to trunk]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
f62cc5c6bf Use the gcc cleanup extension attribute to handle closing temp files
While some of these allocations will go away as we convert to C++,
some of these need to stay C as the are going to be moved into a
library to support loading cache from init daemons etc.

For the bits that will eventually be C++ this helps clean things up,
in the interim.

TODO: apply to libapparmor as well

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
82904cf0e6 Use the gcc cleanup extension attribute to handle freeing temp allocations
While some of these allocations will go away as we convert to C++,
some of these need to stay C as the are going to be moved into a
library to support loading cache from init daemons etc.

For the bits that will eventually be C++ this helps clean things up,
in the interim.

TODO: apply to libapparmor as well

Signed-off-by: John Johansen <john.johansen@canonical.com>
2015-03-25 17:09:26 -05:00
John Johansen
2dd3fa9383 split the policy cache handling fns into their own file
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Don't move globals in favor of lifting those out later]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:25 -05:00
John Johansen
4959e2e2a8 Move feature handling code into its own file
Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Forward ported patch to trunk]
[tyhicks: Don't move set_supported_features()]
[tyhicks: Don't move set_features_by_match_file()]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-25 17:09:25 -05:00
John Johansen
c85bca38f5 fix cache write to not happen when skip-bad-cache is specified
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 17:09:25 -05:00
John Johansen
2b240461a7 change cache check so that debugging can see which file caused failure
Currently the cache tracks the most recent timestamp of parsed files
and then compares that to the cache timestamp. This unfortunately
prevents the parser from being able to know which files caused the
cache check failure.

Rework the cache check so that there is a debug option, and that
the cache file timestamp is set first so that we can output
a deug message for each file that causes a cache check failure.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Forward ported to trunk and minor cleanups]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-25 17:09:25 -05:00
Tyler Hicks
afb3cd0b06 parser: Honor USE_SYSTEM make variable in libapparmor_re
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-25 17:09:25 -05:00
Seth Arnold
ec3c202ca2 Add new gdm path for Xauthority file
Bruce Pieterse reports that AppArmor denied evince, among other
applications, from starting properly:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1432126

He tested a slight variant of the attached patch and reported success. I
propose this patch for both trunk and 2.9.

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-25 14:58:31 -07:00
Steve Beattie
95ae1c5e8b tests: work around systemd mounting / shared in pivot_root tests
The systemd init daemon mounts the / filesystem as shared [1], which
breaks pivot_root(2). The following patch adjusts the pivot_root
test script to remount / as private if it detects that its shared,
allowing the tests to run successfully, and then undoes it once the
tests are complete.

[1] http://cgit.freedesktop.org/systemd/systemd/commit/?id=b3ac5f8cb98757416d8660023d6564a7c411f0a0

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-24 15:59:44 -07:00
John Johansen
471f90e499 Fix unresolved Merge conflict in apparmor.d.pod RLIMIT RULE
Signed-off-by: John Johansen <john.johansen@canonical.com>
2015-03-24 14:56:40 -07:00
John Johansen
553d98cf9c Add basic documentation of apparmor rlimit controls
buglink: https://launchpad.net/bugs/1429202

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:54:10 -07:00
John Johansen
ebef7d0ca1 update apparmor.d man page to file rule pattern
Update the file rule pattern to show it is possible to specify a bare
file rule. Eg.

  file,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:53:03 -07:00
John Johansen
a41a887c17 Fix use of FILEGLOB in apparmor.d.pod
Refactor FILEGLOB so that it means both quoted and unquoted file globs.

Also
FILEGLOB was uncorrectly referenced in a few places where it should have
allowed for quoting.

There were also a few places that provided a parameter description with
FILEGLOB without defining that that is full equivalent to FILEGLOB.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:58 -07:00
John Johansen
4ba7f860ac Add basic info about link rules to apparmor.d man page
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:51 -07:00
John Johansen
c92b5c71e5 Update apparmor.d man page to document file rules with leading permissions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:43 -07:00
John Johansen
6c5cf445c4 Update exec transition documentation.
Add miss ix and ux fallback permission modes, named profile transitions.
Also fix the file access modes and rule pattern to properly reflect
what is allowed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:36 -07:00
John Johansen
cf68b13042 Add basic documentation of change_profile rules to apparmor.d man page
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:31 -07:00
John Johansen
45df80b972 Update qualifier information in the man page
Consolidate and update the qualifier information in the man page.
Most of the rule qualifiers where duplicated instead of being pulled
into a common section.

Also the rule qualifiers where missing the 'allow' qualifier.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:24 -07:00
John Johansen
7fb067c9d6 Update capability rule description in man page
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-24 03:52:16 -07:00
Steve Beattie
11db55a2fc parser: Expand Equality tests touchups
- verify audit and audit allow is equal
- verify audit differs from deny and audit deny
- verify deny differs from audit deny
- make the verbose text a little more useful for some cases
- correct overlap exec tests to substitute in looped perms

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-23 11:55:48 -07:00
Steve Beattie
cecbcb0912 parser: make equality.sh honor env variable VERBOSE
- make the verbose output of equality.sh honor whether or not
  the environment variable VERBOSE is set

- thereby making the output verbose when 'make check V=1' or 'make
  check VERBOSE=1' is given from within the parser/ directory. This
  will make distribution packagers happy when diagnosing build
  failures caused by test failures.

- if verbose output is not emitted and the tests were successful, emit
  a newline before printing PASS.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-23 11:45:45 -07:00
John Johansen
0bfad115cd parser: Expand Equality tests
This adds several new equality tests and turned up a couple of more
bugs
https://launchpad.net/bugs/1433829
https://launchpad.net/bugs/1434018

- add link/link subset tests
- add pix, Pix, cix, Cix, pux, Pux, cux, Cux and specified profile
  transitions (/f px -> b ...)
- test equality of leading and trailing permission file rules
  ie.   /foo rw, == rw /foo,
- test that specific x match overrides generic x rule. ie.
  /** ix, /foo px, is different than /** ix, /foo ix,
- test that deny removes permission
  /f[abc] r, deny /fb r,  is differnt than /f[abc] r,

In addition to adding the new tests, it changes the output of the
equality tests, so that if the $verbose variable is not set successful
tests only output a period, with failed tests outputing the full
info.  If verbose is set the full test info is output as before.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-23 11:39:44 -07:00
John Johansen
80285dfafb parser: fix compilation failure of deny link rules
BugLink: http://bugs.launchpad.net/bugs/1433829

The apparmor_parser fails to compile deny rules with only link
permissions.

  Eg.
       deny /f l,
       deny l /f,
       deny link /f -> /d,

Will all fail to compile with the following assert

  apparmor_parser: aare_rules.cc:99: Node* convert_file_perms(int, uint32_t, uint32_t, bool): Assertion `perms != 0' failed.

NOTE: this is a minimal patch a bigger patch that cleans-up and separates
      and reorganizes file, link, exec, and change_profile rules is needed

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-23 11:25:48 -07:00
Christian Boltz
727f3948ec dovecot auth needs to read openssl.cnf
Darix' guess is that this is needed by libpq because he uses a postgresql
database with dovecot and has ssl enabled in postgresql.

Acked-by: Seth Arnold <seth.arnold@canonical.com> for trunk and 2.9
2015-03-19 13:56:41 +01:00
Steve Beattie
ef4e59256b parser: fix equality and valgrind test scripts to use features file
This patch fixes the equality test script and the valgrind wrapper
script to make the parser under test use the features.all features file
from the features_files/ subdirectory. Otherwise, the equality tests
will fail on systems where the not all of the current language features
are supported. The equality fix does so in a way to make the script work
correctly regardless of the directory it is run from.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-19 04:35:08 -07:00
Steve Beattie
1b1a0d448d parser: fix warning in net_find_af_name
The fix to prevent the compiler from SEGV'ing when dumping network
rules in commit 2888 introduced the following compiler warning:

  network.c: In function ‘const char* net_find_af_name(unsigned int)’:
  network.c:331:16: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
    for (i = 0; i < sizeof(network_mappings) / sizeof(*network_mappings); i++) {

The problem is that the counter i is an int, but sizeof returns size_t
which is unsigned. The following patch fixes the issue by converting the
type of i to size_t.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-19 00:12:09 -07:00
Tyler Hicks
a11a39dd28 parser: Test the 'allow' modifier
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-18 12:34:29 -05:00
Tyler Hicks
92c3b802db parser: Test the 'audit allow' modifier
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-18 12:34:27 -05:00
Tyler Hicks
8700b5297a parser: Verify policies change with the audit and deny modifiers
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-18 12:34:24 -05:00
Tyler Hicks
98ca025c5c parser: Add ability to test the inequality of binary policies
Previously, we only had the ability to test that binary policy files
were equal. This patch allows for the testing of binary policy files
that are not equal.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-03-18 12:34:19 -05:00
John Johansen
d22a867723 Fix compilation of audit modifiers
This fixes the incorrect compilation of audit modifiers for exec and
pivot_root as detailed in

https://launchpad.net/bugs/1431717
https://launchpad.net/bugs/1432045

The permission accumulation routine on the backend was incorrectly setting
the audit mask based off of the exec type bits (info about the exec) and
not the actual exec permission.

This bug could have also caused permissions issues around overlapping exec
generic and exact match exec rules, except the encoding of EXEC_MODIFIERS
ensured that the
  exact_match_allow & AA_USER/OTHER_EXEC_TYPE
  test would never fail for a permission accumulation with the exec permission
  set.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-18 10:05:55 -07:00
Launchpad Translations on behalf of apparmor-dev
556babd125 Launchpad automatic translations update. 2015-03-18 05:08:23 +00:00
Launchpad Translations on behalf of apparmor-dev
17397a655b Launchpad automatic translations update. 2015-03-11 05:08:58 +00:00
Christian Boltz
0636dea5c6 Split off serialize_parse_profile_start_line() from
serialize_profile_from_old_profile() in aa.py, as a preparation to add
tests and then switch to the upcoming RE_PROFILE_START wrapper function.

Besides moving the code, I replaced write_prof_data[profile][hat]['profile']
and write_prof_data[profile][hat]['external'] with function parameters
to avoid that I have to pass around the full write_prof_data.

Note: The "lineno" parameter is technically superfluous - I kept it to
have the parameters as close to parse_profile_start() as possible and
hope that I can merge those functions later (when we have test coverage).


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-03-10 19:08:17 +01:00
Steve Beattie
5b92ef4b10 parser: adjust parser.conf example Include statements
The parser.conf example statement for Include statements used
/etc/apparmor.d/abstractions which is unlikely to make anyone enabling
it happy as our shipped and example policies all include the
'abstractions/' directory in the relative paths. This patch adjusts the
example and provides a second example, based on an enabled entry as
shipped in Ubuntu.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-03-09 10:43:13 -07:00
Christian Boltz
6eb46b7b0c klogd, syslog-ng and syslogd moved from /sbin/ to /usr/sbin/ on openSUSE.
Therefore this patch updates the profile to follow the move and makes
sure the profiles are actually used.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-07 21:16:11 +01:00
Christian Boltz
d1900f42c7 tools.py: add functions to unload and reload profiles
and change the code to use them.

Also add a comment to act() that it's only used by aa-cleanprof.

Note: The new functions add the --base parameter to the apparmor_parser
calls, which also means the disable directory inside the given profile
dir (and not always /etc/apparmor.d/disable) is now honored.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-03-07 20:30:55 +01:00
Christian Boltz
05f78ee733 merge 'path' if conditions in logparser.py / add_event_to_tree()
logparser.py / add_event_to_tree() has 5 places to handle 'path' events.
This patch merges most if conditions to reduce that to 2 places.

It also makes the matching a bit more strict - instead of using 'in',
'xattr' has to be an exact match and 'file_' is matched with startswith().

Also, 'getattr' is added to the list of file events.


Acked-by: Steve Beattie <steve@nxnw.org>


---------- trunk only, unclear for 2.9 --------------
2015-03-07 13:26:10 +01:00
Christian Boltz
411436e32b let load_include raise an exception if an include file can't be found
instead of ignoring the error silently

Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-03-07 13:25:24 +01:00
Christian Boltz
0c216daa9f add read_profiles() call to cmd_disable()
Without it, aa-disable
- didn't error out when hitting a broken profile directory
- didn't find a profile if it doesn't use the default naming scheme
  (for example /bin/true profile hiding in bin.false)


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-03-07 13:24:19 +01:00
Steve Beattie
ce19fe7fde profiles: add mir abstraction
As mir has come into use in Ubuntu touch and is available for testing on
Ubuntu desktop, confined apps need access to a few mir specific things.
This patch adds a mir abstraction.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-03-05 11:46:11 -08:00
Alain BENEDETTI
f29e4a3965 utils/aa-status: don't crash when non-ASCII mountpoints are in use
aa-status was crashing when parsing through /proc/mounts looking to see
if and where the securityfs synthetic file system is mounted if there
was a mount point that contained characters outside of the charset in
use in the environment of aa-status. This patch fixes the issue by
converting the read of /proc/mounts into a binary read and then uses
decode on the elements.

Patch by Alain BENEDETTI.
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-03 22:17:05 -08:00
Tyler Hicks
15e9f2790e parser: Fix error checking of file opening in features_dir_cb()
The error path was being taken when openat() return 0 but openat()
returns -1 on error.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-03 20:28:22 -06:00
Christian Boltz
2867f0d656 Add test for disconnected path
As a follow-up to the logparser.py change that converts disconnected
path events to an error, add a testcase to test-logparser.py.


Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-03-03 22:17:05 +01:00
Steve Beattie
98c6087c54 regression tests: fix gcc-5 inline confusion
Parts of the regression tests that use the do_open() inline function
from changehat.h fail to build under gcc-5 like so:

  cc -g -O0 -Wall -Wstrict-prototypes    changeprofile.c  -lapparmor  -o changeprofile
  /tmp/ccT6GE6k.o: In function `main':
  /home/ubuntu/bzr/apparmor/tests/regression/apparmor/changeprofile.c:43: undefined reference to `do_open'
  collect2: error: ld returned 1 exit status
  <builtin>: recipe for target 'changeprofile' failed

This patch converts the do_open function declaration to be static
inline, which apparently keeps gcc-5 from getting confused.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-03 11:38:40 -08:00
Steve Beattie
fc3a7f49cf parser: net_find_af_name: do not assume that address families are consecutive,
remove unused net_find_af_val function, and network_families array

Merge fixes from Philip Withnall and Simon McVittie.
2015-03-03 11:33:34 -08:00
Christian Boltz
7262b71d47 move strip_quotes() from aa.py to regex.py
The upcoming function parse_profile_start() (which is a wrapper around
the updated RE_PROFILE_START, and will live in regex.py) needs
strip_profile(), but importing it from aa.py fails with an import loop.
Therefore this patch moves strip_quotes() from aa.py to regex.py and
re-imports it into aa.py.

As a bonus, the patch also adds some tests for strip_quotes() ;-)


Also add TestStripQuotes to the test_suite list because it won't run
otherwise.

Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9
2015-03-03 20:15:00 +01:00
Christian Boltz
55a2809a5a aa.py: split off parse_profile_start() from parse_profile_data() and add tests
Move the code for parsing the profile start ("/foo {") from aa.py
parse_profile_data() to a separate function parse_profile_start().

Most of the changes are just moving around code, with some small
exceptions:
- instead of handing over profile_data to parse_profile_start() to
  modify it, it sets two variables (pps_set_profile and
  pps_set_hat_external) as part of its return value, which are then
  used in parse_profile_data() to set the flags in profile_data.
- existing_profiles[profile] = file   is executed later, which means
  it used the strip_quotes() version of profile now
- whitespace / tab level changes

The patch also adds some tests for the parse_profile_start() function.



Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 21:12:12 +01:00
Christian Boltz
485fde8c50 split flags_bad5.sd parser test into multiple tests
flags_bad5.sd contains tests to ensure the debug flag is no longer
accepted.

However, the file contains multiple expected failures, which means that
it will still fail as long as at least one of them fails. This patch
splits each test into its own file to ensure each of them fails.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 19:56:07 +01:00
Christian Boltz
49bc4efa1e Add parser tests for empty flags (which result in "syntax error")
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 19:48:30 +01:00
Christian Boltz
c469b92afb Add some tests for aa.py get_profile_flags().
Also adds a check to get_profile_flags() to catch an invalid syntax:
    /foo (  ) {
was accepted by get_profile_flags, while
    /foo () {
failed.

When testing with the parser, both result in a syntax error, therefore
the patch makes sure it also fails in get_profile_flags().


Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 19:36:20 +01:00
Tyler Hicks
54841a1986 parser: Fix "PDEBUG" redefined warning
Only present when building with DEBUG=1.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-02 09:50:17 -06:00
Tyler Hicks
4bb5fb6003 parser: Fix -Wformat-extra-args warning
Only present when building with DEBUG=1.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 09:50:14 -06:00
Tyler Hicks
6d1bcdf549 parser: Send PDEBUG() to stderr
PDEBUG() and PERROR() should both go to stderr.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-03-02 09:50:11 -06:00
Tyler Hicks
65b0048aae parser: Fix return value of dirat_for_each()
Seth pointed out that dirat_for_each() didn't correctly handle the
return value from readdir_r(). On error, it directly returns a positive
errno value. This would have resulted in that positive errno value being
returned, with an undefined errno value set, from dirat_for_each().
However, the dirat_for_each() documentation states that -1 is returned,
with errno set, on error.

This patch results in readdir_r()'s return value being handled
appropriately. In addition, it ensures that 0 is always returned on
success.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reported-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-03-02 09:50:07 -06:00
Christian Boltz
cec9b0d09f cleanup smbd profiles
The smbd profile contains /{,var/}run/cups/cups.sock rw, which is
covered by abstractions/cups-client and therefore superfluous.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-28 21:35:18 +01:00
Christian Boltz
0166960844 let logparser.py parse_event() change disconnected path events to 'ERROR'
This means that aa-logprof will ignore the event instead of crashing with
    AppArmorException: 'Unexpected rank input: var/run/nscd/passwd'

Note that I made the check as specific as possible to be sure it doesn't
hide other events.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=918787


Acked-by: Steve Beattie <steve@nxnw.org>



Also update test-capability.py - it contains a test that needs
    'error_code': 0,
added to avoid a failure.

Patch by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-02-28 14:09:45 +01:00
Steve Beattie
d0304227e6 profiles: add geary email client to ubuntu-email abstraction
Merge from Cameron Norman <camerontnorman@gmail.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-27 23:24:11 -08:00
Felix Geyer
e2eebe08a8 profiles: allow aspell access to /usr/share/aspell/
From: Felix Geyer <debfx@ubuntu.com>

At least Debian/Ubuntu started shipping some aspell files in
/usr/share/aspell/.
For example:
/usr/share/aspell/iso-8859-1.cmap
/usr/share/aspell/iso-8859-1.cset

The abstraction should allow read access to these files.

Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-27 23:14:03 -08:00
Steve Beattie
a3433dc170 profiles: add support for /etc/pki/ in ssl certs abstraction
These appear to be related to the update-ca-trust tool.

Thanks to Gregor Dschung.
2015-02-27 22:42:06 -08:00
Christian Boltz
4939f7ce14 cleanup aa-disable handling in tools.py
Remove the check if the disable directory exists. If it's really
missing, it will be auto-created by create_symlink(), so we
automagically fix things instead of annoying the user with an
error message ;-)

Acked-by: Steve Beattie <steve@nxnw.org> for both trunk and 2.9.
2015-02-28 00:24:11 +01:00
Philip Withnall
8782872fe2 Remove unused net_find_af_val function, and network_families array
Like net_find_af_name, this assumed that AF_* values were consecutive.

[smcv: split out from a larger patch, added commit message,
removed dead declaration]
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-27 16:20:31 +00:00
Philip Withnall
097c520293 net_find_af_name: do not assume that address families are consecutive
The network_families array is automatically built from AF_NAMES, which is
extracted from the defines in <bits/socket.h>. The code assumes that
network_families is indexed by the AF defines. However, since the
defines are sparse, and the gaps in the array are not packed with
zeroes, the array is shorter than expected, and the indexing is wrong.

When this function was written, the network families that were
covered might well have been consecutive, but this is no longer true:
there's a gap between AF_LLC (26) and AF_CAN (29). In addition,
the code that parses <sys/socket.h> does not recognise AF_DECnet (12)
due to the lower-case letters, leading to a gap betwen AF_ROSE (11)
and AF_NETBEUI (13).

This assumption caused a crash in our testing while parsing the rule
"network raw".

[smcv: split out from a larger patch, added commit message]
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-27 16:20:31 +00:00
Christian Boltz
c913956554 Fix the minitools (aa-audit, aa-complain, aa-enforce, aa-autodep)
to work with multiple profiles at once.

References: https://bugs.launchpad.net/apparmor/+bug/1378095

Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9.
2015-02-27 14:19:00 +01:00
Steve Beattie
35bbe528d2 parser: fix more gcc 5 compilation problems
Don't pass an ostream reference into another ostream via <<.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-02-26 14:55:13 -08:00
Christian Boltz
608f6493be delete traces of program-chunks directory from apparmor.d(5)
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-26 18:44:22 +01:00
Cameron Norman
4803eb7fa2 abstractions/ubuntu-email: add geary 2015-02-22 20:23:04 -08:00
Christian Boltz
064697e791 require logfile only for aa-logprof and aa-genprof
Make sure most tools (for example aa-complain) don't error out if
no logfile can be found. (For obvious reasons, aa-logprof and
aa-genprof will still require a logfile ;-)

This is done by moving code from the global area in aa.py to the new
function set_logfile(), which is called by aa-logprof and aa-genprof.

While on it,
- rename apparmor.filename to apparmor.logfile
- move the error handling for user-specified logfile from aa-genprof
  and aa-logprof to aa.py set_logfile()

Note: I'd have prefered to hand over the logfile as parameter to
do_logprof_pass(), but that would break last_audit_entry_time() in
aa-genprof which requires the log filename before do_logprof_pass()
is called.

References: https://bugs.launchpad.net/apparmor/+bug/1423702


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-02-20 21:36:55 +01:00
Seth Arnold
4ec29a7e29 This should fix a gcc 5 build failure (untested) with os << .. << os
This build failure was discovered by doko's archive rebuild:
http://people.ubuntuwire.org/~wgrant/rebuild-ftbfs-test/test-rebuild-20150202-gcc5-vivid.html
2015-02-12 13:20:57 -08:00
John Johansen
a0706d3a46 And the related patch to fix globbing for af_unix abstract names
Abstract af_unix socket names can contain a null character, however the
aare to pcre conversion explicitly disallows null characters because they
are not valid characters for pathnames. Fix this so that they type of
globbing is selectable.

this is a partial fix for

Bug: http://bugs.launchpad.net/bugs/1413410

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-12 10:19:16 -08:00
John Johansen
daa07671c7 Currently the parser does escape processing in multiple places, this can result in failures if not handled properly
The lexer front end currently incorrectly processes the \000 \x00 \d00 escape sequence resulting in a null character being embedded in the processed string, this results in the string not being full processed later.

The aare to pcre regex conversion fn also incorrectly strips out the \00, and any other escape sequence it doesn't know about, resulting in incorrect strings being passed to the backend. Fix this by passing through any valid escape sequence that is not handled by the fn.

this is a partial fix for
Bug: http://bugs.launchpad.net/bugs/1413410

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-12 10:17:44 -08:00
Tyler Hicks
236ed1cf3a tests: Update code to correctly use the terms context and label
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-02-09 18:46:51 -06:00
Tyler Hicks
011777f483 mod_apparmor: Update code to correctly use the terms context and label
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-02-09 18:46:49 -06:00
Tyler Hicks
98a71b5120 libapparmor: Update code to correctly use the terms context and label
Adjust the libapparmor function prototypes, variable names, and comments
that incorrectly used the name "con" when referring to the label.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-02-09 18:46:46 -06:00
Tyler Hicks
e08f940413 libapparmor: Document the terms context and label in aa_getcon(2)
The correct usage of the terms context and label is not clear in the
aa_getcon(2) man page. The aa_getcon(2) family of functions are also
prototyped incorrectly since the *con parameter represents a label and
not a context.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2015-02-09 18:46:42 -06:00
Christian Boltz
9d471cdd73 Update is_skippable_file() to match all extensions that are listed in
libapparmor _aa_is_blacklisted() - some extensions were missing in the
python code.

Also make the code more readable and add some testcases.

Notes:
- the original code additionally ignored *.swp. I didn't include that -
  *.swp looks like vim swap files which are also dot files
- the python code ignores README files, but the C code doesn't
  (do we need to add README in the C code?)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> for 2.9 and trunk
Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-04 13:16:29 +01:00
Christian Boltz
68a19c4943 Raise an exception if sub_str_to_mode() is called with invalid mode
string or if a mode_char is not in MODE_HASH.

Also update the testcase for "asdf42" (which raises AppArmorBug now)
and add a test that simulates MODE_HASH and MODE_MAP_SET getting out
of sync (tests the second part of the if condition).


Acked-by: Steve Beattie <steve@nxnw.org>
2015-02-03 12:47:36 +01:00
Christian Boltz
5365e12dc9 Fix aa-unconfined to work with profile names that don't start with / or null
Reported by u on the debian pkg-apparmor-team ML.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-02-02 20:52:07 +01:00
Gregor Dschung
f14150c594 added /etc/pki/trust to the ssl_certs-profile 2015-01-31 16:51:17 +01:00
Christian Boltz
9f1ba65471 rename _clean to pod_clean in Makefiles
Since the Makefile cleanup, the _clean target is only used to delete
manpages etc. generated from *.pod files.

This patch renames the _clean target to pod_clean to make it obvious
what it does.


Acked-by: John Johansen <john.johansen@canonical.com>
2015-01-30 22:15:53 +01:00
Christian Boltz
da8230fe95 remove superfluous/outdated comment about m / ix
For the records: the valid statement from the comment is:
    # m is not implied by ix


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2015-01-30 21:08:17 +01:00
John Johansen
03d7c37650 Currently the parser does escape processing in multiple places, this can result in failures if not handled properly
The lexer front end currently incorrectly processes the \000 \x00 \d00 escape sequence resulting in a null character being embedded in the processed string, this results in the string not being full processed later.

The aare to pcre regex conversion fn also incorrectly strips out the \00, and any other escape sequence it doesn't know about, resulting in incorrect strings being passed to the backend. Fix this by passing through any valid escape sequence that is not handled by the fn.

this is a partial fix for
Bug: http://bugs.launchpad.net/bugs/1413410

Signed-off-by: John Johansen <john.johansen@canonical.com>
2015-01-29 14:54:08 -08:00
Christian Boltz
3e74935279 move the DISTRO variable definition from common/Make.rules to
parser/Makefile (which is the only Makefile that uses the DISTRO
variable)

Acked-by: Steve Beattie <steve@nxnw.org>
2015-01-28 22:44:35 +01:00
Christian Boltz
70efe0cb53 delete superfluous 'dist_clean' target from parser/Makefile
'dist_clean' deletes files that are already deleted by 'clean', which
means it's superfluous.


Acked-by: Steve Beattie <steve@nxnw.org>
2015-01-28 22:40:00 +01:00
Steve Beattie
a157966205 libapparmor: more Makefile cleanups
Get rid of the relics in libapparmor's Makefile.am for generating
tarballs from svn, which is no longer relevant. Also clean generated
manpages during make clean rather than just make maintainer-clean.
2015-01-26 15:39:10 -08:00
Steve Beattie
109c7c625f common: more Make.rules cruft removal
This patch removes a bunch of the per-directory tarball and rpm
generation cruft that is no longer needed now that we've been
distributing a unified tarball in our releases.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2015-01-23 16:01:14 -08:00
Steve Beattie
f19eb31f23 Entire tree: makefile cruft removal
- drop the symlink magic of the common/ directory, and just include
  files directly from there.
- update comments indicating required steps to take when including
  common/Make.rules
- drop make clean steps that refer to no longer generated tarballs,
  specfiles, and symlinks to the common directory/Make.rules.
- don't silence clean steps if VERBOSE is set

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian "Ghostbuster" Boltz <apparmor@cboltz.de>
2015-01-23 15:52:09 -08:00
Christian Boltz
0da2be8432 Add a "common_Make.rules_is_a_bad_target" target to common/Make.rules to
make sure nothing accidently hits the first-best target (well,
first-not-so-good would better describe the rpm target ;-)

Also add a dummy "all:" target to the toplevel Makefile with a short
hint towards README.

(see "[patch] fun with the toplevel Makefile") on the ML for the fun
that lead to this patch)


Acked-by: Steve Beattie <steve@nxnw.org>
2015-01-23 20:40:40 +01:00
Jamie Strandboge
024e7ddf41 Description: Allow writes to /{,var}/run/systemd/journal/dev-log, the systemd
journal socket. On Debian and Ubuntu systems, /dev/log is a symlink to
 /run/systemd/journal/dev-log, so this access is now required in the base
 abstraction to maintain current behavior.
Bug: https://bugs.launchpad.net/apparmor/+bug/1413232

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2015-01-21 13:30:46 -06:00
Launchpad Translations on behalf of apparmor-dev
f44af220d4 Launchpad automatic translations update. 2015-01-21 05:32:44 +00:00
Christian Boltz
bb11ad3551 Add some tests for logparser.py based on the log lines from
https://bugs.launchpad.net/apparmor/+bug/1399027

Also move some existing tests from aa_test.py to test-logparser.py and
adds checks for RE_LOG_v2_6_audit and RE_LOG_v2_6_syslog to them.


Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.9
2015-01-18 14:55:15 +01:00
Christian Boltz
d30cdf06e4 update logparser.py to support the changed syslog format by adding
(audit:\s+)?   to RE_LOG_v2_6_syslog

References: https://bugs.launchpad.net/apparmor/+bug/1399027


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2015-01-17 11:04:12 +01:00
Christian Boltz
60b05ab1b9 rule class - split out common parts from is_covered()
Split is_covered() in capability.py into
- is_covered_localparts() for rule-specific code
- is_covered() for common code - located in __init__.py

The object type comparison now uses type(self) and a slightly different
error message to make it usable everywhere.

Also rename rule_obj to other_rule which is more self-explaining
(inspired by the parameter name in the is_covered() dummy in __init__.py).


v2:
- remove check_allow_deny and check_audit parameters from
  is_covered_localvars()


Acked-by: Steve Beattie <steve@nxnw.org>
2015-01-16 14:59:49 +01:00
Christian Boltz
7085b53583 let make coverage fail if one of the tests fail
If one of the testcases fail, this goes unnoticed in "make coverage".
This patch changes the Makefile so that test failures let
"make coverage" fail.

You can use   make COVERAGE_IGNORE_FAILURES=true coverage   to build
coverage data even if some tests fail.

Signed-off-by: Steve Beattie <steve@nxnw.org>
(which was most probably meant as an Acked-by)

Also Acked-by: <timeout> ;-)
2015-01-16 14:45:16 +01:00
Steve Beattie
28450b432e utils: fix python install for rule/ subdirectory
For reasons that are unclear, python's setuptools doesn't install
recursively from a directory, meaning that on make install, the new
Rules/Ruleset classes were not being installed. This patch causes
the rule subdirectory to be included.

Bug: https://bugs.launchpad.net/bugs/1407437

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2015-01-13 13:03:11 -08:00
Christian Boltz
f289bb509e delete unused variable in test_invalid_variable_double_definition()
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-12-25 15:38:20 +01:00
Christian Boltz
8b05b3ae26 delete unused functions check_include_syntax() and check_profile_syntax() in aa.py
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-12-24 16:54:57 +01:00
Christian Boltz
5040499d04 improve severity.py test coverage
adds some tests for severity.py and improves the test coverage to
nearly 100% (only 3 partial left).

Added tests and details (all in SeverityVarsTest):
- move writing the tunables file from setUp() into _init_tunables() for
  more flexibility (allows to specify other file content)
- test adding to a variable (+=)
- test #include
- make sure double definition of a variable fails
- make sure redefinition of non-existing variable fails

BTW: even the comment added to VARIABLE_DEFINITIONS contributes to
the coverage ;-)

severity.py passes all added tests, however I should note that including
a non-existing file is silently ignored.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-12-24 15:42:05 +01:00
Christian Boltz
c4deb6a5ca Fix the dnsmasq profile to allow executing bash to run the --dhcp-script
argument. Also fixed /usr/lib -> /usr/{lib,lib64} to get libvirt
leasehelper script to run even on x86_64.

References: https://bugzilla.opensuse.org/show_bug.cgi?id=911001

Patch by "Cédric Bosdonnat" <cbosdonnat@suse.com>

Note: the original patch used {lib,lib64} - I changed it to lib{,64} to
match the style we typically use.

Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-22 17:56:37 +01:00
Christian Boltz
05dd00aea8 update and cleanup usr.sbin.dovecot profile
Adds #include <abstractions/dovecot-common> to the usr.sbin.dovecot
profile. Effectively this adds "deny capability block_suspend," which
is the only missing part from
https://bugs.launchpad.net/apparmor/+bug/1296667/

It also removes "capability setgid," (covered by
abstractions/dovecot-common) and "@{PROC}/filesystems r," (part of
abstractions/base).

Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-22 17:49:28 +01:00
Christian Boltz
d07249969a Add some missing /run/dovecot/* to usr.lib.dovecot.imap{, -login}
Add the needed permissions as reported in
https://bugs.launchpad.net/apparmor/+bug/1296667/ comment #1
to the usr.lib.dovecot.imap and imap-login profiles.

Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-22 17:41:59 +01:00
Christian Boltz
6126487638 update the mysqld profile in the extras directory to
something that works on my servers ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-22 17:36:13 +01:00
Launchpad Translations on behalf of apparmor-dev
3596cc189e Launchpad automatic translations update. 2014-12-19 05:44:14 +00:00
Christian Boltz
5af5ebc412 fix network rule description in apparmor.d.pod
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-19 02:14:26 +01:00
Steve Beattie
2273a47e26 utils: make parse() be a class method for all rule types
This patch hides raw_rule within the BaseRule class by making parse() be
a class method for all the rule types, implemented via a rule-specific
abstract method _parse() that returns a parsed Rule object.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-16 14:17:33 -08:00
Christian Boltz
e259b2d652 utils: use capability rule class in aa.py and cleanprof.py
This patch integrated the new capability rule class into aa.py and
cleanprof.py.

Patch changes:
  v6:
      - fix logic around same_file in cleanprofile.py that was causing
        capabilities to be deleted when they weren't covered by an
        abstraction.
  v5:
      - merge my changes into Christian's original patches
      - use CapabilityRule.parse() for parsing raw capability rules and
	getting a CapabilityRule instance back
      - cope with move of parse_modifiers back into rule/__init__.py.

Originally-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-16 14:13:25 -08:00
Christian Boltz
c55a466dc9 utils: add tests for capability rules classes
Patch changes:
  v5:
     - merge my changes into Christian's original patches
     - update to use CapabilityRule.parse() as the entry point for
       parsing raw rules and getting a CapabilityRule instance in
       return.

Originally-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-16 14:11:18 -08:00
Christian Boltz
e7ae4bc8e8 utils: add base and capability rule classes
This patch adds four classes - two "base" classes and two specific for
capabilities:

utils/apparmor/rule/__init__.py:

    class base_rule(object):
        Base class to handle and store a single rule

    class base_rules(object):
        Base class to handle and store a collection of rules

utils/apparmor/rule/capability.py:

    class capability_rule(base_rule):
        Class to handle and store a single capability rule

    class capability_rules(base_rules):
        Class to handle and store a collection of capability rules

Changes:
  v5:
    - flattened my changes into Christian's patches
    - pull parse_modifiers into rule/__init__.py
    - pull parse_capability into rule/capability.py
    - make CapabiltyRule.parse() be the class/static method for parsing
      raw capability rules.
    - parse_capability: renamed inlinecomment and rawrule to comment
      and raw_rule to be consistent with CapabilityRule fields.

Originally-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-16 14:06:31 -08:00
Steve Beattie
5125fca9bc Adjust version in preparation for 2.10/3.0 development. 2014-12-16 13:45:47 -08:00
Steve Beattie
4a0f65ef52 libapparmor: adjust version in preparation for 2.9.1 release. 2014-12-16 12:17:57 -08:00
Steve Beattie
235328fdf8 library: fix parsing for yet another format
This patch fixes the libapparmor log parsing library to take into
account yet another log format style, as well as incorporating a
testcase for it.

Bugs:
  https://bugs.launchpad.net/apparmor/+bug/1399027
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771400
  https://bugzilla.opensuse.org/show_bug.cgi?id=905368

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 16:43:35 -08:00
Tyler Hicks
f184609c7a parser: Add mount option parsing tests
This patch creates expected pass tests for all known mount options as
well as expected fail tests for some known bad mount options.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>

Bug: https://launchpad.net/bugs/1399027
2014-12-12 08:23:14 -06:00
Tyler Hicks
0bf2e4f2e1 parser: Fix typo in mount rule error message
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 08:21:31 -06:00
Tyler Hicks
43ef5bfc70 parser: Clean up the use of MS_REC in mount.h
This patch restricts MS_REC to only be used while defining the MS_RBIND,
MS_RUNBINDABLE, MS_RPRIVATE, MS_RSLAVE, and MS_RSHARED macros.

The MS_R* macros are simply an OR of the corresponding non-recursive
macro and MS_REC:

 #define MS_RBIND	(MS_BIND | MS_REC)

Previously, a shortcut was taken when needing to specify the
non-recursive and recursive macros:

 (MS_BIND | MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED | MS_REC)

By using MS_REC above, it is not immediately clear that
MS_R{BIND,UNBINDABLE,PRIVATE,SLAVE,SHARED} are also included.

By restricting the use of MS_REC, this patch improves readability by
forcing the use of the MS_R{BIND,UNBINDABLE,PRIVATE,SLAVE,SHARED} macros
instead of relying on the MS_REC shortcut.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 08:21:25 -06:00
Tyler Hicks
7de5ebd18f parser: Fail when a device is present with recursive mount make opts
The parser correctly rejects mount make-* options (make-shared,
make-slave, make-private, make-unbindable) when a device is specified
(the source argument of mount(2)). However, it was not rejecting the
recursive make-* options (make-rshared, make-rslave, make-rprivate,
make-runbindable) when a device was specified.

This patch adds the MS_REC bit, which is used to indicate a recursive
option, to the MS_CMDS macro. Without this change, the recursive options
are treated as normal mount options.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 08:21:09 -06:00
Tyler Hicks
7140bc27c3 parser: Fail compilation if unknown mount options are found
The parser should not indicate success when mount rules contain
unknown mount options:

  $ echo "/t { mount options=(XXX) -> **, }" | apparmor_parser -qQ
  $ echo $?
  0

This patch modifies the parser so that it prints an error message and
exits with 1:

  $ echo "/t { mount options=(XXX) -> **, }" | apparmor_parser -qQ
    unsupported mount options
  $ echo $?
  1

Bug: https://bugs.launchpad.net/bugs/1401621

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 08:20:49 -06:00
Tyler Hicks
d336d23e4d parser: Sync mount options parsing and documentation
There are a number of differences between what the apparmor.d(5) man
page lists as valid AppArmor mount rule options and what apparmor_parser
looks for when parsing mount rules. There are also typos in the man page
and parser around mount options. Here's the breakdown of problems and
fixes made in this patch:

 * The apparmor.d(5) man page improperly documented a "nodirsync"
   option.
   - That mount option does not exist and the parser did not honor it.
     Remove the mention from the apparmor.d(5) man page.
 * The loud option was typoed as "load" in both the man page and parser
   - There's no sense in preserving backwards compatibility. "load" is
     simply wrong and should not be honored. The man page and parser are
     updated to only use "loud".
 * The rbind option wasn't listed in the man page.
   - Add rbind to the man page. No change needed for the parser.
 * The documented unbindable, private, slave, and shared options were
   not correctly parsed. The parser expected
   make-{unbindable,private,slave,shared}.
   - The parser is updated to accept both the documented
     {unbindable,private,slave,shared} options and their variants
     prefixed with "make-". The man page will not document the "make-"
     variants.
 * The recursive {runbindable,rprivate,rslave,rshared} options were not
   documented and were only recognized by the parser if they were
   prefixed with "make-".
   - The man page is updated to document the option strings that are not
     prefixed with "make-". The parser still accepts the "make-"
     variants.
 * The man page documented a "rec" option but the parser didn't honor
   it. The MS_REC macro is used by the mount utility to be bitwise OR'ed
   with MS_{UNBINDABLE,PRIVATE,SLAVE,SHARED} to indicate the
   corresponding recursive mount options.
   - This is not an option that should be exposed in the AppArmor policy
     since we already allow have the
     {runbindable,rprivate,rslave,rshared} options.
 * The man page typoed the {no,}relatime options as {no,}relative.
   - The man page is updated to document the correct option strings. The
     parser requires no change.

Bug: https://bugs.launchpad.net/bugs/1401619

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-12-12 08:20:31 -06:00
Steve Beattie
b3523fa920 merge it (and en_GB) translations from launchpad 2014-12-11 15:42:43 -08:00
Steve Beattie
4485d039dc periodic sync up with trunk 2014-12-11 15:40:21 -08:00
Steve Beattie
149cdbc210 utils: improve recursive_print output for RawRules
When using recursive_print for debugging, RawRules objects weren't
reporting detailed information. This patch fixes that, as well as fixing
some indenting issues in the output.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-09 10:43:25 -08:00
Christian Boltz
3e222f4b42 delete outdated *.spec{,.in} files
Those *.spec{,.in} files were not updated for years (last change
2006/2007) and don't fit the current "one tarball for everything" model.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-08 22:21:47 +01:00
Christian Boltz
a79caef4c7 extra profiles: Allow useradd to execute nscd
(maybe it tells it to refresh its cache?)

Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 20:22:40 +01:00
Christian Boltz
c791881633 extra profiles: update vsftpd profiles
Allow reading /etc/environment, /etc/ftpusers, /@{PROC}/@{pid}/mounts.
Allow rk for /{,var/}run/utmp
(+ some whitespace fixes)

Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 20:20:37 +01:00
Christian Boltz
7131f4a7f9 extra profiles: delete duplicated lines in usr.sbin.sendmail
Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 20:19:22 +01:00
Christian Boltz
5295ba27d1 extra profiles: allow man to read itsself
Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 20:18:30 +01:00
Christian Boltz
826bdc27fd dnsmasq profile needs inet6 raw
Add "network inet6 raw," to the dnsmasq profile as counterpart to
the IPv4 "network inet raw,"

References: https://bugzilla.novell.com/show_bug.cgi?id=907870


Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 18:46:26 +01:00
Christian Boltz
dc50135bf6 delete commented line in aamode.py / validate_log_mode()
Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-02 18:45:41 +01:00
Steve Beattie
f05649e518 profiles: update make check-logprof for python tools
The check-logprof target was not updated to use the python tools, when
they were merged in. This patch fixes the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-12-02 08:03:09 -08:00
Christian Boltz
c1ed3481e2 cleanup nscd profile
@{PROC}/@{pid}/maps r,
is part of abstractions/base - so there's no need to include it in the
nscd profile.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-01 23:44:13 +01:00
Christian Boltz
d82e9a3bec aamode.py - fix LOG_MODE_RE
LOG_MODE_RE (used in validate_log_mode() in aamode.py) just checked if
the given parameter contains one of the possible matches. This resulted
in "invalid" being a valid log mode (from audit.log requested_mask or
denied_mask) because it contains 'a', which is a valid file mode.

This patch wraps the regex into   ^(...)+$   to make sure the full
string contains only allowed file modes.

The patch also adds some tests for validate_log_mode().


Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-01 22:49:54 +01:00
Christian Boltz
8346ef0f77 delete unused profilemode() from aamode.py
Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-01 20:56:31 +01:00
Christian Boltz
e1da7759dd delete unused map_log_mode() in aamode.py
Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-01 20:55:13 +01:00
Pat Parson
94ebc95eb3 profiles: update usr.bin.passwd profile
Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770788

Acked-by: Steve Beattie <steve@nxnw.org>
2014-12-01 10:23:45 -08:00
Christian Boltz
93ca0c2ff9 aa.py: change_profile vs. changes_profile
aa.py uses profile_data[profile][hat]['change_profile'] at various
places. However, there are also two places that use 'changes_profile'
(note the additional 's'), which should also be 'change_profile'.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-29 13:40:10 +01:00
Steve Beattie
ad17e03b9d utils: wrap ValueError in AppArmorBug w/better reporting
This patch converts a ValueError raised when parsing of a permission
mode fails into an AppArmorBug with better diagnostic information, and
adds a test case to confirm that the exception is raised.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-29 00:15:17 -08:00
Christian Boltz
b1c28c7a23 Add some tests for aa.py check_for_apparmor()
Also change check_for_apparmor() to allow easier testing by optionally
specifying alternative locations for /proc/filesystems and /proc/mounts
as parameter.

Note that the code in check_for_apparmor() differs from what the comment
says - valid_path() only does syntax checks, but doesn't check if the
directory exists. I added a comment saying exactly that.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-27 23:20:26 +01:00
Christian Boltz
ff5024d703 Improve performance in aamode.py (saving 10-17% time):
- replace MODE_MAP_RE regex with MODE_MAP_SET set
- change sub_str_to_mode() to use MODE_MAP_SET set instead of MODE_MAP_RE
- change split_log_mode to use split() instead of a regex

Patch by Peter Maloney <peter.maloney@brockmann-consult.de>


Acked-by: Christian Boltz <apparmor@cboltz.de>

split_log_mode() change also
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-27 19:08:00 +01:00
Christian Boltz
a98426820b improve check_for_apparmor() for better readability and (minor)
performance improvement

Patch by Peter Maloney <peter.maloney@brockmann-consult.de>

Acked-by: Christian Boltz <apparmor@cboltz.de>
(previous patch version (with minor difference) also
 Acked-by: Seth Arnold <seth.arnold@canonical.com>)
2014-11-27 18:34:45 +01:00
Christian Boltz
c7626ec0eb Add tests for sub_str_to_mode() and split_log_mode() in aamode.py.
Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-27 13:54:22 +01:00
Christian Boltz
b6dd8bbb81 Fix the usage of the aa hasher in aa.py handle_children() - for
interpreters, it used
    aa[profile][hat]['path'][interpreter_path]['mode']
instead of
	aa[profile][hat]['allow']['path'][interpreter_path]['mode']

The ['allow'] part was missing.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-27 00:42:06 +01:00
Steve Beattie
8841086c01 utils: abstract out writing prior segments
This patch pulls out all the common processing for writing out
each of the prior segments that need to be written before writing
the current segment into a function called 'write_prior_segments',
reducing a bunch of ugly duplication.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-26 14:32:25 -08:00
Steve Beattie
a5d38d3dc9 utils: fix include prior segments indention
The assignment for setting segments['include'] = True was wrong,
it occured inside the 'if not segments['include'] and True in
segments.values():' block, whereas it needed to always get set outside
of that if test.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-26 14:28:21 -08:00
Christian Boltz
21b6e70865 fix some performance killer bugs in aa.py
This patch
- fixes a check that used if "aa[profile][hat][incname]:" instead of
  "if aa[profile][hat]['include'].get(incname, False):" ("['include']"
  was missing) which means the performance shortcut was never hit
- avoids auto-created empty and superfluous hashers in
  aa[profile][hat]['allow']['path'] and
  include[incfile][incfile][allow]['path']
- adds the filename to the "Can't find system log" exception

Patch by Peter Maloney <peter.maloney@brockmann-consult.de>


Changes compared to the original patch:
- change back quoting in the exception message to '...'


Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-11-26 20:25:07 +01:00
Tyler Hicks
c7f5f55160 Update the top-level README for the utils rewrite
Modify the build instructions and project requirements to reflect the
utils rewrite from Perl to Python.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-18 10:27:56 -06:00
Tyler Hicks
c308e6b24e libapparmor: Make man page generation optional
This patch adds the --enable-man-pages option, defaulting to "yes", to
libapparmor's configure stage so that libapparmor can be built on
systems lacking Perl.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-17 21:20:14 -06:00
Tyler Hicks
806374b5f9 libapparmor: Fix spacing in the configure script usage
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-17 21:20:11 -06:00
Tyler Hicks
b57a229c56 libapparmor: Check for podchecker during configure stage
Fail the configure stage if podchecker is not available since man page
generation always happens.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-17 21:19:55 -06:00
Tyler Hicks
3c7621b511 libapparmor: Point to the correct site for downloading Perl
Point to the site for Perl the language and not Perl news.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-17 21:19:15 -06:00
Tyler Hicks
742adeeeb7 libapparmor: Don't print perl version in the configure script output
There's no need to date ourselves.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-17 21:19:13 -06:00
Tyler Hicks
d27d5f6ba2 libapparmor: Always generate the man pages
The configure script fails if pod2man isn't available since PROG_POD2MAN
is called unconditionally so it is safe to split man page generation out
of the --with-perl configure option.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-17 21:19:09 -06:00
Christian Boltz
534148d9aa fix filename for .../nscd/hosts (which was accidently changed to "host" 3 years ago)
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-18 00:27:10 +01:00
Steve Beattie
961ab6d6e0 utils: add support for alternate pyflakes versions
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-17 12:32:30 -08:00
Christian Boltz
fc1489863d Allow the usage of /run/nscd/ for runtime files in the nscd profile.
References: https://bugzilla.novell.com/show_bug.cgi?id=904620#c14


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-11-17 20:18:29 +01:00
Kshitij Gupta
a3aee5ce33 The make check for utils was failing due to the raw_input being
present as a function (which it is not in Python3, even though it was
under an if else python version check).

The following patch:
- checks the __builtins__ module for existence of raw_input and sets
it up for Python3

Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-17 18:00:04 +05:30
Christian Boltz
5d148c4ac6 Fix leading whitespace in "(V)iew changes" and cleanup profile writing
The diff displayed by (V)iew changes in aa-logprof lacks leading
whitespace because it bases the whitespace on the indention level of the
closing "}".

Besides that, it uses different values for the indention level for newly
added rule types than for existing rule types. (For example, if a
profile already had a network rule, added network rules will get a
different indention level.) However you won't notice this because
currently it doesn't indent the rules at all ;-)

This patch fixes serialize_profile_from_old_profile() in aa.py so that
it always uses the correct indention level.


Also clean up and simplify how the profile is written in the end (when
matching RE_PROFILE_END) - we already have "write_methods", so we can
just re-use it instead of "manually" calling one write_* function after
the other. Unfortunately dicts don't keep their original order,
therefore I had to introduce "default_write_order".


Finally, add some missing rule types to "segments" to avoid key errors.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-15 12:51:24 +01:00
Christian Boltz
23da51b079 fix audit toggle for capability (when asking in logprof)
When aa-logprof asks for adding capability rules, it also offers the
Audi(t) option. Unfortunately, this option does nothing ;-)

This patch fixes ask_the_question() so that it really ;-) allows to
switch the audit flag on and off. It also initializes the "audit"
variable to make sure the next capability doesn't inherit the audit flag
used for the previous capability.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-15 01:38:29 +01:00
Christian Boltz
be287de823 fix and improve recursive_print()
This patch for recursive_print() in common.py fixes printing dicts with
py3. It also replaced the tabs() lambda function with a plain string,
and the brace() lambda function with a simple formatstring to make the
code easier to understand.

Also add support for nested lists - for the start and end of each list,
print a [ and ]. Without that, you get a long list of items without an
indicator if/when a new parent list starts.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-15 01:08:37 +01:00
Christian Boltz
3364eadafc Add "AppArmorBug" Exception (for things that "should never happen")
Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-14 23:52:38 +01:00
Christian Boltz
365d7036a5 fix "unknown capability: CAP_whatever" in aa-logprof
When aa-logprof asks for a capability, you'll see something like

    WARN: unknown capability: CAP_block_suspend

The reason for the warning and "Severity: unknown" is that severity.db
contains the capability names in uppercase, but ask_the_question() calls
sev_db.rank with the capability in lowercase.

This patch converts the "CAP_$capability" string to uppercase before
doing the lookup.

Acked-by: Steve Beattie <steve@nxnw.org>



Also add a testcase (written by Steve Beattie) to ensure this stays fixed.

Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-14 02:27:33 +01:00
Christian Boltz
422680714b utils/Makefile: remove superfluous grep -v from pyflakes call
utils/Makefile contains a grep -v "undefined name _". Some manual
testing shows that pyflakes doesn't print any warning about "_", so
this grep is superfluous.

Removing the grep also means we don't need a tempfile for the pyflakes
output anymore, which simplifies the pyflakes call a lot.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-14 02:21:23 +01:00
Steve Beattie
1a9505a4ef utils: fix pyflakes issues with test-severity
The recent re-work of the severity.db tests were not verified to
pyflakes clean. All but one of pyflakes co are of marginal impact
(assigning to a variable that isn't later referenced); however, one
legitimate issue it detected is that I inadvertently created two test
cases with the same method name, so only one test case would actually
be used.

The following patch fixes the issues.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-13 10:58:50 -08:00
Christian Boltz
4dd956461b Import regexes from apparmor.regex one by one (instead of *) to make
pyflakes happy

Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-13 19:17:10 +01:00
Tyler Hicks
4c30cb0e64 tests: Add ptrace tests for LP: #1390592
These regression tests are for an Ubuntu-specific bug. However, they
should benefit the upstream project, as well. Ubuntu took an incomplete
version of a patch, which introduced the bug. The version of that patch
that landed upstream did not contain the bug.

The bug was in policy compilation of certain combinations of rule types,
conditionals, and conditional values. The easiest such combination to
test is a rule such as:

  ptrace peer=ABC,

Buggy parsers will generate binary policy that causes the kernel to deny
a ptrace of a process confined by ABC, despite the presence of the above
rule.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-13 10:40:19 -06:00
Christian Boltz
e188f04ce4 Move the profile parsing regexes from aa.py to a new file (regex.py)
and add an "import" line so that they are still available in aa.py.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-11-12 00:05:04 +01:00
Christian Boltz
c38062f9b0 make clean: delete "common" symlink in all directories
Acked-by: <timeout>
2014-11-10 20:14:35 +01:00
Christian Boltz
6b4cede82c let RE_EOL strip() whitespace from <comment>
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-11-09 01:33:40 +01:00
Christian Boltz
a3d9de704c aa.py: let parse_audit_allow also match comments
Note: this is v1 of the patch - I'll send a patch for RE_EOL to trim 
whitespace.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-11-08 16:47:39 +01:00
Steve Beattie
43f8bd778f utils: rename severity.db unit tests
This commit renames the unit test script for the severity db so that it
will be included in the 'make check' and 'make coverage*' targets.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-06 12:44:04 -08:00
Steve Beattie
3bf5e5b1d9 utils: fix Severity(None) condition
This patch fixes Severity.__init__() when it is not given an argument to
raise an AppArmor exception rather than returning a Severity object in
an incompletely initialized state. It also adjusts a test case covering
this situation.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-06 12:37:02 -08:00
Steve Beattie
e26f139025 utils: re-work the severity.db unit tests
This patch is a re-work of the severity_test.py tests, to break them
up into individual unit tests, and to add coverage for detecting
an invalid severity database (it does reduce the coverage for walking
profiles to find variable declarations, but that should be pulled out of
the severity handling code anyway).

Note that the last test case will fail, because even though the code
path in Severity.__init__() looks like it will return None if no path
is given, a Severity object in a half-state of initialization will
actually be returned.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-11-06 12:32:49 -08:00
Christian Boltz
c35a4c412d disallow directories as logfile argument in aa-logprof (follow-up
for r2769, which only checked for "exists")

Also allow everything except directories as logfile argument in 
aa-genprof.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-05 20:25:44 +01:00
Steve Beattie
06c3e0be75 utils: add python coverage generation
This patch adds support for generating test coverage information for the
python utils.

To view a text based report, in the test subdirectory do:

  make coverage-report

To generate detailed html reports, do:

  make coverage-html

And then point your web browser at
$(YOUR_CURRENT_WORKING_TREE)/utils/test/htmlcov/index.html .
An alternate output location can be specified by setting the
COVERAGE_OUT variable, e.g.

  make coverage-html COVERAGE_OUT=/tmp/coverage/

(the output directory does not need to exist beforehand.)

To generate only the coverage data, do:

  make coverage

or

  make .coverage

(The coverage data generated by python is stored in the .coverage
file.)  This essentially runs make check, using a single python
interpreter, and records which lines and branches of the python code
were exercised.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-11-04 13:01:14 -08:00
Peter Maloney
d32e838be3 utils: allow logprof to be passed fifos as logfile arguments
From: Peter Maloney <peter.maloney@brockmann-consult.de>

This patch allows the common idiom 'aa-logprof -f <(SOME COMMAND)' to
work,

Acked-by: Steve Beattie <steve@nxnw.org>
2014-11-04 12:55:26 -08:00
John Johansen
77fff04076 Minor updates and reorg to apparmor tech docs 2014-11-03 17:21:20 -08:00
Launchpad Translations on behalf of apparmor-dev
93eb36404d Launchpad automatic translations update. 2014-10-28 05:41:09 +00:00
Steve Beattie
37fc93807a utils: re-org tests Makefile a bit
This patch moves the declaration of phony and quieted make targets
to a single section, to avoid repeated lines. It's not so useful
for just two targets, but future patches will add more targets with
similar attributes.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-10-27 11:23:49 -07:00
Launchpad Translations on behalf of apparmor-dev
cc71c4210c Launchpad automatic translations update. 2014-10-27 05:32:33 +00:00
John Johansen
c11ad5a800 fix: parser: close of fd with value of -1
Both valgrind and strace report the parser doing
close(-1) = -1 EBADF (Bad file descriptor)

This happens the skip kernel load argument is specified in combination
with any of --add, --replace, or --remove arguments (the default
is --add if no other option is specified).

This happens when the parser is not processing profiles but not
writing them out (eg. no kernel load, dump to stdout, file ...)

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-25 16:26:59 -04:00
John Johansen
542f6301e9 fix: incorrect test of open return value
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-25 16:26:07 -04:00
Launchpad Translations on behalf of apparmor-dev
57a8d2c94c Launchpad automatic translations update. 2014-10-23 05:37:49 +00:00
Launchpad Translations on behalf of apparmor-dev
0fb504868e Launchpad automatic translations update. 2014-10-22 05:36:29 +00:00
Launchpad Translations on behalf of apparmor-dev
53517ee6dc Launchpad automatic translations update. 2014-10-21 05:40:24 +00:00
Christian Boltz
8e2a7304cb fix netrules_access_check()
netrules_access_check() in aa.py checks if 
    type(netrules['rule'][family]) == dict
however this check always returns false (at least with py3, I didn't
test with py2).

This broken type check is the reason for
https://bugs.launchpad.net/apparmor/+bug/1380368
    aa-logprof doesn't propose abstractions for network rules
and 
https://bugs.launchpad.net/apparmor/+bug/1380367
    aa-logprof asks for already existing network rules
which are both fixed with this patch.


The type check is needed because netrules['rule'][family] can be
boolean True (for rules like "network inet,") - see line 2994.

The sock_type in .... .keys() check is there to ensure the hasher doesn't 
automagically add an empty sub-dict, which caused the regression in the 
first version of my patch.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-20 22:40:42 +02:00
Christian Boltz
9b4516e5ef use correct variable in match_net_includes()
match_net_includes() in aa.py gets "nettype" as parameter, but then uses 
"type" when calling valid_include(). "type" is a global variable, but not 
what we want to use here ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-20 20:07:24 +02:00
Steve Beattie
49e30d2b90 Merge german translations update from launchpad translations. 2014-10-20 13:43:51 -04:00
John Johansen
71e54288bd Document the ability for apparmor_parser to load profiles from a dir
Update the apparmor_parser documentation for the new ability to load
profiles from a specified directory.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-10-20 13:38:24 -04:00
Launchpad Translations on behalf of apparmor-dev
7d3e375e25 Launchpad automatic translations update. 2014-10-20 05:41:55 +00:00
Steve Beattie
5bafecdcaa sync with trunk after 2.9.0 release 2014-10-17 15:04:05 -07:00
Steve Beattie
d3524c3b7b Adjust version for the followup 2.9.1 release 2014-10-17 15:00:45 -07:00
Steve Beattie
12b3b63594 Adjust versions for impending 2.9.0 release (woohoo!). 2014-10-17 12:57:28 -07:00
Steve Beattie
bedcb8c19c Merge from lp translations branch: a few de updates, some en_GB additions. 2014-10-17 12:07:51 -07:00
Launchpad Translations on behalf of apparmor-dev
c504acb09e Launchpad automatic translations update. 2014-10-17 05:36:15 +00:00
Steve Beattie
39b9985afb utils: make html version of apparmor.vim manpage
Bug: https://bugs.launchpad.net/bugs/1366572

In the move of the apparmor.vim manpage source from the parser
directory to utils/vim/, the creation of the html version of the
manpage was lost.  This patch fixes that, as well as fixes the vim
Makefile to use the common/Make.rules _clean target (which clears the
pod2htm*.tmp files created by pod2html as well).

It also fixes a bug in common/Make.rules where the _clean target
would report an error when used in a directory where the Makefile
doesn't set the NAME variable, such as utils/vim/.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-16 15:50:13 -07:00
Christian Boltz
2758e2e2a1 apparmor.vim: add support for the "hat" keyword
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-16 23:55:43 +02:00
Christian Boltz
1203923be3 more aa-mergeprof fixes
- change --help for files - "Profile(s) to merge" instead of "base profile"
- display the profile to save when asking to save it
- disable searching for existing network rules in abstractions because 
  it crashes. This doesn't hurt too much, see 
  https://bugs.launchpad.net/apparmor/+bug/1382241


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-16 23:35:06 +02:00
Christian Boltz
aeebcbc243 various aa-mergeprof fixes
- remove some debug output (which Kshitij intentionally kept in the 
  draft patch)
- add a UI_Info to display which profile will be merged
- disable the mergeprofiles.clear_common() call because it crashes
  (https://bugs.launchpad.net/apparmor/+bug/1382236)
- disable (M)ore (CMD_OTHER) because it crashes
- make (F)inish work everywhere
- change the help text so that it doesn't mention 3-way-merge until we
  implement it
2014-10-16 23:25:33 +02:00
Christian Boltz
31c4dc80a8 fix parsing of "hat foo {" lines
The python utils didn't know about the hat keyword, for example
    hat foo {

This patch changes RE_PROFILE_HAT_DEF to add support for the hat keyword.

Note that this patch only changes profile reading - when saving a 
profile, the ^foo syntax will always be used.

While on it, also convert the regex to named matches - the result 
numbering changed anyway ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-16 22:03:42 +02:00
Christian Boltz
31a57bdfa9 update the aa-mergeprof manpage to match the new commandline syntax
introduced with the aa-mergeprof patch collection.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-16 20:26:45 +02:00
Christian Boltz
4f4eded593 aa-mergeprof: don't ask for includes that are already there
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-16 20:22:52 +02:00
Christian Boltz
4f9183b23e aa-mergeprof cmdline changes, disable 3-way-merge for now
This is the rebased version of the patch by
Kshitij Gupta <kgupta8592@gmail.com>


(mostly) original patch description:

Changes to facilitate 2-way merge (maybe also 3-way) of multiple
profiles as discussed on IRC

This patch
- moves reset method to reset_aa function
- modifies message displayed to user
- allows processing of multiple files in 2-way merge
- disables 3-way merge till new syntax has been decided

The changes reflect the approach of providing arbitrary number of
files using wildcards or explicitly.

The changes map the profiles in the given files to their respective
files in the local directory specified using -d. Then the merges take
place profile-wise.


Acked-by: Steve Beattie <steve@nxnw.org>.
2014-10-16 20:06:45 +02:00
Christian Boltz
3cb61c5dae highlight comments in alias and link rules with correct color
(in blue, instead of the color used for the rule itsself)

Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-14 21:36:41 +02:00
Christian Boltz
c613d8a884 fix "list index out of range" when allowing inet rules
When adding inet rules in aa-logprof, it crashes with
    IndexError: list index out of range

The reason is that it doesn't display the options if only the raw rule
is available (aka "no abstraction").

This patch checks if options[] is set and otherwise sets selection to
the raw rule.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-14 21:28:32 +02:00
Christian Boltz
d11055aa0c Fix "Invalid mode found: /usr/lib64/firefox/firefox.sh"
After several hours of debugging on IRC and flooding paste.opensuse.org ;-)
I finally found the reason - reading(!) from log_dict with a wrong 
key caused the creation of that strange mode in log_dict.keys().

While finding that bug was very hard, the fix is easy - just replace 
"profile" with "aamode". (That probably makes one char per hour of 
debugging...)

To improve that ratio, also add a warning to common.py so that this 
interesting[tm] behaviour of hasher() is at least documented.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-14 12:54:39 +02:00
Christian Boltz
7e84f4efe9 If a filename mentioned in audit.log contains an @, aa-logprof crashes with
...
  File "/home/cb/apparmor/HEAD-CLEAN/utils/apparmor/severity.py", line 147, in handle_variable_rank
      variable = regex_variable.search(resource).groups()[0]
	  AttributeError: 'NoneType' object has no attribute 'groups'

handle_variable_rank() checked with   if '@' in resource:
and if it finds it, expects it can match a variable, which means   @{.....}
If a filename contains a   @   this fails.

The patch fixes the if condition so that it does a regex match.

It also adds two testcases for filenames containing @ to make sure they
don't cause a crash and result in the exptected severity rank.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-14 12:50:20 +02:00
Christian Boltz
9a960a22a9 prevent adding multiple quotes in file rules
aa-cleanprof (and others?) duplicate quotes in file rules.

If a profile contains
      "/bin/foo bar" mrix,
and I run aa-cleanprof on it several times, I end up with
   """"""/bin/foo bar"""""" mrix,

This patch calls strip_quotes on the pathname.
(If needed, the quotes are re-added when writing the profile - tested 
with aa-cleanprof.)

References: https://bugs.launchpad.net/apparmor/+bug/1328707


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-11 23:30:46 +02:00
Christian Boltz
7ef2ae9b05 Prevent encoding errors when reading a file
This patch changes open_file_read() and open_file_write() to use 
errors='surrogateescape' (with fallback to 'replace' for py2).

This avoids a crash when reading a logfile with special characters that 
are not utf8-encoded (for example a latin1 "ö"), and also avoids crashes 
at several other places we don't know yet ;-)

The patch also changes open_file_read() and open_file_write() to wrapper
functions, and moves the "real" code to the new open_file_anymode() 
function.

Also, I removed the try/except - it's superfluous because it throws the 
exception without any modifications.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-10 20:35:32 +02:00
Steve Beattie
a4685bebf3 Update version in preparation for apparmor 2.9.beta5 release. 2014-10-09 15:14:26 -07:00
Jamie Strandboge
e08c45a65f Description: also allow /var/mail in user-mail
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1192965

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-09 15:48:37 -05:00
Jamie Strandboge
d9cc289022 ubuntu-browsers.d/java: update to allow /run/user/*/icedteaplugin-*
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1293439

Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-10-09 14:56:34 -05:00
Steve Beattie
ada96afd84 mod_apparmor: revert apache 2.4 api fix from commit 2555
This patch reverts commit 2131 which added support for the newer apache
2.4 ap_hook_check_access_ex() api, based on a report from Christian that
it broke apache's simple authentication.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-09 12:52:31 -07:00
Steve Beattie
29f1b9ec7f tests: warn about xpass/xfail marked tests
With the two recent unix socket test patches to mark dgram tests as
failing but expected to pass, I realized that there's no indication
in the output that there are current expected failures (except for
the single corefile test expected failure)[0]. This patch attempts to
remedy that by emitting the x-type plus the test description for each
test that is marked as such. I've set it to always emit these results.

[0] The test infrastructure does give an alert if there is a test that
    has been marked xpass or xfail but has started behaving correctly.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-10-09 12:30:34 -07:00
Steve Beattie
5fee046bfe tests: mark failing dgram tests in unix_socket_unnamed.sh as xpass
It's not been tracked down in
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1373172 why
this is happening, but the current unnamed unix socket dgram tests
are failing when only the server is confined, and the peer label is
given as only the confining profile (the stream and seqpacket dgram
tests/permissions don't seem to trigger this revalidation rejection).

Until this bug is diagnosed and addressed, mark these tests as failing
but expected to pass (i.e. 'xpass').

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-10-09 12:27:51 -07:00
Steve Beattie
dcb39f494c tests: mark failing dgram tests in unix_socket_pathname.sh as xpass
With the addition of the unix socket mediation and
corresponding tests, there are currently two tests that fail
in unix_socket_pathname.sh. These have been recorded as bugs
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1373174 and
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1373176 but John
has not had time to investigate if these are legitimate bugs. The
following patch marks the tests as expecting to pass but currently
failing.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-08 22:32:01 -07:00
John Johansen
c2b8a72317 disable downgrade and not enforced rule messages by default
Currently the apparmor parser warns about rules that are not enforced or
downgraded. This is a problem for distros that are not carrying the out of
tree kernel patches, as most profile loads result in warnings.

Change the behavior to not output a message unless a warn flag is passed.
This patch adds 2 different warn flags
  --warn rule-downgraded    	 # warn if a rule is downgraded
  --warn rule-not-enforced	   # warn if a rule is not enforced at all

If the warnings are desired by default the flags can be set in the
parser.conf file.

v2 of patch
- update man page
- add --warn to usage statement
- make --quiet clear warn flags

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-08 13:20:20 -07:00
Jamie Strandboge
dc9474fe5a Description: update base abstraction read access to
/proc/sys/kernel/cap_last_cap. This is needed to determine the highest valid
 capability of the running kernel. Reference:
 https://lkml.org/lkml/2011/10/15/42
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1378977

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-08 15:18:34 -05:00
Kshitij Gupta
b34e81e606 utils: Allow Perl utils to store and write back unsupported rules
This patch:
- allows the unsupported rules to be stored when parsing profiles
- writes all the unsupported rules back to profile

Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-09 01:42:33 +05:30
Kshitij Gupta
8bc6a176f6 Fix: fix aa-genprof to use new PromptQuestion class
The following patch:
- ensures aa-genprof also uses class based prompt

Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-09 01:37:18 +05:30
Jamie Strandboge
de9fcf1def Description: update freedesktop.org for new location of mimeapps.list
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1377140

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-08 14:32:11 -05:00
Steve Beattie
1e437a3cd8 utils: fix missed conversion in move to more class based approach
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-10-08 11:05:01 -07:00
Steve Beattie
22af3ba507 utils: fix typo in apparmor/aa.py
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-08 10:41:31 -07:00
Christian Boltz
e70f8f2f78 remove duplicated "dbus" from "unsupported rule types" regex
(introduced in my previous patch)

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-10-08 18:46:09 +02:00
Christian Boltz
f1c86e2486 Convert RE_PROFILE_BARE_FILE_ENTRY and the code using it to named
match groups. 

Also split out RE_OWNER that matches the "owner" keyword.

To make the code easier to understand, I dropped the existing audit
variable and instead directly query the "new" audit variable while 
filling path_rule['audit'].


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-08 12:31:56 +02:00
Christian Boltz
3b5bede154 AppArmor.pm: add basic support for signal, unix, ptrace and dbus rules
YaST still uses AppArmor.pm, and now errors out when starting the 
profile editor because it doesn't know about signal, unix, ptrace and 
dbus rules.

This patch adds basic support for those rules to AppArmor.pm by adding 
them to the "ignore those rules" regex.

Note: Rules covered by this regex are lost when writing the profile
therefore the patch adds a comment to at least make this a "known bug".

References:https://bugzilla.novell.com/show_bug.cgi?id=900013


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-07 22:27:58 +02:00
John Johansen
44d2e9dacf fix: auditing of capabilities
BugLink: http://bugs.launchpad.net/bugs/1378091

The audit flags are not being set correctly by the parser so that

  audit capability XXX,

will not result in an audit message being logged when the capability
is used.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-07 12:50:23 -07:00
Kshitij Gupta
52cd4835e2 Refractor prompts in utils.
The following patch:
- creates a class for prompt questions moving away from Perl hash hack
for the purpose.
- moves some functions to the methods for that class
- fix options being incorrectly passed to questionPrompt in aa-mergeprof

Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-07 18:36:01 +05:30
Jamie Strandboge
6c5efcc5ea Update gnome abstraction to allow unix connections to dbus-vfs-daemon abstract
socket. Note, DBus mediation is still in effect so rules still need to be added
for accessing the DBus API (LP: #1375067)


Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-06 14:06:23 -05:00
Christian Boltz
d00f01d0a8 ntpd on openSUSE Factory needs another location for the pid file.
References: https://bugzilla.novell.com/show_bug.cgi?id=899746


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-06 19:57:46 +02:00
Christian Boltz
ed1e2f3321 fix utils/test/runtests-py*.sh exitcode
utils/test/runtests-py*.sh always exits with $? = 1 even if there is no 
error. This is caused by the last executed command, test -n

This patch changes it to test -z so that we'll get $? = 0 if all tests 
succeed.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-10-03 11:48:21 +02:00
Steve Beattie
a44b6ce0a2 C tools: rename __unused macro to unused
Bug: https://bugzilla.novell.com/show_bug.cgi?id=895495

We define the __unused macro as a shortcut for __attribute__((unused))
to quiet compiler warnings for functions where an argument is unused,
for whatever reason. However, on 64 bit architectures, older glibc's
bits/stat.h header defines an array variable with the name __unused
that collides with our macro and causes the parser to fail to build,
because the resulting macro expansion generates invalid C code.

This commit fixes the issue by removing the __unused macro where it's
not needed (mod_apparmor) and renaming it to 'unused' elsewhere. It also
in some instances reorders the arguments so that the unused macro
appears last consistently.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-10-02 12:58:54 -07:00
Steve Beattie
ce70c84f5c X abstraction: adjust for LightDM xauthority location
Bug: https://bugs.launchpad.net/bugs/1339727

LightDM keeps moving the location where it stores xauthority files for
users, when configured to store them in a system directory (e.g. with

  [LightDM]
  user-authority-in-system-dir=true

set in a lightdm configuration file).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-10-02 11:06:05 -07:00
John Johansen
655b1534e7 Parser: fix error when using regex profile names in IPC rules
BugLink: http://bugs.launchpad.net/bugs/1373085

The parser fails to accept certain characters, even when escaped
or quoted as part of the profile or label name in ipc rules. This
is due to the lexer not accepting those characters as part of the
input pattern.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-01 15:54:30 -07:00
Christian Boltz
95994ed64a convert RE_PROFILE_CAP in aa.py and the code using it to named match groups
(capability is one of the easiest rule types, so it's good as a start.)

The patch also adds basic support for rules containing more than one 
capability, like
    capability chown dac_override,
Note that this is just a pass-through mode (instead of complaining about 
an invalid line). aa-logprof will happily add another "capability chown" 
if it hits a log entry for it. (But: we never got a bugreport about not 
supporting multi-capability lines, so I guess they are rarely used ;-)

I also added a parse_audit_allow() function to handle the audit and 
allow/deny keywords. They are used in most rule types, which means we 
can get rid of some duplicated code with this function.


Finally, update utils/test/test-regex_matches.py - RE_PROFILE_CAP now 
has 5 instead of 4 match groups because of the added multi-capability 
support.

While on it, I also improved the error message in setup_regex_tests()
to also show the rule that causes a problem.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-10-01 21:45:22 +02:00
Tyler Hicks
bcb1cd750e tests: getopt is not required for bound AF_UNIX pathname sockets
Bug: https://bugs.launchpad.net/bugs/1375516

The unix_socket test program calls getsockopt() after calling bind().
Because AppArmor continues to use traditional file rules for sockets
bound to a filesystem path, it does not mediate some socket operations
after the socket has been bound to the filesystem path. The getopt
permission is one of those socket operations.

To account for this lack of mediation, the getopt permission should be
removed from the server permissions list.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-30 19:00:32 -05:00
Tyler Hicks
7bf0c15ef8 tests: Add unnamed socket tests
Tests abstract UNIX domain sockets with various combinations of implied
permissions, explicit permissions, and conditionals. It also tests with
bad permissions and conditionals.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-30 12:00:10 -05:00
Tyler Hicks
85db44b586 tests: Add negative tests for missing individual AF_UNIX pathname perms
Iterate through the individual client and server AF_UNIX pathname
permissions and remove them, one-by-one, to verify that the test fails.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-30 11:34:42 -05:00
Tyler Hicks
84b6f98007 tests: Separate client and server AF_UNIX pathname permissions
The client and server programs require a different set of AF_UNIX
permissions. This patch makes it so that the unix rules are constructed
differently depending on the program under test.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-30 11:34:32 -05:00
Tyler Hicks
0262f44eb7 tests: Add abstract socket tests
Tests abstract UNIX domain sockets with various combinations of implied
permissions, explicit permissions, and conditionals. It also tests with
bad permissions and conditionals.

The new file unix_socket.inc includes a generic set of tests that can be
reused by another test script in order to test unnamed AF_UNIX socket
mediation. The do_test() function is conditionalized in a way that it
can test confined servers and confined clients depending on the
arguments passed in.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:49:13 -05:00
Tyler Hicks
2b22c70e74 tests: Break up unix_socket getopt and setopt operations
The unix_socket operations for testing getopt and setopt permissions
were occurring back to back. This patch breaks them up into "pre-bind"
and "post-bind" operations. The setopt operation now occurs pre-bind
while the getopt operation happens post-bind. This allows for the test
policy to test setopt without an addr= conditional and to test getopt
with an addr= conditional.

Additionally, the wrapper functions that call setsockopt()/getsockopt()
are moved into a new file that both unix_socket.c and
unix_socket_client.c can reuse.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:48:27 -05:00
Tyler Hicks
3368c9bc40 tests: Test the getattr permission in unix_socket_client
The client will now do a getsockname() on its socket in order to test
the AppArmor 'getattr' unix rule permission.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:47:53 -05:00
Tyler Hicks
48a755d471 tests: Test the shutdown permission in unix_socket
The server will now do a shutdown() on its socket in order to test the
AppArmor 'shutdown' unix rule permission.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:47:42 -05:00
Tyler Hicks
12b09ecd9e tests: Don't call connect() for connectionless sockets
Use the sendto()/recvfrom() functions when dealing with dgram sockets in
unix_socket_client.

This allows us to test different interfaces besides the typical
write()/read() and will allow for a smaller permissions set for
unix_socket_client.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:47:36 -05:00
Tyler Hicks
f31b44ff2d tests: Don't use autobinding in unix_socket_client
The unix_socket_client test program was using an abstract socket, which
was set up using the autobind feature, when testing any socket address
types.

To more accurately test a specific address type, this patch changes the
client code to use whatever address type that the server is using. The
string ".client" will be added to the end of the server's address.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-29 18:47:14 -05:00
Christian Boltz
deaa692aa2 test if aa-enforce removes force-complain symlinks
Two weeks ago, I fixed various tests in minitools_test.py which also 
included disabling the test if aa-complain deletes the force-complain 
symlink because nothing (especially aa-complain) creates those symlinks.

Seth didn't like the removal of that test too much. Therefore this patch
"manually" creates the force-complain symlink and tests that it's removed
by aa-enforce.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-26 22:03:14 +02:00
Seth Arnold
ce2abf01d5 Simon Deziel 2014-09-25 abstractions/freedesktop.org: Allow reading /usr/share/applications/defaults.list
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-25 17:47:18 -07:00
Simon Deziel
1d867ae7ba abstractions/freedesktop.org: Allow reading /usr/share/applications/defaults.list
This is required at least by Pidgin's profile and it seems harmless
to allow looking at its content.
2014-09-25 19:45:11 -04:00
Christian Boltz
3d902d57fc dovecot profile improvements:
- usr.lib.dovecot.auth needs /{var/,}run/dovecot/auth-token-secret.dat{,.tmp} rw,
- usr.lib.dovecot.imap requests block_suspend, which I propose to deny as usual

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-26 00:37:14 +02:00
Jamie Strandboge
1842767cf3 add /usr/bin/gnome-gmail to ubuntu-email (LP: #1169881) 2014-09-24 15:26:38 -05:00
Launchpad Translations on behalf of apparmor-dev
4ae5e94aec Launchpad automatic translations update. 2014-09-24 05:57:57 +00:00
John Johansen
9e93e6eaf5 fix: if the apparmor parser fails to load the cache try rebuilding
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-23 14:33:54 -07:00
John Johansen
8fb91c8e9d fix: Make the parser behave the same as when driven with xargs -n1
Currently the parser is bailing when it fails to load a profile,
not processing any potential subsequent profiles in the dir or passed
in list. This results in all policy after the first error failing
to load, instead of just the profile(s) with the error.

This is a different behavior than what has been done by initscripts
that have driven it with xargs -n1, passing it a single profile
at a time.

Fix this so that the parser only exits on first error if specifically
told to do so.

Note: this does not fix the various failure points in the parser
that call exit, instead of returning an error.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>, thanks.
2014-09-23 14:24:40 -07:00
Steve Beattie
32e48a077d Periodic sync up with lp:apparmor 2014-09-23 09:21:12 -07:00
Steve Beattie
8b030e8877 Merge launchpad translations:
- updated utils templates for named string parameters
- parser Malay strings update
2014-09-23 09:18:21 -07:00
Steve Beattie
297716d7e7 parser: fix partial compilation of C++ files
With the move to C++-ification of the parser, the parser's makefile was
not updated to take into account .cc files when deriving object files.
This would result in the final linking compilation of the parser binary
including all of the .cc files in its command line, rather than the ,o
files. This patch fixes the issue as well as an additional typo in the
dependency list for af_unix.o that was not triggered because af_unix.o
was not being built independently.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-23 07:54:04 -07:00
Tyler Hicks
862bbb91eb tests: Migrate unix_socket tests from poll to sock IO timeouts
Update unix_socket and unix_socket_client to use setsockopt() in order
to set send and receive timeouts for socket IO operations. This takes
the place of poll(). Poll() was not being used for all potentially
blocking socket operations which could have resulted in test cases
blocking infinitely.

This also has the nice side effect of using getsockopt() and
setsockopt(). These are AppArmor mediation points in kernel ABI v7 so it
is worthwhile to test the calls while under confinement.

This patch updates the existing v7 policy generation to allow the getopt
and setopt accesses.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 18:17:09 -05:00
Tyler Hicks
9e385d86c9 tests: Update unix_socket_pathname.sh socket tests for v7
The AppArmor kernel ABI v7 requires that a 'unix create,' rule be
granted to confined processes that call socket(AF_UNIX, type, 0). This
is true for pathname, abstract, and unnamed UNIX domain sockets since
the address type of a socket is not yet known when socket(2) is called.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 18:16:52 -05:00
Tyler Hicks
5153701317 tests: Revert to grouping AF_UNIX tests into addr type specific scripts
It is too complicated, due to the number of corner cases, to write a
script that generates the rules for each AF_UNIX address type (pathname,
abstract, and unnamed) and socket type (stream, dgram, and seqpacket).

This patch moves the AF_UNIX pathname tests into their own file with the
intent of having each address type be tested in their own file.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 18:16:15 -05:00
Tyler Hicks
3fb09b20f2 tests: Fix socket addr lengths in unix_socket/unix_socket_client
Instead of using the entire sun_path buffer for abstract socket names,
only use the exact length of the string that is specified on the command
line. The nul-terminator is not included for abstract sockets.

The size of sun_path is modified to include the nul-terminator for
pathname address types.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 18:15:01 -05:00
Tyler Hicks
eea15ce54b tests: Exit with error from unix_client if execl() fails
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 18:14:38 -05:00
Christian Boltz
0daaaca946 Make the profile parsing regexes in aa.py easier to read by splitting
out common parts (like audit and deny flags or the typical end of the
line (comma and comment).

The patch also introduces the named match groups <audit>, <allow> and
<comment> which we can start to use whenever we want. The group
numbering is kept unchanged, so we can migrate one regex / rule type
after the other to named groups (not only audit, allow and comments, but
changing all regexes will be another patch ;-)

As a side effect, fix RE_PROFILE_CHANGE_PROFILE, RE_PROFILE_ALIAS and
RE_PROFILE_RLIMIT which did not allow ",   #" (comma, space, comment) at
the end of the line.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-09-22 23:41:54 +02:00
Steve Beattie
bd681b8977 parser: tests: exercise local and peer addr perms
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-22 11:36:14 -05:00
Tyler Hicks
a154d14f5a parser: Sync parser and man page regarding local and peer perms
This patch updates the parser code to reject rules that contain local
socket permissions and peer conditional elements. The error message for
that condition is also corrected to resolve a copy and paste mistake
from the D-Bus rule parsing code.

The patch also updates the man page to correctly describe the two sets
of socket permissions and fixes an example rule that resulted in a
parser error after the change described above.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-22 11:34:32 -05:00
John Johansen
ffa2f682ea Do not output local permissions for rules that have peer_conditionals
while it is not possible to specify a rule with local conditionals with
peer conditionals
eg.
   unix listen peer=(addr=@foo),

a rule such as
   unix peer=(addr=@foo),

is possible, and was setting all permissions for local as well as the peer
condition permissions.

Currently this means the create permission must be specified in a separate
rule from a rule with a peer= condition, if create is to be allowed. This
isn't too much of an issue but it does mean rule such as
  unix connect peer=(addr=@foo),

Can not imply the ability to create a socket. Which may indeed be the
behavior if we wish to enforce that the socket was created in another
process and passed in. Is this what we want to do?

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-09-22 11:33:49 -05:00
Launchpad Translations on behalf of apparmor-dev
0a01abf370 Launchpad automatic translations update. 2014-09-22 05:56:12 +00:00
Launchpad Translations on behalf of apparmor-dev
c32681a236 Launchpad automatic translations update. 2014-09-21 05:45:25 +00:00
Seth Arnold
01b754b24d Support subuids for useradd, patch from Fabian Grünbichler
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761994
2014-09-18 15:03:49 -07:00
Steve Beattie
1519d46325 tests: fix socketpair tests for added af_unix crosscheck
The new af_unix apparmor kernel patches include the first step towards
implicit labeling. As a result, when a file descriptor is inherited
across one profile boundary to another, both labels' policies are
checked for valid access to the file descriptor. However, due to a quirk
in the linux kernel, when a socket is opened, the file descriptor is
marked as having read and write (aka send and receive) access. When the
crosscheck revalidation occurs, this means that the policy being
inherited from requires read/write access to the socket descriptor, even
if the process never reads or writes to it. This resulted in a few
failures in the socketpair tests.

The following patch adjusts the failing tests to include the neccessary
send and receive permissions, as well as adding additional tests that
are expected to fail when they are not present, to try to ensure that
if our crosscheck behavior changes, we catch it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-09-18 12:04:29 -07:00
Christian Boltz
f22496cdac abstractions/php: allow access to /etc/php5/**.ini
Based on a patch from Felix Geyer who wrote in April:
> On Ubuntu trusty the php package creates config symlinks in
> /etc/php5/cli/conf.d/, /etc/php5/cgi/conf.d/ and
> /etc/php5/fpm/conf.d/ to /etc/php5/mods-available/.

This patch is a simplified version of his patch that allows 
/etc/php5/**.ini r and /etc/php5/**/ r

Acked-by: Seth Arnold <seth.arnold@canonical.com> on IRC
(after menacing an Acked-by: <timeout>)
2014-09-16 21:44:48 +02:00
Jamie Strandboge
5def2f5693 update Ubuntu-specific abstractions/ubuntu-helpers for unix mediation
Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-09-15 16:18:51 -05:00
Steve Beattie
08bc0441d4 Due to wanting to support additional external apparmor python modules,
both real [0] and hypothetical (e.g. gui prototypes), as part of
the python utils merge, some namespace packaging bits were added
to apparmor/__init__.py, based on the (not very clear) advice given
in python's pep 0420 [1]. However, a side effect of this is that it
causes system installed versions of python modules to be used over
paths specified via PYTHONPATH [2], which breaks our in-tree tests
when the system versions of the python modules are out of date with
respect to the in-tree version.

It seems based on testing, however, that carrying this code snippet
is no longer necessary to have external modules be found. Thus,
the following patch drops it.

[0] e.g. https://launchpad.net/click-apparmor
[1] http://www.python.org/dev/peps/pep-0420/
[2] a python upstream discussion about this occurred at
    https://mail.python.org/pipermail/distutils-sig/2014-March/024049.html

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-15 12:18:16 -07:00
Steve Beattie
c48d7dc71f manpages: incorporate podchecker; fix errors and (most) warnings
This patch adds a 'check_pod_files' make target to the common make
rules, and then fixes the errors it highlighted as well as most of
the warnings. It will cause 'make check' in most of the directories to
fail if there are errors in a pod file (but not if there are warnings).

Common issues were:

  - using an '=over/=back' pair for code-like snippets that did not
    contain any =items therein; the =over keyword is intended for
    indenting lists of =item entries, and generates a warning if
    there isn't any.

  - not escaping '<' or '>'

  - blank lines that contained spaces or tabs

The second -warnings flag passed to podchecker is to add additional
warnings, un-escaped '<' and '>' being of them.

I did not fix all of the warnings in apparmor.d.pod, as I have not come
up with a good warning-free way to express the BNF of the language
similar in format to what is currently generated. The existing
libapparmor warnings (complaints about duplicate =item definition
names) are actually a result of passing the second -warnings flag.
The integration into libapparmor is suboptimal due to automake's
expectation that there will be a test driver program(s) for make check
targets; that's why I added the podchecker call to the manpage
generation point.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
---
 changehat/mod_apparmor/Makefile         |    3 
 changehat/mod_apparmor/mod_apparmor.pod |   28 ++-
 common/Make.rules                       |    4 
 libraries/libapparmor/doc/Makefile.am   |    7 
 parser/Makefile                         |    2 
 parser/apparmor.d.pod                   |  275
+++++++++++++-------------------
 utils/Makefile                          |    3 
 utils/aa-cleanprof.pod                  |    2 
 utils/aa-complain.pod                   |    2 
 utils/aa-decode.pod                     |    2 
 utils/aa-easyprof.pod                   |   69 +++-----
 utils/aa-enforce.pod                    |    2 
 utils/aa-genprof.pod                    |    2 
 utils/aa-logprof.pod                    |    6 
 utils/aa-sandbox.pod                    |   64 ++-----
 utils/logprof.conf.pod                  |    2 
 utils/vim/Makefile                      |    2 
 17 files changed, 212 insertions(+), 263 deletions(-)
2014-09-15 11:30:47 -07:00
Launchpad Translations on behalf of apparmor-dev
f4b5811109 Launchpad automatic translations update. 2014-09-15 06:03:21 +00:00
Kshitij Gupta
b7ff639d73 Fix warnings generated due to unnamed arguments in translatable strings.
This patch:
- replaces unnamed arguments with named arguments wherever more than 1
one arguments ware present in a message
- minor fix in aa-unconfined for pname argument in 2 strings
- updated pot files (as a side-effect of testing with make)

Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-14 23:47:00 +05:30
Christian Boltz
bc06f9f23a various fixes for utils/test/minitools_test.py:
- test_audit: fix error message
- test_complain: replace "aa-complain -r" with aa-enforce (we removed 
  the -r flag from aa-complain)
- test_complain: disable checks for force-complain symlinks, 
  aa-complain doesn't create them

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-09-14 17:27:01 +02:00
Steve Beattie
b6d33f2c16 Periodic sync up from trunk of lp:apparmor 2014-09-14 00:47:20 -07:00
Steve Beattie
68b3af026c Merge back the updated translation files from launchpad with the
added format strings from the recently update parser template file.
2014-09-14 00:45:20 -07:00
Launchpad Translations on behalf of apparmor-dev
503fcc1ad9 Launchpad automatic translations update. 2014-09-14 05:58:56 +00:00
Steve Beattie
79fe4cbfb5 Merge updated parser translation template as well as other commits from
trunk.
2014-09-13 00:21:14 -07:00
Steve Beattie
ff1ae04853 Regenerate the parser's string translation template file. 2014-09-13 00:14:06 -07:00
Steve Beattie
3ca8bbe6a7 parser: make flags defintion consistent
In profile.h, flagvals is declared to be class, but then in the
Profile class, the flags field declares it as a struct. This patch
makes the field declaration type consistent.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-12 23:53:39 -07:00
Steve Beattie
b80559ab20 parser: fixup af_xxxx.o make dependencies
In trunk commit 2615, make targets for af_rule.o and af_unix.o were
added. Unfortunately, the af_rule.o target's dependency on rule.h was
missing the .h suffix. This patch fixes the issue and adds some other
headers that the source file are dependent on.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-12 23:51:26 -07:00
Launchpad Translations on behalf of apparmor-dev
8418703863 Launchpad automatic translations update. 2014-09-13 05:57:25 +00:00
Steve Beattie
b421cf7c1a Merge back in the German launchpad translations that got dropped due to
the last merge having a conflict.
2014-09-11 23:56:27 -07:00
Launchpad Translations on behalf of apparmor-dev
e67f6561c4 Launchpad automatic translations update. 2014-09-12 05:53:50 +00:00
Steve Beattie
cd539e0a21 Periodic merge from lp:apparmor (trunk). 2014-09-11 10:42:00 -07:00
Steve Beattie
b099168e6b Merge translation updates back from launchpad. 2014-09-11 10:35:47 -07:00
Launchpad Translations on behalf of apparmor-dev
298df16292 Launchpad automatic translations update. 2014-09-11 05:48:53 +00:00
Tyler Hicks
4d93599568 tests: Update dbus.inc for af_unix mediation
Put a bare unix rule in the core gendbusprofile() function that all
dbus_*.sh use. We aren't interested in testing AF_UNIX mediation in the
dbus tests, since that's already done elsewhere, so we'll
unconditionally allow full AF_UNIX access to prevent test breakage
caused by any future changes in libdbus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-10 21:30:29 -05:00
Tyler Hicks
0371afa3fc tests: Update unix_fd_server.sh for af_unix mediation
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-10 21:30:27 -05:00
Tyler Hicks
2f85b775d3 tests: Update socketpair.sh for af_unix mediation
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-10 21:30:24 -05:00
Tyler Hicks
f2e4a44191 tests: Update deleted.sh for af_unix mediation
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-10 21:30:20 -05:00
Christian Boltz
47ec6707e5 fix syntax error
Pre-Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-11 01:09:07 +02:00
Seth Arnold
d3bf71c20a intrigeri@boum.org 2014-09-10 audio abstraction: allow reading /etc/wildmidi/wildmidi.cfg.
Needed for at least pidgin.
2014-09-10 16:07:42 -07:00
intrigeri
c9bf33e17f audio abstraction: allow reading /etc/wildmidi/wildmidi.cfg. 2014-09-10 15:40:43 -07:00
Christian Boltz
40a829ef6b merge in some translations from old utils de.po
A side effect of not including utils/apparmor/*.py in the .pot file was
that some translations were lost. This patch includes backported (or
forward-ported?) translations from r2186. It's not a simple merge, I 
reviewed everything I merged and changed it if necessary.

I also removed the outdated 
    "Language-Team: Novell Language <language@novell.com>\n"


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-11 00:10:03 +02:00
Steve Beattie
525451de43 Periodic merge from lp:apparmor (trunk). 2014-09-10 11:18:18 -07:00
Steve Beattie
251a8a9650 Regenerate the utils translation template (.pot) file, both to prepare
for the upcoming release and to compensate for the previous commit that
fixed an issue with missing translatable strings.
2014-09-10 11:15:56 -07:00
Steve Beattie
2f54f0d97a utils: search python modules for translatable strings
In the conversion from perl to python, it got overlooked to add the
python-apparmor modules to the set of things to search for translatable
strings in. This patch addresses the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-10 11:13:59 -07:00
Seth Arnold
70119a81d8 The AppArmor parser failed to build on the x32 architecture due to a
missing <sys/sysctl.h> header. This header is included by accident, a
vestige of earlier days, and wasn't removed when the sysctls were removed.
(Think Linux 2.0 or Linux 2.2 days.)

See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760378

Thanks to Thorsten Glaser for the discovery and initial fix.
2014-09-10 10:28:00 -07:00
Steve Beattie
0e7c2e4296 Merge added Chechen po template and meta info updates from launchpad
translations branch.
2014-09-09 16:27:07 -07:00
Steve Beattie
4e7dbabd61 With 2.9 beta 2 released, prepare for possible beta 3. 2014-09-09 16:25:14 -07:00
Jamie Strandboge
63976b49d4 Miscellaneous updates for phpsysinfo on Ubuntu 14.10
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-08 20:42:50 -05:00
Jamie Strandboge
575d75eca8 Update phpsysinfo instructions in usr.sbin.apache2. Incorporate feedback from
Simon Deziel.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-08 20:39:34 -05:00
Christian Boltz
e9fbdbf74b abstractions/ruby: add /usr/local/ and vendor_ruby paths
The Debian and Ubuntu Ruby 1.9.1 package is configured like this:
--with-vendordir='/usr/lib/ruby/vendor_ruby' --with-sitedir='/usr/local/lib/site_ruby

These paths are missing in the ruby abstraction.

Patch by Felix Geyer <debfx@ubuntu.com>


Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-08 21:36:47 +02:00
Christian Boltz
3035660716 add missing --display to aa-notify.pod
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-08 20:40:33 +02:00
Christian Boltz
4985e50a41 Fix for commit trunk r2657:
> Allow dnsmasq read access to IPv6 config

The commit did not match this part of the commit message  
> slightly modified (../conf/**/mtu -> ../conf/*/mtu)
which I'm fixing now.
2014-09-08 20:35:31 +02:00
Kshitij Gupta
f63f08d79a Fix incorrect options being displayed for capabilites in aa.py
The following patch:
- ensures the options are passed correctly in the expected form.

Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-08 18:01:18 +05:30
John Johansen
e5528ff87b Remove unnecessary include of libintl.h
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-07 12:42:47 -07:00
Christian Boltz
ce8fbf63fd Allow dnsmasq read access to IPv6 config
The IPv6 Neighbor Discovery protocol (RFC 2461) suggests
implementations provide MTU in Router Advertisement (RA)
messages.  From section 4.2

MTU    SHOULD be sent on links that have a variable MTU
       (as specified in the document that describes how to
       run IP over the particular link type).  MAY be sent
       on other links.

dnsmasq supports this option and should have read access
to an interface's MTU.

Patch by James Fehlig <jfehlig@suse.com>


slightly modified (../conf/**/mtu -> ../conf/*/mtu)


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-06 23:06:46 +02:00
Christian Boltz
6bc1b6ef43 replace copy_netrules_other with list(netrules_other[...]) in
delete_net_duplicates()

Also remove the now unused "import copy".

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-09-05 23:21:00 +02:00
Jamie Strandboge
bafb5ff2b4 The base abstraction for unix sockets uses peer=(addr=none) with getattr,
getopt, setopt and shutdown. This was added based on incorrect logging in early
iterations of the abstract kernel patches which have since been fixed. These
options don't make sense with peer=(addr=none), so drop that.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-05 13:08:55 -05:00
Tyler Hicks
79698cdbfe tests: Update mkprofile.pl to accept unix rules
Example gen_unix() inputs and outputs:

  "unix:ALL" -> "  unix,\n"

  "unix:(create,bind,listen,accept):addr=@foo:peer=(label=bar)" ->
    "  unix (create,bind,listen accept) addr=@foo peer=(label=bar),\n"

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-05 09:43:49 -05:00
Tyler Hicks
cdd23798bb tests: Add dbus tests for unrequested reply messages
Unrequested replies are message types that are typically replies, such
as error and method_return message types, but have not been requested by
the recipient.

The AppArmor mediation code in dbus-daemon allows requested reply
messages through if the original message was allowed. However,
unrequested reply messages should be checked against the system policy
to make certain that they should be allowed.

This test verifies that the dbus-daemon is properly querying system
policy when it detects that a message is an unrequested reply.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-05 09:43:05 -05:00
John Johansen
2259857281 parser: Fix the permission encoding output of getopt/setopt
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-04 12:40:47 -07:00
Steve Beattie
c2f7e5ff80 bison grammers: use pure.api directive instead of pure-parser variants
This patch adjusts the bison grammer in libapparmor and the parser
to use the %define api.pure directive instead of the deprecated
%pure_parser and %pure-parser keywords.  Bison had been warning about
the former:

  libraries/libapparmor/src/grammar.y:71.1-12: warning: deprecated directive, use ‘%pure-parser’ [-Wdeprecated]
  %pure_parser
  ^^^^^^^^^^^^

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 11:37:33 -07:00
Jamie Strandboge
5bd93faf73 man page updates for abstract, anonymous and netlink sockets
- fix typo
- fix whitespace
- add netlink
- update for change from path to addr
- remove TODO items
- add and document examples
- remove undocumented 'unix server addr=@foo,' example

Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 10:53:13 -07:00
Steve Beattie
d99222b1b9 libaalogparse: support missing mount keywords
This patch adds support for the mount and pivotroot related keywords,
fstype, flags, and srcname.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 10:10:56 -07:00
Steve Beattie
4dd76b704e libaalogparse: add signal and peer keyword support
When signals and ptrace mediation were added to apparmor, the aalogparse
routines were not adjusted to compensate. This patch adds support for
the signal and peer keywords.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 09:57:32 -07:00
Steve Beattie
049cb96106 libaalogparse: fix for new kernel dmesg format
The upstream kernel at some point between the 3.13 and 3.16 kernel
adjusted the output of audit messages to include an additional "audit:"
keyword. e.g. a 3.13 message would look like:

  kernel: [182243.243324] type=1400 audit(1409684003.960:273342): [SNIP]

whereas in 3.16, it looks like:

  kernel: [182243.243324] audit: type=1400 audit(1409684003.960:273342): [SNIP]
                          ^^^^^^

This patch adjust the libapparmor aalogparse grammar and lexer to
compensate for this change.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 09:51:18 -07:00
Christian Boltz
826e9d998b fix "dictionary changed size during iteration" in cleanprof.py
delete_net_duplicates()

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-04 13:19:39 +02:00
Steve Beattie
3a5106527c utils tests: restructure signal parse tests
Convert the signal parse tests to use common AAParseTest super class in
common_test.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:36:11 -07:00
Steve Beattie
b05cc0f36f utils tests: restructure ptrace parse tests
Convert the ptrace parse tests to use common AAParseTest super class
in common_test.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:32:59 -07:00
Steve Beattie
e8d7dcd321 utils tests: restructure pivotroot parse tests
Convert the pivotroot parse tests to use common AAParseTest super
class in common_test.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:31:09 -07:00
Steve Beattie
37adff769c utils tests: restructure mount parse tests
Convert the mount parse tests to use common AAParseTest super class in
common_test.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:28:18 -07:00
Steve Beattie
59b5b8bab6 Subject: utils tests: restructure DBUS parse tests
Convert the DBUS parse tests to use common AAParseTest super class in
common_test.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:26:19 -07:00
Steve Beattie
365b6d603c utils tests: restructure Unix Parse tests
This patch abstracts out parse tests into a super class to inherit from
and converts the af_unix parse tests to use the super class.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:24:57 -07:00
Steve Beattie
74da13e7a3 utils: convert raw rules classes to subclass from _Raw_Rule
The patch that adds support for af_unix rules added a _Raw_Rule base
class to inherit from in rules.py. This patch converts the rest of the
raw rules classes to use the same.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:23:38 -07:00
Steve Beattie
b86d83759a Subject: utils tests: assign regex function at test setup
This patch moves the assignment of the regex function into the unittest
setUp() function rather than at script load time. If for some reason
the python utils library does not define the relevant function, without
this patch the script fails entirely; with it, each individual test
class that depends on the missing regex will fail each test case.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:22:04 -07:00
Steve Beattie
6d34893d4d utils: add limited support for af_unix rules
This patch adds limited support for af_unix rules in the python
utilities, of the "don't touch them, but don't throw a python backtrace
when coming across them, either" variety. Testcases are added as well.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-09-03 18:18:33 -07:00
Christian Boltz
9e4c01f8d3 Add a warning to aa-mergeprof --help that the syntax will change in the
future. Also remove --auto, which is not implemented yet.
2014-09-04 01:49:47 +02:00
John Johansen
29c776e4fc parser: fix rejecting of unix rules with listen or bind permissions
Only reject rules with explicit listen or bind permissions if a peer
conditional is specified.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 16:09:06 -07:00
John Johansen
e119901e3a parser: fix output of listen and setopts commands
The listen and setopts commands have broken encodings because the
tmp stream they use to handle diverging from the other commands
has does not set its write position to to the end of the copied data.
Instead the write head is set to the beginning so that when the
new data for the command is written it overwrites the begging of
the command instead of appending to it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 16:04:31 -07:00
John Johansen
4a616e3545 parser: allow specifying the unix perm with peer perms
Fix to allow specifying the unix perm with peer perms. This is allowed
now and even supported, since for unix sockets the peer accept is
mediated in the unix_stream_connect hook (something that is not
possible in the lsm accept hook).

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 16:01:37 -07:00
John Johansen
4f80b4d5ca parser: change/fix the encoding for unix socket rules.
This changes/fixes the encoding for unix socket rules. The changes
look larger than they are because it refactors the code, instead
of duplicating.

The major changes are:
- it changes where the accept perm is stored
- it moves anyone_match_pattern to default_match_pattern
- it fixes the layout of the local addr only being written when local
  perms are present

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 15:57:17 -07:00
Tyler Hicks
0005895e3d parser: Don't write the stream's address to the rule buffer
The writeu16() function was returning the address of the passed in
std::ostringstream and then the callers of that function were
incorrectly writing that address to the rule buffer.

Before:

  $ echo "/t { unix (connect,read,write) type=stream, }" |
apparmor_parser -qQD dfa-states
  {1} <== (allow/deny/audit/quiet)
  {2} (0x 4/0/0/0)
  {3} (0x 4/0/0/0)
  {43} (0x 46/0/0/0)
  {44} (0x 46/0/0/0)
  
  {1} -> {2}: 0x2
  {1} -> {3}: 0x4
  {1} -> {2}: 0x7
  {1} -> {2}: 0x9
  {1} -> {2}: 0xa
  {1} -> {2}: 0x20 \ 
  {1} -> {4}: 0x34 4
  {3}  (0x 4/0/0/0) -> {5}: 0x0
  {4} -> {6}: 0x0
  {5} -> {7}: 0x1
  {6} -> {2}: 0x31 1
  {7} -> {8}: 0x30 0
  {8} -> {9}: 0x78 x
  {9} -> {10}: 0x37 7
  {10} -> {11}: 0x66 f
  {11} -> {12}: 0x66 f
  {12} -> {13}: 0x66 f
  {13} -> {14}: 0x31 1
  {14} -> {15}: 0x30 0
  {15} -> {16}: 0x34 4
  {16} -> {17}: 0x66 f
  {17} -> {18}: 0x33 3
  {18} -> {19}: 0x35 5
  {19} -> {20}: 0x31 1
  {20} -> {21}: 0x38 8
  {21} -> {22}: 0x0
  {22} -> {23}: 0x1
  {23} -> {24}: 0x30 0
  {24} -> {25}: 0x78 x
  {25} -> {26}: 0x37 7
  {26} -> {27}: 0x66 f
  {27} -> {28}: 0x66 f
  {28} -> {29}: 0x66 f
  {29} -> {30}: 0x31 1
  {30} -> {31}: 0x30 0
  {31} -> {32}: 0x34 4
  {32} -> {33}: 0x66 f
  {33} -> {34}: 0x33 3
  {34} -> {35}: 0x35 5
  {35} -> {36}: 0x31 1
  {36} -> {37}: 0x38 8
  {37} -> {38}: []
  {38} -> {39}: []
  {39} -> {40}: 0x0
  {39} -> {39}: []
  {40} -> {40}: 0x0
  {40} -> {41}: 0x1
  {40} -> {39}: []
  {41} -> {42}: 0x0
  {41} -> {39}: []
  {42} -> {40}: 0x0
  {42} -> {44}: 0x1
  {42} -> {43}: []
  {43}  (0x 46/0/0/0) -> {40}: 0x0
  {43}  (0x 46/0/0/0) -> {43}: []
  {44}  (0x 46/0/0/0) -> {42}: 0x0
  {44}  (0x 46/0/0/0) -> {43}: []

After:

  $ echo "/t { unix (connect,read,write) type=stream, }" |
apparmor_parser -qQD dfa-states
  {1} <== (allow/deny/audit/quiet)
  {2} (0x 4/0/0/0)
  {3} (0x 4/0/0/0)
  {15} (0x 46/0/0/0)
  {16} (0x 46/0/0/0)
  
  {1} -> {2}: 0x2
  {1} -> {3}: 0x4
  {1} -> {2}: 0x7
  {1} -> {2}: 0x9
  {1} -> {2}: 0xa
  {1} -> {2}: 0x20 \ 
  {1} -> {4}: 0x34 4
  {3}  (0x 4/0/0/0) -> {5}: 0x0
  {4} -> {6}: 0x0
  {5} -> {7}: 0x1
  {6} -> {2}: 0x31 1
  {7} -> {8}: 0x0
  {8} -> {9}: 0x1
  {9} -> {10}: []
  {10} -> {11}: []
  {11} -> {12}: 0x0
  {11} -> {11}: []
  {12} -> {12}: 0x0
  {12} -> {13}: 0x1
  {12} -> {11}: []
  {13} -> {14}: 0x0
  {13} -> {11}: []
  {14} -> {12}: 0x0
  {14} -> {16}: 0x1
  {14} -> {15}: []
  {15}  (0x 46/0/0/0) -> {12}: 0x0
  {15}  (0x 46/0/0/0) -> {15}: []
  {16}  (0x 46/0/0/0) -> {14}: 0x0
  {16}  (0x 46/0/0/0) -> {15}: []

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:46:39 -07:00
Tyler Hicks
b5c3ce638d parser: Adjust writeu16() to output escaped byte sequences
The writeu16() function was outputting unescaped byte sequences to the
rule buffer. That resulted the generation of in an incomplete rule if
one of those unescaped byte sequences contained 0x00.

This patch uses u8 pointers, instead of char pointers, when writing out
the big endian u16 value. More importantly, it casts the u8 values to
unsigned ints, which is what's needed to get the properly escaped byte
sequences.

Before:

  $ echo "/t { unix (connect,read,write) type=stream, }" |
apparmor_parser -qQD dfa-states
  {1} <== (allow/deny/audit/quiet)
  {2} (0x 4/0/0/0)
  {3} (0x 4/0/0/0)
  {5} (0x 46/0/0/0)
  
  {1} -> {2}: 0x2
  {1} -> {3}: 0x4
  {1} -> {2}: 0x7
  {1} -> {2}: 0x9
  {1} -> {2}: 0xa
  {1} -> {2}: 0x20 \ 
  {1} -> {4}: 0x34 4
  {3}  (0x 4/0/0/0) -> {5}: 0x0
  {4} -> {6}: 0x0
  {6} -> {2}: 0x31 1
  

After (the next patch fixes the pointer values that are being written
out):

  $ echo "/t { unix (connect,read,write) type=stream, }" |
apparmor_parser -qQD dfa-states
  {1} <== (allow/deny/audit/quiet)
  {2} (0x 4/0/0/0)
  {3} (0x 4/0/0/0)
  {43} (0x 46/0/0/0)
  {44} (0x 46/0/0/0)
  
  {1} -> {2}: 0x2
  {1} -> {3}: 0x4
  {1} -> {2}: 0x7
  {1} -> {2}: 0x9
  {1} -> {2}: 0xa
  {1} -> {2}: 0x20 \ 
  {1} -> {4}: 0x34 4
  {3}  (0x 4/0/0/0) -> {5}: 0x0
  {4} -> {6}: 0x0
  {5} -> {7}: 0x1
  {6} -> {2}: 0x31 1
  {7} -> {8}: 0x30 0
  {8} -> {9}: 0x78 x
  {9} -> {10}: 0x37 7
  {10} -> {11}: 0x66 f
  {11} -> {12}: 0x66 f
  {12} -> {13}: 0x66 f
  {13} -> {14}: 0x31 1
  {14} -> {15}: 0x30 0
  {15} -> {16}: 0x34 4
  {16} -> {17}: 0x66 f
  {17} -> {18}: 0x33 3
  {18} -> {19}: 0x35 5
  {19} -> {20}: 0x31 1
  {20} -> {21}: 0x38 8
  {21} -> {22}: 0x0
  {22} -> {23}: 0x1
  {23} -> {24}: 0x30 0
  {24} -> {25}: 0x78 x
  {25} -> {26}: 0x37 7
  {26} -> {27}: 0x66 f
  {27} -> {28}: 0x66 f
  {28} -> {29}: 0x66 f
  {29} -> {30}: 0x31 1
  {30} -> {31}: 0x30 0
  {31} -> {32}: 0x34 4
  {32} -> {33}: 0x66 f
  {33} -> {34}: 0x33 3
  {34} -> {35}: 0x35 5
  {35} -> {36}: 0x31 1
  {36} -> {37}: 0x38 8
  {37} -> {38}: []
  {38} -> {39}: []
  {39} -> {40}: 0x0
  {39} -> {39}: []
  {40} -> {40}: 0x0
  {40} -> {41}: 0x1
  {40} -> {39}: []
  {41} -> {42}: 0x0
  {41} -> {39}: []
  {42} -> {40}: 0x0
  {42} -> {44}: 0x1
  {42} -> {43}: []
  {43}  (0x 46/0/0/0) -> {40}: 0x0
  {43}  (0x 46/0/0/0) -> {43}: []
  {44}  (0x 46/0/0/0) -> {42}: 0x0
  {44}  (0x 46/0/0/0) -> {43}: []

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:10:41 -07:00
Steve Beattie
4ed3dd090d parser: let unix keyword accept bare send, receive keywords
Let unix keyword accept bare send, receive keywords and add more
simple unix acceptance test cases.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:05:56 -07:00
Steve Beattie
ab93c858d3 parser: initialize perms in unix_rule constructor
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:03:05 -07:00
John Johansen
e811d8f2bf parser: map net permission set into a form compatible with the old dfa table
The old dfa table format has 2 64 bit permission field used to store
all of allow, quiet, audit, owner/!owner and transition mask. This
leaves 7 bits for entry + a few other special bits.

Since policydb entries when using old style dfa permission format
don't use support the !owner permission entries we can map, the
high net work permission bits to these entries.

This allows us to enforce base network permissions on system with
only support for the old dfa table format.

  Bits 0-7 inclusive stay put
  Bits 8-9 inclusive move (14 - 8) = 6 to 14-15 GETATTR | SETATTR
  Bits 20-22 inclusive move -4 to 16-18  ACCEPT | BIND | LISTEN  (notice 22 not 23)
  Bit 23 is skipped, hence the need to shift 5 for 24-25 instead of 4
  Bits 24-25 inclusive move -5 to 19-20

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 14:50:22 -07:00
John Johansen
19c942e5c2 parser: split accept perm processing from rule parsing
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:40:08 -07:00
John Johansen
fb53ec793b parser: Refactor add_new_state into two versions
Refactor add_new_state into two versions, one that splits anodes from
nnodes, and one for use when anodes and nnodes are presplit

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:36:08 -07:00
John Johansen
df961a3e02 parser: Refactor the process_work_queue code into its own fn
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:32:52 -07:00
John Johansen
e86f850d59 parser: Refactor accept nodes to be common to a shared node type
The shared node type will be used in the future to add new capabilities

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 14:29:35 -07:00
John Johansen
ee7bf1dc28 parser: Refactor rule accumulation to use some helper functions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:24:37 -07:00
John Johansen
73c74d044d parser: Move nodeset caching into expr-tree.h
We need to rework permission type mapping to nodesets, which means we
need to move the nodeset computations earlier in the dfa creation
processes, instead of a post step of follow(), so move the nodeset
into expr-tree

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:21:18 -07:00
Steve Beattie
831db5985f parser: update test features file for af_unix feature
This patch tells the parser to do af_unix processing while running the
parser sanity tests, letting the af_unix tests generate the correct
results.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-03 14:12:50 -07:00
Steve Beattie
ade71dc171 parser: Fix segfault in af_unix rule processing
This patch fixes a segfault that was occurring in testing over the
weekend. The problem existed in the original patch that adds af_unix
rules (lp:apparmor commit 2615).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-03 14:08:48 -07:00
Steve Beattie
e85777a57c parser: Convert af_unix rules to support addr= rather than path=
This patch converts the path= modifier to the af_unix rules to use
addr= instead.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:02:25 -07:00
Tyler Hicks
5b46e3b334 parser: Fix AF_UNIX stub rule creation
The patch titled "parser: Add support for unix domain socket rules."
modified the code the creates the stub rules for rule types that the
parser supports.

It added new stub rules for extended network and AF_UNIX rule types but
it also changed the stub rules for all existing rule types. That change
causes the kernel to not enforce some rule types.

This patch fixes the stub rule creation so that existing rule types
continue to be enforced, as well as AF_UNIX rule types when the parser
and kernel both support them.

Here's the DFA states generated before applying the patch mentioned
above:

$ echo "/t { /f r, }" | ./apparmor_parser -qQD dfa-states
{1} <== (allow/deny/audit/quiet)
{3} (0x 10004/0/0/0)

{1} -> {2}: 0x2f /
{2} -> {3}: 0x66 f

{1} <== (allow/deny/audit/quiet)
{2} (0x 4/0/0/0)

{1} -> {2}: 0x2
{1} -> {2}: 0x7
{1} -> {2}: 0x9
{1} -> {2}: 0xa
{1} -> {2}: 0x20 \

Here are the DFA states generated after applying the patch mentioned
above:

$ echo "/t { /f r, }" | ./apparmor_parser -qQD dfa-states
{1} <== (allow/deny/audit/quiet)
{3} (0x 10004/0/0/0)

{1} -> {2}: 0x2f /
{2} -> {3}: 0x66 f

{1} <== (allow/deny/audit/quiet)
{4} (0x 4/0/0/0)

{1} -> {2}: 0x0
{1} -> {3}: 0x34 4
{2} -> {4}: 0x2
{2} -> {4}: 0x4
{2} -> {4}: 0x7
{2} -> {4}: 0x9
{2} -> {4}: 0xa
{2} -> {4}: 0x20 \
{3} -> {4}: 0x31 1

Here are DFA states generated after applying this patch:

$ echo "/t { /f r, }" | ./apparmor_parser -qQD dfa-states
{1} <== (allow/deny/audit/quiet)
{3} (0x 10004/0/0/0)

{1} -> {2}: 0x2f /
{2} -> {3}: 0x66 f

{1} <== (allow/deny/audit/quiet)
{2} (0x 4/0/0/0)

{1} -> {2}: 0x2
{1} -> {2}: 0x4
{1} -> {2}: 0x7
{1} -> {2}: 0x9
{1} -> {2}: 0xa
{1} -> {2}: 0x20 \
{1} -> {3}: 0x34 4
{3} -> {4}: 0x0
{4} -> {2}: 0x31 1

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-03 13:45:44 -07:00
Steve Beattie
019de74059 parser: fix logic error and incorrect reference from previous commit
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-09-03 13:34:10 -07:00
John Johansen
dd44858e60 parser: first step implementing fine grained mediation for unix domain sockets
This patch implements parsing of fine grained mediation for unix domain
sockets, that have abstract and anonymous paths. Sockets with file
system paths are handled by regular file access rules.

The unix network rules follow the general fine grained network
rule pattern of

  [<qualifiers>] af_name [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]

specifically for af_unix this is

  [<qualifiers>] 'unix' [<access expr>] [<rule conds>] [<local expr>] [<peer expr>]

  <qualifiers> = [ 'audit' ] [ 'allow' | 'deny' ]

  <access expr> = ( <access> | <access list> )

  <access> = ( 'server' | 'create' | 'bind' | 'listen' | 'accept' |
               'connect' | 'shutdown' | 'getattr' | 'setattr' |
	       'getopt' | 'setopt' |
               'send' | 'receive' | 'r' | 'w' | 'rw' )
  (some access modes are incompatible with some rules or require additional
   parameters)

  <access list> = '(' <access> ( [','] <WS> <access> )* ')'

  <WS> = white space

  <rule conds> = ( <type cond> | <protocol cond> )*
     each cond can appear at most once

  <type cond> = 'type' '='  ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )

  <protocol cond> = 'protocol' '='  ( <AARE> | '(' ( '"' <AARE> '"' | <AARE> )+ ')' )

  <local expr> = ( <path cond> | <attr cond> | <opt cond> )*
     each cond can appear at most once

  <peer expr> = 'peer' '=' ( <path cond> | <label cond> )+
     each cond can appear at most once

  <path cond> = 'path' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )

  <label cond> = 'label' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')')

  <attr cond> = 'attr' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )

  <opt cond> = 'opt' '=' ( <AARE> | '(' '"' <AARE> '"' | <AARE> ')' )

  <AARE> = ?*[]{}^ ( see man page )

 unix domain socket rules are accumulated so that the granted unix
 socket permissions are the union of all the listed unix rule permissions.

 unix domain socket rules are broad and general and become more restrictive
 as further information is specified. Policy may be specified down to
 the path and label level. The content of the communication is not
 examined.

 Some permissions are not compatible with all unix rules.

 unix socket rule permissions are implied when a rule does not explicitly
 state an access list. By default if a rule does not have an access list
 all permissions that are compatible with the specified set of local
 and peer conditionals are implied.

 The 'server', 'r', 'w' and 'rw' permissions are aliases for other permissions.
 server = (create, bind, listen, accept)
 r = (receive, getattr, getopt)
 w = (create, connect, send, setattr, setopt)

In addition it supports the v7 kernel abi semantics around generic
network rules. The v7 abi removes the masking unix and netlink
address families from the generic masking and uses fine grained
mediation for an address type if supplied.

This means that the rules

  network unix,
  network netlink,

are now enforced instead of ignored. The parser previously could accept
these but the kernel would ignore anything written to them. If a network
rule is supplied it takes precedence over the finer grained mediation
rule. If permission is not granted via a broad network access rule
fine grained mediation is applied.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 13:22:26 -07:00
Jamie Strandboge
0d4f802572 r2606 had updates for the dbus-session-strict and X abstractions but
mistakenly did not incorporate feedback from Seth Arnold. Specifically, don't
specify label=unconfined on the abstract sockets.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 15:11:05 -05:00
John Johansen
0b355ebaac parser: fix build dependencies from .c to .cc
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 13:05:43 -07:00
Steve Beattie
72cde9a4f4 utils/tests: fix bashisms in runtests-py2.sh
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 13:00:33 -07:00
Jamie Strandboge
288fc40d1a mdnsd update for fine-grained netlink mediation
Update mdnsd for fine-grained netlink mediation. A mdnsd binary was not
available to test but code inspection showed it set up the socket the same as
avahi, which uses SOCK_DGRAM type instead of SOCK_RAW with netlink.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:49:50 -05:00
Jamie Strandboge
95c393ae29 update kde abstraction for /etc/xdg/Trolltech.conf
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:48:41 -05:00
Jamie Strandboge
e1ef7e5582 identd pid file location on Debian/Ubuntu
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 14:47:33 -05:00
Jamie Strandboge
9dfa9611ea update to allow /usr/sbin/dovecot access to /usr/share/dovecot/protocols.d/**
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-09-03 14:45:56 -05:00
Jamie Strandboge
8566ed0a0a add unix rules for syslog
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:24:00 -05:00
Jamie Strandboge
1f003c0120 abstraction updates for abstract, anonymous and netlink
- the base abstraction for common abstract and anonymous rules (comments
  included per rule)
- dbus-session-strict to add a rule for connecting to the dbus session
  abstract
  socket. I used 'peer=(label=unconfined)' here, but I could probably lose the
  explicit label if people preferred that
- X to add a rule for connecting to the X abstract socket. Same as for
  dbus-session-strict
- nameservice to add a rule for connecting to a netlink raw. This change could
  possibly be excluded, but applications using networking (at least on Ubuntu)
  all seem to need it. Excluding it would mean systems using nscd would need to
  add this and ones not using it would have a noisy denial

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:21:31 -05:00
Jamie Strandboge
1245d9c287 update avahi-daemon for fine-grained netlink mediation
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-09-03 14:16:32 -05:00
Seth Arnold
c4d40cede0 Fix Debian bug 756807, clang inline functions
Fix clang warnings about inline functions needing either a non-inline
definition or 'static' if they aren't used outside a translation unit.
http://clang.llvm.org/compatibility.html#inline
http://clang.debian.net/status.php?version=3.4.2&key=UNDEF_REF

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-29 17:40:30 -07:00
John Johansen
659e5ff11d fix: [patch 05/12] Make the af type protocol mappings available for use
before the af type protocol mappings patch was applied, a single rule could
result in multiple rule entries being created. The af type protocol mappings
patch broke this by apply only the first of the mappings that could be
found.

Restore the previous behavior by search through the entire table until
all matches have been made.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-25 15:29:20 -07:00
Kshitij Gupta
9e37c3278e Fix the value being set in nt_name when allowed path exist
The patch:
- sets nt_name to the path, if it is allowed.

Acked-by: Christian Boltz <apparmor@cboltz.de>

(acked on IRC based on a link to the ML archive[1])

[1] https://lists.ubuntu.com/archives/apparmor/2014-August/006194.html
2014-08-26 03:13:42 +05:30
Christian Boltz
a620f18cf0 aa.py / ask_the_question() - simplify duplicate option prevention
add a add_to_options() helper function to aa.py which
- adds newpath to options if it's not already there
- returns the updated options and the index of newpath

This removes duplicated code for CMD_GLOB and CMD_GLOBEXT in 
ask_the_question()

It also adds duplicate prevention to CMD_NEW.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-08-25 22:49:29 +02:00
Christian Boltz
4608322da9 better error message in aa.py when reaching EOF unexpectedly
When reaching EOF while still in a profile (syntax-wise), there are two
possible reasons:
- missing "}"
- missing "," in the last rule (which means that, thanks to multiline 
  rule handling, the "}" is considered to be part of the last rule)

This patch improves the error message in aa.py to cover a missing ","


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-08-25 22:05:45 +02:00
John Johansen
1930675a9b Make the af type protocol mappings available for use
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-24 00:00:28 -07:00
John Johansen
bccca11bf6 add generic lookup of af_name mappings
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-23 23:57:55 -07:00
John Johansen
f5704761b5 provide a mapping of sock type and name and a fn to look access the mapping
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-23 23:55:33 -07:00
John Johansen
54655cf9a4 Add network.c, network.h, missing from previous ci 2014-08-23 23:55:12 -07:00
John Johansen
d3c229fc48 group network rule bits into their own file
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-23 23:52:15 -07:00
John Johansen
9fe1e72c44 put the gettext define in one place
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-23 23:50:43 -07:00
Jamie Strandboge
0465bdbf81 Update perl abstraction to allow reading /usr/lib/@{multiarch}/perl{,5}/**
Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-08-21 07:28:44 -05:00
Jamie Strandboge
ac481f142e Allow /var/lib/extrausers/group and /var/lib/extrausers/passwd 'read' in order
to work with libnss-extrausers

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-21 07:27:07 -05:00
Jamie Strandboge
6db2f7d4eb Newer version of libvirt have a lease helper. Update dnsmasq policy for this.
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-20 22:06:15 -05:00
Jamie Strandboge
502e992c42 Update perl abstraction, logprof.conf, severity.db and tests for Debian/Ubuntu
perl multiarch paths

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-20 19:14:24 -05:00
Christian Boltz
5006abbbb2 Fix "Invalid mode found: AUDITING" in aa-logprof. Actually the fix is
done in logparser.py which contained "AUDITING" instead of "AUDIT" at
one place.

References: https://bugs.launchpad.net/apparmor/+bug/1358705


Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-21 00:55:44 +02:00
Christian Boltz
427258d07a remove unused REs in logparser.py
Those REs also exist (and are used) in aa.py.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-18 21:01:38 +02:00
Christian Boltz
784837301b Fix a bug in logparser.py add_event_to_tree(). It looked for '\\null-/'
but should look for '//null-' instead.

Also remove some code duplication by merging with the next condition, 
which executes the same self.add_to_tree code.


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-08-17 21:50:15 +02:00
Christian Boltz
51eb1bd69c fix a crash in aa.py / check_for_LD_XXX():
File "/home/cb/apparmor/HEAD-CLEAN/utils/apparmor/aa.py", line 126, in check_for_LD_XXX
  for line in f_in:
  [...]
UnicodeDecodeError: 'ascii' codec can't decode byte 0xf8 in position 40: ordinal not in range(128)

While on it, also replace usage of the "found" variable by "return" 
statements, which should bring a small performance improvement - if we 
have a match, it's superfluous to continue searching.

The patch also adds me to the copyright header ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-08-17 18:16:33 +02:00
Christian Boltz
ddd78f97d9 Simplify simple_tests/profile/flags/*bad*.sd testcases to make sure
they only fail because of one (expected) reason and we notice if they
don't fail anymore. Complex profiles have the risk to fail for multiple
reasons, which also means nobody will notice if they fail for one reason
less.

The simplification is done by
- removing #include lines
- in some cases, replace the #include line with "/foo/bar r," to avoid 
  empty hats

Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-16 13:22:51 +02:00
Seth Arnold
0ba4c8cd7e Ensure the that the {**,} and {,**} regexs are being properly parsed by
the Python tools.

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-08-14 10:51:42 -07:00
Launchpad Translations on behalf of apparmor-dev
74f82b022f Launchpad automatic translations update. 2014-08-14 05:34:24 +00:00
Tyler Hicks
e46fa6d92f tests: Update unix_socket.sh for kernel ABI v7
Kernel ABI v6 only required 'w' permissions for the parent process that
creates the socket, accepts a connection, writes to the socket, and
reads from the socket.

Kernel ABI v7 will require 'rw' permissions for the parent process. This
change detects the current kernel ABI version and adjusts the parent
process's confinement appropriately. It also performs a negative test to
make sure that 'w' is not sufficient.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:59:34 -05:00
Tyler Hicks
a2d0cc1a97 tests: Minimal update to make unix_socket.sh aware of abstract sockets
This change only sets up unix_socket.sh to test abstract sockets.
Unconfined processes are tested while using an abstract socket but
the test function returns before testing with confinement.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:59:28 -05:00
Tyler Hicks
f7465573b7 tests: Modify unix_socket/unix_socket_client to accept abstract names
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:59:17 -05:00
Tyler Hicks
1cd336386e tests: Rename the unix_socket_file test to unix_socket
Rename the test in preparation for expanding its capabilities to cover
all UNIX domain socket address format types.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:58:51 -05:00
Tyler Hicks
fc8c936361 tests: Don't leak socket fd to child process
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:56:17 -05:00
Christian Boltz
0c904eb476 smbd: changed cachedir in openSUSE
openSUSE now compiles samba --with-cachedir=/var/lib/samba (instead of 
the default /var/cache/samba). This patch updates the smbd profile to 
match this change.


Acked by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:22:55 +02:00
Christian Boltz
61ac0a0ac4 dovecot/auth needs read access to /etc/dovecot/* when using plaintext
user/password files (everybody will use a different filename for the 
user/password list - and when you allow reading the password list, 
allowing to read the config doesn't add any harm ;-)

References: https://bugzilla.novell.com/show_bug.cgi?id=874094

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-08-11 23:16:22 +02:00
Christian Boltz
d5e6058370 apparmor:vim: add mediate_deleted and delegate_deleted flags
Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-11 23:13:55 +02:00
Christian Boltz
c814443a83 Set the currently selected path as (editable) default when using "(N)ew"
in aa-logprof or aa-genprof.

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-08-06 19:07:41 +02:00
Christian Boltz
356e7cb199 aa-mergeprof: honor -d parameter
(it was ignored until now)

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-08-04 20:19:08 +02:00
Christian Boltz
265270b83c From: Jeff Mahoney <jeffm@suse.com>
Subject: perl-apparmor: Properly handle bare 'file' keyword
References: bnc#889652

The bare file keyword is a shortcut for /{**,}. There are also implied
permissions that go with it.

This patch accepts the file keyword as well as allowing for missing mode
specifiers.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-02 12:46:15 +02:00
Christian Boltz
c7f7b8d7e0 From: Jeff Mahoney <jeffm@suse.com>
Subject: perl-apparmor: Handle bare 'capability' keyword
References: bnc#889651

Specifying 'capability' implies all capabilities, but the perl code didn't
recognize it.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-02 12:45:26 +02:00
Christian Boltz
d6f1895465 From: Jeff Mahoney <jeffm@suse.com>
Subject: perl-apparmor: Fix bare 'network' keyword handling
References: bnc#889650

The 'network' bare keyword was being printed as "audit network all" due to
two different bugs:

1) {audit}{all} was always being set to 1, regardless of whether the audit
   keyword was used
2) {rule} eq 'all' is the wrong test - it should be {rule}{all}

With these fixed, 'network' is properly handled.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-by: Steve Beattie <steve@nxnw.org>
2014-08-02 12:43:54 +02:00
Christian Boltz
241544ad8a modify aa-mergeprof to:
- allow users to merge two profiles (2-way merge) using aa-mergeprof by
  making the third profile optional
- re-enable code that cleaned up base and other profile and using it in
  deleted count (was disabled due to pyflakes thinking it was unused)

Patch by Kshitij Gupta <kgupta8592@gmail.com>


Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-07-29 12:39:12 +02:00
Christian Boltz
37ca3dd556 add some more globbing tests for globs with extension, including
filenames that contain a * wildcard and a .* regex wildcard.

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-28 20:16:04 +02:00
Christian Boltz
be6cb6724d fix aa-mergeprof to
- import apparmor.ui as aaui
- call aaui.UI_*() instead of apparmor.aa.UI_*()
- use apparmor.aamode.AA_MAY_EXEC instead of apparmor.aa.AA_MAY_EXEC


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>.
2014-07-28 00:24:26 +02:00
Steve Beattie
ab2ac92ecf utils: make all tests consistent in verbosity
This patch adjusts the verbosity of several of the utils tests,
to make them all consistently verbose.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-25 17:49:06 -07:00
Launchpad Translations on behalf of apparmor-dev
3ec7f81dcc Launchpad automatic translations update. 2014-07-24 05:40:28 +00:00
Christian Boltz
dd3b6a8d4a Set PYTHONPATH=.. in runtests-py3.sh to make sure the tests use the in-
tree python modules.

Also remove "sys.path.append('../')" (and now-unused "import sys") from 
all tests that contain it for consistency and to make testing with the 
installed modules possible (even if we don't have a USE_SYSTEM option 
yet).


Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-22 21:25:25 +02:00
Christian Boltz
95ef7cabcb Fix a crash in aa-logprof (to be exact: save_profiles() in aa.py) when
saving the remaining profile after using "save selected profile".

When using "save selected profile", write_profile() (called by 
write_profile_ui_feedback()) does "changed.pop(profile_name)". 
However, saving the remaining profiles in save_profiles() uses a cached 
version of changed.keys() and therefore tries to save a profile that 
was already saved and is no longer part of "changed".


Also remove two commented lines we'll never need again:
- #changed.pop is done in write_profile()
- q['options'] is set some lines above

References: https://bugs.launchpad.net/apparmor/+bug/1341178

Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-22 12:56:37 +02:00
Steve Beattie
aeebd69555 utils: add CAP_AUDIT_READ to severity.db
This patch adds the new capability CAP_AUDIT_READ, added in the 3.16
kernel, to the utils severity.db. I set the severity level at 7,
since it seemed to offer less exposure than CAP_AUDIT_CONTROL and
CAP_AUDIT_WRITE, which are both considered severity 8.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-21 22:54:14 -07:00
Christian Boltz
a04a6bfdaf change severity_test.py and minitools_test.py to use the in-tree
profiles instead of the system profiles in /etc/apparmor.d/

Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-17 15:59:57 +02:00
Christian Boltz
5f8b035a71 change runtests-py*.sh (scripts for manually running the utils/test/*.py
testcases) to
- sleep 10 seconds after each failed test to make failures more annoying
  ^W^W^W^Wgive people a chance to read failure details
- print a list of failed tests at the end

Also avoid duplicate code by letting runtests-py2.sh call runtests-py3.sh.


Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-17 15:47:18 +02:00
Steve Beattie
9106aa7e59 Periodic merge from lp:apparmor (trunk) 2014-07-16 11:31:47 -07:00
Steve Beattie
0c64863c97 Merge from launchpad translations branch:
* updates to Bosnian, Suomi, and Malay parser translations
* added stub Turkish translation for utils
2014-07-16 11:28:08 -07:00
Launchpad Translations on behalf of apparmor-dev
1619144323 Launchpad automatic translations update. 2014-07-16 05:44:54 +00:00
Christian Boltz
43b128473d logparser.py defines LOG_MODE_RE, but doesn't use it.
LOG_MODE_RE is also defined (and used) in aamode.py.

This patch removes the superfluous definition from logparser.py.


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-14 21:01:15 +02:00
Christian Boltz
abf92ecf67 fix two issues in LOG_MODE_RE in aamode.py:
- remove "Ix" (only valid as lowercase "ix")
- add "pux" (was missing before)

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-14 20:56:26 +02:00
Christian Boltz
faff4b97c4 We still carry around the initscripts for aa-eventd. Since aa-eventd
is dead since a very long time, move them to the deprecated/ directory.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-12 20:51:03 +02:00
Steve Beattie
c71af8b926 libapparmor: fix log parsing memory leaks
This patch fixes some memory leaks in the libapparmor log parsing
functions, specifically around handling records obtained from syslog
and records containing network addresses.

Bug: https://bugs.launchpad.net/bugs/1340927
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-07-11 15:59:21 -07:00
Steve Beattie
16d7e971c3 profiles: permit clustered Samba access to CTDB socket and databases
Merge update to samba abstraction for CTDB support from David Disseldorp
<ddiss@suse.de>,

Acked-by: Steve Beattie <steve@nxnw.org>
2014-07-11 12:49:34 -07:00
Steve Beattie
dd41f0ff87 mod_apparmor: for apache 2.4, use new access control hook
Use ap_hook_check_access_ex() instead of
ap_hook_access_checker() for apache 2.4; see
http://httpd.apache.org/docs/2.4/developer/new_api_2_4.html#http_request

Signed-off-by: Steve Beattie <steve@nxnw.org>
2014-07-09 14:15:11 -07:00
Christian Boltz
dd3df80f01 abstractions/nameservice should allow /run/nscd/passwd etc. in addition
to /var/run/nscd/passwd.

References: https://bugzilla.novell.com/show_bug.cgi?id=886225


Acked-by: Seth Arnold <seth.arnold@canonical.com> for both trunk and 2.8.
2014-07-09 10:14:14 +02:00
Steve Beattie
c42bc173ac mod_apparmor: whitespace cleanups
This patch is cosmetic; it cleans up a lot of whitespace issues:
removing trailing spaces, converting tabs into spaces, and removing
unneeded spaces around function arguments.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-07-08 00:46:13 -07:00
Steve Beattie
495b4c2c36 mod_apparmor: remove immunixisms from code
This patch is a cosmetic set of changes to remove references to immunix
from the source code (except in the case of handling deprecated
keywords), as well as correcting my email address.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-07-08 00:44:44 -07:00
Steve Beattie
8b79c9beb1 mod_apparmor: add 'servername-uri' hat
This patch adds an additional hat to try in the mod_apparmor processing
sequence, constructed from the host's ServerName + '-' + URI
(e.g. 'www.example.com-/some/uri'). This hat is attempted before the raw
URI hat is attempted, leaving the ordering as follows:

  (1) to a hatname in a location/directory directive
  (2) to the server name or a defined per-server default
  (3) to the server name + "-" + uri
  (4) to the uri
  (5) to DEFAULT_URI
  (6) back to the parent profile

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-07-08 00:41:58 -07:00
Steve Beattie
372764355a mod_apparmor: try uri hat after AADefaultHatName, not before
In trunk revno 2335, a bug was fixed in mod_apparmor that corrected
the storage location for AADefaultHatName.  The incorrect storage
caused the hat specified by the AADefaultHatName keyword to be the
default value for AAHatName, and meant that if both an AAHatName and
an AADefaultHatName entry were given in a vhost, mod_apparmor would
not fall back to trying AADefaultHatName if the hat specified in
AAHatName did not exist in the apache apparmor profile.

However, because the value specified in AADefaultHatName was the
default, if no AAHatName was specified, it would be attempted first,
before a hat based on the passed URI, rather than after as the
documentation stated and the code intended. By fixing the storage bug,
the attempted hat ordering now matched the documentation. But a number
of users came to rely on AADefaultHatName being attempted before
the URI. For trunk, this issue is less severe because mod_apparmor
passes a vector of hats to aa_change_hatv(), and thus missing URI
hats are not logged by the kernel apparmor bits. It still represents
a behavioral change to users, though.

This patch re-adjusts the ordering so that the URI-based hat is
attempted after the hat specified by AADefaultHatName is attempted,
thus maintaining the actual behavior before the bug addressed in
revno 2335 was fixed.

Patch history:
  v1: initial revision
  v2: no code changes; adjust comments and improve the man page
      documentation

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-07-08 00:39:05 -07:00
Christian Boltz
0f6be43d8e dovecot profile update
Some updates for the dovecot profiles, based on a patch from 
Christian Wittmer <chris@computersalat.de> (he sent it as SR for the 
openSUSE package, which uses a slightly older version of the dovecot
profiles)

Fix problems with dovecot and managesieve:
* usr.lib.dovecot.managesieve-login: network inet6 stream
* usr.lib.dovecot.managesieve:
  +#include <tunables/dovecot>
    /usr/lib/dovecot/managesieve {
  +  capability setgid,   # covered by abstractions/dovecot-common, therefore not part of this patch
  +  capability setuid,
  +  network inet stream,
  +  network inet6 stream,
  +  @{DOVECOT_MAILSTORE}/ rw,
  +  @{DOVECOT_MAILSTORE}/** rwkl,
* add #include <abstractions/wutmp> to usr.lib.dovecot.auth
   apparmor="DENIED" operation="open" parent=18310 \
   profile="/usr/lib/dovecot/auth" name="/var/run/utmp" pid=20939 \
   comm="auth" requested_mask="r" denied_mask="r" fsuid=0 ouid=0


Acked-by: Steve Beattie <steve@nxnw.org>

Bug: https://launchpad.net/bugs/1322778
2014-07-07 23:35:18 +02:00
David Disseldorp
b3c7f00669 profiles: permit clustered Samba access to CTDB socket and databases
When configured with "clustering = yes", Samba needs to be able to
connect to the local ctdbd daemon socket, and directly manipulate .tdb
database files managed by ctdb.

Signed-off-by: David Disseldorp <ddiss@suse.de>
2014-07-04 12:09:58 +02:00
Steve Beattie
70926b5d55 profiles: add dovecot-common abstraction
This commit adds a dovecot-common abstraction, as well as adjusting
the profiles for dovecot's helper binaries to make use of it. The
important addition is the ability for the dovecot master process to
send signals to the helpers.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-27 12:14:53 -07:00
Steve Beattie
1b29c35db8 profiles: move postfix-common to abstractions/
Move postfix-common from program-chunks/ to abstractions/; remove
program-chunks directory since postfix-common was the last resident of
that directory (and had been since 2007), and adjust the includes of all
the profiles that include postfix-common.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-26 21:32:56 -07:00
Kees Cook
8f60678946 profiles: allow apache hats to receive signals from unconfined
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-24 11:06:06 -07:00
Kees Cook
2edbaca0bf profiles: Allow php5 abstraction to access Zend opcache files.
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-24 10:53:00 -07:00
Jamie Strandboge
999cb6e4f5 Adjust base abstraction for ptrace and signal mediation
- Allow reciprocal ptrace readby to everyone (requires peer unconfined or to
   ptrace read to us)
 - same for ptrace tracedby
 - allow us to ptrace read ourselves
 - receive all signals from unconfined
 - allow us to signal ourselves
 - allow sending and receiving "exists" (for pid existence)

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-23 16:11:03 -05:00
Jamie Strandboge
f9ea3d47a6 dnsmasq profile updates for signals and ptrace from libvirtd
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-23 15:31:40 -05:00
Christian Boltz
f77d5666d4 better error messages in aa.py store_list_var()
This patch improves the error messages in aa.py store_list_var() to make
debugging of profile syntax problems easier. It also adds an additional
parameter for the profile filename (used in the error message)

Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-20 13:36:35 +02:00
Steve Beattie
7c14d01d7a regression tests: adjust for parser escape fixes
Earlier fixes to the parser's handling of escape sequences involving '\'
caused a behavioral change that profiles no longer needed to contain
'\\' before an octal escape sequence. However, the regression tests were
never modified to take this change into account, and thus the i18n.sh
octal tests would fail. This patch fixes that.

Also, with the changes, the parser no longer accepts _\_ as a valid
sequence, so we skip this character.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com> (on IRC)
2014-06-19 13:54:49 -07:00
Steve Beattie
3bd3573dbb parser: fix unit test for \\ quoting in r2537
The change to processing escape sequences in trunk commit r2537 requires
a corresponding change to the unit tests in parser_misc.c.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-06-19 13:50:57 -07:00
John Johansen
f3fd90ea57 fix: pass through escape sequences that result in aare special chars
escape sequences that result in special character that will be interpreted
by later processing need to be passed through as well.

Eg. previously \\ was fixed to be passed through, but other chars
get interpretted as well.

*?[]{}
and ^, in character classes

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-19 13:49:53 -07:00
John Johansen
7f29e7edee Fix: backend processing was not treating ${} as a special pcre character
Also for characters that are not recognized as a valid escape seq
make sure that the character is emitted.

previously
  \$ resulted in \
where it should have been \$ if $ wasn't recognized

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-19 13:49:00 -07:00
John Johansen
80cb9dd67b Fix the processing of character escape sequences
r2456 unified escape sequence processing but it results in the \\
sequence being processed multiple times (lexer, regex conversion,
backend pcre parsing).

What used to happen was the lexer would only convert octal sequences
and a few special escapes, \\ would be passed through the lexer and
the regex conversion, thus only being handled in the pcre backend.

r2456 changed that so that \\ is handled by the lexer, converting it
to \, which is handled as an escape sequence in both the regex
conversion and the pcre backend.

This means
  \\001 instead of being treated as the literal \001 is treated
  as an octal escape sequence which is rejected by the regex conversion
  (it only allows for certain special chars).

  etc.

Fix this by ensuring the lexer does not processes \\ and passes it
through so it is only handled in the backend as was done in the past.

Also fix front end escape sequence processing of octals etc from resulting
in a later escape sequence.  That is \134, \d92, .. would get converted
to \ in the lexer and then treated as an escape sequence in the regex
conversion or pcre processing.

We fix this by converting them to the equivalent \\ sequence in the
lexer and letting the backend processes it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-19 13:47:39 -07:00
Christian Boltz
b917e30c35 fix aa-complain to work with quoted profile names
This patch fixes a crash in aa-complain when a profile name is quoted. 
It also makes sure aa-complain actually adds the complain flag in such 
cases. (aa-enforce etc. will also benefit from this fix.)

Note: superfluous quotes will be removed when saving the profile (for 
example with aa-cleanprof), but they are kept if needed, like in
    profile "/bin/foo bar"
(tested with aa-complain and aa-cleanprof - and also with "rcapparmor 
reload", where the initscript bailed out because my profile filename 
contained a space...)

The patch also adds some TODO notes.

References: https://bugs.launchpad.net/apparmor/+bug/1296218


Acked-by: Steve Beattie <steve@nxnw.org>.
2014-06-19 20:44:57 +02:00
John Johansen
d2d6cdb1c2 Convert cache to using mtime
For some strange reason our caching use ctime instead of mtime.
However this can lead to odd cases of the cache missing even though
neither the profile data nor cache data have changed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-17 10:59:15 -07:00
John Johansen
4a753029bb Update error message to indicate it is about a binary profile or cache file
Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-06-17 10:58:09 -07:00
Kees Cook
84082805e0 profiles: adjust apache2 for signal mediation changes
Update the apache2 profile so that the parent apache process can kill
worker processes inside of hats. Update the example comments and the
DEFAULT_URI and HANDLING_UNTRUSTED_INPUT hats to include the
apache2-common abstraction to allow them to receive signals from the
parent process.

Author: Kees Cook <kees@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Bug: https://bugs.launchpad.net/apparmor/+bug/1322764
2014-06-12 16:36:47 -07:00
Kees Cook
c1e06843eb profiles: adjust apache2-common abstraction for signals/mod_apparmor changes
Update the apache2-common abstraction so that the parent apache process
can kill worker processes inside of hats, as well as handle the updated
mod_apparmor behavior that invokes aa_change_hatv() and then checks
which hat it ended up in via aa_getconn() (which reads from
{PROC}/@{pid}/attr/current).

Author: Kees Cook <kees@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Bug: https://bugs.launchpad.net/apparmor/+bug/1322764
2014-06-12 16:14:08 -07:00
Tyler Hicks
6e127a5deb tests: Add named_pipe tests to only place child process into a hat
The child process changes into a hat while the parent process stays in
the main profile.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 23:05:44 -05:00
Tyler Hicks
2a8c44ad83 tests: Add named_pipe tests containing bad parent and child perms
Add two tests that verify AppArmor denials when one end of the pipe has
bad access permissions to the pipe.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 17:30:01 -05:00
Tyler Hicks
092ac30ee5 tests: Allow named_pipe test profiles to send/receive signals
The named_pipe parent process kills the child process at exit. A
"signal," rule must be added to all confinement profiles when the test
is running under a kernel that performs signal mediation.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 17:29:56 -05:00
Tyler Hicks
da7c856f5d tests: Add more named pipe tests
Allow for the parent and child processes to change into separate hats to
verify named pipe communications between hats with varying permissions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 17:29:40 -05:00
Tyler Hicks
f32daf1e34 tests: Make the regression tests easier to debug
Add debugging info to test binaries and disable optimizations.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 12:55:14 -05:00
Christian Boltz
a79453fb1f fix save_profile() by fixing some other code
When creating a child profile while using genprof, I get a backtrace:

Traceback (most recent call last):
  File "aa-genprof", line 160, in <module>
      lp_ret = apparmor.do_logprof_pass(logmark, passno)
    File "/home/cb/apparmor/HEAD-CLEAN/utils/apparmor/aa.py", line 2291, in do_logprof_pass
      save_profiles()
    File "/home/cb/apparmor/HEAD-CLEAN/utils/apparmor/aa.py", line 2309, in save_profiles
      for prof_name in changed.keys():
RuntimeError: dictionary changed size during iteration

(See https://bugs.launchpad.net/apparmor/+bug/1014304 for more details.)


After digging into the code, it seems for some reason the child profile 
is added to "changed" - I doubt this is correct (guess why it's removed 
later... ;-)

After digging a bit more, I found out that create_new_profile() is 
(ab)used to create a new stub profile to be used as child profile. 
create_new_profile then adds the new child (which looks like a normal 
profile to it) to "changed".

This patch most probably makes the cleanup round in save_profile() 
superfluous by adding a is_stub parameter to create_new_profile(). If
this parameter is set, the new (child) profile is not added to "created" 
and "changed".

I intentionally added the two print() lines in safe_profile because
a) I think they will never be displayed
b) I want to know if a) is wrong ;-)
c) it's always nice to have a "nice" error message before displaying
   a backtrace ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-10 00:44:59 +02:00
Christian Boltz
0d4257462d aa-genprof failed to set /proc/sys/kernel/printk_ratelimit to 0
(unlimited) because the "if not value:" check matches 0.

This patch replaces the check with "... is None".

It also prints a warning if the old value is None (could in theory 
happen if reading the old value failed).

Acked-by: Steve Beattie <steve@nxnw.org>. Thanks.
2014-06-09 23:47:36 +02:00
Jamie Strandboge
f8ed2e1d0d Description: use -QTK instead of -p in verify_policy(). '-p' only runs the
preprocessor and is not as thorough as -QTK (--skip-kernel-load,
 --skip-read-cache, --skip-cache). Like with '-p', '-QTK' can be run without
 privilege but it will catch things like conflictings 'x' modifiers.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-09 13:38:35 -05:00
Jamie Strandboge
f6f4ef7ee9 Description: update nvidia abstraction for additional /proc and ~/.nv/GLCache
access
Bug-Ubuntu: https://launchpad.net/bugs/1325050

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-06-06 13:50:58 -05:00
Simon Déziel
cf9a7287fe Improve cross-distro compatibility by supporting python 2.[4-7] and python 3.[0-4]. Fixes LP: #1198672 2014-06-05 19:43:59 -07:00
John Johansen
8eebcf28ac Bump parser ABI version to 1
Commit r2456 fixes a bug in the parsers compilation that can result
policy failures. Unfortunately this Bug slipped into the wild and
shipped in at least one distro.

Bump the parser abi so that parsers that have the fix will invalid
existing cache files, and recompile policy to ensure the fix is applied.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-06-03 15:29:14 -07:00
Tyler Hicks
d2b62fff47 utils: Handle unmount rules
Bug: https://bugs.launchpad.net/bugs/1325109

The parser will accept rules with either umount or unmount rule types.
The utils should follow suite.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-06-03 16:23:30 -05:00
Christian Boltz
4bff5778e0 handle_children() tried to read a profile from the binary instead of
the binary's profile

Patch by timdaman 
Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1324154

Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-05-29 16:53:02 +02:00
Tyler Hicks
29469c6e2a tests: Create socketpair test for checking labeling on fds
Bug: https://bugs.launchpad.net/bugs/1235478

This is a test to check the label on file descriptors returned from
socketpair().

In its simple form, it simply calls socketpair() and checks the
labels on both fds.

In its complex form, it has the ability to do the simple test, then set
up an exec transition using aa_change_onexec(), and re-exec itself to
check the labeling after the file descriptors have been passed across an
exec transition.

The complex form is meant to test revalidation at exec. AppArmor
currently keeps the original labeling in place across the exec
transition.

Note that this test does not currently test read/write access to the
file descriptors. It only checks the label, as returned by
aa_getpeercon(2).

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-05-27 09:19:15 +02:00
Tyler Hicks
0cf50140a5 tests: Allow profile names that don't match an exec
Allow for the regression tests to specify arbitrary profile names
without hitting fatal errors or getting warnings from mkprofile.pl.

This allows for a test to have a line like this:

  genprofile change_profile->':arbitrary_name -- \
	     image=arbitrary_name addimage:$test

In the example above, $test can call aa_change_onexec("arbitrary_name")
and then re-exec itself to test behavior across exec transitions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-05-27 09:17:31 +02:00
Christian Boltz
5ffb6eb26b fix autodep() in aa.py which fills filelist[] with a wrong structure
(one nesting level missing), which then causes aa-genprof to crash 
when pressing "s" for "scan".

References: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1319829


Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-22 19:43:10 +02:00
Seth Arnold
5fee376411 fix for starting chromium-browser from evince, 14.04
Ubuntu 14.04's chromium-browser has changed paths in a way that prevents
evince from opening clicked links in chromium-browser windows.

This patch adds a new path for the chrome-sandbox executable to the
sanitized_helper profile, so chromium will get its own tailored profile if
necessary.

The reporter who said this patch helped included some further DENIED lines
for signals that indicates this is probably not sufficient but did make
the links work as expected.

https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1282314

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-05-21 22:49:22 -07:00
Launchpad Translations on behalf of apparmor-dev
5cde820d4c Launchpad automatic translations update. 2014-05-22 05:31:07 +00:00
Christian Boltz
b2c4934bc1 fix two issues in aa-genprof's last_audit_entry_time():
- convert "tail" result from byte to string to avoid TypeError crash
- use apparmor.filename instead of hardcoded /var/log/audit/audit.log

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-05-21 21:42:43 +02:00
Jamie Strandboge
8c28481311 Description: allow access to egl libraries in X abstraction
Bug: https://launchpad.net/bugs/1320014

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-15 22:01:35 -05:00
Jamie Strandboge
24210c084d Author: John Johansen <john.johansen@canonical.com>,
Jamie Strandboge <jamie@canonical.com>
Description: man page updates for signals, ptrace and new variables

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-05-15 17:22:21 -05:00
John Johansen
fdc55ff203 Move C++ files from .c suffix to .cc suffix
mount.c  -> mount.cc
  dbus.c   -> dbus.cc
  rule.c   -> rule.cc
  signal.c -> signal.cc
  ptrace.c -> ptrace.cc

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-05-09 15:34:34 -07:00
John Johansen
e08eaa39e2 Fix profile loads from cache files that contain multiple profiles
v3: fix freeing of filename when undefined
v2: address tyhicks feedback
    refactor to have a common write routine
    fix issue with set profile load being done even if !kernel_load

Profile loads from cache files that contain multiple profiles can
result in multiple reloads of the same profile or error messages about
failure to load profiles if the --add option is used. eg.

  apparmor="STATUS" operation="profile_load"
  name="/usr/lib/apache2/mpm-prefork/apache2" pid=8631
  comm="apparmor_parser"
  <sth0R> [82932.058388] type=1400 audit(1395415826.937:616):
  apparmor="STATUS" operation="profile_load" name="DEFAULT_URI" pid=8631
  comm="apparmor_parser"
  <sth0R> [82932.058391] type=1400 audit(1395415826.937:617):
  apparmor="STATUS" operation="profile_load"
  name="HANDLING_UNTRUSTED_INPUT" pid=8631 comm="apparmor_parser"
  <sth0R> [82932.058394] type=1400 audit(1395415826.937:618):
  apparmor="STATUS" operation="profile_load" name="phpsysinfo" pid=8631
  comm="apparmor_parser"
  <sth0R> [82932.059058] type=1400 audit(1395415826.937:619):
  apparmor="STATUS" operation="profile_replace" info="profile can not be
  replaced" error=-17
  name="/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI" pid=8631
  comm="apparmor_parser"
  <sth0R> [82932.059574] type=1400 audit(1395415826.937:620):
  apparmor="STATUS" operation="profile_replace" info="profile can not be
  replaced" error=-17
  name="/usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT"
  pid=8631 comm="apparmor_parser"


The reason this happens is that the cache file is a container that
can contain multiple profiles in sequential order
  profile1
  profile2
  profile3

The parser loads the entire cache file to memory and the writes the
whole file to the kernel interface. It then skips foward in the file
to the next profile and reloads the file from that profile into
the kernel.
  eg. First load
    profile1
    profile2
    profile3

  advance to profile2, do second load
    profile2
    profile3

  advance to profile3, do third load
    profile3


With older kernels the interface would stop after the first profile and
return that it had processed the whole file, thus while wasting compute
resources copying extra data no errors occurred. However newer kernels
now support atomic loading of multipe profiles, so that all the profiles
passed in to the interface get processed.

This means on newer kernels the current parser load behavior results
in multiple loads/replacements when a cache file contains more than
one profile (note: loads from a compile do not have this problem).

To fix this, detect if the kernel supports atomic set loads, and load
the cache file once. If it doesn't only load one profile section
from a cache file at a time.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-08 09:03:13 -07:00
Tyler Hicks
ea4cbd68e7 parser: Document that pivot_root arguments must end in '/'
Mention, in the apparmor.d man page, that pivot_root arguments must end
with a '/' character since they are directories.

The parser currently allows pivot_root arguments that do not end in '/',
but those rules will always fail to match.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-05 11:36:00 -05:00
Tyler Hicks
46586a6334 parser: Add example dbus rule for unconfined peers
It may not be obvious that the peer label can be "unconfined". Provide
an example rule, in the apparmor.d man page, demonstrating the
peer=(label=unconfined) conditional.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-05-05 11:35:50 -05:00
Launchpad Translations on behalf of apparmor-dev
e7001e0d94 Launchpad automatic translations update. 2014-05-02 05:29:28 +00:00
Steve Beattie
cb5306e2c5 Merge in some Italian translations. 2014-05-01 11:10:21 -07:00
Launchpad Translations on behalf of apparmor-dev
f4c0353061 Launchpad automatic translations update. 2014-05-01 05:27:43 +00:00
Seth Arnold
62fdd3bd3a abstractions/mysql: allow access to mysqld.sock
From: Felix Geyer <debfx@ubuntu.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-28 14:07:17 -07:00
Christian Boltz
e83d05e521 test the mountains and pay the dbusdriver a pivot_rootbeer
(in a more serious version: add some tests for dbus, *mount, signal, 
ptrace and pivot_root and make sure a space after the keyword is enforced.
The tools shouldn't accept a "dbusdriver" or "pivot_rootbeer" rule. ;-)

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-04-26 13:10:44 +02:00
Christian Boltz
6aab291185 Fix regular expressions in aa.py to enforce a space after some keywords
(dbus, *mount, signal, ptrace, pivot_root) except if the line only 
contains the bare keyword.

Note that in most cases (except *mount) I used an alternation - this has 
the advantage that it doesn't change the match group numbering, with the
small disadvantage of having to mention the keyword twice in the regex.
I chose this way to avoid that I have to change lots of other places and
possibly introduce bugs by overlooking something.

For the *mount rules, I read the code - it shouldn't need any changes 
because it uses only matches[0..2] 

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-04-26 13:05:55 +02:00
Steve Beattie
17fa550665 parser: extend dbus language tests
This patch extends the coverage of the parser's simple dbus language
tests.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-25 21:48:25 -07:00
Steve Beattie
236c7db4b3 parser: add signal language tests
This patch adds basic signal tests to the parser's simple language
test suite.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-25 21:46:06 -07:00
Tyler Hicks
c7d180c43b tests: Mount without updating mtab in mount.sh
The mount.sh script mixes calls to the regression test 'mount' binary
and /sbin/mount. This can result in stale mtab entries being left around
after a test run because /sbin/mount adds an mtab entry but the test
'mount' binary, which is also used for unmounting, does not remove mtab
entries.

To solve this problem, the -n option is passed to /sbin/mount so that it
doesn't add an mtab entry when mounting.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-24 14:24:54 -05:00
Tyler Hicks
d3030f8627 tests: Fix mount.sh test error
The end of the mount.sh regression test script contained cleanup
commands to unmount and detach the loop device used for testing.
However, the second losetup command fails and, with the recent
regression test suite fix to not ignore failed shell commands, an error
is triggered at the end of the test run.

Additionally, these cleanup commands are not ran when the test fails
during the test run and an immediate exit is requested upon failure
(with the -r flag).

This patch fixes and moves the cleanup logic into a function that is
assigned to do_onexit so that the cleanup is always performed at exit
and the test can run successfully.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-24 14:24:49 -05:00
Tyler Hicks
b3863c8af7 tests: Don't silently ignore test errors
When there was a test error, such as a shell command failure, the
function used for the ERR trap, error_handler(), was causing the error
to be silently ignored by the test runner.

It was calling exit_handler() directly, before calling fatalerror().
This caused $_fatal to be left unset when exit_handler() was called.
exit_handler() sources epilogue.inc and the last bit of epilogue.inc
exits with $num_testfailures if $_fatal was unset. The fatalerror() call
site in error_hanlder() was never reached. So, as long as there were no
test failures, then an error in a test script would cause the test to
exit early with 0.

It is safe to simply call fatalerror() from error_handler() because
fatalerror() sets $_fatal to true and exits. This causes exit_handler()
to be called and since $_fatal is set to true, prologue.inc exits with
127.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-24 14:24:42 -05:00
Steve Beattie
0033f683fd parser language tests: force using a features file
With the recent addition of features like ptrace and signals that
give warnings and then ignore the subset of rules when the features
directory indicates that the kernel does not support mediating such
features, at least one of the language tests fails in a chroot
environment where the apparmor securityfs tree is not mounted
inside it.

To compensate, a features file containing the current supported features
is included, and the simple.pl test driver is modified to pass it as an
argument to the parser, so that it will act as if the environment
supports all our current features.

A simple python script is included that was used to generate the
features file based on the current feature set.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-24 12:14:54 -07:00
Steve Beattie
55fe4c4a4e Merge from launchpad translations branch.
What a great lot of gratuitous changes just to get one new translated
Italian string.
2014-04-24 10:26:16 -07:00
Steve Beattie
a67d9be5a2 parser: add implicit set variable @{profile_name} to profile symbol
table

This patch adds the creation of an implicit set variable
@{profile_name} for use within policy. It expands to:

  - a given profile name if specified; e.g. for
      'profile flappy_bird /some/pattern/match* { [...] }'
    @{profile_name} would expand to 'flappy_bird'
  - if no given name, the match pattern; e.g. for
      '/usr/bin/doge_bird { [...] }'
    @{profile_name} would expand to '/usr/bin/doge_bird'
  - hats and child profiles will include the fully qualified name; e.g.
    the 'doge' hat in the /usr/bin/flappy_bird profile would cause
    @{profile_name} to expand to '/usr/bin/flappy_bird//doge' within the
    'doge' hat, and '/usr/bin/flappy_bird' outside of it in the profile.

There are some parsing tests added, but more tests are needed to verify
that expansion occurs properly (I've verified manually using parser
dumps of the added tests, but automated checks are needed).

The @{profile_name} variable is expected to be most useful in the
context of signal and ptrace rules (e.g. for specifying that an app
can send itself signals).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 16:38:29 -07:00
Steve Beattie
e9019eb650 Subject: parser: refactor symtab unit tests, expand coverage, fix
seenlist bug

This patch:
  - refactors the parser_symtab.c unit tests a bit in preparation for
    the patch to add an implicit autofilled @{profile_name} variable
  - expands coverage of the unit tests such that all code paths that
    don't result in an exit() or are due to memory allocation errors are
    exercised (this doesn't mean the tests are complete; the
    __expand_variable() could use more tests for correctness).
  - it fixes a bug where variables were not being removed from the
    seenlist when a problem was detected in __expand_variable().

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 16:36:30 -07:00
Tyler Hicks
876e30a3c5 utils: Simplify newly added test-regex_matches tests
Remove duplicated test code by adding a simple way for regex test
classes to declare a regex to use and a list of tuples consisting of
(line, expected_result). The setup_regex_tests() method generates test
methods for each tuple in a classes list. The test methods are based on
the regex_test() method, which performs the regex search and compares
the results to the expected_result.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-04-23 16:41:44 -05:00
Tyler Hicks
f8f3d16d4c utils: Remove unnecessary regex groups
The regexes for signal, ptrace, and pivot_root rules each had an extra
grouping around the terms 'signal', 'ptrace', and 'pivot_root'. Those
extra groupings can be safely removed.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-04-23 16:28:34 -05:00
Tyler Hicks
bd129145ad utils: Clean up file rule parsing
This patch backs out most of the changes from r2448 in favor of a better
approach.

The optional "file" keyword is handled under the pre-existing
RE_PROFILE_PATH_ENTRY regex and a new regex, RE_PROFILE_BARE_FILE_ENTRY,
is created for handling bare file rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-04-23 16:28:17 -05:00
Tyler Hicks
6b85a158e9 utils: Clean up str_to_mode()
The first conditional around string being set is not needed. If string
is not set, the while loop will be skipped and mode will be returned.

The variable tmp was being overloaded by being the regex search result
and then being reassigned to be the first match group in the regex
search result. This patch keeps tmp as the regex search result and then
uses mode_char to represent the first match group of the search.

Group the search and replace actions together at the beginning of the
loop and group the mode character processing at the end of the loop.

Finally, remove the unnecessary check of tmp (now mode_char) before
calling MODE_HASH.get(tmp, False). If tmp is None or '', get() will
do the right thing and return False.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-04-23 15:46:42 -05:00
Tyler Hicks
ddf977faf5 utils: Fix infinite loop when converting an unrecognized mode string
Bug: https://bugs.launchpad.net/bugs/1307665

When str_to_mode() was given a string containing unknown mode
characters, it entered an infinite loop. The case of the MODE_MAP_RE
regex string not matching the mode string was being ignored.

This patch makes it so that the loop breaks when MODE_MAP_RE no longer
matches the mode string. This occurs when all of the valid mode
characters have been processed and only invalid mode characters remain.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-04-23 15:46:03 -05:00
Tyler Hicks
432bf597ae utils: Basic support for pivot_root rules
Bug: https://bugs.launchpad.net/bugs/1298678

This patch does bare bones parsing of pivot_root rules and stores the raw
strings for writing them out later. It is meant to be a simple change to
prevent aa.py from emitting a traceback when encountering pivot_root rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-04-23 15:41:03 -05:00
Tyler Hicks
496502b150 utils: Basic support for ptrace rules
Bug: https://bugs.launchpad.net/bugs/1300317

This patch does bare bones parsing of ptrace rules and stores the raw
strings for writing them out later. It is meant to be a simple change to
prevent aa.py from emitting a traceback when encountering ptrace rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-04-23 15:40:20 -05:00
Tyler Hicks
81c6fc9ff1 utils: Basic support for signal rules
Bug: https://bugs.launchpad.net/bugs/1300316

This patch does bare bones parsing of signal rules and stores the raw
strings for writing them out later. It is meant to be a simple change to
prevent aa.py from emitting a traceback when encountering signal rules.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-04-23 15:39:14 -05:00
Steve Beattie
5cf1c6973d parser: add ptrace language tests
This patch adds a bunch of language parsing tests for ptrace rules.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-04-23 12:25:45 -07:00
Steve Beattie
49b51e8070 parser: include rules class entries when dumping profiles
This patch adds the newer rules class entries (e.g. ptrace, signals)
when dumping profiles (invoking the parser with the -dd argument).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-04-23 12:21:49 -07:00
John Johansen
071e956981 Update test scripts for new signal and ptrace semantics
The previous test patches where done with the hardcoded bypass for
unconfined.

This semantic was changed so that a confined app can now block unconfined
processes from tracing or sending signals to it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-23 11:46:06 -07:00
John Johansen
288faefae3 Update test scripts for ptrace rules.
Update mkprofile.pl to generate ptrace rules and update test scripts to
test ptrace mediation.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:44:41 -07:00
John Johansen
844b5cbd42 Update test scripts for signal rules
Update mkprofile.pl to generate signal rules and update test scripts to
grant signal permissions when needed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:40:56 -07:00
John Johansen
0cc659cdb4 change syntax of ptrace target
change from
  ptrace /foo,

to
  ptrace peer=/foo,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Steve Beattie <steve@nxnw.org>
2014-04-23 11:39:59 -07:00
John Johansen
a1a7c78755 Add the ability to specify ptrace rules
ptrace rules currently take the form of

  ptrace [<ptrace_perms>] [<peer_profile_name>],
  ptrace_perm := read|trace|readby|tracedby
  ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')'

After having used the cross check (permission needed in both profiles)
I am not sure it is correct for ptrace.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:38:04 -07:00
John Johansen
559f0a72fa fix: the what conditional names can be a condlistid
The match
  {VARIABLE_NAME}/{WS}*={WS}*\(

is too broad causing mount and dbus rules to fail for sets of values eg.

  mount options=(ro bind)

Instead of doing a broad match, for now lets lock it down to just
peer=(...) being the only cond that can cause entry into CONDLISTID

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:37:18 -07:00
John Johansen
f19c9f9511 fix: the what names can treated as a condlistid
The match
  {VARIABLE_NAME}/{WS}*={WS}*\(

is too broad causing mount and dbus rules to fail for sets of values eg.

  mount options=(ro bind)

Instead of doing a broad match, for now lets lock it down to just
peer=(...) being the only cond that can cause entry into CONDLISTID

Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-04-23 11:36:26 -07:00
John Johansen
b222731c4f Add the ability to mediate signals.
Add signal rules and make sure the parser encodes support for them
if the supported feature set reports supporting them.

The current format of the signal rule is

  [audit] [deny] signal [<signal_perms>] [<signal_set>] <target_profile>,

  signal_perm  := 'send'|'receive'|'r'|'w'|'rw'
  signal_perms := <signal_perm> | '(' <signal_perm> ([,]<signal_perm>)* ')'
  signal := ("hup"|"int"|"quit"|"ill"|"trap"|"abrt"|"bus"|"fpe"|"kill"|
             "usr1"|"segv"|"usr2"|"pipe"|"alrm"|"term"|"tkflt"|"chld"|
             "cont"|"stop"|"stp"|"ttin"|"ttou"|"urg"|"xcpu"|"xfsz"|"vtalrm"|
             "prof"|"winch"|"io"|"pwr"|"sys"|"emt"|"exists")
  signal_set   := set=<signal> | '(' <signal> ([,]<signal>)* ')'


it does not currently follow the peer=() format, and there is some question
as to whether it should or not. Input welcome.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:35:29 -07:00
John Johansen
b10965b78e Fix: output of apparmor_parser -p having double comma
For some rules the output of apparmor_parser -p has a double comma

Eg.
   ptrace (tracedby),
   dbus (send,receive),
is output as
   ptrace (tracedby),,
   dbus (send,receive),,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:17:41 -07:00
John Johansen
2e01c945aa Fix garbage characters in -p profile preprocessing output
apparmor_parser -p is broken. Outputting garbage charcters after every
include statement.

eg.

##included <tunables/multiarch>
^@^@V><A8>^?^@^@<C8>^NV><A8>^?^@^@<A0>^Pu^@# -----------------------------------
-------------------------------
#

This is happening because includes are handled specially and should not
go through the usual preprocessing output dump.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:17:08 -07:00
John Johansen
f5494f0331 A few fixes/improvements to the lexer debug output
Signed-off-by: John Johansen <john.johansen@canonical.com>

requires following two fix patches as well which have the acks
2014-04-23 11:16:08 -07:00
John Johansen
7907132269 Make dbus tests be conditionally run based on pkg-config
The addition of the dbus tests requires dbus dev libraries be installed
to run the test suite. This is not always desirable or even possible.

So make building and running the dbus tests conditional on the
pkg-config info from those libs. If they are not present output a
message about skipping the tests.

This patch contains the review fix from sbeattie

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:11:56 -07:00
John Johansen
77cd2e34a0 Split dfa optimization and dump flag handling into a separate file so that it can be shared with DFA test programs
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-23 11:10:41 -07:00
John Johansen
746cecf4b7 Convert to htoleXX fns instead of ifdef on endian
This patch makes use of the htoleXX() functions (see endian(3))
defined as part of endian.h (already included in parser_interface.c),
instead of defining a function differently based on the detection of
endian related macros.

This fixes a build failure experienced on powerpc with John's patch
set applied. This patch has been updated with John's feedback to use
letoh16() in the le16_to_cpu() macro.


Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:07:49 -07:00
John Johansen
564ffd3c8d Move buffer management for the interface to C++ ostringstream class
includes sbeattie's pad calculation fix.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:07:01 -07:00
John Johansen
727489fffd Turn on diff-encoding if the kernel supports it
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:05:58 -07:00
John Johansen
2097398232 The label class is used to lookup object permissions based off of label
alone when the labeling is not path dependent.

Some rules will not generate label entries, some will generate only
label entries and some will generate both label and path entries.
This is left to the particular rule encoding.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:02:25 -07:00
John Johansen
6ecf828a13 Don't use the parser time stamp to determine if policy is newer.
Using the parser timestamp was a work around to force recompilation of
policy that was built with a buggy parser. There are better ways to
handle this so remove checking of the parser timestamp.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:01:33 -07:00
John Johansen
d05313f555 Add the ability to separate policy_version from kernel and parser abi
This will allow for the parser to invalidate its caches separate of whether
the kernel policy version has changed. This can be desirable if a parser
bug is discovered, a new version the parser is shipped and we need to
force cache files to be regenerated.

Policy current stores a 32 bit version number in the header binary policy.
For newer policy (> v5 kernel abi) split this number into 3 separate
fields policy_version, parser_abi, kernel_abi.

If binary policy with a split version number is loaded to an older
kernel it will be correctly rejected as unsupported as those kernels
will see it as a none v5 version. For kernels that only support v5
policy on the kernel abi version is written.

The rules for policy versioning should be
policy_version:
  Set by text policy language version. Parsers that don't understand
  a specified version may fail, or drop rules they are unaware of.

parser_abi_version:
  gets bumped when a userspace bug is discovered that requires policy be
  recompiled. The policy version could be reset for each new kernel version
  but since the parser needs to support multiple kernel versions tracking
  this is extra work and should be avoided.

kernel_abi_version:
  gets bumped when semantic changes need to be applied. Eg unix domain
  sockets being mediated at connect.

  the kernel abi version does not encapsulate all supported features.
  As kernels could have different sets of patches supplied. Basic feature
  support is determined by the policy_mediates() encoding in the policydb.

  As such comparing cache features to kernel features is still needed
  to determine if cached policy is best matched to the kernel.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 11:00:32 -07:00
John Johansen
b9b99508e8 Add tag indicating file policy is mediated.
Tag start of entries in the policydb as being mediated. This makes
the start state for any class being mediated be none 0. The kernel
can detect this to determine whether the parser expected mediation
for the class.

This is just a way of encoding what features expect mediation within
the policydb it self so that a separate table isn't needed.

This is also used to indicate the new unix semantics for mediation of
unix domain sockets on connect should be applied.

Note: this does cause a fail open on situation on Ubuntu Saucy, which
did not properly indicate support. That is if a kernel using this patch
is installed on an Ubuntu Saucy system, unix domain socket mediation
on connect won't happen, instead the older behavior will be applied.
This won't cause policy failures as it is less strict than what
Ubuntu Saucy applies.

This is necessary so that AppArmor can properly function on older
userspaces without a compile time configuration on the kernel to determine
behavior. A kernel expecting this behavior will function correctly
with all old userspaces expect it will not enforce connect time mediation
on Ubuntu Saucy. However Ubuntu does not support Trusty (or newer)
kernels as backports to Saucy, so this does not break them.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 10:59:07 -07:00
John Johansen
f7e12a9bc5 Convert aare_rules into a class
This cleans things up a bit and fixes a bug where not all rules are
getting properly counted so that the addition of policy_mediation
rules fails to generate the policy dfa in some cases.

Because the policy dfa is being generated correctly now we need to
fix some tests to use the new -M flag to specify the expected features
set of the test.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 10:57:16 -07:00
John Johansen
873ae31d29 fix: network detection
The features file patch broke detection of network support.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 10:55:46 -07:00
John Johansen
0d42a832c1 Hack rework of the feature/match file support
This is not the cleanup this code needs, but a quick hack to add the
-M flag so we can specify a feature file (or directory) to use for
the compile.

It mostly just moves around existing code and adds the -M option,
though it does introduce a few changes.

While I didn't do it in this patch I propose we drop support for
the match file without create support. This is several years old
now and would clean things up a lot.

Note: that the manually input -m or -M drop support for it already
I just can't see a good way to support a single input stream indicating
the result/existance of two separate files.

This needs more work but is needed to support tests and the policy_mediates
frame work depends on the policydb getting generated with the special
stub rules to indicate whether policy was compiled expecting a certain
feature. But this can break the current tests, at least once a bug
in the policy rule counting is fixed in a follow on patch.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-23 10:53:46 -07:00
Christian Boltz
30b5eef230 update the usr.sbin.winbindd profile to
- allow rw access to /var/cache/krb5rcache/*
- treat passdb.tdb.tmp as passdb.tdb

Patch from Lars Müller <lmuelle@suse.com>

References: https://bugzilla.novell.com/show_bug.cgi?id=870607


Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-21 22:10:51 +02:00
Steve Beattie
53216edd1d parser: find SIZE_MAX on older versions of glibc and g++
Another issue with commit 2456 is that with older versions of glibc and
g++, a definition for SIZE_MAX was not being found; e.g. on Ubuntu 12.04
LTS and 12.10, the parser fails to compile with the following error:

  g++ -g -O2 -pipe -Wall -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter -std=gnu++0x -D_GNU_SOURCE -DPACKAGE=\"apparmor-parser\" -DLOCALEDIR=\"/usr/share/locale\" -DSUBDOMAIN_CONFDIR=\"/etc/apparmor\" -I../libraries/libapparmor//include -c -o lib.o lib.c
  lib.c: In function 'int str_escseq(const char**, const char*)':
  lib.c:292:32: error: 'SIZE_MAX' was not declared in this scope

The following patch addresses the issue by explicitly including the C stdint
header which contains the definition for SIZE_MAX.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-04-17 11:10:41 -07:00
Steve Beattie
e4cc8d1396 parser: fix i386 breakage on min() argument mismatches
Trunk commit 2456 broke the builds on i386 with the following compiler
error:

  g++ -g -O2 -pipe -Wall -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter -std=gnu++0x -D_GNU_SOURCE -DPACKAGE=\"apparmor-parser\" -DLOCALEDIR=\"/usr/share/locale\" -DSUBDOMAIN_CONFDIR=\"/etc/apparmor\" -I../libraries/libapparmor//include -c -o lib.o lib.c
  lib.c: In function 'int strn_escseq(const char**, const char*, size_t)':
  lib.c:236:47: error: no matching function for call to 'min(long unsigned int, size_t&)'
     tmp = strntol(*pos, &end, 8, 255, min(3ul, n));
                                                ^

This is due to size_t differing in size on i386 and amd64. The
following patch addresses the issue by casting the constant values
to size_t (and removing the ul suffix since the constant values are
getting cast anyway), satisfying C++'s types (and the patch removes
the unnecessary min macro).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-17 09:20:40 -07:00
John Johansen
c9ed990016 fix failure paths around policy that can result in a crash
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-15 15:01:05 -07:00
John Johansen
6eeaabb33c Add stub rules to indicate compilation support for given features.
Policy enforcement needs to be able to support older userspaces and
compilers that don't know about new features. The absence of a feature
in the policydb indicates that feature mediation is not present for
it.

We add stub rules, that provide a none 0 start state for features that
are supported at compile time. This can be used by the kernel to
indicate that it should enforce a given feature. This does not indicate
the feature is allowed, in an abscence of other rules for the feature
the feature will be denied.

Note: this will break the minimize tests when run with kernels that
      support mount or dbus rules. A patch to specify these features to
      the parser is needed to fix this.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-15 15:00:28 -07:00
John Johansen
94632cdca5 Unify escape sequence processing into a set of library fns.
Fix the octal escape sequence that was broken, so that short escapes \0,
\00 \xa, didn't work and actually resulted in some encoding bugs.

Also we were missing support for the decimal # conversion \d123

Incorporate and update Steve Beattie's unit tests of escape sequences
patch

v2
- unify escape sequence processing, creating lib fns.
- address Steve Beattie's feedback
- incorporate Steve Beattie's feedback 
v3
- address Seth's feedback
- add missing strn_escseq tests
- expand strn_escseq to take a 3rd parameter to allow specifying chars to
  convert straight across. . eg "+" will cause it to convert \+ as +
- fix libapparmor/parse.y failed escape pass through to match processunqoted

Unit tests by Steve Beattie

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-15 14:59:41 -07:00
Tyler Hicks
d44a16e1f0 parser: Document pivot_root in the apparmor.d(5) man page
This patch separates pivot_root rules from mount rules, since the syntax
of the two types of rules is very different. It also documents the
missing "oldroot=" prefix required for the conditional corresponding to
the put_old parameter. Finally, it briefly describes pivot_root rules
and provides some examples.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-04-14 21:52:02 -05:00
Tyler Hicks
1f01ade154 tests: Add pivot_root tests
This test attempts to clone itself in a new mount namespace, pivot root
into a new filesystem (ext2 disk image mounted over loopback), and then
verify that a profile transition, if one was specified in the pivot_root
rule, has properly occurred.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
2014-04-14 21:48:14 -05:00
Launchpad Translations on behalf of apparmor-dev
0f4ad98321 Launchpad automatic translations update. 2014-04-12 05:40:11 +00:00
John Johansen
01b8e1c609 Add missing rule.[hc] files that should have been part of commit 2449
Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-04-07 11:41:25 -07:00
John Johansen
79f80314ed make the parse_sub_mode code more generic
Make it more generic so that it can be shared with signals.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-07 03:19:19 -07:00
John Johansen
ac540cff74 cleanup the list fns and use a little bit.
Yes its seems pointless because these will eventually get replaced by
stl. But until then

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-07 03:18:33 -07:00
John Johansen
86ce4ba305 Fix mount rule initializers
Valgrind is offering complaints like the following when dealing with
profiles with mount rules:

   ==27919== Conditional jump or move depends on uninitialised value(s)
   ==27919==    at 0x805CDC1: mnt_rule::mnt_rule(cond_entry*, char*, cond_entry*
   ==27919==    by 0x805674E: do_mnt_rule(cond_entry*, char*, cond_entry*, char*
   ==27919==    by 0x8057937: yyparse() (parser_yacc.y:1133)
   ==27919==    by 0x8053916: process_profile(int, char const*) (parser_main.c:1
   ==27919==    by 0x804B20E: main (parser_main.c:1340)


Doing this consistently with the other initializers for the mount
class instead:

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-04-07 03:17:38 -07:00
John Johansen
a066f80372 Convert mount and dbus to be subclasses of a generic rule class
This will simplify add new features as most of the code can reside in
its own class. There are still things to improve but its a start.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-07 03:16:50 -07:00
Tyler Hicks
54a24c2b6a utils: Basic support for file prefix in path rules
Bug: https://bugs.launchpad.net/bugs/1295346

Add the ability to read and write path rules containing the file prefix.
This also includes bare "file," rules.

The ALL global is updated to include a preceding NUL char to eliminate
possibilities of a real file path colliding with the ALL global.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-04-03 21:58:59 -05:00
John Johansen
a26b7a5a79 tests: Improve mount rule tests
The mount.sh regression test script was not testing with actual AppArmor
mount rules. This patch improves mkprofile.pl by adding the ability to
generate mount rules and adds tests to mount.sh that verify mount
mediation is working properly.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Fixed a couple typos and added fstype tests]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-26 21:10:04 -05:00
John Johansen
40c2d811f9 tests: Update the regression tests for v6 policy
This updates the regression tests for v6 policy. It refactors the
required_features test into a have_features fn, and a new
requires_features fn (renamed to catch all instances make sure they
where right)

The have_features fn is then applied to several test to make them
conditionally apply based off of availability of the feature
and policy version.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-03-26 21:08:59 -05:00
Launchpad Translations on behalf of apparmor-dev
29208310a9 Launchpad automatic translations update. 2014-03-26 05:41:51 +00:00
Steve Beattie
74b523f248 utils: don't install two copies of aa-easyprof
With the conversion of the python utils, aa-easyprof got added to the
list of tools to be installed (in /usr/sbin/), but is already installed
(in /usr/bin) by the python-tools-setup.py distutils script, leaving two
copies of the tool in place. This patch filters out aa-easyprof from the
list of tools for the makefile to install itself, leaving it to
(continue to) be installed by the distutils script.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-25 15:04:37 -07:00
Steve Beattie
01ecdee3b2 parser tests: abort valgrind test if valgrind is missing
The valgrind test script would happily chug along even if if valgrind
was not installed, not doing anything of use. This patch fixes that, and
offers up the ability to specify an alternate location for valgrind if
it does not exist in the usual /usr/bin location.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-25 15:02:46 -07:00
Alban Crequy
5a826d8a5c profiles/Makefile: grep: use [[:space:]] instead of \s
\s is a new feature of GNU grep 2.6 (released on 2010-03-23) and
it does not work in older versions. By using [[:space:]] instead,
AppArmor can compile on systems with older versions of grep.

Signed-off-by: Alban Crequy <alban.crequy@collabora.co.uk>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-25 10:45:20 -07:00
Steve Beattie
731358f3bc Drop deprecated/management subdirectory and re-add deprecated/ to tarball
This branch removes the deprecated/management subdirectory as the code
there has languished there for four years without interest. It then
drops excluding the deprecated/ tree from the toplevel tarball creation,
while adding a mechanism for adding back in exclusions to tar.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-20 15:27:24 -07:00
Steve Beattie
cbf8a59ef1 toplevel: drop exclusion of deprecated directory from tarball creation
After removing the tools that had lingered in the deprecated directory
for too long, don't exclude the deprecated/ subdirectory from tarball
creation, as SUSE needs access to the deprecated perl modules for YaST.
Add a make variable for adding back in exclusions if needed.
2014-03-20 14:52:03 -07:00
Steve Beattie
52955d1e98 Remove the deprecated apparmor dbus client and the wxwidgets based
profile editor. They've been under the deprecated tree since Feb 2010,
and were placed there because they were already problematic to support.
No one has taken the mantle to resurrect support after 4 years, so
remove them from the tree entirely. (They will live on in the history,
if anyone does decide to resurrect them.)
2014-03-20 14:39:48 -07:00
Steve Beattie
3ecb969a12 utils: add simple capability regex tests
This patch adds some simple tests of the capability regex in
apparmor/aa.py.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-03-20 12:38:37 -07:00
Tyler Hicks
62ea36073b utils: Basic support for bare capability rules
Bug: https://bugs.launchpad.net/bugs/1294819

This patch as minimal support for bare capability rules ("capability,").
It prevents aa.py from emitting a traceback when encountering such a
rule.

It only adds the ability to parse and write the bare rule. It doesn't
attempt to be clever when deleting duplicate rules, such as realizing
that "capability audit_control," can be deleted if "capability," is also
present.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-20 14:27:24 -05:00
Tyler Hicks
e5d9d541f6 utils: Add very limited support for mount rules
Bug: https://bugs.launchpad.net/bugs/1294825

This patch is inspired by sbeattie's patch to add limited dbus rule
support. It adds does very dumb parsing of mount rules. Basically, it
stores mount, remount, and umount rules as raw strings wrapped in a
class.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-20 14:25:42 -05:00
Tyler Hicks
5dce40c97f utils: Fix typo in write_dbus()
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-20 14:19:40 -05:00
Steve Beattie
87d1c1e9f4 regression swap test: 640 KiB not enough swap for everyone
On ppc64el platforms, the minimum swapfile size is 640KiB. Our swap
test aborts there because it creates a swapfile of size 512KiB. This
patch adjusts the size to 768KiB, to satisfy ppc64el and to try
to keep the size down for embedded and otherwise limited platforms
(e.g. phones).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-20 11:28:51 -07:00
Steve Beattie
13af2c37f0 regression sysctl: skip if sysctl not available
Some kernels have CONFIG_SYSCALL_SYSCTL disabled, which is something to
be encouraged. This patch separates out the two different kind of sysctl
tests (syscall based and /proc/sys based) into separate shell functions,
and then checks to see that the test environment supports each before
invoking each shell function, issuing a warning (but not failing the
tests) if not available.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-20 11:23:10 -07:00
Steve Beattie
ea79ad206c Bump version to 2.8.96 in preparation for a potential additional beta
release before 2.9.0 final.
2014-03-20 01:53:55 -07:00
Steve Beattie
d0edb879b8 utils/easyprof: fix regression test when apparmor-easyprof is not installed
Bug: https://bugs.launchpad.net/bugs/1294848

This patch fixes the testsuite for aa-easyprof when the easyprof
utilities and configuration files are not installed in the system.
What was happening was that verify_manifest was calling parse_args()
without the synthetic arguments created by the test case and passing
the result to AppArmorEasyProfile(). Because parse_args() didn't
have the synthetic arguments, it would parse the actual command line
arguments passed to the testscript, which of course didn't specify the
alternate configuration file location. This would work when easyprof
had been installed in the system, because the fallback configuration
file in /etc/apparmor/easyprof.conf would exist and specify template
and policy group locations. Without that, though, the tests would abort
due to not knowing the location of the templates and policy groups.

This patch fixes the issue by passing the synthetic argument list
to verify_manifest, which uses that when calling parse_args(). A
debugging statement that states which conffile is being used when
AppArmorEasyProfile is being instantiated.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-03-19 22:02:53 -07:00
Christian Boltz
5f3fc904b5 aa-genprof: fix last_audit_entry_time()
last_audit_entry_time() was waiting forever because 
subprocess.check_output() started tail without any parameters.
Fixed by removing shell=True (default is shell=False).

Also fix the regex ("^.*", the dot was missing)


Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-20 00:10:13 +01:00
Steve Beattie
6557090ac3 Regression swap test: skip with failure if on tmpfs
The regression swap test attempts to activate a swap file in a
directory under where tmpdir is set in uservars.inc; if this is a
tmpfs filesystem, this will fail (it's kind of silly to create a
swap file on a tmpfs, a memory-backed filesystem). This patch adds a
check to the swap test script and skips the tests if it detects it's
on tmpfs and marks the test as a failure if the check fails.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-19 11:53:26 -07:00
Steve Beattie
ad2973e89f Merge from launchpad translations:
- added beginning of utils translations for Polish and Swedish
- Some rejiggering of existing utils translations; I don't think any
  existing translations got lost, but there are new missing entries
- A whole bunch of comment updating for the parser translations

Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-18 10:14:24 -07:00
Steve Beattie
19cf0fd89d merge from trunk 2014-03-18 10:02:27 -07:00
Launchpad Translations on behalf of apparmor-dev
12d13a4a33 Launchpad automatic translations update. 2014-03-18 05:31:37 +00:00
Kshitij Gupta
d9deb90953 Fix comments when multiple profiles in a single file
Signed-off-by: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-16 20:36:42 +05:30
John Johansen
05ef0c51a0 Fix filtered af list to remove af_unspec
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-12 05:20:11 -07:00
John Johansen
fa1a5f8a61 Remove the old unused ptrace code that snuck in years ago.
It was never used, never supported, and we are doing it differently now.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-12 05:02:32 -07:00
Steve Beattie
61fb0e9cea Makefiles: add ${nl} for errors, apply when failing to find libapparmor
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-11 14:42:23 -07:00
Simon Deziel
212586fceb Support python 2.[4-7] and python 3.[0-4] for greater cross-distro
compatibility. Fixes LP: 1198672
2014-03-11 16:03:24 -04:00
Launchpad Translations on behalf of apparmor-dev
7d96d41f8e Launchpad automatic translations update. 2014-03-11 05:30:43 +00:00
Arkadiusz Miśkiewicz
757cc25163 libapparmor: raise exception in python bindings when something fails
Current libapparmor python bindings are very "unpythonic". Also lack
ability to access "why" information in case of failure.

In python when something fail the normal behaviour is exception
to occur. In case of apparmor functions die silently and require
user to verify returned value.

And here comes second problem. In C api when return value is -1
(and the same value is returned in python API) we can access errno
to get information why this occured. Unfortunately in python there
is no way to access the same information.  Pythonic way of accessing
errno is via exception (which is never raised in python bindings
currently).

So the patch adds exceptions on failures. First %exception creates
a wrapper that swig adds to each function listed below. Empty %exception
causes that the rest of code (beside listed functions) won't be wrapped.

How this works? Example on apparmor disabled system:

Before:
>>> LibAppArmor.aa_change_hat(hat, random.randint(1, sys.maxint))
-1

After:
>>> LibAppArmor.aa_change_hat(hat, random.randint(1, sys.maxint))
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
OSError: [Errno 22] Invalid argument

so pythonic way of accessing "why":
>>> try:
...     LibAppArmor.aa_change_hat(hat, random.randint(1, sys.maxint))
... except OSError, e:
...     print e.errno
...
22

Signed-off-by: Arkadiusz Miśkiewicz <arekm@maven.pl>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-07 11:54:12 -08:00
Steve Beattie
579aa7cb3e utils: add simple parsing of multi-line rules [v3]
D-Bus rules in particular seem to get written as multi-line rules. This
patch adds very simple hackish support for multiple lines. Essentially,
what it does is if the parsing of a line doesn't match anything and
falls all the way through, it saves the line and prepends it to the next
line that occurs in the profile, but *only* if the line does not have a
trailing comma to indicate the end of a rule. If the trailing comma
exists, then it assumes that it's a rule that it doesn't understand and
aborts.

With this patch, the simpler tools (aa-enforce, aa-complain, etc.) can
parse policies containing multi-line rules to an extent and continue to
function correctly. Again, aa-logprof and aa-genprof may have issues on
the writing back of profiles, so some assistance testing here would be
appreciated.

Some testcases are added to exercise the regex that looks for a rule
with a trailing comma but can still handle rules that have (,) or {,}
in them.

Patch history:
  v1 - initial version
  v2 - simplify and rearrange rule-ending comma search regex, since
       we only care about the trailing comma
     - add a new regex to search for trailing comments to filter out
     - simplify reset of lastline variable
     - restructure tests into a new script, and add more tests
  v3 - add additional testcases, most of which are problematic and thus
       commented out :(

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-07 10:04:57 -08:00
Steve Beattie
0e33e27401 utils: add very limited dbus rule support
This patch adds very limited support for very dumb parsing of dbus
rules. Basically, it stores dbus rules as raw strings wrapped in
a class.

There's class structure to indicate how I'd like to see fuller future
support for dbus rules to be implemented and act as a guidepost for
how to handle most rules, moving away from the giant structure of
nested dictionaries. A stub test script is included as well, with a
modification to the make check target to set the PYTHONPATH to point
in the right place.

With this patch, aa-audit, aa-autodep, aa-complain, aa-disable,
and aa-enforce all function for me. aa-logprof and aa-genprof have
functionality issues for me at the moment (one of them dumps a
backtrace even without this patch), and I'm not sure the writing out
of dbus rules is completely implemented for modified profiles.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-07 09:58:54 -08:00
Steve Beattie
2eb307661f utils: split out aa-genprof command
This patch splits out the genprof tool functionality into a separate
command function, merging with the use_autodep function that already
existed.

Patch history:
 v1 - initial revision
 v2 - mark strings for translation and modify message when a profile
      name is passed to aa-autodep, rather than a program name/path.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 11:54:38 -08:00
Steve Beattie
d37de1fd46 utils: split out aa-audit function
This patch moves the audit functionality to an audit specific command
function.

As an aside, the -r option is left in place here, because aa-audit
is a bit orthogonal to aa-enforce, aa-complain, and aa-disable.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 11:52:00 -08:00
Steve Beattie
0f32b02deb utils: split out aa-complain function
This patch creates a separate tool.cmd_complain function, as well as
removes the -r remove option, to match aa-enforce and aa-disable.
It also cleans up some bits in aa-enforce now that aa-complain and
aa-enforce have been separated.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 11:51:00 -08:00
Steve Beattie
a18b499552 utils: split out aa-enforce function
This patch splits out the aa-enforce functionality into a separate
method in the aa_tools class.  It also removes one last reference to
the no-longer-existent -r option in the aa-enforce manpage.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 11:49:43 -08:00
Steve Beattie
eb76275cea utils: let aa-disable take profile name as arguments
This patch modifies the aa-disable tool implementation to allow it to
take a profile name (rather than a program name) as the argument(s)
for what to disable, as this was supported behavior in the perl
tools. (The rest of the commands that make use of the aa_tools.act()
method have not been exercised with this patch in place, as further
patches will separate those out.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 11:48:09 -08:00
Steve Beattie
bea00cf66b utils: two minor cleanups in aa.py
This patch removes a debugging print statement accidentally left in,
as well as a duplicated initialization to a variable, and moves the
variable init closer to the declaration that the variable is a global.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 10:34:08 -08:00
Steve Beattie
daf437f4e3 utils: don't delete tmpdir when debugging test-aa-easyprof.py
It's not useful to report the location of the temporary directory for
each test if you're going to immediately delete it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 10:30:14 -08:00
Steve Beattie
390cfb2cd5 utils: fix apparmor.ui references in aa-genprof
aa-genprof was incorrectly trying to refer to UI_xxx functions in
apparmor.aa rather than the correct apparmor.ui. This patch fixes the
issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 10:22:26 -08:00
Steve Beattie
7580a02c6c utils: remove generated vim manpage on make clean
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-06 10:20:21 -08:00
Steve Beattie
07bcb79b1d utils: use realpath of tmpdir in test-aa-easyprof.py
The relative directory tests in test-aa-easyprof.py were failing when
TMPDIR pointed to a directory that was a symlink, because the generated
tmpdir path was not the same as the realpath that easyprof resolved to.
This patch sets the tmpdir to the realpath of the result of the
tempfile.mkdtemp() to avoid the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-05 13:13:39 -08:00
Steve Beattie
6ceb2030f9 utils: more verbose fail messages for relative dir tests in test-aa-easyprof.py
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-03-05 13:12:12 -08:00
Seth Arnold
c4ef115e3d Store the aa_change_hat magic token in an unsigned long in the test suite
The magic token used in the test suite is incorrectly stored
as an int rather than unsigned long leading to failure like this:

running changehat_misc
/tmp/testlibCTcwOe/source/trusty/apparmor-2.8.95~2411/tests/regression/apparmor/prologue.inc: line 176: 20184
Killed                  $testexec "$@" > $outfile 2>&1
Error: changehat_twice failed. Test 'CHANGEHAT (subprofile->subprofile)' was expected to 'pass'. Reason for
failure 'killed by signal 9'

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-03-04 10:50:47 -08:00
Seth Arnold
2a5587439f Merge two patches around uservars.* files
Delete uservars.out (Message-ID: <20140303235422.GD4112@nxnw.org>)
Add uservars.inc.{system,source} to support USE_SYSTEM variable

(John ack'd the USE_SYSTEM variable bit)

Signed-of-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-03 16:03:23 -08:00
Steve Beattie
6cf4cbea21 utils: remove aa-enforce '--remove' option
This patch removes the '--remove' option on aa-enforce as well as from
the man page. It also removes the test entry that contains it, but I
don't think this is entirely correct because I think the second half
of the test is dependent on the (now deleted) first half of the test.

(It also removes a missed reference to --revert in the aa-disable man
page.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-03 14:59:47 -08:00
Steve Beattie
3575ca4ac9 utils: remove aa-disable non-functional '-r' option
This patch removes the non-funcional -r option for aa-disable, as
well as the test and manpage documentation for it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-03 13:29:32 -08:00
Steve Beattie
4f8dea0db8 utils: make test-aa-easyprof.py cope with UsrMove
The test-aa-easyprof.py script has '/bin/ls' hardcoded as a path;
however, on systems that have undergone UsrMove, this is a symlink to
/usr/bin/ls. This patch fixes the issue by getting the realpath of
/bin/ls and storing it as an instance field.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-03 13:26:41 -08:00
Steve Beattie
fc24ae63ef s patch splits out the disable functionality from the
apparmor/tools.py:act() method into a separate cmd_disable()
method. The intent is to unwind the logic in act() into smaller, more
digestible chunks, while sharing commonality via helper functions
(e.g. the added get_next_to_profile() function).

A secondary driver of this change is that the tools fail when used
against the trunk profiles, due to act() forcing all the profiles to
be read and the tools not understanding the recently added dbus rules
(they were intentionally ignored as part of scoping the rewrite).
Unfortunately, this is not a solution for aa-enforce, aa-complain, etc.
as they are expected to know enough about profiles to understand and
update profile flags.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-03-03 07:50:12 -08:00
Steve Beattie
9bfb0d911e libapparmor: fix missing symbol adjustment from previous commit. 2014-03-01 16:19:11 -08:00
Steve Beattie
09af9efd5c libapparmor: add APPARMOR_1.1 version for aa_query_label symbol
In the course of developing apparmor dbus mediation, the aa_query_label
symbol was added to libapparmor on trunk, and given the symbol version
(via libapparmor.map) of APPARMOR_3.0. As apparmor upstream, we have
not made a release where this would have been exported.

Unfortunately, in Ubuntu, a version was released in 13.10 that included
the aa_query_label() symbol with a version of APPARMOR_1.1. This
can cause a breakage on that platform with the incorporation of the
impending apparmor 2.9 release.

This patch provides both versions (APPARMOR_1.1 and APPARMOR_2.9)
of the aa_query_label() symbol. It requires the function name in
kernel_interface.c to be renamed (similar to how the deprecated
change_hat() symbol is named in the source as __change_hat()),
otherwise linking fails with duplicated symbols. The default symbol
used will still be the APPARMOR_2.9 version, but binaries linked with
the APPARMOR_1.1 version would still continue to work unchanged.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-03-01 15:46:42 -08:00
Christian Boltz
6a44e0eef5 add recursive_print() to common.py.
It prints a data structure in an easily readable output and is quite 
useful for debugging. However, I don't recommend to call it in 
production code ;-)

Acked-by: Kshitij Gupta <kgupta8592 at gmail.com>
2014-02-28 23:31:16 +01:00
Kshitij Gupta
781d237798 Fix tests for new tools.
Update path to tools in minitools_test.py
Fix assert values in config_test.py

Signed-off: Kshitij Gupta <kgupta8592@gmail.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-02-28 16:09:00 +05:30
Steve Beattie
5045d74716 utils: add common symlink to test/ clean target, to compensate for
packaging systems that do a make clean while trying to represent
changes.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-02-27 16:47:06 -08:00
Steve Beattie
20f26a0680 utils: hook in vim generator sanity test into make check
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-02-27 16:25:00 -08:00
Steve Beattie
0dede73da8 utils: fix path in test-aadecode.py and push make check into the test/
subdirectory.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-02-27 16:23:35 -08:00
Seth Arnold
fc7a7004da Fix module import errors, remove extraneous newlines
AttributeError: 'module' object has no attribute 'UI_Info'
AttributeError: 'module' object has no attribute 'open_file_read'
AttributeError: 'module' object has no attribute 'check_for_apparmor'

Signed-off-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-27 14:53:25 -08:00
John Johansen
6744feeb76 Capability entries in the profile are not being correctly initialized to 0
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-27 13:53:28 -08:00
Jamie Strandboge
429f077679 Add /var/www/html to abstractions/web-data, which is the path used on Debian
and its derivatives
Bug-Ubuntu: https://launchpad.net/bugs/1285653

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-02-27 14:49:54 -06:00
Christian Boltz
7e60928b34 aa-autodep (and therefore also aa-genprof) created a nearly-empty
profile files with only tunables/global, but no profile. This patch 
makes sure that the profile itsself is also written to the profile file.

Without the added line, filelist[prof_filename]['profiles'].keys()) in 
serialize_profile was empty, which means the loop that writes the 
profile was never executed.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-26 23:41:00 +01:00
Steve Beattie
7b9d8a1f9d libapparmor: libtool versionin
This commit adjusts the trunk libtool versions in accordance
with the outlined rules. It also adds clarifying text to the
documentation comment to explain how to use the rules and what the
resulting outcome is. Finally, it removes a bogus argument to linker
to forcibly set the SONAME in the library, as libtool will do this
automatically (and override the passed argument).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-25 15:34:40 -08:00
Christian Boltz
410e1eb132 Change aa-complain / set_complain() to (only) add the complain flag.
We don't need to additionally create a force-complain symlink.

Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-25 13:17:46 +01:00
Steve Beattie
361f08bad8 utils: fix cmd reference in apparmor/tools.py
This patch fixes up the parser command invocation via
apparmor/common.py:cmd(), as it handles stdout/stderr redirection,
and the redirection that was being attempted were being handed as
arguments to the parser.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-02-24 14:22:35 -08:00
Christian Boltz
33857562af update the bugtracker link in the libapparmor README
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-24 22:44:32 +01:00
Christian Boltz
a5d003f90d new profile tools - handling of "(F)inish"
Let "(F)inish" ask the user if he wants to save the changed profiles 
before exiting, instead of aborting without saving (we already have 
Abo(r)t for that ;-)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-02-24 20:56:28 +01:00
Christian Boltz
ce8429523d fix two (unrelated) issues in common.py:
- add some debug logging in valid_path()
- fix a py2 incompability in DebugLogger.__init__ (OSError vs. IOError)

Acked-by: Kshitij Gupta <kgupta8592@gmail.com>
2014-02-24 20:34:21 +01:00
Christian Boltz
2e3d542c28 Profile parsing: some fixes around the REPOSITORY: line
- use the (new) "parts" variable for the line.split result to make the 
  code less confusing
- change the line.startswith to check for "REPOSITORY:" (note the 
  added ":") like it was in the code before my previous patch.
- make the check for "NEVERSUBMIT" more exact
- print a warning on invalid REPOSITORY: lines and make sure to keep
  them as unmodified line (it might just be a "normal" comment someone
  added manually)


Acked-by: Kshitij Gupta <kgupta8592@gmail.com> (on IRC)
2014-02-24 19:20:11 +01:00
Christian Boltz
295a836324 new profile tools: preserve full initial comment
This patch
- preserves the complete initial comment
- makes sure whitespace inside the comment is kept (except leading 
  whitespace - line.trim() is still applied).
- no longer removes the "# vim:syntax" line

Note: I didn't test if handling the "REPOSITORY" line still works (in
theory it should), but without a working repo, I don't care too much ;-)


Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-22 13:09:15 +01:00
Launchpad Translations on behalf of apparmor-dev
1c731c92fd Launchpad automatic translations update. 2014-02-22 05:26:17 +00:00
Steve Beattie
72fa616362 Merge abstraction changes from Simon Dezial:
- Add missing applications/ directory read access rules
  - Adapt paths for python 3.{3,4}, coalescing some rules, and
    remove unneeded rule
2014-02-21 12:58:05 -08:00
Launchpad Translations on behalf of apparmor-dev
00ca3bf967 Launchpad automatic translations update. 2014-02-21 05:14:03 +00:00
Steve Beattie
e4c534fc99 merge apparmor trunk back into the tree 2014-02-20 17:37:42 -08:00
Steve Beattie
192ca1dc57 parser: exit with error on invalid arguments
The parser currently indicates that it exited successfully if invalid
arguments are passed to it, which makes it difficult to detect when
other tools are calling it incorrectly. This patch causes it to return
'1' indicating a failure.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-20 16:53:18 -08:00
Simon Deziel
59e97687b1 Remove unneeded rule as this is already allowed by
the site-wide config rule.
2014-02-20 10:33:19 -05:00
Simon Deziel
96fd3f8bd0 Adapt path for python 3.{3,4} too 2014-02-20 10:31:47 -05:00
Simon Deziel
2eb7390aa2 Add missing directory read access rules 2014-02-20 10:31:07 -05:00
Launchpad Translations on behalf of apparmor-dev
ff2be24203 Launchpad automatic translations update. 2014-02-18 05:12:47 +00:00
Christian Boltz
ea8e02412e dnsmasq profile - NetworkManager integration
This is an updated version of the previous dnsmasq profile patch, again 
from develop7 [at] develop7.info


Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-17 22:56:02 +01:00
Seth Arnold
c77143b542 Bump library version numbers for a 2.8.95 pre-release of 2.9. 2014-02-16 22:12:43 -08:00
Launchpad Translations on behalf of apparmor-dev
20e0063dfc Launchpad automatic translations update. 2014-02-16 05:28:50 +00:00
Steve Beattie
c3b258f602 Merge in the new python version of the apparmor utilities from Kshitij
Gupta's <kgupta8592@gmail.com> Google Summer of Code project, as well as
deprecate the older perl versions of the code.
2014-02-14 23:34:42 -08:00
Steve Beattie
b98c40181c utils/apparmor/yasti.py: remove XXX comments; when the time comes for
someone to attempt to see if things work with the python ycp bindings,
they'll discover whether the functions are the right ones or not.
2014-02-14 22:52:31 -08:00
Steve Beattie
7fab3a7a69 Sync with trunk. 2014-02-14 14:47:18 -08:00
Steve Beattie
ec7676bdec utils/aa-*: adjust python shebang lines to ease rewriting to an
alternate python if installed via the python-tools-setup.py script.
2014-02-14 14:42:19 -08:00
Christian Boltz
503d951673 update abstractions/winbind
- some *.dat files live in a different directory nowadays (at least in 
  openSUSE)
- the openSUSE smb.conf includes the (autogenerated) dhcp.conf, so this
  file also needs to be readable.

References: https://bugzilla.novell.com/show_bug.cgi?id=863226

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-02-14 23:37:13 +01:00
Jamie Strandboge
6812e5e550 Update abstractions to use new XDG_*_DIR values. Thanks to Christian Boltz for
the suggestion to use @{XDG_DOWNLOAD_DIR} in abstractions/user-download as
well as the existing entries.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-02-14 16:28:16 -06:00
Jamie Strandboge
8a0951be18 = Background =
The xdg-user-dirs specification[1] allows for translatable and movable common
directories. While this may be beneficial for users who for example want to have
~/Pictures translated into their own language, this flexibility provides
challenges for AppArmor. Untranslated xdg user directories are typically (see
~/.config/user-dirs.dirs):

XDG_DESKTOP_DIR="$HOME/Desktop"
XDG_DOWNLOAD_DIR="$HOME/Downloads"
XDG_TEMPLATES_DIR="$HOME/Templates"
XDG_PUBLICSHARE_DIR="$HOME/Public"
XDG_DOCUMENTS_DIR="$HOME/Documents"
XDG_MUSIC_DIR="$HOME/Music"
XDG_PICTURES_DIR="$HOME/Pictures"
XDG_VIDEOS_DIR="$HOME/Videos"

On an Ubuntu system with the fr_CA locale installed, these become:
XDG_DESKTOP_DIR="$HOME/Desktop"
XDG_DOWNLOAD_DIR="$HOME/Téléchargements"
XDG_TEMPLATES_DIR="$HOME/Templates"
XDG_PUBLICSHARE_DIR="$HOME/Public"
XDG_DOCUMENTS_DIR="$HOME/Documents"
XDG_MUSIC_DIR="$HOME/Musique"
XDG_PICTURES_DIR="$HOME/Images"
XDG_VIDEOS_DIR="$HOME/Vidéos"

While the kernel and AppArmor parser handle these translations fine, the
profiles do not.

As an upstream, we can vastly improve the situation by simply creating the
xdg-user-dirs tunable using the default 'C' xdg-user-dirs values:
$ cat /etc/apparmor.d/tunables/xdg-user-dirs
@{XDG_DESKTOP_DIR}=Desktop
@{XDG_DOWNLOAD_DIR}=Downloads
@{XDG_TEMPLATES_DIR}=Templates
@{XDG_PUBLICSHARE_DIR}=Public
@{XDG_DOCUMENTS_DIR}=Documents
@{XDG_MUSIC_DIR}=Music
@{XDG_PICTURES_DIR}=Pictures
@{XDG_VIDEOS_DIR}=Videos

# Also, include files in tunables/xdg-user-dirs.d for site-specific adjustments
# to the various XDG directories
#include <tunables/xdg-user-dirs.d>

and then create the /etc/apparmor.d/tunables/xdg-user-dirs.d directory. With
that alone, we can start using rules like this in policy:

  owner @{HOME}/@{XDG_MUSIC_DIR}/** r,

and users/admins can adjust /etc/apparmor.d/tunables/xdg-user-dirs or drop files
into /etc/apparmor.d/tunables/xdg-user-dirs.d, providing a welcome convenience.

This of course doesn't solve everything. Because users can modify their
~/.config/user-dirs.dirs file at will and have it point anywhere, so we can't
examine those files and do anything automatic there (when we have user policy we
can revisit this). This patch handles translations well though since use of
translations for these directories happens outside of the user's control. Users
who modify ~/.config/user-dirs.dirs can update policy like they need to now (ie,
this patch doesn't change anything for them).

[0] https://lists.ubuntu.com/archives/apparmor/2013-August/004183.html
[1] http://freedesktop.org/wiki/Software/xdg-user-dirs/

This patch adds basic support for XDG user dirs:

1. Update profiles/apparmor.d/tunables/global to include xdg-user-dirs.
2. Create the xdg-user-dirs tunable using the default 'C' xdg-user-dirs values
   and includes tunables/xdg-user-dirs.d
3. Add profiles/apparmor.d/tunables/xdg-user-dirs.d/site.local with commented
   out examples on how to use the directory.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-02-14 16:24:52 -06:00
Jamie Strandboge
e9c30a9361 libthai-data is used by LibThai which is the library used to deal with
Thai-specific functions like word-breaking, input and output methods and basic
character and string support. This is: https://launchpad.net/bugs/1278702

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-14 14:28:12 -06:00
Steve Beattie
a482139616 utils/aa-autodep: make --force be a boolean argument, not require an additional value 2014-02-14 12:25:13 -08:00
Steve Beattie
3cbbeac60d utils/apparmor/tools.py: fix misimport of UI stuff as well as a paren
depth error in use_autodep()
2014-02-14 12:19:55 -08:00
Steve Beattie
edb874a2de utils/apparmor/aa.py: fix confusion over name vs data structure 2014-02-14 11:54:02 -08:00
Steve Beattie
4d2b9b5c5d utils/apparmor/aa.py: fix dict/list confusion in create_new_profile() 2014-02-14 11:20:20 -08:00
Seth Arnold
35e79ef66d Author: Jamie Strandboge <jamie@canonical.com>
Description: Allow applications run under sanitized_helper to connect to DBus

This was originally 0076_sanitized_helper_dbus_access.patch in the Ubuntu
apparmor packaging.

jdstrand: +1 (this is in the Ubuntu namespace, so feel free to commit)
2014-02-13 18:11:54 -08:00
Seth Arnold
0aefb378f9 Subject: using webapps triggers firefox rejections
Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1056418
From: Steve Beattie <steve.beattie@canonical.com>

Came from 0021-webapps_abstraction.patch in the Ubuntu apparmor packaging.

jdstrand: +1 (this is in the Ubuntu namespace, so feel free to commit)
2014-02-13 18:10:05 -08:00
Seth Arnold
b432cf45c9 Add aa-easyprof and easyprof.py and related pieces from the Ubuntu
apparmor packaging.

These were originally 0030-easyprof-sdk.patch and
0037-easyprof-sdk-pt2.patch. Jamie posted an updated
0030-easyprof-sdk_v2.patch and I squashed both patches into one commit.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-02-13 17:53:40 -08:00
Seth Arnold
3ee30ca14c Description: Remove access to pulseaudio debug socket from audio abstraction
Grant access to specific files in the /var/run/user/UID/pulse/ directory to
 remove access to potentially dangerous and non-essential files such as the
 debug (cli) socket provided by the module-cli-protocol-unix module.
Author: Tyler Hicks <tyhicks@canonical.com>
Bug-Ubuntu: https://launchpad.net/bugs/1211380
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-13 17:25:31 -08:00
Seth Arnold
b70d3fe48e Author: Jamie Strandboge <jamie@canonical.com>
Description: allow mmap of fglrx dri libraries
Bug-Ubuntu: https://launchpad.net/bugs/1200392
Acked-by: Steve Beattie <steve@nxnw.org>

Came from 0038-lp1200392.patch.
2014-02-13 17:23:56 -08:00
Seth Arnold
8e5f15c603 Author: Jamie Strandboge <jamie@canonical.com>
Description: update mod_apparmor man page for Apache 2.4 and add new
 apparmor.d/usr.sbin.apache2 profile (based on the prefork profile)
Acked-by: Steve Beattie <steve@nxnw.org>

Differs from original 0036-libapache2-mod-apparmor-profile-2.4.patch
ubuntu patch -- I've deleted the "delete the apache 2.2 profile" part of
the patch. So apache 2.2's profile is also still supported.
2014-02-13 17:21:41 -08:00
Seth Arnold
f88539d230 Description: /etc/vdpau_wrapper.cfg needed for Firefox 18+ on quantal
Author: Micah Gersten <micah@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>

Modified by Seth Arnold; nvidia nvpau_wrapper.cfg permission was hoisted
up into an nvidia abstraction.
2014-02-13 17:17:46 -08:00
Seth Arnold
37ecdcfce5 Description: Allow using sssd for group and password lookups
Author: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>

This was originally patch 0018-lp1056391.patch in the Ubuntu apparmor
packaging; Steve noticed the now-redundant line for /var/lib/sss/mc/passwd
so I removed that at the same time.
2014-02-13 17:15:03 -08:00
Steve Beattie
841c0e767c deprecated/utils/: add back Makefile to simplify install of deprecated
Immunix perl modules
2014-02-13 14:32:28 -08:00
Christian Boltz
311163203a dovecot profiles - use abstractions/nameservice
After testing the dovecot profiles on a new server, I noticed 
/usr/lib/dovecot/dict and /usrlib/dovecot/lmtp need more nameservice-
related permissions.

Therefore include abstractions/nameservice instead of adding more and 
more files.

Acked-by: John Johansen (on IRC)
2014-02-13 22:19:26 +01:00
Steve Beattie
e61d8bda60 utils: have make clean purge python3 __pycache__ dir in apparmor/ 2014-02-13 11:54:42 -08:00
Steve Beattie
f54a574ee4 utils/: fix last make check failure, though the new utils tests need to
be added in (but they have failures themselves currently)
2014-02-13 11:32:36 -08:00
Steve Beattie
56b01b6eaa utils/apparmor/yasti.py: work around ycp not being available everywhere 2014-02-13 11:14:34 -08:00
Steve Beattie
3b726b996d utils: no need to run pyflakes on aa-status twice 2014-02-13 11:01:29 -08:00
Steve Beattie
2db3a226dc Regenerate apparmor-utils pot (translations template) file 2014-02-13 10:59:16 -08:00
Steve Beattie
be2296edf1 utils/apparmor/: work around last of pyflakes issues here 2014-02-13 10:52:00 -08:00
Steve Beattie
81b3db3dbf Fix more pyflakes issues that cause make check to fail 2014-02-13 10:01:03 -08:00
Steve Beattie
f652178a02 aa-mergeprof: fixup some of the whitespace issues 2014-02-13 08:31:59 -08:00
Steve Beattie
d318ff6100 Fix up last pyflakes issues with tools 2014-02-13 08:24:02 -08:00
Steve Beattie
15a95e3b36 Fix up some more pyflakes issues with the tools 2014-02-13 08:20:59 -08:00
Steve Beattie
bf655b530f Fix make install to handle new python binaries, as well as informing
setuptools to install the entire apparmor python package.
2014-02-13 00:04:39 -08:00
Steve Beattie
e9db24ac23 Add support for better integration of external apparmor modules (e.g.
appamror-click), see http://www.python.org/dev/peps/pep-0402/ for details.
2014-02-12 23:32:25 -08:00
Steve Beattie
32e0931588 Fix up execute permissions that were lost in the merger for some reason. 2014-02-12 16:59:27 -08:00
Steve Beattie
f989dd0132 Merge in Kshitij Gupta <kgupta8592@gmail.com>'s rewrite of the
logprof/genprof and related utilities in python. Because the branch that
was worked on was not based on the apparmor tree, not all of the history
can be maintained for files that are not newly created or entirely
rewritten in the branch.

(This merge also includes a subsequent commit to the branch
I was merging from which includes my missed bzr add of
utils/apparmor/translations.py)
2014-02-12 15:54:00 -08:00
Steve Beattie
b3b4fd448e Reorganize layout to ease merger into upstream apparmor-utils tree. 2014-02-12 13:27:30 -08:00
Steve Beattie
c1c0eab113 Merge trunk change. 2014-02-12 13:05:03 -08:00
Jamie Strandboge
46f5f51909 add support for python3.2 and python3.4 to the python abstraction
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-12 14:42:39 -06:00
Steve Beattie
975e389f1d Move over the perl apparmor modules (Immunix) as well as some other
perl utilities to the deprecated to directory; a couple of perl
utilities remain, but they are still useful and do not depend on the
Immunix module (just the LibAppArmor perl module).
2014-02-12 10:27:44 -08:00
Steve Beattie
c43d4eaa93 Move perl applications that were reimplemented in python by Kshitij
Gupta to the deprecated directory.
2014-02-12 09:59:23 -08:00
Steve Beattie
d27752350a Simplify the work tools and modules need to do to get the shared
translations. External utilities can still use their own textdomains
if they have strings that are not part of the apparmor-utils catalog.
2014-02-11 16:23:21 -08:00
Steve Beattie
4987e5b158 Clean up a bunch of pep8 warnings, as found by running:
pep8 --ignore=E501,E302

on individual files. This uncovered a bug where the type of an object
was being compared to a type of a list. However, a python string is a
list of characters, and so would cause the test to be true.
2014-02-10 22:20:36 -08:00
Steve Beattie
0525932561 Get rid of the globbing imports, which allows pyflakes to do a better
job. Clean up a bunch of pyflakes complaints. Doing so uncovered
references to apparmor/yasti.py functions in aa.py that hadn't been
imported.
2014-02-10 22:17:21 -08:00
Steve Beattie
35e1936202 Convert to using python's modular translations interface. This allows
the utility python modules to be used inside another tool with another
textdomain binding and still have the translations for that tool and the
stuff internal to the apparmor module convert properly.
2014-02-10 22:15:05 -08:00
Steve Beattie
395c429cb1 Delete empty file 2014-02-10 22:14:54 -08:00
Jamie Strandboge
4b01cb2544 Move os.chdir(old_cwd) to before the aa-exec call it remove the side-effect of
the chdir to $HOME when using Xpra.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-06 15:15:48 -05:00
Jamie Strandboge
0c5d6f4660 add ubuntu-unity7-* abstractions for Ubuntu desktop users 2014-02-05 23:44:04 -05:00
Tyler Hicks
4b950117f9 parser: Quiet search dir valgrind warning and remove suppression
When passing an include directory on the command line to
apparmor_parser, valgrind emits a warning:

 Invalid read of size 4
    at 0x404DA6: add_search_dir(char const*) (parser_include.c:152)
    by 0x40BB37: process_arg(int, char*) (parser_main.c:457)
    by 0x403D43: main (parser_main.c:590)
  Address 0x572207c is 28 bytes inside a block of size 29 alloc'd
    at 0x4C2A420: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x53E31C9: strdup (strdup.c:42)
    by 0x404D94: add_search_dir(char const*) (parser_include.c:145)
    by 0x40BB37: process_arg(int, char*) (parser_main.c:457)
    by 0x403D43: main (parser_main.c:590)

This patch quiets the warning by removing strlen() calls on the t char
array. Instead, it only calls strlen() on the dir char array. t is a
dupe of dir and strlen(dir) does not trigger the valgrind warning.

Additionally, this patch adds a bit of defensive programming to the
while loop to ensure that index into the t array is never negative.

Finally, the valgrind suppression is removed from valgrind_simple.py.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-05 15:17:32 -05:00
Steve Beattie
0d613279ba parser: remove one valgrind suppression from test script
With commit 2364 addressing one of valgrind's false positives, we can
remove the related valgrind suppression entry from the test script.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-02-05 10:58:03 -08:00
Tyler Hicks
2001fb6f81 parser: Quiet valgrind false positive
strlen() assumes that it can read an entire word but when a char array
does not end on a word boundary, it reads past the end of the array.
This results in the following valgrind warning:

 Invalid read of size 4
    at 0x40A162: yylex() (parser_lex.l:277)
    by 0x40FA14: yyparse() (parser_yacc.c:1487)
    by 0x40C5B9: process_profile(int, char const*) (parser_main.c:1003)
    by 0x404074: main (parser_main.c:1340)
  Address 0x578d870 is 16 bytes inside a block of size 18 alloc'd
    at 0x4C2A420: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
    by 0x53E31C9: strdup (strdup.c:42)
    by 0x40A145: yylex() (parser_lex.l:276)
    by 0x40FA14: yyparse() (parser_yacc.c:1487)
    by 0x40C5B9: process_profile(int, char const*) (parser_main.c:1003)
    by 0x404074: main (parser_main.c:1340)

This patch quiets the warning by not using strlen(). This can be done
because yyleng already contains the length of string.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-05 13:39:24 -05:00
John Johansen
5df1ac3610 Move short_options next to long_options to make them easier to keep in sync
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-05 09:10:53 -05:00
Steve Beattie
0a8e97098d parser: fix --cache-loc short arg option (-L)
When the --cache-loc option was added in trunk commit 1916, it was
intended that -L would be the short form of the option (based on
documentation and usage changes). However, the commit mistakenly
did not include the short option in the list include in the call
to getopt_long(3). This patch adds it along with the indicator
that it requires an argument (the different cache location) to the
getopt_long() call.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-02-04 14:28:21 -08:00
John Johansen
572fe066da The preprocessing output is broken, in a couple of places
includes come out like

  #include 

  ##included <tunables/home>

which is wrong because #include by itself is broken, and since -p is
supposed to be removing includes, it should not be directly echoed

any keyword in the keyword table is double echoed

  ownerowner /{run,dev}/shm/pulse-shm* rwk


Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-02-02 19:23:10 -10:00
Christian Boltz
19038d063b /usr/lib/dovecot/auth reads the mysql config files, which is not covered by
abstractions/mysql.

This binary/profile seems to be the only one that needs to do this, so 
add it to this profile (instead of abstractions/mysql) to avoid superfluous
permissions for other programs with abstractions/mysql

Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-02 15:16:25 +01:00
Christian Boltz
a38ce71813 update usr.bin.dovecot profile
after testing the dovecot profiles on a new server, I noticed 
/usr/sbin/dovecot needs some more permissions:
- mysql access
- execution permissions for /usr/lib/dovecot/dict and lmtp
- write access to some postfix sockets, used to
  - provide SMTP Auth via dovecot
  - deliver mails to dovecot via LMTP 
- and read access to /proc/filesystems

Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-02 15:13:51 +01:00
Christian Boltz
8b802b3fe6 update logprof.conf for UsrMove
logprof.conf contains a list of binaries in the [qualifiers] section 
that should for example never have their own profile.

Since some distributions moved lots of files from /bin/ to /usr/bin/ 
("UsrMove"), this list is outdated.

The patch adds copies of all /bin/ (and /sbin/) lines with /usr 
prepended.

Acked-by: John Johansen <john.johansen@canonical.com>
2014-02-02 15:12:32 +01:00
Kshitij Gupta
1126e1f8d7 Fixed the sample --trace feature. Opinions on using it? and should it be implemented in every tool separately? 2014-02-01 07:04:08 +05:30
Kshitij Gupta
21d1c4572d 2014-02-01 06:32:20 +05:30
Kshitij Gupta
c82fda86b6 Some bugfixes for UIYesNo to deny invalid keys, fix autodep when creating new profiles 2014-02-01 06:14:05 +05:30
Christian Boltz
bdaf2592e8 apparmor.vim says "attach_disconnect" is correct, but the parser only
likes "attach_disconnected".

Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-29 23:16:36 +01:00
Christian Boltz
0fa4676d30 [3/3] dovecot profiles: update usr.sbin.dovecot profile for dovecot 2.x
The usr.sbin.dovecot profile needs several updates for dovecot 2.x, 
including
- capability dac_override and kill
- Px for various binaries in /usr/lib/dovecot/

The patch also adds a nice copyright header (I hope I got the bzr log 
right ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-26 22:48:02 +01:00
Christian Boltz
df94a355fc [2/3] dovecot profiles: add profiles for new dovecot 2.x binaries
dovecot 2.x comes with several new binaries in /usr/lib/dovecot. 
This patch adds profiles for

/usr/lib/dovecot/anvil 
/usr/lib/dovecot/auth 
/usr/lib/dovecot/config 
/usr/lib/dovecot/dict 
/usr/lib/dovecot/dovecot-lda 
/usr/lib/dovecot/lmtp 
/usr/lib/dovecot/log 
/usr/lib/dovecot/managesieve 
/usr/lib/dovecot/ssl-params

References: https://bugzilla.novell.com/show_bug.cgi?id=851984


Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-26 22:46:51 +01:00
Christian Boltz
86ed060f25 [1/3] dovecot profiles: introduce tunables/dovecot
Introduces tunables/dovecot (with @{DOVECOT_MAILSTORE}) and replace 
the mail storage location in various dovecot-related profiles with 
this variable.

Also add nice copyright headers (I hope I got the bzr log right ;-)


Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-26 22:43:42 +01:00
Felix Geyer
6733da5fcd nameservice abstraction: read permission to avahi socket
From: Felix Geyer <debfx@ubuntu.com>

AppArmor requires read and write permission to connect to
unix domain sockets but the nameservice abstraction only
grants write access to the avahi socket.
As a result mdns name resolution fails.

Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-26 12:16:54 -08:00
Steve Beattie
cb679f3206 add keyword 'other' vim syntax support, plus language parsing tests
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 11:17:23 -08:00
Steve Beattie
9bb81e1ed3 parser: add rttime rlimit support
This patch adds support for the rttime rlimit (aka RLIMIT_RTTIME),
available since the 2.6.25 kernel, according to the getrlimit(2)
man page; see that man page for more details on this rlimit.
An acceptance test is also added, as well as an update to the
apparmor.vim input template.

While reviewing to see what made sense in apparmor.vim for the rttime
rlimit, I discovered that RLIMIT_RTTIME's units are microseconds, not
seconds like RLIMIT_CPU (according to the setrlimit(2) manpage). This
necessitated not sharing the case switch with RLIMIT_CPU. I didn't add
a keyword for microseconds, but I did for milliseconds. I also don't
accept any unit larger than minutes, as it didn't seem appropriate
(and even minutes felt... gratuitous). I would appreciate feedback
on what keywords would be useful here.

Patch History:
  v1: initial submission
  v2: - add apparmor.vim support for rttime keyword
      - adjust RLIMIT_TIME value assignment due to its units being
	microseconds, not seconds, and add milliseconds keyword.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 11:06:31 -08:00
Steve Beattie
f65368068f regression tests: minor dbus compilation cleanups
This patch replaces explicitly named output targets with the make
variable $@ as well as an instance where dbus_common.h was being added
to the compile command line due to the use of $^ rather than $<.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 11:03:22 -08:00
Steve Beattie
1fd3b5ed5a parser: close file handle left opened
Close file handle left opened if parser.cfg is found and read from.
Found by cppcheck.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:59:30 -08:00
Steve Beattie
fb3baeaf23 parser: fix memory leak on calloc() failure
Fix leaked memory if calloc() fails. Found by cppcheck.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:58:06 -08:00
Steve Beattie
8237c6fb28 parser: simplify handling of default matching patterns
Seth Arnold noticed an ugly string.clear(); convert_entry(string,
NULL) pattern occurred frequently following the conversion to using
std::string. This patch replaces that by using a static pointer to
a constant string matching pattern, and also converts other uses of
that pattern. It also adds a function wrapper that will clear the
passed buffer before calling convert_entry().

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:47:42 -08:00
Steve Beattie
d4c8971b65 parser: pull forward free() calls
As noted by Seth Arnold, in expand_by_alternations() if our set
variable has at least one value, then we're going to rewrite the entry,
so rather than sprinkle the free()s near where the reallocation occurs,
use one free() once we're guaranteed to need to do so.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:45:48 -08:00
Steve Beattie
78fe398a2f parser: replace reverse iterator
As suggested by Seth Arnold, we can use string::find_last_not_of()
instead of using C++'s hideous reverse iterators.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:30:08 -08:00
Steve Beattie
39564bbdf5 parser: remove unneeded e_buffer_overflow
As noted by Seth Arnold, e_buffer_overflow is no longer set in
convert_aaregex_to_pcre(), so remove it and the sole check for it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:27:58 -08:00
Steve Beattie
6e701f798f parser: remove static sized buffer in process_dbus_entry()
This patch converts a stack allocated buffer into an std::ostringstream
object. The stringstream interface for specifying the equivalent of
a printf %02x conversion is a bit of an awkward construction, however.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:25:47 -08:00
Steve Beattie
5f18a7c237 parser: remove unneeded vars/allocations in regex unit tests
Based on feedback from Seth Arnold, the convert_aaregex_to_pcre()'s
first argument is const char *, and thus the unit test macros don't need
to pass a copy of the input string to it, as it's guaranteed to be
unmodified by the function.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:21:30 -08:00
Steve Beattie
fdd89f1da5 parser: eliminate bison warning
This patch eliminates the bison warning about "%name-prefix =" being
deprecated.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-24 10:19:59 -08:00
Steve Beattie
52b3458972 mod_apparmor: include errno in log messages for failures
This patch includes the errno in the log messages generated by two
different failed aa_change_hat() calls and the failure to open
/dev/urandom to get the random token, to further ease failure
diagnosis.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 14:50:07 -08:00
Steve Beattie
016e1f1b19 mod_apparmor: eliminate unnecessary back out aa_change_hat() calls
This patch removes unnecessary back out aa_change_hat() calls that occur
if the prior call to aa_change_hat() call failed. It used to be case
that an aa_change_hat() call that failed would result in the task being
placed in a profile with no permissions except the ability to
aa_change_hat() back out, but this behavior has been removed from
apparmor for many, many years now.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 14:44:24 -08:00
Steve Beattie
6fd2f36bd8 mod_apparmor: add logging for AAHatName/AADefaultHatName policy misconfig
This patch adds code that checks the resulting hat that apache gets
placed into, and verifies that if the apache configuration specified
that an AAHatName or AADefaultHatName should have been the resulting
hat. If it wasn't, emit a warning message to the apache log, as this
likely indicates a mismatch between the apache configuration and its
apparmor policy (i.e. why define AAHatName if you aren't going to
create the corresponding hat in the apparmor policy?)

Note for AADefaultHatName, a message is not logged if a defined
AAHatName would also apply or if there is a hat defined for the uri,
as each of those come first in the order of attempted hats.

Also note that the way the hat name is manually calculated will break
for nested profiles and stacking. It should be fine for all current
deployments as we don't allow nesting beyond the first subprofile level
in policy yet. And stacking will likely only be used between namespaces
where aa_getcon() will not report parent namespace info. However, when
libapparmor adds functionality to query the hatname, the code that
computes it here should be replaced by a call to that library function.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 14:42:00 -08:00
Steve Beattie
c98f54ecdc mod_apparmor: convert aa_change_hat()s into single aa_change_hatv()
This patch converts the request entry point from using multiple (if
necessary) aa_change_hat() calls into a single aa_change_hatv() call,
simplifying the code a bit, requiring fewer round trips between
mod_apparmor and the kernel for each request, as well as providing more
information when the apache profile is in complain mode.

Patch history:
  v1: initial version
  v2: - the server config (scfg) code accidentally re-added the
        directory config (dcfg) hat to the vector of hats, fix that
      - actually add the DEFAULT_URI hat to the vector of hats, instead
	of only logging that that is happening.
      - pass errno to ap_log_rerror() if aa_change_hatv() call fails.
      - don't call aa_change_hat again if aa_change_hatv() call fails,
	as this is no longer necessary.
  v3: - Based on feedback from jjohansen, convert exit point
        aa_change_hat() call to aa_change_hatv(), in order to work
        around aa_change_hat() bug addressed in trunk rev 2329,
        which causes the exiting aa_change_hat() call to fail and
        results in the apache process being killed by the kernel.
        When it's no longer likely that mod_apparmor could run into
        a system libapparmor that still contains this bug, this can
        be converted back.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 14:08:46 -08:00
Steve Beattie
8250e061d4 mod_apparmor: make the ServerName be the default AADefaultHatName
Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1207424

This patch makes the default value for AADefaultHatName be the
server/vhost name, which can be specified in apache via the ServerName
configuration declaration. It can be overridden by setting
AADefaultHatName directly. Thus, with this patch applied, the order of
attempted hats will be:

  1. try to aa_change_hat(2) into a matching AAHatName hat if it exists
     and applies, otherwise
  2. try to aa_change_hat(2) into the URI itself, otherwise
  3. try to aa_change_hat(2) into the value of ServerName, unless
     AADefaultHatName has been explicitly set for this server/vhost, in
     which case that value will be used, otherwise
  4. try to aa_change_hat(2) into the DEFAULT_URI hat, if it exists,
     otherwise
  5. fall back to the global Apache policy

This should eliminate the need for most admins to define both
ServerName and AADefaultHatName, unless there's a specific need for
the values to deviate.

Man page documentation is updated as well, though probably more
wordsmithing is needed there for clarity.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:51:34 -08:00
Steve Beattie
1a008da295 mod_apparmor: fix AADefaultHatName storage
When defining an AADefaultHatName entry, it was being stored in the
passed mconfig location, which is not the module specific server
config, but instead the top level (i.e. no path defined) default
directory/location config. This would be superceded by a more specific
directory config if it applied to the request. Thus, if an AAHatName was
defined that applied, but the named hat was not defined in the apparmor
policy, mod_apparmor would not attempt to fall back to the defined
AADefaultHatName, but instead jump directly to trying the DEFAULT_URI
hat.

This patch fixes it by storing the defined AADefaultHatName correctly in
the module specific storage in the related server data structure. It
also adds a bit of developer debugging statements.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>


Bug: https://launchpad.net/bugs/1207424
2014-01-23 13:46:17 -08:00
Steve Beattie
124f598090 mod_apparmor: improve initial and exit aa_change_hat call log message
This patch adds the name of the hat to the log message about the
initial aa_change_hat call, just to be explicit about what's happening
when debugging and changes the formatting slightly of the exiting
change_hat log message.

Patch history:
  v1: initial version
  v2: tweak output of exit trace message

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:45:00 -08:00
Steve Beattie
3d155a3016 mod_apparmor: convert change_hat to aa_change_hat()
mod_apparmor never got converted to use the renamed aa_change_hat()
call (there's a compatibility macro in sys/apparmor.h); this patch does
that as well as converting the type of the magic_token to long from int.

(This patch is somewhat mooted by a later patch in the series to
convert to using aa_change_hatv(), but would be a safer candidate
for e.g. the 2.8 branch.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:43:36 -08:00
Steve Beattie
eff2a32082 Subject: mod_apparmor: convert debug_dump_uri to use trace loglevel
This patch converts the debug_dump_uri() function to use the trace
loglevels and enable it all the time, rather than just when DEBUG is
defined at compile time.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:41:57 -08:00
Steve Beattie
087ec5e1ce mod_apparmor: use trace1 loglevel for developer-oriented debug messages
Apache 2.4 added addition logging levels. This patch converts some of
the log messages that are more intended for mod_apparmor development
and debugging than for sysadmins configuring mod_apparmor to use trace1
(APLOG_TRACE1) level instead. Since apache 2.2. does not contain this
level (or define), we define it back to APLOG_DEBUG.

Patch history:
  v1: initial version
  v2: mark a couple of additional log messages as trace1 level

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:40:19 -08:00
Steve Beattie
637a6bfe9f mod_apparmor: fix logging
The apache2 mod_apparmor module was failing to log debugging messages
when the apache loglevel was set to debug or lower (i.e. traceN). This
patch fixes it by using ap_log_rerror() (for request specific messages,
with the request passed for context) and ap_log_error() (more general
messages outside of a request context).

Also, the APLOG_USE_MODULE macro is called, to mark the log messages as
belonging to the apparmor module, so that the apache 2.4 feature of
enabling debug logging for just the apparmor module will work, with an
apache configuration entry like:

  LogLevel apparmor:debug

See

  http://ci.apache.org/projects/httpd/trunk/doxygen/group__APACHE__CORE__LOG.html

for specific about the ap_log_*error() and APLOG_USE_MODULE functions
and macros, and

  http://httpd.apache.org/docs/2.4/mod/core.html.en#loglevel

for the bits about module specific logging.

Patch history:
  v1: initial version
  v2: - revert to using ap_log_error with (the 2.4 specific)
        ap_server_conf outside of a request specific context, as the
        pool specific ap_log_perror messages weren't being reported.
      - add compatibility workaround for apache 2.2
  v3: keep commented out merge function's log call consistent with the
      others

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:38:31 -08:00
Steve Beattie
2d504e3c71 Subject: libapparmor: fix aa_change_hat token format string
This patch fixes the format string for the magic token in aa_change_hat
to match the type of the magic token (long). Without this, on 64
bit platforms, only the bottom 32 bits of the token would be used.
aa_change_hatv() has the correct format string, so an aa_change_hatv()
call followed by an exiting aa_change_hat() call would result in the
latter having a different token, which would cause the process to be
killed by apparmor.

(Hat tip to John Johansen for spotting the actual bug.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 13:16:56 -08:00
Christian Boltz
960a8aee87 several updates for the winbindd profile
(collected in the openSUSE package over the last months)

- add abstractions/samba to usr.sbin.winbindd profile
  (and cleanup things that are included in the abstraction - the cleanup 
  part is not in the openSUSE package)
- add capabilities ipc_lock and setuid to usr.sbin.winbindd profile 
  (bnc#851131)
- updates for samba 4.x and kerberos (bnc#846586#c12 and #c15, 
  bnc#845867, bnc#846054)
- drop always-outdated "Last Modified" comment

References: see the bnc# above (they are bug numbers at 
bugzilla.novell.com)

Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-23 15:04:12 +01:00
Launchpad Translations on behalf of apparmor-dev
32eb900317 Launchpad automatic translations update. 2014-01-22 05:15:04 +00:00
Christian Boltz
1886ab9f35 make sure all profiles have #include <local/...>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-01-20 23:35:13 +01:00
Steve Beattie
b3c9d8b86b utils: address pep8 complaints
This patch eliminates the complaints from running:

  pep8 --ignore=E501 aa-easyprof vim/

(E501 is 'line too long', which I'm not too chuffed about.)

Mostly, it's a lot of whitespace touchups, with a few conversions from
'==' to 'is'.

Commit includes applied feedback from cboltz.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-20 11:51:01 -08:00
Steve Beattie
2edb7d57be periodic sync up with trunk 2014-01-20 11:47:14 -08:00
Steve Beattie
f6af922088 po files: eliminate msgfmt missing language header warning
Current builds include many warnings when building translations message
files like so:

  msgfmt -c -o ja.mo ja.po
  ja.po:5: warning: header field 'Language' missing in header

According to what I read in the entry for Language in
http://www.gnu.org/software/gettext/manual/gettext.html#Header-Entry
the language entry should be (in our case) the same as the file name
minus the .po suffix. This patch adds the language field for those
po files that were missing it.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-20 11:45:10 -08:00
Steve Beattie
5bae654061 parser: add additional language tests to get wider test coverage
This patch adds several assorted language tests, to exercise various
parts of the parser that were not being covered by the language tests
previously. Areas lacking were found using the coverage compilation
option; coverage from the language tests is still incomplete.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-17 23:20:51 -08:00
Christian Boltz
68fbe714a4 allow dnsmasq read config created by recent NetworkManager
(see  http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d82669d3fdaa7ec70ef1b64941c101ac810c394b 
for details)

Patch by develop7 [at] develop7.info

Acked-by: Jamie Strandboge <jamie@canonical.com>
2014-01-17 20:58:21 +01:00
Steve Beattie
6e2733a945 merge sync with trunk 2014-01-17 11:20:46 -08:00
Steve Beattie
bae37248f5 parser+utils: adjust translation bugs reporting address
This patch updates the Report-Msgid-Bugs-To: to point to the apparmor
list instead of the old Novell forge address. It also makes the
Project-Id-Version: field consistent.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-17 11:19:33 -08:00
Steve Beattie
cb7e717a7e utils: fix apparmor.vim rlimits support
The rlimits syntax checking support in apparmor.vim was broken in
various unhelpful ways:

  - lacked support for the 'infinity' keyword (aka RLIM_INFINITY)
  - lacked support for the 'ofile' rlimit, an alias for the nofile
    rlimit
  - lacked support for the 'cpu' rlimit (aka RLIMIT_CPU)
  - incorrect syntax for nofile|nproc|rtprio rlimits (didn't include
    required '<=' between the limit name and value)
  - incorrect syntax for specifying optional SI units for size based
    rlimits (e.g. 'MB' is required, but syntax only allowed incorrect
    'M'; that said, one could argue the parser is overly strict here,
    and the pattern should be '[KMG]B?')

(See the setrelimit(2) man page for more details on the specifics of the
rlimit definitions.)

This patch fixes the above issues.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-17 11:14:27 -08:00
Steve Beattie
f9d1005b9d utils: remove unneeded imports from aa-easyprof and aa-sandbox
Found by running pyflakes on these scripts.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-17 00:09:23 -08:00
Steve Beattie
62d636f125 parser: add rlimit language acceptance tests
The parser was lacking language tests for rlimits. This test adds
several, one for each rlimit type.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-16 23:11:07 -08:00
Steve Beattie
49ec571bd0 parser: remove unneeded goto target in build_mnt_opts()
As noted by Seth Arnold, there's now only one failure case in the
function and thus does not warrant a goto target (especially since
there's no cleanup to occur).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2014-01-16 19:09:35 -08:00
Steve Beattie
831870b122 periodic merger of trunk back into translations branch 2014-01-14 14:29:55 -08:00
Steve Beattie
aae194cc54 Merge the subsequent launchpad translations back into trunk. 2014-01-14 14:28:03 -08:00
Steve Beattie
a5a9e6c7a8 Merge initial launchpad translations import. 2014-01-14 14:23:44 -08:00
Steve Beattie
252829aee0 Merge in collected changes from trunk since branching off the
translations branch.
2014-01-14 10:36:36 -08:00
Tyler Hicks
58f96365d9 tests: Default to in-tree parser for regression tests
Change uservars.inc subdomain variable to use the in-tree parser by
default.

Also, clean up some commented out subdomain values that don't look to be
in use any longer and add one commented out value pointing to the system
parser.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-01-12 22:39:07 -06:00
Tyler Hicks
9c1890fe13 parser: Make equality test output look like minimize test output
Subtle change to remove the "..." between the test description and
result and also to single-space the output. This brings the output in
line with what minimize.sh outputs, which is the test that runs just
before equality.sh.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-12 22:38:10 -06:00
Tyler Hicks
b9b1f7efe7 tests: Update README to reflect bash requirement
The regression test README examples use sh when showing how to run
individual tests but bash is needed, instead.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-12 22:37:39 -06:00
Tyler Hicks
f6f8232b6c parser: Add DFA minimization test that mimics D-Bus abstractions
This test ensures that the proper DFA minimization occurs when a
permissive D-Bus abstraction #include's the corresponding strict
abstraction.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-01-10 15:35:51 -06:00
Tyler Hicks
2559b9cfd8 profiles: Add strict accessibility bus abstraction
Create a new strict accessibility bus abstraction.

The strict abstraction only allows for calling the Hello, AddMatch,
RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods
that are exported by the D-Bus daemon.

The permissive abstraction reuses the strict abstraction and then allows
all communications on the accessibility bus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-10 15:35:30 -06:00
Tyler Hicks
46685a5637 profiles: Add strict session bus abstraction
Move some of the file rules from the existing permissive session bus
abstraction into a new strict session bus abstraction. Leave the
dbus-launch rule in the permissive profile since not all applications
will need it.

The strict abstraction only allows for calling the Hello, AddMatch,
RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods
that are exported by the D-Bus daemon.

The permissive abstraction reuses the strict abstraction and then allows
all communications on the session bus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2014-01-10 15:35:09 -06:00
Tyler Hicks
38aae1d1f0 profiles: Add strict system bus abstraction
Move the file rule from the existing permissive system bus abstraction
into a new strict system bus abstraction.

The strict abstraction only allows for calling the Hello, AddMatch,
RemoveMatch, GetNameOwner, NameHasOwner, and StartServiceByName methods
that are exported by the D-Bus daemon.

The permissive abstraction reuses the strict abstraction and then allows
all communications on the system bus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-10 15:34:45 -06:00
Steve Beattie
9fcbd8af1c parser: fix compilation failure on 32 bit systems
std::max in C++ requires that both arguments be the same type. The
previous fix added std::max comparisons between unsigned long numeric
constants and size_t, this fix casts the numeric constants to size_t.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-10 11:02:59 -08:00
John Johansen
b6cb988ed7 Tests for DFA minimization
Tests should be added for other rule types but this is a good start at
testing DFA minimization.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2014-01-09 17:34:28 -08:00
John Johansen
92eae9d2d9 Fix dump output of expr tree
Make the accept information dump output be in hexidecimal like the
other dumps so its easier to reference between them.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-01-09 17:30:00 -08:00
John Johansen
35f89fc3d6 Fix for the previous minimization patch
This was part of the original minimization patch, but got dropped when
applying to bzr. Again bzr status didn't show any files out of place
nor did the patching fail :(

Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-01-09 17:27:47 -08:00
John Johansen
7ba571395e Fixes to that where dropped from the diff-encode patch
This diff is part of the diffencode patch but was dropped when it was
applied to bzr. I have no idea why and status showed a clean tree.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2014-01-09 17:24:40 -08:00
John Johansen
3fb0689b84 Fix policy generation for small dfas
So there are multiple bugs in policy generation for small dfas.
- A bug where dfas reduced to only have a none accepting state
  drop the start state for accept tables in the chfa encoding

  eg. deny audit dbus,

  the accept and accept2 tables are resized to 1 but the cfha format
  requires at least 2. 1 for the none accepting state and 1 for the
  start state.
  the kernel check that the accept tables == other state table sizes
  caught this and rejected it.

- the next/check table needs to be padded to the largest base position
  used + 256 so no input can ever overflow the next/check table
  (next/check[base+c]).

  This is normally handled by inserting a transition which resizes
  the table. However in this case there where no transitions being
  inserted into the dfa. Resulting in a next/check table size of
  2, with a base pos of 0. Meaning the table needed to be padded
  to 256.

- there is an alignment bug for dfas within the container (see below)
  what follows is a hexdump of the generated policy. With the
  different parts broken out. There are 2 dfas (policy and older file) and
  it is the second dfa that is out of alignment.

  The aadfa blob wrapper should be making sure that the start of the actual
  dfa is in alignment but this is not happening. In this example


00000000  04 08 00 76 65 72 73 69  6f 6e 00 02 05 00 00 00  |...version......|
00000010  04 08 00 70 72 6f 66 69  6c 65 00 07 05 40 00 2f  |...profile...@./|
00000020  68 6f 6d 65 2f 75 62 75  6e 74 75 2f 62 7a 72 2f  |home/ubuntu/bzr/|
00000030  61 70 70 61 72 6d 6f 72  2f 74 65 73 74 73 2f 72  |apparmor/tests/r|
00000040  65 67 72 65 73 73 69 6f  6e 2f 61 70 70 61 72 6d  |egression/apparm|
00000050  6f 72 2f 71 75 65 72 79  5f 6c 61 62 65 6c 00 04  |or/query_label..|
00000060  06 00 66 6c 61 67 73 00  07 02 00 00 00 00 02 00  |..flags.........|
00000070  00 00 00 02 00 00 00 00  08 02 00 00 00 00 02 00  |................|
00000080  00 00 00 02 00 00 00 00  02 00 00 00 00 04 07 00  |................|
00000090  63 61 70 73 36 34 00 07  02 00 00 00 00 02 00 00  |caps64..........|
000000a0  00 00 02 00 00 00 00 02  00 00 00 00 08 04 09 00  |................|
000000b0  70 6f 6c 69 63 79 64 62  00 07

begin of policy dfa blob wrapper
000000b0                                 04 06 00 61 61 64  |policydb.....aad|
000000c0  66 61 00 06

size of the following blob (in little endian) so 0x80
000000c0              80 00 00 00  

begin of actual policy dfa, notice alignment on 8 byte boundry
000000c0                           1b 5e 78 3d 00 00 00 18  |fa.......^x=....|
000000d0  00 00 00 80 00 00 6e 6f  74 66 6c 65 78 00 00 00  |......notflex...|
000000e0  00 01 00 04 00 00 00 00  00 00 00 01 00 00 00 00  |................|
000000f0  00 07 00 04 00 00 00 00  00 00 00 01 00 00 00 00  |................|
00000100  00 02 00 04 00 00 00 00  00 00 00 02 00 00 00 00  |................|
00000110  00 00 00 00 00 00 00 00  00 04 00 02 00 00 00 00  |................|
00000120  00 00 00 02 00 00 00 00  00 08 00 02 00 00 00 00  |................|
00000130  00 00 00 02 00 00 00 00  00 03 00 02 00 00 00 00  |................|
00000140  00 00 00 02 00 00 00 00  08

dfa blob wrapper
00000140                              04 06 00 61 61 64 66  |............aadf|
00000150  61 00 06

size of the following blob (in little endian) so 0x4c8
00000150          c8 04 00 00

begin of file dfa, notice alignment. NOT on 8 byte boundry
                               1b  5e 78 3d 00 00 00 18 00  |a.......^x=.....|
00000160  00 04 c8 00 00 6e 6f 74  66 6c 65 78 00 00 00 00  |.....notflex....|
00000170  01 00 04 00 00 00 00 00  00 00 06 00 00 00 00 00  |................|
00000180  00 00 00 00 9f c2 7f 00  00 00 00 00 00 00 00 00  |................|
00000190  04 00 30 00 00 00 00 00  07 00 04 00 00 00 00 00  |..0.............|
000001a0  00 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001c0  02 00 04 00 00 00 00 00  00 00 06 00 00 00 00 00  |................|
000001d0  00 00 00 00 00 00 01 00  00 00 01 00 00 00 02 00  |................|
000001e0  00 00 00 00 00 00 00 00  04 00 02 00 00 00 00 00  |................|
000001f0  00 00 06 00 00 00 00 00  02 00 00 00 05 00 05 00  |................|
00000200  08 00 02 00 00 00 00 00  00 01 02 00 00 00 03 00  |................|
00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000260  00 00 00 00 00 00 00 00  00 00 02 00 04 00 00 00  |................|
00000270  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000410  03 00 02 00 00 00 00 00  00 01 02 00 00 00 02 00  |................|
00000420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000470  00 00 00 00 00 00 00 00  00 00 01 00 03 00 04 00  |................|
00000480  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000610  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00

end of container
00000610                                                08  |................|
00000620

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-01-09 17:09:54 -08:00
John Johansen
f0b154528d Fix dfa minimization
So DFA minimization has a bug and feature that keeps it from  minimizing
some dfas completely. This feature/bug did not result in incorrect dfas,
it just fails to result in full minimization.

The same mappings comparison is wrong. Or more correctly it is right when
transitions are not remapped to minimization partitions, but it may be
wrong when states are remapped. This means it will cause excess
partitioning (not removing all the states it should).

The trans hashing does a "guess" at partition splitting as a performance
enhancement. Basically it leverages the information that states that have
different transitions or transitions on different characters are not the
same. However this isn't always the case, because minimization can cause
some of those transitions to be altered. In previous testing this was
always a win, with only a few extra states being added some times. However
this changes with when the same mappings are fixed, as the hashing that was
done was based on the same flawed mapping as the broken same mappings.

If the same mappings are fixed and the hashing is not removed then there
is little to no change. However with both changes applied some dfas see
significant improvements. These improvements often result in performance
improvements despite minimization doing more work, because it means less
work to be done in the chfa comb compression

eg. test case that raised the issue (thanks tyler)
  /t { mount fstype=ext2, mount, }

  used to be minimized to
   {1} <== (allow/deny/audit/quiet)
   {6} (0x 2/0/0/0)

   {1} -> {2}: 0x7
   {2} -> {3}: 0x0
   {2} -> {2}: []
   {3} -> {4}: 0x0
   {3} -> {3}: []
   {4} -> {6}: 0x0
   {4} -> {7}: 0x65 e
   {4} -> {5}: []
   {5} -> {6}: 0x0
   {5} -> {5}: []
   {6}  (0x 2/0/0/0) -> {6}: [^\0x0]
   {7} -> {6}: 0x0
   {7} -> {8}: 0x78 x
   {7} -> {5}: []
   {8} -> {6}: 0x0
   {8} -> {5}: 0x74 t
   {8} -> {5}: []

  with the patch it is now properly minimized to
    {1} <== (allow/deny/audit/quiet)
    {6} (0x 2/0/0/0)

    {1} -> {2}: 0x7
    {2} -> {3}: 0x0
    {2} -> {2}: []
    {3} -> {4}: 0x0
    {3} -> {3}: []
    {4} -> {6}: 0x0
    {4} -> {4}: []
    {6}  (0x 2/0/0/0) -> {6}: [^\0x0]


The evince profile set sees some significant improvements picking a couple
example from its "minimized" dfas (it has 12) we see a reduction from 9720
states to 6232 states, and 6537 states to 3653 states. All told seeing the
performance/profile size going from
  2.8 parser: 4.607s 1007267 bytes
  dev head:   3.48s  1007267 bytes
  min fix:    2.68s  549603 bytes

of course evince is an extreme example so a few more

firefox
   2.066s   404549 bytes
 to
   1.336s   250585 bytes


cupsd
   0.365s   90834 bytes
 to
   0.293s   58855 bytes

dnsmasq
   0.118s   35689 bytes
 to
   0.112s   27992 bytes


smbd
   0.187s   40897 bytes
 to
   0.162s   33665 bytes


weather applet profile from ubuntu touch
   0.618s   105673 bytes
 to
   0.432s   89300 bytes


I have not seen a case where the parser regresses on performance but it is
possible. This patch will not cause a regression on generated policy size,
at worst it will result in policy that is the same size

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2014-01-09 17:06:48 -08:00
John Johansen
22855508e8 Add Differential State Compression to the DFA
Differential state compression encodes a state's transitions as the
difference between the state and its default state (the state it is
relative too).

This reduces the number of transitions that need to be stored in the
transition table, hence reducing the size of the dfa.  There is a
trade off in that a single input character may have to traverse more
than one state.  This is somewhat offset by reduced table sizes providing
better locality and caching properties.

With carefully encoding we can still make constant match time guarentees.
This patch guarentees that a state that is differentially encoded will do at
most 3m state traversal to match an input of length m (as opposed to a
non-differentially compressed dfa doing exactly m state traversals).
In practice the actually number of extra traversals is less than this becaus
we selectively choose which states are differentially encoded.

In addition to reducing the size of the dfa by reducing the number of
transitions that have to be stored.  Differential encoding reduces the
number of transitions that need to be considered by comb compression,
which can result in tighter packing, due to a reduction in sparseness, and
also reduces the time spent in comb compression which currently uses an
O(n^2) algorithm.

Differential encoding will always result in a DFA that is smaller or equal
in size to the encoded DFA, and will usually improve compilation times,
with the performance improvements increasing as the DFA gets larger.

Eg. Given a example DFA that created 8991 states after minimization.
* If only comb compression (current default) is used

 52057 transitions are packed into a table of 69591 entries. Achieving an
 efficiency of about 75% (an average of about 7.74 table entries per state).
 With a resulting compressed dfa16 size of 404238 bytes and a run time for
 the dfa compilation of
   real 0m9.037s
   user 0m8.893s
   sys  0m0.036s

* If differential encoding + comb compression is used, 8292 of the 8991
  states are differentially encoded, with 31557 trans removed.  Resulting in

  20500 transitions are packed into a table of 20675 entries.  Acheiving an
  efficiency of about 99.2% (an average of about 2.3 table entries per state
  With a resulting compressed dfa16 size of 207874 bytes (about 48.6%
  reduction) and a run time for the dfa compilation of
   real 0m5.416s (about 40% faster)
   user 0m5.280s
   sys  0m0.040s

Repeating with a larger DFA that has 17033 states after minimization.
* If only comb compression (current default) is used

 102992 transitions are packed into a table of 137987 entries.  Achieving
 an efficiency of about 75% (an average of about 8.10 entries per state).
 With a resultant compressed dfa16 size of 790410 bytes and a run time for d
 compilation of
  real  0m28.153s
  user  0m27.634s
  sys   0m0.120s

* with differential encoding
 39374 transition are packed into a table of 39594 entries. Achieving an
 efficiency of about 99.4% (an average of about 2.32 entries per state).
 With a resultant compressed dfa16 size of 396838 bytes (about 50% reduction
 and a run time for dfa compilation of
  real  0m11.804s (about 58% faster)
  user  0m11.657s
  sys   0m0.084s

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-01-09 16:55:55 -08:00
Steve Beattie
c6f1034177 Convert make errors finding libapparmor to only occur when building
By raising an error for being unable to find libapparmor any time
a make command is run, we break things like make clean and other
targets that don't strictly depend on libapparmor existing (note that
Tyler's implementation for the parser did not do this). This patch
fixes this for the regression tests, mod_apparmor and pam_apparmor
by making a separate libapparmor_check target that looks to see if
an error message should be generated.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-01-09 12:11:19 -08:00
Steve Beattie
598f7a0b5b mod_apparmor/pam_apparmor: fix libapparmor search path and add USE_SYSTEM support
This patch adds support for the USE_SYSTEM make flag and adjusts
search paths for mod_apparmor and pam_apparmor, as well as fixing up
a couple of the (probably ought to be deprecated) tomcat locations
where apparmor.h is included.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2014-01-09 11:57:13 -08:00
Launchpad Translations on behalf of apparmor-dev
11301681aa Launchpad automatic translations update. 2014-01-08 04:35:03 +00:00
Steve Beattie
c478f8f0e1 regression tests: build against in-tree libapparmor by default [v3]
This patch converts the regression tests to build against the in-tree
libapparmor, giving an error if libapparmor has not already been built.
It also maintains support for building against the system libapparmor
via passing

  USE_SYSTEM=1

on the make command line. An error is also given if the system
libapparmor cannot be found, indicating that development packages need
to be installed. The check to look for libapparmor is also updated
to make use of libapparmor pkg-config data if available.

Patch history:
  v1: initial submission
  v2: convert from including the apparmor.h on the command line to
      specifying an in-tree libapparmor header include path, now
      that their location has been adjusted to make it safe to do
      so. Remove work around related to defining _GNU_SOURCE.
  v3: fix LDLIBS to use output of pkg-config et al tests instead of
      hardcoding -lapparmor in the USE_SYSTEM case.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-01-06 14:58:15 -08:00
Steve Beattie
260d73f752 parser: Add make variable to build against local or system libapparmor [v3]
By default, statically link against the in-tree libapparmor. If the
in-tree libapparmor is not yet built, print a helpful error message. To
build against the system libapparmor, the USE_SYSTEM make
variable can be set on the command line like so:

  $ make USE_SYSTEM=1

This patch also fixes issues around the inclusion of the apparmor.h
header. Previously, the in-tree apparmor.h was always being included
even if the parser was being linked against the system libapparmor.
It modifies the apparmor.h include path based on the previous patch
separating them out in the libapparmor source. This was needed because
header file name collisions were already occurring.

For source files needing to include apparmor.h, the make targets were
also updated to depend on the local apparmor.h when building against
the in-tree libapparmor.  When building against the system libapparmor,
the variable used in the dependency list is empty. Likewise, a
libapparmor.a dependency is added to the apparmor_parser target when
building against the in-tree apparmor.

Patch history:
  v1: from Tyler Hicks <tyhicks@canonical.com>
      - initial version
  v2: revert to altering the include search path rather than including
      the apparmor.h header directly via cpp arguments, alter the
      include statements to <sys/apparmor.h> which will work against
      either in-tree or (default) system paths.
  v3: convert controlling variable to USE_SYSTEM from SYSTEM_LIBAPPARMOR
      to unify between the parser and the regression tests.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Steve Beattie <steve@nxnw.org>
2014-01-06 14:46:10 -08:00
Steve Beattie
a72f0693f3 libapparmor: move public headers to separate directory
This patch moves the apparmor.h and aalogparse.h headers
from the libapparmor/src/ directory to a new directory
libapparmor/include/. The apparmor.h header is stored in a sys/
directory within libapparmor/include/ to match its usual install
location in /usr/include/sys/, simplifying the #include statements of
source that wishes to include either the in-tree or system installed
version of the header (i.e. #include <sys/apparmor.h> can be used
everywhere).

The patch size is inflated by the movements of the header files, which
are unchanged except for their locations. Otherwise, the rest of the
changes are to modify the include search path or to stop looking in
$CWD for one of the headers.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2014-01-06 14:08:55 -08:00
Steve Beattie
6552d192a6 libapparmor: require libtoolize instead of libtool
libtoolize is the standard mechanism for incorporating libtool support
into a library; however, libapparmor's autogen.sh script specifically
looks for the existence of the libtool binary rather than libtoolize.
The libtoolize tool automatically generates a libtool script and does
not require the existence of the libtool binary, so we no longer need
to check for it.

The autogen.sh script aborting because it can't find the libtool
binary causes a spurious build failure in Ubuntu 14.04, due to the
libtool binary being separated out into its own package, and which
is not a strict dependency for libtool.

(I also added setting the package variable so that the error message
emitted will indicate that the failure is in building libapparmor.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2014-01-03 15:13:26 -08:00
Christian Boltz
c37643e8a0 add FIPS support to abstractions/openssl
References: https://bugzilla.novell.com/show_bug.cgi?id=857122#c2

Acked-by: Steve Beattie <steve@nxnw.org>
2014-01-03 20:43:43 +01:00
Kshitij Gupta
3edc4d16ac Fixed some variable name conflicts, moved some code to methods from functions. Fixes the bug in custom logfile name. 2013-12-29 15:12:30 +05:30
Christian Boltz
aa6b86a1c3 samba (nmbd and smbd) need to create /var/run/samba and /var/cache/samba
at startup (at least on systems where /var/run is on a tmpfs)

References: https://bugzilla.novell.com/show_bug.cgi?id=856651

Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.8. Thanks!
2013-12-23 22:15:47 +01:00
Tyler Hicks
d64797e4c3 profiles: rw file perms are now needed on AF_UNIX socket files
The AppArmor kernel now checks for both read and write permissions when
a process calls connect() on a UNIX domain socket.

The patch updates four abstractions that were found to be needing
changes after the change in AF_UNIX kernel mediation.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:19:40 -08:00
Tyler Hicks
9b82f1286f profiles: Create D-Bus abstraction for the accessibility bus
The accessibility bus uses an abstract socket, so there hasn't been a
need for an accessibility bus abstraction in the past. Now that D-Bus
mediation is supported, an abstraction becomes a useful place to put
accessibility bus D-Bus rules.

This patch follows the lead of the dbus and dbus-session abstraction by
granting full access to the accessibility bus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:18:27 -08:00
Tyler Hicks
28964ebe24 profiles: Allow full D-Bus access in system and session abstractions
Before D-Bus mediation support was added to AppArmor, the dbus and
dbus-session abstractions granted full access to the system and session
buses, respectively.

In order to continue granting full access to those buses, bus-specific
D-Bus mediation rules need to be added to the abstractions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-19 23:17:10 -08:00
Kshitij Gupta
42ea5f4f67 Added read from custom logfile feature and some other older changes I sadly dont remember 2013-12-20 03:12:58 +05:30
Steve Beattie
4146495b05 parser: remove now unused clone_and_chain functions
With the previous patch to switch to using alternations for variable
expansion, the clone_and_chain set of functions are no longer needed
and no longer need to be passed around. This patch removes them.
(I kept this patch separate to keep the previous patch smaller and more
easily reviewed.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-16 01:30:13 -08:00
Steve Beattie
68a9f24fb5 parser: convert var expansion to use alternations
This patch converts the parser's variable expansion from adding new
entries for each additional variable value to incorporating an
alternation that includes all the values for the variable; e.g. given:

  @{BINS}=/bin /usr/bin /sbin /usr/sbin
  @{BINS}/binary ix,

rather than expanding to exntries for

  /bin/binary
  /usr/bin/binary
  /sbin/binary
  /usr/sbin/binary

one entry would remain that looks like:

  {/bin,/usr/bin,/sbin,/usr/sbin}/binary

One complication with this patch is that we try to prevent mistakes for
our users with variable expansion around '/'s; it's common for people to
write profiles that contain things like:

 @{BAR}=/bingo/*/ /bango/
 /foo/@{BAR}/baz

We already have a post-processing step that walks entries looking
for multiple sequences of '/'s and filters them into single
'/' which worked when creating new entries for each variable
expansion. Converting to alternation expansion breaks this filtering,
so code is added that removes leading and trailing slashes in variable
values in the expansion if the character immediately preceding or
following the variable is also a slash.

The intent behind this is to reduce the amount of memory allocations
and structure walking that needed to occur in when converting from the
entry strings to the back end nodes. Examples with real world profiles
showed performance improvements ranging from 2.5% to 10%. However,
because the back end operations are sensitive to the front end inputs,
it is possible for worse results to occur; for example, it takes the
simple_tests/vars/vars_stress_0[123].sd tests significantly longer to
complete after this patch is applied (vars_stress_03.sd in particular
takes ~23 times longer). An initial analysis of profiling output in
this negative case looks like it causes the tree simplification in
the back end to do more work for unknown reasons.

On the other hand, the test simple_tests/vars/vars_dbus_9.sd
(introduced in "[patch 09/12] parser: more dbus variable testcases")
takes ~1 sec to complete on my laptop before this patch, and roughly
0.01s with this patch applied.

(One option would be to keep the "expand entries" approach as an
alternative, but I couldn't come up with a good heuristic for when
to use it instead.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-16 01:28:38 -08:00
Steve Beattie
513d507423 parser: convert process_mnt_entry's typebuf to std::string
This patch addresses the FIXMEs from the last patch by converting
process_mnt_entry's typebuf from a char[] to std::string. As a side
effect, the code in build_list_val_expr() is greatly simplified.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-16 01:17:21 -08:00
Steve Beattie
cc1a6f0e55 parser: remove length restriction in convert_aaregex_to_pcre usage
This patch removes the string length limit in convert_aaregex_to_pcre()
usage. One of the benefits to moving to C++ is the ability to use
std::strings, which dynamically resize themselves. While it's a large
patch, a non-trivial amount is due to needing to get a char * string
back out via the c_str() method.

The unit tests are modified to include checks to ensure that
convert_aaregex_to_pcre only appends to the passed pcre string,
it never resets it.

As the test case with overlong alternations added in the previous
patch now passes, the TODO status is removed from it.

(Note: there's a couple of FIXME comments related to converting typebuf
to std::string that are added by this patch that are addressed in the
next patch. I kept that conversion separate to try to reduce the size
of this patch a little.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-16 01:15:17 -08:00
Steve Beattie
62c13f66b0 parser: add large number of alternations test case
This patch adds a test case with an extremely large set of alternations.
It is marked TODO, because it fails with the current parser due to
strings used in convert_aaregex_to_pcre() being limited to (roughly)
PATH_MAX.

While contrived, it is possible to have alternations that are longer
than PATH_MAX that always  match paths that are shorter than PATH_MAX.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-16 00:33:08 -08:00
Christian Boltz
d60f1a19da can ?not fix apparmor.pod
At least that's how this patch started ;-)

The updated (and much bigger) patch
- removes the note about can ?not mknod
- also removes mount and umount from the can ?not list which are covered
  by mount rules now
- updates the example audit.log lines to the current log format
- updates the description of the log format

Acked-By: Seth Arnold <seth.arnold@canonical.com> (on IRC)

Seth also promised a follow-up patch with the remaining changes.
2013-12-12 03:07:37 +01:00
Steve Beattie
f0cfec62cd parser: add some developer documentation
Patch history:
  v1: initial version
  v2: based on feedback from cboltz and sarnold:
      - fix bad grammar when mentioning *.gcno and *.gcda files
      - mention that distros generally don't need other options besides
        verbose builds
      - fix 'the valgrind' grammar messup.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-10 14:15:02 -08:00
Steve Beattie
b62f6d3982 parser: more dbus variable testcases (v2)
This patch adds more testcases around variables used in dbus rules.
In particular, it

  - attempts to verify that variable expansion and alternation
    expansion results in identical DFA blobs,
  - tests that variables can be expanded within alternations,
  - tests that alternations can occur in variable definitions, and
  - that having alternations inside variable declarations that are
    used inside alternations results in parsing success

Note that vars/vars_dbus_9.sd veers into stress test land, as the
combinatoric expansion results in over 1000 dbus rule entries being
generated, which means that DFA reduction on all the fields takes
noticeable amounts of time (around 1s on my i5 ivy-core laptop).

Patch history:
  v1: initial version
  v2: based on feedback:
      - add more alternation tests for cases where only part of the
        alternation is defined within a variable
      - mark test with nested alternations as being successful now that
        the patch that implements it was accepted
  v3: based on feedback from cboltz:
      - tst/simple_tests/vars/vars_dbus_9.sd: reference all variables
        declared, including a variable that references another variable

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-10 14:00:32 -08:00
Steve Beattie
d3bc4e43a5 parser: fix rlimit missing initializer warning
When compiling the parser, g++ currently emits warnings like so:

  profile.h: In constructor ‘Profile::Profile()’:
  profile.h:177:11: warning: missing initializer for member ‘aa_rlimits::limits’ [-Wmissing-field-initializers]
     rlimits = { 0 };
             ^

This patch fixes the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-10 12:42:50 -08:00
Steve Beattie
690f35f61c parser: fix /proc version file read
The parser was not checking for an error when reading from
/proc/sys/kernel/osrelease. Additionally, valgrind was complaining
because of the uninitialized space in the buffer in between where
the read(2) had deposited its data and where the parser was writing
a trailing NUL to close the string. This patch fixes the above by
writing the NUL byte at the position at the end of the read characters
and checks for a negative result from the read() call.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-10 12:41:25 -08:00
Steve Beattie
2e8f7fff7c parser: fix alternation expansions that occur inside character classes
The parser was converting alternation characters ('{', '}', and ',')
to their pcre versions ('(', ')', and '|', respectively) that occurred
inside of character class patterns (i.e. inside '[ ]'). This patch
fixes the issue and adds a few unit tests around character classes.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-10 12:22:32 -08:00
Launchpad Translations on behalf of apparmor-dev
d50169fc06 Launchpad automatic translations update. 2013-12-08 05:18:38 +00:00
Launchpad Translations on behalf of apparmor-dev
30a215009d Launchpad automatic translations update. 2013-12-07 05:14:31 +00:00
Christian Boltz
9a4b1c6493 fix broken english in parser_yacc.y
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 21:41:41 +01:00
Tyler Hicks
500c5cca68 Remove private mediation class types from apparmor.h
Currently, D-Bus rules are the only type of policy that we expect to be
queried from userspace. Therefore, we do not need to export other
mediation types at this time.

This patch removes all AA_CLASS_* macros, except AA_CLASS_DBUS, from
libapparmor's apparmor.h header. These macros are already defined in the
parser's policydb.h header.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:20:40 -08:00
Tyler Hicks
de13aa5126 Move public mediation class types and perms to apparmor.h
Now that the parser links against libapparmor, it makes sense to move
all public permission types and flags to libapparmor's apparmor.h. This
prevents duplication across header files for the parser and libapparmor.

Additionally, this patch breaks the connection between
AA_DBUS_{SEND,RECEIVE,BIND} and AA_MAY_{WRITE,READ,BIND} by using raw
values when defining the AA_DBUS_{SEND,RECEIVE,BIND} macros. This makes
sense because the two sets of permission flags are from two distinctly
different mediation types (AA_CLASS_DBUS and AA_CLASS_FILE). While it is
nice that they share some of the same values, the macros don't need to
be linked together. In other words, when you're creating a D-Bus rule,
it would be incorrect to use permission flags from the AA_CLASS_FILE
type.

The change mentioned above allows the AA_MAY_{WRITE,READ,BIND} macros
to be removed from public-facing apparmor.h header.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:20:06 -08:00
Tyler Hicks
b83810af84 tests: Add regression tests for dbus eavesdrop rules
Simple regression test that calls AddMatch using a match string that
sets up eavesdropping on all method call messages.

The shell script file runs the test unconfined and under a variety of
confinement profiles to make sure that eavesdropping confinement is
working as intended.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:19:33 -08:00
Tyler Hicks
98f0202c99 parser: Update equality tests for the new eavesdrop permission
Rules using implied permissions may pick up the eavesdropping
permission, depending on the conditionals present in the rule.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:19:11 -08:00
Tyler Hicks
d5ee5d0c65 parser: Test dbus eavesdrop rule parsing
Make the dbus rule generator knowledgeable of the eavesdrop permission.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:18:48 -08:00
Tyler Hicks
99e509065f parser: Document eavesdropping permission syntax in apparmor.d(5)
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:18:17 -08:00
Tyler Hicks
1580ba5ac1 parser: Add dbus eavesdrop permission support to apparmor_parser
Allows for the policy writer to grant permission to eavesdrop on the
specified bus. Some example rules for granting the eavesdrop permission
are:

  # Grant send, receive, bind, and eavesdrop
  dbus,

  # Grant send, receive, bind, and eavesdrop on the session bus
  dbus bus=session,

  # Grant send and eavesdrop on the system bus
  dbus (send eavesdrop) bus=system,

  # Grant eavesdrop on any bus
  dbus eavesdrop,

Eavesdropping rules can contain the bus conditional. Any other
conditionals are not compatible with eavesdropping rules and the parser
will return an error.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:17:43 -08:00
Steve Beattie
b7e9efdc98 parser: add trailing / glob unit tests for convert_aaregex_to_pcre()
Thanks to Seth Arnold for the suggestion.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 11:00:05 -08:00
Steve Beattie
738427a151 parser: add more convert_aaregex_to_pcre() unit tests
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 06:07:24 -08:00
Steve Beattie
fa9c9f14a6 parser: give warning for unnecessary quote characters
This patch adds a warning when quote characters '\' are added
unnecessarily, generates an error when a single quote is the last
character in a pattern, and uncomments and corrects the relevant unit
test cases.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 06:01:12 -08:00
Steve Beattie
7a42de3eae parser: add build option for coverage (v3)
This patch adds a parser make variable and a make target for building
the compiler with coverage compilation flags. With this, coverage
information can be generated by running tests/test suites against the
built parser and run through tools like gcovr.

Patch History:
  v1: initial version
  v2: refreshed/no change
  v3: address feedback from sarnold:
      - mark coverage target as phony
      - correct missing '.' typo in clean target
      - make coverage extensions consistent in clean targets

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-06 05:31:11 -08:00
Steve Beattie
dfb4d9a48b parser: add basic alternation tests, along with their file and owner
equivalents. (v2)

This patch verifies basic alternation usage.

Patch history:
  v1: initial revision
  v2: mark nested alternation tests as passing, as it was deemed a bug
      that the parser didn't support them.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2013-12-03 16:34:17 -08:00
Steve Beattie
8bda1488dc parser: add test case for empty character class regex
This patch adds a test that verifies the parser considers an emty
character class regex as a parse arror.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2013-12-03 15:55:54 -08:00
Steve Beattie
73a5f13175 parser: mark valgrind test target as phony
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2013-12-03 15:37:57 -08:00
Steve Beattie
7e71162ed5 regression tests: fix introspect.c compiler warnings
This patch annotates that a couple of values emitted on failure are
of type size_t, eliminating a couple of compiler warnings.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-12-03 14:18:00 -08:00
Steve Beattie
8498f129d3 Subject: parser: add convert_aaregex_to_pcre() unit tests
This patch adds unit tests and macros for the convert_aaregex_to_pcre()
function.

Patch history:
  v1: initial version
  v2: - give more verbose output on failures
      - free memory used in tests

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-12-03 11:30:46 -08:00
Kees Cook
26498aac58 Since --per-file-timestamps is broken over the SSH transport, make the
default the HTTPS URI instead.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-12-02 14:49:35 -08:00
Kees Cook
5a15953a76 Without "-c", libtoolize will create a symlink for ltmain.sh, which is not
useful for people without the tools installed, and is against Debian
packaging policy (symlink pointing outside the source tree).

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-12-02 14:49:08 -08:00
Steve Beattie
0e09546391 parser - push normalize_tree() ops into expr-tree classes
This is patch tries to reduce the number of dynamic_cast<>s needed
during normalization by pushing the operations of normalize_tree()
into the expr-tree classes themselves rather than perform it as
an external function. This eliminates the need for dynamic_cast<>
checks on the current object under inspection and reduces the number
of checks needing to be performed on child Nodes as well.

In non-strict benchmarking, doing the dynamic_cast<> reduction
for just the tree normalization operation resulted in a ~10-15%
improvement in overall time on a couple of different hosts (amd64,
armel), as measured against apparmor_parser -Q.  Valgrind's callgrind
tool indicated a reduction in the number of calls to dynamic_cast<>
on the tst/simple_tests/vars/dbus_vars_9.sd test profile from ~19
million calls to ~12 million.

In comparisons with dumped expr trees over both the entire
tst/simple_tests/ tree and from 1000 randomly generated profiles via
stress.rb, the generated trees were identical.

Patch history:
  v1: initial version of patch
  v2: update patch to take into account the infinite loop fix in
      trunk rev 1975 and refresh against current code.
  v3: no change

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-11-28 00:43:35 -08:00
Steve Beattie
fb33689ec3 parser: fix python caching test in envs without apparmor securityfs mounted
Enabling the python caching test by default broke the build tests when
running in environments that do not contain the apparmor securityfs
mounted (think build chroots). This is because an initial check from the
shell script version of the tests was not reproduced within the python
version. This patch adds a check in the base class setUp function that
marks each testcase as skipped if apparmor's securityfs cannot be found.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 23:54:09 -08:00
Steve Beattie
cfd8478ba4 parser - use new caching test script
This patch:
 - incorporates the new python caching test into the make check/make
   caching target, and removes the older shell based test script
 - adjusts the python scripts to give verbose output when the VERBOSE
   flag is set
 - reorders the tests so that the tests that take a shorter amount of
   time to run come first, leaving the language sanity test with its
   69000+ testcases last

Patch history:
  v1: initial revision
  v2: add gen_xtrans/gen_dbus dependency to valgrind test
  v3: drop gen_xtrans/gen_dbus as that was committed as a separate fix

Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 21:25:06 -08:00
Steve Beattie
dd8c646920 parser valgrind tests - fixup suppressions
With the C++-ization of the parser, some functions were renamed or
eliminated; this patch fixes the relevant valgrind false positive
suppression
pattern to match.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-27 21:15:24 -08:00
Launchpad Translations on behalf of apparmor-dev
c7019d4d14 Launchpad automatic translations update. 2013-11-27 04:31:33 +00:00
Launchpad Translations on behalf of apparmor-dev
7694eae167 Launchpad automatic translations update. 2013-11-26 05:13:39 +00:00
Christian Boltz
4e82541ead add /var/lib/ca-certificates/ to abstractions/ssl_certs.
update-ca-certificates (from ca-certificates-1_201310161709-1.1.noarch) 
stores certs in this directory now.

References: https://bugzilla.novell.com/show_bug.cgi?id=852018

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-26 00:41:04 +01:00
Launchpad Translations on behalf of apparmor-dev
010f3c9575 Launchpad automatic translations update. 2013-11-21 05:11:44 +00:00
Launchpad Translations on behalf of apparmor-dev
067a87dc30 Launchpad automatic translations update. 2013-11-20 05:14:49 +00:00
Christian Boltz
208cf752a1 Update samba profiles for samba 4.x
The patch includes changes needed for Samba 4.x, which also includes 
some small abstraction updates.

References: https://bugzilla.novell.com/show_bug.cgi?id=845867
References: https://bugzilla.novell.com/show_bug.cgi?id=846054

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-20 01:17:52 +01:00
Steve Beattie
151fb20972 parser: convert array into unordered map
This patch converts the problematic-with-g++ 4.6 state_names array
into a C++ unordered_map type. Using this depends on using the c++0x
(aka c++11) standard, and as we have gnuisms elsewhere (using the
typeof builtin), the patch also adds/converts to using -std=gnu++c0x
in the build rules (which conveniently eliminates some other warnings
we had due to other c++11-isms).

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-11-18 16:23:23 -08:00
Launchpad Translations on behalf of apparmor-dev
49ba23dc1a Launchpad automatic translations update. 2013-11-16 05:14:19 +00:00
Launchpad Translations on behalf of apparmor-dev
8d21d1e1fe Launchpad automatic translations update. 2013-11-15 05:16:08 +00:00
Christian Boltz
f4fd695853 ntpd needs access to /var/lib/ntp/drift/driftfile and
/var/lib/ntp/drift/driftfile.TEMP

References: https://bugzilla.novell.com/show_bug.cgi?id=850374

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-14 21:48:51 +01:00
John Johansen
b235dea47b Update parser translations as discussed in yesterdays meeting 2013-11-14 10:20:43 -08:00
John Johansen
b5b42f3de1 Remove old translation files and regenerate .pot as discussed in todays meeting 2013-11-13 21:20:25 -08:00
Steve Beattie
61aebaeb4c parser - fix unbalanced ']' issue
A bug existed in the parser that it would not detect the error case
where an unquoted ']' is given without a matching '[' (the quoted
cases are accepted properly). This patch fixes the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-11-05 14:37:53 -08:00
John Johansen
055b68289c allow for nested alternations in regex patterns
Currently alternations are limited to a single level, make it so we can
nest alternations.

Note: this is a temporary solution to the problem. Long term this routine
to convert to pcre will go away when native parsing of aare is added to
the backend.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-05 14:33:51 -08:00
John Johansen
1c86517e79 The apparmor parser build fails when bison 3 is used. The following
patch is needed to fix the build.

patch from: Jan Rękorajski <baggins@pld-linux.org>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-05 14:30:01 -08:00
Jamie Strandboge
36704d4224 Author: Jamie Strandboge <jamie@canonical.com>
Description: python abstraction updates for Ubuntu 14.04

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-11-04 19:52:57 -06:00
Tyler Hicks
71b441020e tests: Remove remainder of libimmunix and 2.[24] kernel support
The previous patch for removing libimmunix support from the regression
tests wasn't complete. Also, the 2.2 and 2.4 kernel support code is
closely related and can be removed considering how old those kernels
are.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 12:25:53 -08:00
Tyler Hicks
b566174cc5 libapparmor: Check correct macro to prevent multiple apparmor.h includes
This typo allowed apparmor.h to be pulled in multiple times.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 12:02:53 -08:00
Tyler Hicks
a80c27ece3 LibAppArmor.pm: Adjust Makefile dependencies to support parallel builds
The libapparmor_wrap.c target generates libapparmor_wrap.c and
LibAppArmor.pm. The Perl module must exist before `perl Makefile.PL`
under the Makefile.perl target, otherwise the generated Makefile.perl
ends up with an empty $(TO_INST_PM) variable and the pm_to_blib target's
dependencies are incomplete. That results in the Perl module not getting
copied to the blib directory and a build that is missing LibAppArmor.pm.

A build missing LibAppArmor.pm only occurred while building with
multiple threads.

Thanks to Seth Arnold for the suggestion on how to best fix the
dependencies.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 11:40:33 -08:00
Tyler Hicks
89bae9e64b parser: Add gen_dbus test target to the .PHONY list
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 08:54:08 -08:00
Tyler Hicks
218e727163 tests: Drop support for linking against libimmunix
Only attempt to link against libapparmor since libimmunix has been
deprecated for 5+ years.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 08:53:47 -08:00
Tyler Hicks
98d57db313 tests: Use ldconfig for library detection in Makefile
The multiarch filesystem layout for Ubuntu uses directories such as
/usr/lib/{i386-linux-gnu,x86_64-linux-gnu,arm-linux-gnueabihf} so
peeking into /usr/{lib,lib64} is no longer sufficient.

This patch uses ldconfig to print out the libraries that it knows about
and grep that output for libapparmor.so or libimmunix.so.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-11-04 08:53:17 -08:00
Steve Beattie
5593678542 parser tests - fix dependency for parallel builds
The parser sanity test make target does not directly depend on the make
targets that generate the tests consumed by the sanity test, leading to
runs that did not verify all the test cases when make check is invoked
with parallelism (e.g. make check -j4). This patch against trunk fixes
the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-10-31 12:04:12 -07:00
Christian Boltz
1303ad0d16 dnsmasq profile - update for libvirt files
dnsmasq needs read access to more files in /var/lib/libvirt/dnsmasq/
(at least *.conf and *.addnhosts)

Since this directory contains only files that are intended for dnsmasq 
(also confirmed by Jim Fehlig, the SUSE libvirt maintainer), the best 
way is to just allow "/var/lib/libvirt/dnsmasq/* r,"

References: https://bugzilla.novell.com/show_bug.cgi?id=848215


+1'd for trunk and 2.8 by Jamie Strandboge <jamie@canonical.com>
2013-10-30 21:41:28 +01:00
Tyler Hicks
1d1ccf7488 utils: Ignore unsupported log events
The log parsing in the Immunix::AppArmor perl module has fallen behind
when it comes to audit events from some of the newer rule types
supported by apparmor_parser.

When an unsupported event is found, it causes aa-logprof to error out.
This patch creates a list of valid, but unsupported, event operations
that should be ignored by the perl module when parsing logs.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-29 17:04:28 -07:00
Tyler Hicks
825f5864d3 parser: Check for kernel support prior to processing dbus entries
When a parser that is aware of dbus rules is running under a kernel
that is unaware of dbus rules, the parser should ignore the dbus rules
instead of attempting to load them into the kernel. Otherwise, the
kernel will reject the entire profile, leaving the application
unconfined.

Similar to what is done for mount rules, the features listed in
apparmorfs should be checked to see if dbus is supported under the
current kernel.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-29 17:03:23 -07:00
John Johansen
7237146ea5 Update kernel-patches directory with compatibility patches for v3.{7,8,9,10,11,12} 2013-10-29 11:59:11 -07:00
Tyler Hicks
7adcc25aa4 tests: Verify mediation of path-based UNIX domain sockets
The purpose is to provide test coverage for accessing UNIX domain socket
files. AppArmor write permissions are needed to create the socket files
and both read and write permissions are needed to connect to the socket.

This patch adds a test to the UNIX file descriptor passing tests and
creates an entirely new set of tests for sending and receiving messages
using path-based SOCK_STREAM, SOCK_DGRAM, and SOCK_SEQPACKET UNIX domain
sockets.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-29 10:35:51 -07:00
Christian Boltz
fa8fecd610 Fix some minor issues in parser/po/de.po
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-10-29 01:06:40 +01:00
John Johansen
38934d74ae allow directories to be passed to the parser
Allow directories to be passed directly to the parser and handled instead
of needing an initscript to find the files in the directory.

eg. load all profiles in profiles dir
  apparmor_parser -r /etc/apparmor.d/

eg. load all binary files in the cache dir
  apparmor_parser -Br /etc/apparmor.d/cache/

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-26 00:15:13 -07:00
Steve Beattie
859774482f parser testlib - use metaclass to mark all test functions keep_on_fail
This patch adds a python metaclass to wrap the test methods in the
subclasses of the template class AATestTemplate with the keep_on_fail
function, which sets the do_cleanup attribute to False when a testcase
failure occurs (i.e. an Exception is raised), and removes the manually
applied decorators to the caching tests that made use of this.

The downside to this approach is that the way metaclasses are declared
changed between python 2 and python 3 in an incompatible way. Since
python 3 is The Future™, I chose that approach and made the caching
and valgrind tests which use testlib be python3 (until this change,
they would have worked under either python 2 or python 3).

(An output message when a failure occurs is tweaked, to make the
output a little cleaner when verbose test output is requested and
failures occur.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-25 16:26:16 -07:00
Steve Beattie
037924384f parser testlib - write_file() argument adjustments
This patch modifies testlib.write_file() to take a directory and a file
name instead of a path and return the joined result for callers to use
if necessary.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-25 16:24:17 -07:00
Steve Beattie
744f434a32 parser valgrind tests - report command used on fail
This patch adds the command run to the reported message when a valgrind
failure is detected. This makes reproducing the failure outside of the
test suite easier, for easier diagnosis of what problem is occurring.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-25 16:12:36 -07:00
Steve Beattie
7841b26c18 parser valgrind tests - fix argparse conversion
When converting the valgrind tests from optparse to argparse, I managed
to not verify that the resulting code actually worked :( . This patch
fixes it by adding a positional argument to handle the optional passed
directory location.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-25 16:11:17 -07:00
Steve Beattie
ca01679379 parser caching tests - remove unused value
Remove report value where it's not used.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-25 15:45:55 -07:00
John Johansen
fb712c3987 more doc edits 2013-10-24 15:46:42 -07:00
Kshitij Gupta
eb61520753 Added left right arrow use to UI_YesNoCancel 2013-10-22 03:09:31 +05:30
Kshitij Gupta
aa0a24a0f1 Fixes the application level translations, the module level translation in __init__.py become reduntant though as app level covers them. Besides added the feature to allow use of arrow keys for UI_YesNo. Added README.md to store the list of known bugs. 2013-10-22 03:06:23 +05:30
Steve Beattie
a69f5655d8 parser - rewrite caching tests in python unittest [cond'd]
[previous commit forgot to bzr add caching.py; this commit fixes that]

This patch rewrites the caching test in python, using python's unittest
framework. It has been used with python 2.7 and python 3.3; python2.6
may have issues. It covers the tests in the existing caching.sh
test script (with the exception of the test that checks for when the
parser in $PATH is newer), as well as adding additional tests that
more extensively cover using a cache in an alternate location from
basedir. It also adds simple tests for the --create-cache-dir option
(along with that option's interaction with the alt-cache option).

(Some further work to be done is listed under TODO.)

Patch history:
  v1: - initial version
  v2: - create template base class
      - add keep_on_fail() decorator to keep temporary test files
        around after a test fails
      - don't dump raw cache file to failure output in
        test_cache_writing_updates_cache_file()
      - push run_cmd into template class
      - create run_cmd_check wrapper to run_cmd that adds an assertion
        check based on whether return code matches the expected rc
        (the valgrind tests only want to verify that the rc is not a
        specific set of values, hence the separate wrapper function)
      - similarly, add a check to run_cmd_check for verifying the output
        contains a specific string, also simplifying many of the caching
        tests.
      - create testlib.write_file() to simplify writing file

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-15 17:16:46 -07:00
Steve Beattie
b3bf36175d parser - rewrite caching tests in python unittest
This patch rewrites the caching test in python, using python's unittest
framework. It has been used with python 2.7 and python 3.3; python2.6
may have issues. It covers the tests in the existing caching.sh
test script (with the exception of the test that checks for when the
parser in $PATH is newer), as well as adding additional tests that
more extensively cover using a cache in an alternate location from
basedir. It also adds simple tests for the --create-cache-dir option
(along with that option's interaction with the alt-cache option).

(Some further work to be done is listed under TODO.)

Patch history:
  v1: - initial version
  v2: - create template base class
      - add keep_on_fail() decorator to keep temporary test files
        around after a test fails
      - don't dump raw cache file to failure output in
        test_cache_writing_updates_cache_file()
      - push run_cmd into template class
      - create run_cmd_check wrapper to run_cmd that adds an assertion
        check based on whether return code matches the expected rc
        (the valgrind tests only want to verify that the rc is not a
        specific set of values, hence the separate wrapper function)
      - similarly, add a check to run_cmd_check for verifying the output
        contains a specific string, also simplifying many of the caching
        tests.
      - create testlib.write_file() to simplify writing file

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-15 17:10:12 -07:00
Steve Beattie
5c2bea1b4f parser - add simple valgrind wrapper tests
This patch adds a test wrapper that runs valgrind on the parser over the
simple_tests tree (or other directory tree if passed on the command
line). An alternate parser location can also be passed on the command
line.

Like the libapparmor python bindings test, this test uses a bit of magic
to generate tests that doesn't work with auto-detecting test utilities
like nose.

Running valgrind on the parser over all 69000+ testcases takes several
hours, so while this patch includes a make target 'make valgrind', it
does not add it to the set of tests run when 'make check' is called.
Perhaps a 'make extra-tests' target is in order.

Patch history:
  v1: - initial version.
  v2: - add some valgrind suppressions for overaggressive 4 byte reads
        past the end of allocated storage (not completed).
  v3: - add ability to dump valgrind suppressions to stdout, to use
        diagnosis runs of valgrind for determining whether a given
        failure is a false positive or not.
      - correctly return 0 on a successful run and an error code if one
        or more test cases fail.
      - point LD_LIBRARY_PATH at the in-tree libapparmor build.
      - split out some utility functions into testlib.py, for possible
        use by other to be written test scripts
  v4: - convert optparse to argparse

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com> (for v2 version)
2013-10-15 17:06:26 -07:00
Steve Beattie
2aad74d8cc parser - link in libapparmor statically
This patch converts to statically linking libapparmor with
whichever static libapparmor it can find on its library search path
(and verified to choose the in-tree version over the system one if both
are available)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 17:02:59 -07:00
Steve Beattie
b216d488f9 parser - remove hackish way of getting a static libstdc++
This patch switches over from using our hackish way to get a
statically linked libstdc++ (which was based on the article at
http://www.trilithium.com/johan/2005/06/static-libstdc/) with the
-static-libstdc++ compiler option

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 16:50:42 -07:00
Steve Beattie
99a58c93d3 Managed to miss committing the README change from the last commit. 2013-10-15 16:48:32 -07:00
Steve Beattie
aa53ef66e2 parser - build against in-tree libapparmor
With trunk commit 2205 "use libapparmor's find mountpoint fn",
the parser now builds against and uses libapparmor at runtime. However,
it currently builds against the system installed libapparmor library and
header files, which fails if either aren't installed, and is thus
painful for bootstrapping in a new environment.

Instead, the parser, like pam_apparmor and mod_apparmor, should build
against the in-tree libapparmor header and library. This patch does
that and adjusts the tests to point LD_LIBRARY_PATH at the location
of the built library as well.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-15 16:46:18 -07:00
John Johansen
8aa976458c On Ubuntu saucy fontconfig reads user configs from
$HOME/.config/fontconfig/conf.d/* and
$HOME/.config/fontconfig/fonts.conf

/etc/fonts/conf.d/50-user.conf:
        <!--
            Load per-user customization files where stored on XDG Base Directory
            specification compliant places. it should be usually:
              $HOME/.config/fontconfig/conf.d
              $HOME/.config/fontconfig/fonts.conf
        -->
        <include ignore_missing="yes" prefix="xdg">fontconfig/conf.d</include>
        <include ignore_missing="yes" prefix="xdg">fontconfig/fonts.conf</include>

abstractions/fonts should allow read access to those files:

From: Felix Geyer debfx@ubuntu.com
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 17:38:48 -07:00
John Johansen
2542705390 Rev 2203 (rev 2097 on the 2.8 branch) created a regression such that
cache files will be written out even if the '--skip-bad-cache' option
is given and the cached features file differs from the features of
the currently running kernel. The patch below fixes the regression.

From: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-14 17:35:29 -07:00
Steve Beattie
c3e2e9cf26 parser - dbus code depends on yacc definitions
Fix Makefile to rebuild dbus object when yacc definitions change.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 14:38:53 -07:00
Steve Beattie
b2d8e25f41 parser - fix void* warnings
With the conversion to c++, the use of void* pointers for the parser
interface buffers generates several warnings. This patch converts the
types from void* to u8* for the buffer pointers, to clean up those
warnings.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 14:37:48 -07:00
Steve Beattie
9c50ff9fb3 parser - terminate search early if wildcards are discovered
This patch is a very minor optimization to the search to determine
whether a given rule is an exact match or not. If a wildcard rule
(i.e.  an inexact match) is discovered, exact_match is set to 0,
so we don't need to continue the tree traversal.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 14:36:05 -07:00
Steve Beattie
3d26d2431c parser - fix more memory leaks
This patch fixes a few more parser memory leaks as identified by the
simple valgrind test script. These mostly occur during cleanup of
structs and classes and as such, don't represent very serious leaks
for common usages of the parser.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-10-14 14:34:12 -07:00
Steve Beattie
a5bf039819 parser - add simple file deny rule tests
Our simple language tests did not include any file deny rule tests. This
patch adds a few simple ones.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-11 22:33:05 -07:00
Steve Beattie
5161dca58a parser - update README information
The README in the parser directory was woefully out of date; this patch
updates the information to contain the current mail list, wiki, and bug
tracking locations.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-10-11 22:14:28 -07:00
Steve Beattie
cd3a23e7bf cleanup usr.sbin.smbd profile
From: Kshitij Gupta <kgupta8592@gmail.com>

This patch removes:-
2 rules covered by abstractions in smbd profile:
- /var/log/samba/cores/smbd/ rw and /var/log/samba/cores/smbd/** rw
are in abstractions/samba covered by /var/log/samba/cores/** rw

1 superfluous rule:
- /var/lib/samba/printers/** rw is covered by /var/lib/samba/** rwk

Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-09 13:42:41 -07:00
Steve Beattie
0c4d2a0fc5 Add dconf abstraction for querying dconf settings
An abstraction to grant the ability to query dconf settings. It does
not grant the ability to update or add settings, due to our current
inability to restrict where within the dconf hierarchy updates
can occur.

From: intrigeri <intrigeri@boum.org>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-09 06:18:09 -07:00
Steve Beattie
a32c85c1c2 cleanup usr.sbin.nscd profile
From: Kshitij Gupta <kgupta8592@gmail.com>

This patch removes rules covered by abstractions in nscd profile:
- the network rules are in abstractions/nameservice
- @{PROC}/filesystems is in abstractions/base
- /{,var/}run/avahi-daemon/socket is in abstractions/nameservice
- /tmp/.winbindd/pipe and /var/lib/samba/winbindd_privileged/pipe are
  in abstractions/winbind via abstractions/nameservice

Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-09 05:39:58 -07:00
Christian Boltz
3093465dc7 remove some rules from the ntpd profile that are already
covered by abstractions:
- the network rules are in abstractions/nameservice
- /etc/gai.conf is also in abstractions/nameservice
- @{PROC}/sys/kernel/ngroups_max is in abstractions/base

Acked-by: Steve Beattie <steve@nxnw.org>
2013-10-03 15:35:56 +02:00
Steve Beattie
cf57476d6b parser - Fix const char warnings
This patch addresses a bunch of the compiler string conversion warnings
that were introduced with the C++-ification patch.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-10-01 10:59:04 -07:00
Kshitij Gupta
9bbf089634 some fixed bugs 2013-10-01 01:30:50 +05:30
John Johansen
f85bf5fa68 use libapparmor's find mountpoint fn to find the interface
Drop support for the old subdomainfs mountpoint and use the fn exported
by libapparmor.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-29 02:44:19 -07:00
John Johansen
d22b985e3f Add an option to create the cache directory if it is missing
Signed-off-by: John Johansen john.johansen@canonical.com
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-29 02:04:55 -07:00
John Johansen
3bbf269afb Moves the cache clearing logic into the create cache routine, because if
we are writing a new cache .features file the cache dir should be cleared
out.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-29 02:03:37 -07:00
John Johansen
9d375934dd The parser is not correctly clearing cache files if cache-loc is specified.
Fix this and unify creation and use of cacheloc so that we can hopefully
avoid these bugs.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-29 02:02:02 -07:00
John Johansen
f1a566ec6b The feature file is not being written to the proper location if the parameter
--cache-loc= is specified. This results in using the .features file from
/etc/apparmor.d/cache or always recompiling policy.

The former case is particularly bad as the .features file in
/etc/apparmor.d/cache/ may not correspond to the file in the specified
cache location.

bug: launchpad.net/bugs/1229393

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-29 01:52:39 -07:00
Kshitij Gupta
f3e549e772 fixed 22013 to 2013 in __init__.py license 2013-09-28 20:47:45 +05:30
Kshitij Gupta
4f8c524839 Added license headers 2013-09-28 20:43:06 +05:30
Tyler Hicks
5b908d7502 tests: Add aa_query_label() regression tests
This is a regression test to load a profile, query it from userspace
using aa_query_label(), and then verify the results.

The query interface is tested by the dbus mediation regression tests,
but this test helps in finding bugs specific to AppArmor, which may
possibly be caused by the parser, kernel, and/or libapparmor.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-09-27 17:33:09 -07:00
Tyler Hicks
c70710d4c7 parser: Clean up dbus accept state bitmasks
AppArmor dbus rules are split into two classes. The first is
(send receive) rules and the second in bind rules. When the parser was
creating its internal representation of dbus rules, it wasn't separating
the overlapping bitmasks for (send receive) perms and bind perms.

(send receive) perms are 0x06 and bind perms are 0x40. Here's the old
parser output for an audit dbus rule that has accept states for
(send receive) and for bind:

  $ dbus="/t { audit dbus, }"
  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {3} (0x 40/0/40/0)
  {7} (0x 46/0/46/0)

The {3} state is the accept state for the bind perms. The {7} state is
the accept state for the (send receive) perms. Note that the bind perm
mask bled over into the (send receive) accept state's mask.

With this patch, the masks for the two accept states do not overlap:

  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {3} (0x 40/0/40/0)
  {7} (0x 6/0/6/0)

Additionally, this patch makes the rule creation for (send receive)
perms more strict to keep any future perm bits from unintentionally
slipping into the (send receive) accept states.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-09-27 17:27:23 -07:00
Tyler Hicks
ef8a468f1f parser: Don't generate accept states for audit deny dbus and mount rules
Rules that have the audit and deny modifiers are to be explicitly denied
and audited. However, accept states were incorrectly being generated
with the deny and quiet masks set. This resulted in actions being denied
but not audited.

Here's the old parser output for audit deny dbus and mount rules:

  $ dbus="/t { audit deny dbus, }"
  $ mount="/t { audit deny mount, }"
  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {3} (0x 0/40/0/40)
  {7} (0x 0/46/0/46)
  $ $ echo $mount | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {5} (0x 0/2/0/2)

With this patch, no accept states are generated which means that actions
will be denied and audited:

  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  $ echo $mount | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-09-27 17:26:39 -07:00
Tyler Hicks
6d2b2ef2b9 parser: Generate accept states for denied dbus and mount rules
When using the deny rule modifier, accept states were not being
generated for dbus and mount rules. This means that the actions were
being denied, but it was not possible to quiet the auditing of the
actions.

The problem is that the deny and audit members of the dbus_entry and
mnt_entry structs were being used incorrectly. The deny member is a
boolean, not a bitmask. When the deny modifier is exclusively used in a
rule, the deny boolean should be true and the audit mask should be equal
to the perm mask.

Here's the old parser output for denied dbus and mount rules:

  $ dbus="/t { deny dbus, }"
  $ mount="/t { deny mount, }"
  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  $ echo $mount | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)

With this patch, the accept states are generated correctly with deny and
quiet masks:

  $ echo $dbus | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {3} (0x 0/40/0/40)
  {7} (0x 0/46/0/46)
  $ echo $mount | apparmor_parser -qQD dfa-states 2>&1 | sed '/^$/,$d'
  {1} <== (allow/deny/audit/quiet)
  {5} (0x 0/2/0/2)

https://launchpad.net/bugs/1226356

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-09-27 17:25:39 -07:00
John Johansen
a28e66c5fe Convert codomain to a class
Convert the codomain to a class, and the policy lists that store
codomains to stl containers instead of glibc twalk.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Merge with dbus changes and process_file_entries() cleanup]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:16:37 -07:00
John Johansen
dc76404590 remove support for change_hat 1.4
change_hat 1.4 was an experiement is more directly controlling change_hat
by adding hat rulles to the profile. It has not been used since the
original experiment (4 years).  So remove it

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:15:00 -07:00
John Johansen
59dc00bc30 Remove dead code around pattern matching in rules
remove old dead code that used to fail compilation if regular expressions
where detected in the rules and the apparmor kernel module did not support
regular expression matching.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:14:25 -07:00
John Johansen
a34059b1e5 Convert the parser to C++
This conversion is nothing more than what is required to get it to
compile. Further improvements will come as the code is refactored.

Unfortunately due to C++ not supporting designated initializers, the auto
generation of af names needed to be reworked, and "netlink" and "unix"
domain socket keywords leaked in. Since these where going to be added in
separate patches I have not bothered to do the extra work to replace them
with a temporary place holder.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: merged with dbus changes and memory leak fixes]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:13:22 -07:00
John Johansen
b0a1488820 Remove testing for AARE as it is the only matching engine
Remove use of AARE_DFA as the alternate pcre matching engine was removed
years ago.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-27 16:11:00 -07:00
Kshitij Gupta
173d8fca00 Fixes the TypeError associated with Python3 in calling netstat in aa-unconfined 2013-09-26 18:41:41 +05:30
Kshitij Gupta
7cccd1fae5 fixed test for cleanprof 2013-09-24 00:34:09 +05:30
Kshitij Gupta
be63388638 remove the allow prefix from rules 2013-09-24 00:21:47 +05:30
Kshitij Gupta
72e0aac551 Final push for GSoC 2013 (hopefully) 2013-09-24 00:02:26 +05:30
Kshitij Gupta
63efd5d96a added handler for conflicting *x access 2013-09-23 23:56:28 +05:30
Kshitij Gupta
a8a19da607 Fixes netrule deletion for includes 2013-09-23 23:05:25 +05:30
Kshitij Gupta
24f3b67b56 2013-09-23 21:00:36 +05:30
Kshitij Gupta
6f46a777ca updated messages.pot 2013-09-23 20:09:09 +05:30
Kshitij Gupta
37529a4cd1 Added first version of aa-mergeprof, does not include the check for conflicting ix rules yet 2013-09-23 19:32:25 +05:30
Kshitij Gupta
381ff97efa fix for the delete count 2013-09-23 03:47:15 +05:30
Kshitij Gupta
0b0aeeda29 Fixed the netrule persistence issue in cleanprof, some elementary work for mergeprof 2013-09-23 02:14:11 +05:30
Kshitij Gupta
93d59eb6eb Fixes from rev70..72 2013-09-22 23:49:19 +05:30
Kshitij Gupta
4debd1ea79 Only ran sed -i s/ *// in ./apparmor/*.py , ./Tools/aa* and ./Testing/*.py no other changes, should ignore this commit unless it broke something 2013-09-22 22:51:30 +05:30
Kshitij Gupta
86e7c22196 Added help messages to translate strings and a few other minor fixes 2013-09-22 15:25:20 +05:30
Kshitij Gupta
2c19d7f3da added a little tiny abstraction redundancy in profile in test case 2013-09-22 15:08:30 +05:30
Kshitij Gupta
61ed67f27b So that closes the first proper version of aa-cleanprof with testcases added, fixed profile writer to work on multiple profiles at once, please use the view clean changes option in logprof and genprof, the comment preserver version needs tweaking that version wont be written anyways. Plus a few other changes 2013-09-22 15:01:34 +05:30
Kshitij Gupta
e44863e908 Fixes from rev58, working on the general concerns will push it soon 2013-09-21 18:50:00 +05:30
Kshitij Gupta
72f9a80c76 Fixed flag reader and writer to be able to set unset flag for a specific target program also fixed tests for mini tools to be independent of existence of ntpd 2013-09-21 12:36:51 +05:30
Kshitij Gupta
1d3c2be0be fixes from rev65 2013-09-21 01:08:34 +05:30
Kshitij Gupta
877f8253c3 fixed the explicit LANG in aa-unconfined to LANG=C 2013-09-20 21:21:35 +05:30
Kshitij Gupta
0b73862cfe rev 63-64, fixes man pages, messages 2013-09-20 19:20:41 +05:30
Steve Beattie
17f0565afc add optional allow prefix to the language
From: John Johansen <john.johansen@canonical.com>

let allow be used as a prefix in place of deny.  Allow is the default
and is implicit so it is not needed but some user keep tripping over
it, and it makes the language more symmetric

   eg.
      /foo rw,
      allow /foo rw,
      deny /foo rw,

Patch history:
  v1: - initial revision

  v2: - rename yacc target rule from opt_deny to opt_perm_mode to
reflect
        that it can be either an allow or deny modifier
      - break apart tests into more digestible chunks and to clarify
        their purpose
      - fix some tests to exercise 'audit allow'
      - add negative tests for 'allow' and 'deny' in the same rule
      - add support for 'allow' keyword to apparmor.vim
      - fix a bug in apparmor.vim to let it recognize multiple
        capability entries in a single line.

  v3: - add support for optional keywords on capability rules in
        regression tests, as well as the bare capability keyword (via
        'cap:ALL')
      - add allow, deny, and conflicting capability behavioral
        regression tests
      - fix vim syntax modeline to refer to apparmor in parser tests
      - adjust FILE regex in vim syntax file creator script

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-20 06:48:56 -07:00
Christian Boltz
ec7381483a aa-unconfined displays less unconfined processes in some languages (for
example with LANG=pt_BR) because a regex relies on netstat output.

Enforce LANG=C to make sure aa-unconfined always sees the expected output.

Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-20 13:21:50 +02:00
Christian Boltz
198f660ee8 fix broken URLs in various utils/*.pod files.
(The broken URLs were introduced in r1582.)

for utils/*.pod:
  Acked-by: Steve Beattie <steve@nxnw.org> 

for the other directories:
  Patch by Steve Beattie
  Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-09-19 21:17:39 +02:00
Kshitij Gupta
b512123303 Finally added the translations pot file for the current codebase 2013-09-19 21:20:40 +05:30
Kshitij Gupta
3d0307a5a9 Added manpages for the tools, fixes from rev 59..62, some fixes from rev 58 2013-09-19 10:32:19 +05:30
Kshitij Gupta
e41a8aec0e 2013-09-17 22:37:13 +05:30
Kshitij Gupta
3f9526c1ac seperated the code to check for duplicates into a separate module, will be using it to remove duplicates/superfluous rules/includes from base and other profiles in the aa-mergeprof 2013-09-17 22:30:48 +05:30
Kshitij Gupta
a8a1878281 added check for matching profile paths 2013-09-17 14:03:58 +05:30
Kshitij Gupta
9482ccdb74 2013-09-17 11:46:17 +05:30
Christian Boltz
1eddb70396 ntpd needs read access to openssl.cnf
Patch-Author: Stefan Seyfried <seife+obs@b1-systems.com>

After this change in ntp:

* Mo Aug 19 2013 crrodriguez@opensuse.org
- Build with -DOPENSSL_LOAD_CONF , ntp must respect and use
  the system's openssl configuration.

we need to read openssl.cnf or starting of ntpd will fail silently(!)


Patch v2 by Christian Boltz: use abstractions/openssl instead of
allowing /etc/ssl/openssl.cnf directly

Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-17 00:23:32 +02:00
Steve Beattie
49c51368eb libapparmor python binding - fix 32bit test failures
The python bindings were using the wrong data type cast (long long
instead of just long) on the value '-1' that is used to indicate no
value for the 'fsuid' and 'ouid' fields in the returned data structure.
Thus a bunch of the tests were failing in 32bit environments.

This patch corrects the issue.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-16 10:26:06 -07:00
Christian Boltz
3d989e822d fix some (mis)translations in utils/po/de.po
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-14 00:36:31 +02:00
Steve Beattie
398ed04958 parser - finish prefix refactoring for dbus rules
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-12 15:06:41 -07:00
John Johansen
74d72d6028 refactor parser prefix parsing to remove execess code
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-12 13:26:13 -07:00
John Johansen
f6c192f584 clean up the lexer
- Make indenting consistent
- Move common match + fn patterns into a single shared entry with mulitstate
  headers
- add names table to convert lexer state #s to state names used in the code
- Create/use macros for common patterns of DUMP, DEBUG, return ...
  this fixes a few places where preprocess or DEBUG output was not
  available
- update RE patterns for bugs eg. {WS} inside a character class [] does
  not match whitespace

all told despite adding code to provide better support to debug and
preprocessing, the code is about 150 lines shorter, and has few corner
cases cleaned up.

Signed-off-by: John Johansen <john.johansen@canonical.com>
[tyhicks: Added small fix for D-Bus parsing bug]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-12 12:37:04 -07:00
Jamie Strandboge
53d6e4bff3 p11-kit needs access to /usr/share/p11-kit/modules
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org> (for trunk and 2.8)
2013-09-12 09:24:28 -05:00
Kshitij Gupta
2763f0c064 Updated __init_.py tested with de_DE and hi_IN translations using old apparmor-utils.mo file, not pushing remainder of files for their lack of beauty 2013-09-12 14:42:15 +05:30
Steve Beattie
6c64b35f4d profiles - Allow reading /etc/machine-id in the dbus-session abstraction.
From: intrigeri <intrigeri@boum.org>

D-Bus now uses /etc/machine-id in some cases:
https://bugs.freedesktop.org/show_bug.cgi?id=35228

Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 16:03:32 -07:00
Tyler Hicks
3ce3adf3fe parser: Clean up file entry processing
Removes an unnecessary variable, simplifies and unifies some of the loop
logic, and removes commented out code.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 11:59:00 -07:00
Tyler Hicks
98ee5a5741 parser: Never leave entries list in a bad state
When merging file entries in process_file_entries(), an error condition
can leave the entries list in a bad state which can cause invalid reads
and/or double frees when freeing the codomain and entries list memory.

The problem comes from the need to sort the entries linked list. An
array of pointers is created to represent the linked list, then the
array is sorted, then the linked list and the array coexist while the
entries are merged, then the linked list is reconstructed and the array
is freed. While the entries are being merged, an error condition can
occur and the function can return while the linked list is partially
modified.

The solution is to complete the sorting, reconstruct the linked list,
and free the array immediately. Once the linked list is in a good state,
the entries can be merged. Care is taken to adjust the linked list
pointers as entries are merged. An error condition can occur but the
linked list is always in a good state and proper cleanup can be
performed without any memory access issues.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 11:58:24 -07:00
Tyler Hicks
eb0d2d9851 parser: Use free_cod_entries() when merging file entries
Reuse free_cod_entries() when freeing merged file entries in
process_file_entries().

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 11:57:38 -07:00
Tyler Hicks
46ae49a305 parser: Detect core dumps during parser tests
If a parser test case causes the parser to produce a core dump, the
simple.pl test runner incorrectly treats the test as a success.

This patch treats tests that cause core dumps as failures, even when the
tests are marked as #=TODO. The only way to ignore tests that fail in
this manner is with #=DISABLED.

Note that this patch changes the meaning of the $result variable.
Previously, it held a true or false status returned when closing the
apparmor_parser pipe. Now, it holds the exit status of apparmor_parser.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2013-09-11 11:56:47 -07:00
Steve Beattie
93198cc7dd Subject: parser - fix memory leaks identified by valgrind tests
This patch fixes a few memory leaks found by valgrind. Most of these
occur in error cases and as such, are not a big deal. The dbus TOK_MODE
and flags TOK_CONDID leaks in parser_yacc.y are legitimate leaks,
if of very small amounts of memory.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-11 02:10:31 -07:00
Steve Beattie
a1bf63dbe9 Subject: libapparmor - add python bindings tests based on C tests
This patch adds tests for the swig generated python library bindings
that reuse the C language tests.

Fitting it into autotools was a bit of a trick, and is likely pretty
brittle, as before the test script runs, it needs to know the location
of the built libapparmor.so library, the built _LibAppArmor.so library
and the python wrapper bits (thankfully, the latter two are the same
directory). It's also unclear how to get autotools to emit the output of
the test_python.py script when building, rather than just summarizing it
as one test run.

Also note that test_python.py is doing a bit of magic to automatically
generate test case methods based on the contents of the test_multi/
directory. This has the disadvantage of breaking tools like nosetests
and other external tools that try to automatically detect testcases.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:18:08 -07:00
Steve Beattie
fce987ffc8 Subject: libapparmor - swig setup.py.in minor cleanup
This patch gives a more pythonish whitespace cleanup to the swig python
setup.py.in configuration file. It also updates the wiki url.

(That said, pep8 will still probably barf all over it.)

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:15:43 -07:00
Steve Beattie
6047bca2c3 Subject: libapparmor - don't emit path in testcase output
This patch converts the C test program to only emit the basename(3) of
the test input file under consideration, rather than the entire path as
passed on the command line, and fixes up all the expected outputs to
match.

The reason to do this is to make it easier for other tools located
in other directories (e.g. under libapparmor/swig) to use these same
test cases with reduced special casing.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:13:56 -07:00
Steve Beattie
2c7ba24977 Subject: libapparmor - in C test, restructure event case.
This patch wraps the event record output cases in a macro, for
consistent generation.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:09:56 -07:00
Steve Beattie
a76b0d8d74 Subject: libapparmor - convert other fields to use macros in C test program
This patch converts most of the fields to using the existing macros for
output, to make consistent and simplify the code a bit.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:08:25 -07:00
Steve Beattie
a41e4696a0 Subject: libapparmor - c tests, only print epoch and audit subid if identified
The test program didn't make use of the existing print_long() macro for
printing long values, which meant that they were always emitted for
every testcase. This patch makes them consistent with all the other
emitted fields and fixes up the expected output where they shouldn't be
emitted.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 14:04:22 -07:00
Steve Beattie
994d1ddbba Subject: libapparmor - rename configure.in to configure.ac
The oldstyle name configure.in has been deprecated by autotools. This
patch renames configure.in to the new standard name configure.ac.
The AC_INIT() entry was adjusted as well to point to configure.ac
instead of configure.in.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:49:00 -07:00
Steve Beattie
c0ef28186e Subject: libapparmor - enhance readability of binding checking message
This patch makes the binding check messages a little more understandable
and coherent. The original messages looked like (for a perl binding only
build):

  checking Checking for Python... no
  checking Checking for perl... yes
  checking for perl... /usr/bin/perl

Note the duplicated 'checking Checking' and '[cC]hecking for perl'
statements. With the patch applied, the output looks like thus:

  checking whether python bindings are enabled... no
  checking whether perl bindings are enabled... yes
  checking for perl... /usr/bin/perl

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:45:15 -07:00
Steve Beattie
54b6b527c7 Subject: libapparmor - fail configure if interpreter for lang bindings not found
This patch causes libapparmor's configure script to exit with an error
if a language binding is asked for and the relevant interpreter is not
found. The previous behavior was to *silently* disable the binding.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:43:52 -07:00
Steve Beattie
e5ce6f92ac Subject: libapparmor - fail configure if swig not found
This patch causes libapparmor's configure script to exit with an error
if any of the language bindings are requested but swig has not been
found earlier in the configure script. Without this script, configure
would bury the inability to find swig in its output, without informing
the user that building any of the language bindings would fail.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:42:46 -07:00
Steve Beattie
d68f67bf5c Subject: parser - fix dbus peer_conds memory leak in new_dbus_entry()
The function new_dbus_entry() free()s the conds argument but not the
peer_conds argument.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:41:03 -07:00
Steve Beattie
dd5145131e Subject: parser - use DUP_STRING more widely and detect strdup errors
This patch moves the DUP_STRING macro to parser.h and modifies
it to accept a goto error target, that will be jumped to if the
call to strdup(3) fails. It also uses it in additional locations
where copying structures occurs, as well as detecting additional
cases where a structure duplication might have failed but not been
propagated outward.

Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-09-06 13:39:41 -07:00
Tyler Hicks
ebabb30abd libapparmor: Clarify that mode strings are not to be freed
The aa_getcon man page only implies that the *mode strings returned by
aa_getprocattr(), aa_gettaskcon(), aa_getcon(), and aa_getpeercon()
should not be freed. A developer using the man page to build against
libapparmor may miss that subtlety and end up hitting double free issues.

This patch makes the man page more clear, makes the function comments
more clear, and changes the aa_getprocattr() *buf param to *con. The use
of *buf should reserved for the aa_get*_raw() functions that do not
allocate a buffer for the confinement context and all documents now
clearly mention that *con must be freed.

Additionally, this patch removes the line wrapping of the
aa_getprocattr_raw() prototype in the aa_getcon man page source. The
line wrapping caused incorrect formatting of the function prototype when
viewing the man page.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-04 15:48:43 -07:00
Tyler Hicks
54382a9bf5 libappamor: Fix mode string NUL-termination of aa_getcon() functions
r2125 caused a regression in aa_getpeercon_raw() when a NULL pointer was
passed into the mode parameter. Instead of unconditionally
NUL-terminating the con string before the mode portion of the security
context, it made it to where the NUL byte was only put into place when
mode was non-NULL.

This resulted in the con string incorrectly containing the label and the
mode.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-09-04 14:50:55 -07:00
Kshitij Gupta
2ce5fd6267 Renamed tools to get rid of the .py extension and fixed the same in minitools_test 2013-08-31 17:48:40 +05:30
Kshitij Gupta
bdc2677f7b 2013-08-31 04:13:05 +05:30
Kshitij Gupta
c7a74802ab Tests for minitools aa-disable, aa-audit, aa-complain, aa-enforce added and some minor bugs fixed. Ran all existing test suites on python2 and python3 and tweaked a few things 2013-08-31 04:08:26 +05:30
Kshitij Gupta
27efe62a92 Fixes from review 52-53, merging cleanprof into apparmor/tools.py corrected enforce() and complain() to create/remove symlinks to force-complain/disable subdirs. Wrote some tests for globbing methods, segregated glob-path and glob-path-with-extension into methods in aa.py 2013-08-30 03:54:31 +05:30
Steve Beattie
05029cb9b7 parser - add support for variable expansion in dbus rules
Bug: https://bugs.launchpad.net/bugs/1218099

This patch adds support for expanding variables with dbus rules.
Specifically, they can expanded within the bus, name, path, member,
interface, and peer label fields.

Parser test cases and regression test cases are added as well.

Patch history:
  v1: initial version of patch
  v2: add equality.sh tests to verify that the results of using
      variable expansion is the same as what should be equivalent rules

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-29 12:34:13 -07:00
Tyler Hicks
2420c573d0 libapparmor: Fix fd leak when write to aafs/.access fails
In aa_query_label(), errors encountered during a write() to the AppArmor
filesystem's .access file results in an unintentional file descriptor
leak outside of aa_query_label(). Callers don't expect aa_query_label()
to return with a newly opened file descriptor so they can't be expected
to close the fd.

This flaw was introduced in r2147, which has not yet been included in an
official release.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-08-26 16:54:26 -07:00
Tyler Hicks
a5213b572c utils: Ignore unsupported rules
The profile parsing in the Immunix::AppArmor perl module has fallen
behind when it comes to some of the newer rule types and syntax
supported by apparmor_parser.

When an unsupported rule is found, it causes aa-logprof and aa-genprof
to error out. This patch creates a list of valid, but unsupported rule
types that should be ignored by the perl module when parsing policy.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-08-26 16:53:01 -07:00
Kshitij Gupta
781ff9c3d9 aa-cleanprof tool 2013-08-26 00:41:15 +05:30
Kshitij Gupta
41b9aa112d Merged aa-audit, aa-autodep, aa-complain, aa-disable, aa-enforce to share the common code into a tools.py module. Added -r/--remove feature to aa-complain, aa-enforce, aa-audit and -r/--revert feature to aa-disable. Some other fixes from review 48..51 2013-08-26 00:23:59 +05:30
Christian Boltz
9af7906180 use grep instead of ~~ (smartmatch)
Patch by Kshitij Gupta <kgupta8592@gmail.com>

A previous bugreport [1] was fixed using the smartmatch operator,
which raised the minimum Perl version requirement to >=5.10.1 .
However in Perl5.18 the smartmatch operator has again become
"experimental" [2] so the following patch replace smartmatch operator
with grep and thereby avoiding the requirement hike and avoiding
warnings.

[1] https://bugs.launchpad.net/apparmor/+bug/1180230

[2] http://blogs.perl.org/users/mike_b/2013/06/a-little-nicer-way-to-use-smartmatch-on-perl-518.html

ACKed-by: Christian Boltz <apparmor@cboltz.de>
2013-08-23 22:02:15 +02:00
Kshitij Gupta
5490dddbda First set of tools in their alpha release, logprof and genprof are pre-bleeding edge so dont hurt yourself or worse your distro. 2013-08-21 11:26:09 +05:30
Tyler Hicks
8801abf380 profiles: dnsmasq needs dbus abstraction
When dnsmasq is started with the --enable-dbus option, it uses the
system bus.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-08-20 15:52:22 -07:00
Tyler Hicks
f2dfd613f8 tests: Add regression tests for dbus
Integrate dbus tests into the regression testing framework.

This started out as dbus-send.c, from the dbus source, and then grew
from there.

dbus_message is an example "client" program that only sends out
messages. dbus_service binds to a well-known name and then listens and
responds to incoming messages. They share some code in dbus_common.c.

The test scripts, dbus_message.sh and dbus_service.sh, share some
functionality in dbus.inc.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-20 12:14:03 -07:00
Kshitij Gupta
1fb521418d Semmingly working writer from old profile 2013-08-19 12:37:47 +05:30
Kshitij Gupta
ed28caeba6 first partially working iteration of new profile writer from old profile 2013-08-18 14:13:46 +05:30
Kshitij Gupta
457604014f working commit prior to writer code alterations 2013-08-17 12:34:42 +05:30
Steve Beattie
d1791ff286 Description: clean out test dir python cache directory
Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-12 17:55:45 -07:00
Kshitij Gupta
6ce67f3cbe debugging level 0 fix 2013-08-13 00:48:37 +05:30
Kshitij Gupta
2a1e419bf8 some fixes from review 41..45 and fixes for python3 compatibility 2013-08-13 00:43:20 +05:30
Kshitij Gupta
396b504b5f minor fix 2013-08-11 23:22:08 +05:30
Kshitij Gupta
f12667c011 Working tool (seemingly to me), except the writing profile order needs to be fixed 2013-08-11 23:16:35 +05:30
Kshitij Gupta
5886faf63b Working tool (seemingly to me), except the writing profile order needs to be fixed 2013-08-11 23:16:05 +05:30
Kshitij Gupta
4f4a8f6163 backup commit for modes 2013-08-11 18:30:01 +05:30
Kshitij Gupta
05e695c7d3 A commit before changing modes style 2013-08-11 15:22:07 +05:30
Kshitij Gupta
3212422921 fixes from rev 32..39 and fixed(?) flags=(..)thing 2013-08-10 12:46:22 +05:30
Tyler Hicks
cbedbdde81 libapparmor: ENOENT should only signify label not found in label queries
It may be useful to applications that do AppArmor queries to know if the
subject label in the query is unknown to the kernel. For example, the
corresponding profile may have been removed/renamed.

This patch eliminates all potential return locations of aa_query_label()
that may have errno set to ENOENT, except for the write() to
apparmorfs/.access that sets ENOENT when the subject label isn't found
by the kernel.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-09 18:55:16 -07:00
Kshitij Gupta
eacdddaf12 working logger 2013-08-10 01:17:00 +05:30
Tyler Hicks
fe3ccea370 libaalogparse: Regression tests for dbus-daemon audit messages
Test a set of send, bind, and receive denials routed through syslog,
as well as a set routed through auditd.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-08-09 11:08:57 -07:00
Tyler Hicks
5aa58bef7c libaalogparse: Parse dbus-daemon audit messages
This requires libaalogparse to become aware of USER_AVC messages.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-09 11:02:41 -07:00
Kshitij Gupta
a9c594d5bc fixed test encoded data for log entries 2013-08-09 16:49:01 +05:30
Tyler Hicks
5bddcaa84d tests: Verify delegation of fd inheritance
Add a new set of tests that tests delegation of file descriptors when
inherited across combinations of confined and unconfined processes.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-08 22:47:25 -07:00
Tyler Hicks
de69b2242c tests: Verify delegation of fd passing
This patch broadens the testing of file descriptor passing over Unix
domain sockets, but the real focus is on passing a file descriptor from
an unconfined server to a confined client. The confined client should
have full access to the file descriptor, despite not having a
corresponding file rule in its profile, due to delegation.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-08-08 22:45:49 -07:00
Kshitij Gupta
2d9f37be87 fixed debugglogger 2013-08-09 11:04:32 +05:30
Kshitij Gupta
da49e6a3ee fixed allow 2013-08-08 21:40:56 +05:30
Kshitij Gupta
d48c88428e certain fixes 2013-08-07 14:43:17 +05:30
Kshitij Gupta
bb4c83d404 Some code for logprof 2013-08-06 01:53:28 +05:30
Kshitij Gupta
68afe0f0e9 Added some tests for common module and fixed a few minor bugs in regex parser 2013-08-05 18:55:34 +05:30
John Johansen
d680eb7b6d This quick little patch adds the ability to specify the features
required for a test to run. This will help keep the regression suite
from reporting a lot of failures when it hits a kernel that doesn't
support the feature being tested.

its current iteration is pretty brain dead, only testing for the
existance of feature files/dirs (and not contents) but I think it is
probably sufficient for now.

To use it, just call the required_features fn right after sourcing
prologue.inc in the bash test script that is called by the make file.

If any of the requested features don't exist the bash script will exit
reporting the first feature that was missing

Eg.

. $bin/prologue.inc
required_features dbus
required_features dbus dbus/mask network domain/change_hatv

Acked-by: Tyler Hicks <tyhicks@canonical.com>
2013-08-02 16:22:12 -07:00
Tyler Hicks
2fbea1ceea tests: Add an optional final check to checktestfg and checktestbg
Allows for the test script to specify a final check to be performed
after checking the output of the test binary. This may be useful, for
example, if the test script wants to compare logging output of the test
binary to known-good logging output.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-08-02 16:19:54 -07:00
Kshitij Gupta
e78dd6e9bc updated regex parser 2013-08-01 21:57:27 +05:30
Tyler Hicks
553d0d9eaf libapparmor: Export a label-based query interface
Add an interface for trusted applications to use when they need to query
AppArmor kernel policy to determine if an action should be allowed.

This is a simplified interface that tries to make it as easy as possible
for applications to use. They provide a permissions mask and query
string and they get a pair of booleans back that let them know if the
action should be allowed and/or audited.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:22:40 -07:00
Tyler Hicks
7c817bde70 parser: Binary profile equality tests for DBus rules
This test is to verify that a list of profiles compile down into the
same binary representation. This is useful, for example, when testing a
rule syntax that includes permission aliases, as well as implied and
explicit accesses.
    
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:22:11 -07:00
Tyler Hicks
670a1815ed parser: Regression tests for DBus rules
This is a test in the style of gen-xtrans.pl that attempts to run
through the most commonly constructed DBus rules. It also attempts to
run through some common mistakes to ensure that the parser fails
appropriately.
    
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:20:56 -07:00
Tyler Hicks
ab84444d3a parser: Add support for DBus rules
This patch implements the parsing of DBus rules.

It attempts to catch all corner cases, such as specifying a bind
permission with an interface conditional or specifying a subject name
conditional and a peer name conditional in the same rule.

It introduces the concept of conditional lists to the lexer and parser
in order to handle 'peer=(label=/usr/bin/foo name=com.foo.bar)', since
the existing list support in the lexer only supports a list of values.

The DBus rules are encoded as follows:

bus,name<bind_perm>,peer_label,path,interface,member<rw_perms>

Bind rules stop matching at name<bind_perm>. Note that name is used for
the subject name in bind rules and the peer name in rw rules. The
function new_dbus_entry() is what does the proper sanitization to make
sure that if a name conditional is specified, that it is the subject
name in the case of a bind rule or that it is the peer name in the case
of a rw rule.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:05:51 -07:00
Tyler Hicks
1aba3394a3 parser: Update man page for DBus rules
Document the DBus rule syntax and provide several examples.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-31 09:03:15 -07:00
Kshitij Gupta
8f378e3ce2 Intermediate codebase update and the test cases are still broken 2013-07-31 19:56:33 +05:30
Kshitij Gupta
928e4503c6 Intermediate: codebase update with broken tests 2013-07-30 20:13:08 +05:30
Kshitij Gupta
1af5f1f03f python regex fix 2013-07-28 08:29:59 +05:30
Kshitij Gupta
375fc3b5bb edits from review 26,27 and codebase update 2013-07-28 08:23:46 +05:30
Kshitij Gupta
bcceaa9c28 minor fix to regex from rev 26 2013-07-27 15:32:12 +05:30
Kshitij Gupta
5abbc86d37 Revision 24 edits and code update 2013-07-27 15:28:12 +05:30
Steve Beattie
8e47307fed Subject: [patch] fix apparmor cache tempfile location to use passed arg v2
This patch fixes problems in the handling of both the final cache
name location and the temporary cache file when an alternate location
is specified.

The first issue is that if the alternate cache directory location was
specified, the alternate directory name would be used as the final location for
the cache file, rather than the alternate directory + the basename of
the profile.

The second issue is that it would generate the temporary file that it
stores the cache file in [basedir]/cache even if an alternate cache
location was specified on the command line. This causes a problem
if [basedir]/cache is on a separate device than the alternate cache
location, because the rename() of the tempfile into the final location
would fail (which the parser would not check the return code of).

This patch fixes the above by incorporating the basename into the cache
file name if the alternate cache location has been specified, bases the
temporary cache file name on the destination cache name (such that they
end up in the same directory), and finally detects if the rename fails
and unlinks the temporary file if that happens (rather than leave it
around). It also has been updated to add a couple of testcases to verify
that writing and reading from an alternate cache location work.

Patch history:
  v1: first draft of patch
  v2: add testcases, convert PERROR() to pwarn() if rename() fails for
      placing cachefile into place.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-07-26 10:55:52 -07:00
Kshitij Gupta
60def06040 Code-base update 2013-07-24 22:12:34 +05:30
Kshitij Gupta
d97f0c6b7d Code-base update 2013-07-23 04:35:51 +05:30
Kshitij Gupta
e727c62e76 Fixes from review 19-22 and updated codebase 2013-07-20 04:19:07 +05:30
Kshitij Gupta
211b404195 Fixed configparser and added unit test for the same tried on python2 and python3 2013-07-19 00:44:55 +05:30
Kshitij Gupta
af034537fc A new version of the variable loader for severity 2013-07-18 19:17:43 +05:30
Kshitij Gupta
da9cd60ec4 2013-07-18 05:29:54 +05:30
Kshitij Gupta
f5b43cc7b4 2013-07-18 03:21:44 +05:30
Kshitij Gupta
f4b89ce45b ugly solution to py2 configparser by stripping 2 spaces off everyline into a tempfile 2013-07-18 03:11:05 +05:30
Kshitij Gupta
a33c95f8b1 Some fixes from review16 and updated codebase 2013-07-17 20:38:13 +05:30
Seth Arnold
2ba755318f Fix $options -> @options in previous patch. Fix tabs -> spaces.
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-07-09 16:02:08 -07:00
Seth Arnold
f745f7df33 From: intrigeri <intrigeri@boum.org>
At least on Debian sid, software such as Vidalia and Iceweasel go look for
fonts in there.

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-08 17:43:49 -07:00
Seth Arnold
ddcf88b827 From: intrigeri <intrigeri@boum.org>
Debian sid's fonts-mathjax ships fonts in
/usr/share/javascript/mathjax/fonts, that are now used by default by
fontconfig-enabled software.

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-08 17:43:08 -07:00
Seth Arnold
bf0674c40b From: intrigeri <intrigeri@boum.org>
At least on Debian, with recent versions of fontconfig-config
(>= 2.10), files in /etc/fonts/conf.d/ are symlinks pointing to
/usr/share/fontconfig/.

This was reported by Jakub Wilk <jwilk@debian.org> on Debian bug #714843.

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-07-08 17:42:09 -07:00
Kshitij Gupta
ccee5cd5e0 Codebase update 2 2013-07-09 03:46:26 +05:30
Seth Arnold
38b8d4527c Describe some known minimum versions of tools needed for which parts
Acked-By: Christian Boltz <apparmor@cboltz.de>
2013-07-07 18:30:18 -07:00
Kshitij Gupta
58f48db381 updated codebase 2013-07-06 18:57:06 +05:30
Seth Arnold
03908feacc Kshitij Gupta found and fixed a problem with Glob and Glob w/ Ext behavior
in aa-logprof and aa-genprof that would add duplicate entries to the
interactive list of permissions.

https://bugs.launchpad.net/bugs/1180230
2013-07-05 14:12:08 -07:00
Kshitij Gupta
48fdbda9cd some minor bugs fixed after package name change 2013-07-04 05:04:04 +05:30
Kshitij Gupta
b3767766ef Python2 compatible code except for configparser, code from week2 2013-07-04 04:12:04 +05:30
Seth Arnold
7b50892339 Fix potential NULL-write in aa_getprocattr() error path
Gernot Vormayr provided this fix in
https://bugs.launchpad.net/apparmor/+bug/1196880
2013-07-02 11:47:43 -07:00
John Johansen
5b8abaee50 refactor/simplify the regex for ruby abstractions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-07-01 11:06:52 -07:00
Christian Boltz
6753f46bf5 add Dolphin (default Kubuntu file manager) to the list of file managers in
abstractions/ubuntu-browsers.d/ubuntu-integration.

Patch by Felix Geyer <debfx@ubuntu.com>

Acked-by: Seth Arnold <seth.arnold at canonical.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-07-01 17:48:58 +02:00
Christian Boltz
e03a9ba22f merge https://code.launchpad.net/~kensington/apparmor/apparmor/+merge/169010
Michael Palimaka 2013-06-13 Add missing key shortcuts for hu linguas.
2013-07-01 17:44:53 +02:00
Christian Boltz
54a5c2a5c4 merge https://code.launchpad.net/~kensington/apparmor/vim-man/+merge/172201
Michael Palimaka 2013-06-30 Move apparmor.vim.5 from parser to utils (apparmor.vim already lives there).
2013-07-01 17:35:18 +02:00
Michael Palimaka
1974c22e54 Move apparmor.vim.5 from parser to utils (apparmor.vim already lives there). 2013-06-30 00:25:44 +10:00
Jamie Strandboge
9b7a7d797e remove unneeded perl requires on Time::Local and File::Basename
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Marc Deslauriers <marc.deslauriers@canonical.com>
2013-06-28 12:37:36 -05:00
Jamie Strandboge
80f5a9a448 remove unneeded perl requires on Time::Local and File::Basename
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-06-27 12:11:09 -05:00
Kees Cook
4eb5fa017d fix missing long opt arg value
Using --subdomainfs without an argument triggers a segfault. This was due
to the long option missing the "has_arg" flag.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-06-26 11:26:43 -07:00
Tyler Hicks
1423e8f8ff Subject: libapparmor: Update aa_getcon man page to reflect getpeercon changes
Add aa_getpeercon_raw() to the man page and adjust aa_getpeercon()
prototype to include the new mode parameter.

Also, explain the significance of ERANGE for aa_getpeercon_raw() and fix
a misspelling in the meaning of ERANGE.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:55:52 -07:00
Tyler Hicks
7d81fbcd05 Subject: libapparmor: Make aa_getpeercon_raw() similar to aa_getprocattr_raw()
The parameter names are slightly different in the two functions. Rename
buffer to buf and rename size to len to make the two function prototypes
look similar.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:55:08 -07:00
Tyler Hicks
43f29bbc58 Subject: libapparmor: Parse mode from confinement string in getpeercon
functions

The functions that return the confinement information of a peer socket
connection should parse and return the mode like the task-based
functions.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:54:17 -07:00
Tyler Hicks
063095bcaa Subject: libapparmor: Move mode parsing into separate function
The getpeercon functions need to parse the mode from the confinement
string. This patch creates a function that aa_getpeercon_raw() and
aa_getprocattr_raw() can both use.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:53:39 -07:00
John Johansen
0d86e64114 Subject: libapparmor: fix return value of aa_getpeercon_raw
Return the total size of the security context on success
as documented.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:52:46 -07:00
John Johansen
b6c9a7623a Subject: libapparmor: Safeguard aa_getpeercon buffer reallocation
Protect against bugs in AppArmor's getsockopt() LSM hook from sending
aa_getpeercon() into an infinite loop.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:52:15 -07:00
Tyler Hicks
887c0a9a44 Subject: Fix mount rule preprocessor output
Currently, mount rule preprocessor output is incorrect:

$ echo '/t { mount options=ro /s -> /d, }' | apparmor_parser -p
/t { mountmount =ro /s -> /d, }
$ echo '/t { mount options in (ro) /s -> /d, }' | apparmor_parser -p
/t { mountmount  in (ro) /s -> /d, }

This is due to incorrect placement of DUMP_PREPROCESS in parser_lex.l.
With this patch, the output is correct:

$ echo '/t { mount options=ro /s -> /d, }' | apparmor_parser -p
/t { mount options=ro /s -> /d, }
$ echo '/t { mount options in (ro) /s -> /d, }' | apparmor_parser -p
/t { mount options in (ro) /s -> /d,

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-06-25 15:46:57 -07:00
Kshitij Gupta
e4ad1bde21 tested and completed config.py ans severity.py with the exception of source hooks in severity 2013-06-25 04:46:59 +05:30
Kshitij Gupta
1c10749be2 added variable handling also added a loader for all paths 2013-06-23 05:04:22 +05:30
Kshitij Gupta
c70af14af3 modified severity and testing modules 2013-06-21 20:08:32 +05:30
Kshitij Gupta
9692fbfd89 completed severity module, pending its module testing 2013-06-21 01:35:26 +05:30
Kshitij Gupta
47679582aa minor typo 2013-06-18 03:55:09 +05:30
Kshitij Gupta
758d1c6e7d added severity.py with tested convert_regex and the old and new config 2013-06-18 03:49:05 +05:30
John Johansen
a3a3624c57 More updates to the apparmor 3 docs - they are still not in a usable state 2013-06-14 12:35:51 -07:00
Michael Palimaka
b6c9f6cc53 Add missing key shortcuts for hu linguas. 2013-06-13 02:10:46 +10:00
Kshitij Gupta
c832f82027 indentation bug in write method fixed 2013-06-01 16:55:26 +05:30
Kshitij Gupta
6f38bb5c0e minor typo fixed 2013-06-01 16:11:55 +05:30
Kshitij Gupta
80ce4c557b minor fix 2013-06-01 16:10:00 +05:30
Kshitij Gupta
adb9936959 fixed a space 2013-06-01 16:01:56 +05:30
Kshitij Gupta
6d32f3cb94 updated OSError to IOError 2013-06-01 15:56:56 +05:30
Kshitij Gupta
e40445dea7 config.py added to library 2013-06-01 15:37:31 +05:30
Seth Arnold
647d7c1585 move poppler cMap from gnome to fonts, thanks to Felix Geyer 2013-05-30 12:01:27 -07:00
Jamie Strandboge
58f5df11e6 deny writes to upstart user sessions jobs in abstractions/private-files
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-05-13 14:56:10 -05:00
Jamie Strandboge
e3c0425857 add @{HOME}/.gnome2/keyrings/** to abstractions/private-files-strict
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-05-13 14:55:23 -05:00
John Johansen
b643a42dfd This is a minimal fix to apparmor 2.8 for cache failures when the feature
file is larger than the feature buffer used for cache version comparison.

Ideally this would be dynamically allocated but for 2.8 just bumping the
buffer size is the quick fix.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-05-02 11:32:56 -07:00
John Johansen
c0123646f6 Add more wip apparmor documentation 2013-05-02 10:57:23 -07:00
John Johansen
5d220486e9 rename variable doc 2013-05-02 10:55:02 -07:00
John Johansen
8a2efb0dec Add wip AppArmor Policy document 2013-05-02 10:45:36 -07:00
Jamie Strandboge
ae2cdf0fad Fix two race conditions:
1) make sure that the xpra socket exists before trying to attach to it
2) make sure that the client has attached before we start the application

The fix for '1' solves a problem when the system is under load and the
one for '2' fixes a problem with firefox starting too soon and not
having system themes applied.

Exercising the 1 week rule. Seth Arnold commented on the added sleeps and I
adjusted one based on his comments and replied to the list that the other is
needed and that this improves the sandbox/xpra code but that there are
limitations with driving xpra.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-04-09 08:31:39 -05:00
Jamie Strandboge
5f871cfad2 profiles/apparmor.d/usr.sbin.nscd: remove read access to
@{PROC}/sys/vm/overcommit_memory, now included in base

Acked-By: Christian Boltz <apparmor@cboltz.de>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-04-09 08:19:55 -05:00
Jamie Strandboge
7679ac49b1 add read access to @{PROC}/sys/vm/overcommit_memory as used by glibc. See
http://sourceware.org/git/?p=glibc.git;a=commit;h=9fab36eb583c0e585e83a01253299afed9ea9a11

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-04-08 20:11:43 -05:00
Jamie Strandboge
7e9c7c37be update pulseaudio directory and cookie file paths
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-04-08 20:10:36 -05:00
Christian Boltz
53f9cd79f5 Add missing permissions to the nscd profile.
Also deny capability block_suspend because nobody can imagine why it 
would be needed.

References: https://bugzilla.novell.com/show_bug.cgi?id=807104

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-03-05 22:11:59 +01:00
Steve Beattie
0c3899065b Subject: libapparmor - use python-config if it exists when configuring
Author: Dmitrijs Ledkovs <dmitrij.ledkov@ubuntu.com>

Modifiy the libapparmor macro for python to use python-config if it
exists to determine what CPPFLAGS and LDFLAGS to use when building
the python swig libraries. Without this addition, python detection
fails on ubuntu 13.04. I've confirmed that with this patch applied,
the python libraries still build successfully on older releases as well
(as far back as ubuntu 11.10).

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2013-01-29 15:21:47 -08:00
Steve Beattie
8f931d8fd6 jjohansen's recent commit to extend the datetime parsing of syslog
messages neglected to include the empty .err files in the testsute
directory, resulting in ERROR output. These files were included in the
patch submitted to the mail list. This commit adds them.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-28 11:19:54 -08:00
Steve Beattie
f4716805aa Merge from Michael Palimaka <kensington@gentoo.org>:
* parser - Respect LDFLAGS while building the parser
* libapparmor - Remove an unused configure option

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-28 11:15:57 -08:00
Jamie Strandboge
3c41028cd5 Committing per IRC discussions. Does not update the Makefile to install it yet.
= How it works =
There are basically two modes:
 1. using an existing profile with --profile
 2. dynamically generating a profile

For '1', aa-sandbox is just a wrapper around aa-exec.

For '2', aa-sandbox leverages easyprof and allows you to specify policy
in a limited way on the command line. It then loads the policy into the
kernel as a profile (ie, 'profile <foo> { ... }') so it doesn't get in
the way of existing profiles. It currently calls apparmor_parser via
sudo or pkexec. Once the profile is loaded, aa-exec the application
under the profile.

When -X is specified, the application is launched inside its own X
server using either xpra (the default, which uses Xvfb), xephyr and
xpra3d (xpra, but using Xorg with the xdummy[1] driver for now[2].
xpra3d doesn't currently perform well, but works ok with newer Gnome
applications that now require GLX). When using '-X', it:
- adds an explicit deny rule for ~/.Xauthority
- generates a dynamic Xauthority file for the session in 
  ~/.Xauthority-sandbox<DISPLAYNUMBER>
- adds an allow rule for ~/.Xauthority-sandbox<DISPLAYNUMBER>
- adds checks for xhost being properly setup
- honors the --with-xauthority option which can be used with --profile

With the above, the :0.0 display should no longer be accessible. Eg:
$ ./aa-sandbox -t ~/sandbox-xterm -X /usr/bin/xterm
$ XAUTHORITY=~/.Xauthority DISPLAY=:0.0 xinput
No protocol specified
Unable to connect to X server

This requires a specifically configured xauth/xhost setup, which is less common
on modern distributions. The man page details how to get this setup.


= Trying it out =
Apply the patch, then:
$ cd ./utils
# cli
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates --read-path=/proc/ /usr/bin/uptime

# 2d only
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X /usr/bin/xeyes
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X /usr/bin/gedit

# 2d alternate (xephyr)
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X --with-xserver=xephyr /usr/bin/xeyes
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X --with-xserver=xephyr /usr/bin/gedit

# 3d
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X --with-xserver=xpra3d /usr/bin/xeyes
$ ./aa-sandbox --templates-dir=`pwd`/easyprof/templates -X --with-xserver=xpra3d /usr/bin/glxgears

# With an existing profile:
$ ./aa-sandbox --profile=/usr/bin/evolution -X --with-xserver=xpra3d /usr/bin/evolution


= The Patch =
The patch itself is pretty self contained:
utils/aa-easyprof:
- adjusted to import optparse

utils/easyprof/templates/sandbox*
- add two new templates to easyprof

utils/apparmor/easyprof.py:
- use 'profile <foo>' if '<foo>' is not an absolute path
- adjust parser handling so we can reuse it

utils/aa-sandbox:
- small script to drive utils/apparmor/sandbox.py

utils/apparmor/common.py:
- the start of our python library. aa-easyprof would eventually use 
  this (along with the various rewrites), but for now, only the 
  sandboxing uses it.

utils/apparmor/sandbox.py:
- the sandboxing code itself. Of particular note is the use of classing
  to support different X servers

utils/aa-sandbox.pod:
- the corresponding man page


= Improvements =
* don't use sudo
* make pulseaudio in xpra opt-in (currently it is off)
* take advantage of upstream's 3D patches when they stabilize
* investigate how applications can work with the Unity global menu
* surely lots more 

[1]http://xpra.org/Xdummy.html
[2]http://xpra.org/trac/ticket/147
2013-01-14 09:11:58 -06:00
Jamie Strandboge
e91ac70739 revert r2080, it doesn't actually help anything 2013-01-14 08:55:53 -06:00
Jamie Strandboge
52d8345a55 merge from trunk 2013-01-14 08:54:29 -06:00
Christian Boltz
c4947a5a1c abstractions/mysql: changed paths and MariaDB support
abstractions/mysql  contains
   /var/lib/mysql/mysql.sock rw,
   /usr/share/mysql/charsets/ r,
   /usr/share/mysql/charsets/*.xml r,

but the files moved (at least on openSUSE) to
    /usr/share/mysql-community-server/charsets/*.xml
    /var/run/mysql/mysql.sock
This causes denials for all applications using MySQL on 12.2 and 
Factory.

MariaDB has the *.xml files in
    /usr/share/mariadb/charsets/*.xml
and also seems to use /var/run/mysql/ for the socket.

Since MariaDB is basically a drop-in replacement for MySQL, it makes
sense to allow access to it via abstractions/mysql.

References: https://bugzilla.novell.com/show_bug.cgi?id=798183

Acked-by: Seth Arnold <seth.arnold@canonical.com>
2013-01-13 14:38:28 +01:00
Michael Palimaka
f86e2858a2 Respect LDFLAGS. 2013-01-14 00:10:41 +11:00
Michael Palimaka
a9e0ae35ba Remove rootlib configure option.
This option is not referenced anywhere, so it should be safe to remove.
2013-01-13 01:56:56 +11:00
Steve Beattie
4962992516 Subject: libapparmor - remove deprecated libimmunix
The libimmunix library is a historical artifact and has generated a
deprecation warning when used to syslog for over 4 years. This patch
removes it entirely from the libapparmor tree.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-01-10 13:52:04 -08:00
Steve Beattie
cc2beb996e Subject: profiles - adjust pusleaudio in abstraction
I was testing out a profile for pulseaudio and hit an issue where my
pulseaudio process was getting the firefox profile applied to it. This
is because in abstractions/ubuntu-browsers.d/multimedia the rule for
pulseaudio is /usr/bin/pulseaudio ixr; attached is a patch to change it
to Pixr, so as to use a global pulseaudio policy if it exists.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-01-09 15:12:06 -08:00
John Johansen
902c48d748 The following patch extends the libraries log parsing to support more date
time formats.

currently the only supported format is
  <Month> ## hh:mm:ss

extend this to
  <Month> ## hh:mm:ss(.ms)?((+|-)timezone)?

  yyyy-mm-dd hh:mm:ss(.ms)?((+|-)timezone)?

  yyyy-mm-ddThh:mm:ss(.ms)?((+|-)timezone)?

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-08 14:22:00 -08:00
Steve Beattie
e80eeb3296 Subject: update sshd extra profile
From: Simon Déziel <simon.deziel@gmail.com>
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/228229

Update sshd profile to function under 12.04 LTS.

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:31:00 -08:00
Steve Beattie
e3e47a7b61 Subject: profiles - owner usage for @{HOME} rules
From: Simon Deziel <simon.deziel@gmail.com>

A fair number of the rules that apply to files in @{HOME} predate the
existence of the 'owner' qualifier. This patch adds the 'owner'
qualifier in several places.

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-04 22:05:53 -08:00
Steve Beattie
33bfedb95a Add comment describing why check-logprof was dropped from the make check
target in the profiles Makefile, for future archaeological spelunking.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Christian Boltz <apparmor@cboltz.de>
2013-01-04 16:33:41 -08:00
Steve Beattie
fd26b2c044 Disable the logprof check by default for the profiles tree, as logprof
has not kept pace with language changes.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2013-01-02 17:56:45 -08:00
Steve Beattie
ce8bb0863b Subject: profiles - dnsmasq: allow writes to
/{,var/}run/sendsigs.omit.d/*dnsmasq.pid for network manager
 integration

Author: Jamie Strandboge <jamie@canonical.com>
Description: allow writes to /{,var/}run/sendsigs.omit.d/*dnsmasq.pid
 for network manager integration
Bug-Ubuntu: https://launchpad.net/bugs/941808

Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2013-01-02 15:47:28 -08:00
Steve Beattie
1cc0885890 Subject: profiles - use @{pid} tunable
This patch adds the kernelvars tunable to the global set that is usually
included by default in apparmor policies. It then converts the rules
that are intended to match /proc/pid to use this tunable.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-01-02 15:34:38 -08:00
Steve Beattie
3810ecb08b Subject: profiles - finish @{PROC} conversion
This patch finishes the conversion from /proc to the @{PROC}
tunable within profiles and abstractions. It also adjusts some of
the /proc/*/something usages to @{PROC}/[0-9]*/something to restrict
things to just the /proc/pid directories. (A followup patch will
convert these to use @{pid} from the kernelvars tunable.)

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 15:31:01 -08:00
Steve Beattie
39b1aa98eb Subject: profiles - add user's XCompose file to X abstraction
In testing the skype profile, I found access to my @{HOME}/.XCompose
was being rejected. This patch updates the X abstraction to take a
user's defined XCompose key shortcuts into account.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 15:23:08 -08:00
Steve Beattie
f536c8c50d Subject: profiles - update skype profile
Author: Jamie Strandboge <jamie@canonical.com>
Bug-Ubuntu: https://launchpad.net/bugs/933440 Forwarded: yes

This is a very slightly updated version of the skype profile
update that Jamie Strandboge submitted, but did not get a review.
The only addition over the previously submitted version is rw access
to @{HOME}/.config/Skype/Skype.conf.

(This commit incorporates the additional @{HOME}/.kde4 change proposed
by Christian Boltz <apparmor@cboltz.de>)

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 15:17:35 -08:00
Steve Beattie
fb510f8d5b Subject: profiles - fix apparmor_api abstractions
The apparmor_api abstractions make the mistake of including tunables
directly, which is a no-no since the variable definitions in tunables
need to occur in the preamble of a profile, not embedded within it.
This patch removes those includes, and replaces them documentation of
tunables are necessary, as some of the expected ones are not part of
tunables/global.

It also adjust the kernelvars tunable's definition of the @{pid}
regex, as the current parser does not support nesting of {} groupings,
which breaks any profile that attempts to use the tunable.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2013-01-02 15:02:29 -08:00
Steve Beattie
d19097c5e1 Subject: profiles - nvidia abstraction cleanups
This patch modifies the nvidia abstraction to add the livdpau wrapper
config file for nvidia workarounds. It also converts the /proc/
rules to use the @{PROC} tunable. And finally, it converts the
ubuntu-browsers.d/multimedia abstraction to use the nvidia abstraction.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 14:39:45 -08:00
Steve Beattie
f9b9212100 Subject: profiles - separate out logprof checks from parser checks
This patch separates out make check in the profiles/ directory into
two sub targets, for checking profiles against the built parser
and aa-logprof respectively. The logprof check currently makes some
assumptions about the environment that make it difficult to run in
a minimal chroot environment.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2013-01-02 14:33:12 -08:00
Christian Boltz
5a053dc580 speed up aa-decode by using a bash regex matching instead of calling egrep for each line.
Acked-by: Steve Beattie <sbeattie@ubuntu.com>

(Patch sent 2012-11-01, Acked-by from 2013-01-01)
2013-01-01 20:15:04 +01:00
Steve Beattie
3690a2e1c0 Subject: profiles - fix make check
When I corrected the profiles/Makefile to automatically find files to
install, I converted one variable name but missed a later location where
that variable was used, which broke the 'make check' target, because
directories would be handed to the apparmor parser. This patch corrects
that and also makes the VERBOSE flag report each profile name as it's
being handed to the parser.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Seth Arnold <seth.arnold@canonical.com>
2012-12-21 22:43:11 -08:00
Steve Beattie
039e8d285b Add a parser testcase that triggered the match flags state issue that
was addressed (however temporarily) in commit 2085.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-12-10 17:10:40 -08:00
John Johansen
66717a2aec temp fix using the 2.8 patch until the 3.0 patch is ready to land
fix a nasty little bug that can surface in apparmor 2.8 when
Hats/children profiles are used.
  
the matchflags in the dfa backend are not getting properly reset, which
results in a previously processed profiles match flags being used. This is
not a problem for most permissions but can result in x conflict errors.
  
Note: this should not result in profiles with the wrong x transitions loaded
as it causes compilation to file with an x conflict.
  
This is a minimal patch targeted at the 2.8 release. As such I have just
updated the delete_ruleset routine to clear the flags as it is already
being properly called for every rule set.

Apparmor 2.9/3.0 will have a different approach where it is not possible
to reuse the flags.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2012-12-10 17:08:19 -08:00
Steve Beattie
40d4e22249 Add a small sleep call to the onexec test to give the forked process a
chance to run before verifying it's current and future confinement
state. In testing the combined sleeps added roughly a second to
onexec.sh's total time on relatively reasonable hardware.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com> (via IRC)
2012-12-10 10:01:38 -08:00
Steve Beattie
3298ac489c This patch modifies the parser's caching test to more accurately detect
whether or not the filesystem has a fine enough timestamp resolution.
Occasionally even on filesystems like ext3, the two files' creation
dates would differ when created less than a second apart, which would
typically cause the 'Cache is used when cache is newer' test to fail
because the cached file would have the same timestamp as the profile.

The fix creates 10 files 0.1 seconds apart and ensures that all ten
have distinct timestamps.

(The occasional failure was caught in testing runs like
 https://bugs.launchpad.net/qa-regression-testing/+bug/1087061/ )

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-12-07 23:18:40 -08:00
Jamie Strandboge
7baf9a4d36 utils/apparmor/sandbox.py: sigh, add another sleep to avoid a race in firefox 2012-12-04 10:15:34 -06:00
Jamie Strandboge
826a84aca1 merge from trunk 2012-12-04 10:12:09 -06:00
Steve Beattie
6a8e98d4b7 Add a small sleep call to the onexec test to give the forked process a
chance to run before verifying it's current and future confinement
state. In testing the combined sleeps added roughly a second to
onexec.sh's total time on relatively reasonable hardware.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com> (via IRC)
2012-11-30 21:25:23 -08:00
Steve Beattie
7d5f45d9e3 This patch fixes an existing install failure in the profiles tree, due
to the apparmor_api subtree not getting added in the Makefile. Rather
Rather than require every sub-directory that gets added to be
enumerated, it uses find to determine what directories and files to
install, to avoid future breakage. It is admittedly slower than the
original code because install(1) is being invoked for every file in
the apparmor.d tree, rather than acting on wildcard globs. That said,
I think it's an acceptable tradeoff.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-11-21 07:39:40 -08:00
John Johansen
d633495817 Add kernel patches for 3.5 and 3.6 kernels 2012-11-20 17:01:28 -08:00
John Johansen
4ede12c5c0 Update documentation of change_hat and change_profile apis
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@gmail.com>
2012-11-20 16:55:09 -08:00
Steve Beattie
849a8bd4d2 Given that we want to do more apparmor things in user space (dbus
mediation, file picker, etc.), making it easier for other source bases
to detect the presence of libapparmor would be beneficial. This patch
adds pkg-config support to the build infrastructure for libapparmor.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-11-14 11:00:06 -08:00
Gregor Dschung
b9043f2785 abstractions/ruby updated for 1.9.1 2012-11-07 12:10:19 +01:00
Gregor Dschung
0857616d9f Merge from main branch 2012-11-07 12:02:57 +01:00
Christian Boltz
fab491b44c Add a profile for samba's winbindd.
I added this profile to the openSUSE apparmor-profiles package in Feb 2012. 
Until now I didn't receive any bugreports so I'd say it's complete ;-)

References: https://bugzilla.novell.com/show_bug.cgi?id=748499

Acked-By: jdstrand (on IRC)
2012-11-06 23:19:46 +01:00
Steve Beattie
8e70fdcdfd Subject: aa-decode test script v3
This patch adds a test script/driver for the aa-decode utility. The only
change from the previous versions is to support overriding the location
of the aa-decode to test via the APPARMOR_DECODE environment variable
and documenting the utils/ tests in the top level README.

The aa-decode test can be run directly from the commandline in the utils
directory like so:

  test/test-aa-decode.py -v

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2012-11-05 17:27:20 -08:00
Steve Beattie
8c7c5a6a80 Subject: two fixes to the parser's simple test driver
This patch fixes two issue with the simple test driver. The first is
that child exec that actually ran the parser was located inside the
eval statement. This meant that if the exec failed for some reason
(like the parser didn't exist), the child wouldn't actually die,
but would pop out of the eval and continue running through the loop
of test profiles (while the parent process does the same). This meant
that if the script ran on the full testsuite with a misconfiguration,
it would explode creating O(n^2) processes, where n is the number of
testcase files -- with over 25k testcases, that's a lot. The fis is to
lift the child exec outside the eval{}, then an exec() failure causes
the child process to die correctly.

The second fix is that several of the testcases were added with the
DESCRIPTION field added in lower case (i.e. #=Description blah blah).
This fix makes the regex that pulls out the description not be
case-sensitive.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com>
2012-11-05 17:23:53 -08:00
Steve Beattie
4791fb1bc8 Subject: parameterize parser tests to support different binaries
This patch replaces the hardcoded path to the in-tree apparmor parser
in several of the script based test scripts with the APPARMOR_PARSER
environment variable, keeping the hardcoded location as the default.
It also adds support for overriding the location of the parser via the
same environment variable. The make infrastructure is updated to use
this, though uses a different variable (PARSER) to drive it.

Thus 'make check PARSER=/some/path/to/an/alternate/apparmor_parser'
will run all the parser tests on that binary. This is useful for
running the testsuite in an automated post-install environment.
(It should be noted that doing so will still build and run the unit
test binaries based on the source tree.)

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: John Johansen <john.johansen@canonical.com>
2012-11-05 17:22:37 -08:00
Gregor Dschung
702a6edcb9 abstractions/ruby updated for ruby 1.9.1 2012-11-02 17:21:05 +01:00
John Johansen
0e88c3ac70 apparmor: Fix clone test on quantal arm omap-4
It turns out that PAGE_SIZE isn't defined on all architectures.

This fixes a regression test failure happening on Ubuntu quantal
on the arm ti-omap4 architecture.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-10-20 01:22:29 -07:00
John Johansen
6fe8e80388 apparmor: add abstractions to support the apparmor api
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-10-20 01:19:22 -07:00
Christian Boltz
50d89bc579 Fix aa-decode handling of stdin
Handling stdin was totally broken (= no output) with the current log 
format because aa-decode expected name= to be the last entry in the 
log line.

This patch for stdin handling
- fixes the pattern to match the current log format (name= is NOT the
  last part in the log entry)
- uses bash replacement to avoid some sed calls (which also means the 
  script now needs an explicit "#!/bin/bash")
- prints decoded filenames in double instead of single quotes to be
  consistent with filenames that were not encoded
- also prints lines that do not contain an encoded filename (instead of 
  grepping them away)
- replace tr calls by perl's uc() (also for non-stdin mode)
- also handle encoded profile names (introduced by Steve)
- don't fail if a file or profile name contains a '

In other words: you can pipe your audit.log through aa-decode, and the 
only difference to the raw audit.log is that filenames are decoded.


Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-10-16 00:19:49 +02:00
John Johansen
528d7c463a So the library version has not been being correctly bumped.
Make this a little bit easier to follow

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-10-12 11:44:11 -07:00
John Johansen
3a9cb05d58 The apparmor coredump regression test was broken.
- It failed to remove coredump files named "core"
- It failed to properly detect "core.<pid>" files
- And it would fail if the coredump_pattern had been modified to
  a different location.

This lead one of the tests to report it was passing when it
wasn't because it was detecting the previous tests core file.
- Fix the test to set the coredump_pattern, to dump into the
  tmpdir used for the test.
- Make it so it will only detect the core file for the pid of
  the last test run.
- And extend the test to have a couple of extra test cases.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-10-01 11:05:24 -07:00
Christian Boltz
5ae05cc2f4 Install extra profiles in /usr/share/apparmor/extra-profiles/ instead of
/etc/apparmor/profiles/extras/, and update the path at various places.

Also update the mailinglist address in extra-profiles README and 
recommend cp instead of mv.

Note: if you want to have a symlink 
    /etc/apparmor/profiles/extras -> /usr/share/apparmor/extra-profiles/
for backward compability, you'll have to create it yourself (for example
in the .spec file)

This also fixes https://bugzilla.novell.com/show_bug.cgi?id=713647


Acked-by: John Johansen <john.johansen@canonical.com>
2012-09-27 23:57:21 +02:00
Christian Boltz
0742f72f4f fix error handling in aa-decode
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

Looks-Good-By: ;-)  Seth Arnold <seth.arnold@gmail.com>
2012-09-17 23:55:28 +02:00
Jamie Strandboge
a8f5562bde utils/apparmor/sandbox.py: adjust LIBOVERLAY_SCROLLBAR too, since the overlay
scrollbar doesn't track properly
2012-09-03 14:29:05 -05:00
Jamie Strandboge
aa6407d07b utils/apparmor/sandbox.py: only save environment variables that exist 2012-08-29 08:56:06 -05:00
Jamie Strandboge
457d19beaf utils/aa-sandbox.pod: note on hotplugging monitors 2012-08-29 08:49:15 -05:00
Jamie Strandboge
a324724cf3 utils/apparmor/sandbox.py: set QT_X11_NO_NATIVE_MENUBAR=1
utils/aa-sandbox.pod: update KNOWN LIMITATIONS for global menu
2012-08-29 08:43:48 -05:00
Jamie Strandboge
08d91ef714 utils/apparmor/sandbox.py: update title again 2012-08-28 11:56:18 -05:00
Jamie Strandboge
7eeaa74dd9 utils/apparmor/sandbox.py: fix error warning 2012-08-28 08:39:39 -05:00
Jamie Strandboge
0cd5965fcc utils/aa-sandbox.pod:
- clean up LIMITATIONS a bit
- mention lack of cursor support
2012-08-28 08:09:46 -05:00
Jamie Strandboge
06cc33166d utils/aa-sandbox.pod: document limitations 2012-08-28 08:01:15 -05:00
Jamie Strandboge
f2050ec13a utils/aa-sandbox.pod: document --with-clipboard 2012-08-28 07:44:49 -05:00
Jamie Strandboge
c92491621b utils/apparmor/sandbox.py:
- add --with-clipboard for use with xpra
- check for incompatible options
2012-08-28 07:41:23 -05:00
Jamie Strandboge
091bcd72fd adjust title to include the display 2012-08-27 20:13:41 -05:00
Jamie Strandboge
981188e17a utils/apparmor/sandbox.py: use a 3840x2560 server size to reduce memory usage 2012-08-27 17:18:21 -05:00
Jamie Strandboge
72995c5bcb utils/easyprof/templates/sandbox-x: add explicit deny rule to deny
@{HOME}/.Xauthority
utils/apparmor/sandbox.py: verify the above rule is any any dynamic templates
 that use -X
utils/aa-sandbox.pod: update man page to warn about /.Xauthority access
2012-08-27 16:43:20 -05:00
Jamie Strandboge
cb3d73424b utils/apparmor/sandbox.py: add --read-path=x.xauth to opt 2012-08-27 16:16:04 -05:00
Jamie Strandboge
392b5e07c0 various fixes based on feedback from James Troup. 2012-08-27 16:11:01 -05:00
Jamie Strandboge
ea6b1568b4 utils/apparmor/sandbox.py:
- use signal.<signal> instead of hardcoding a number
- add --with-xauthority option
- remove '-r' and '--with-geometry' and use --with-xephyr-geometry instead
- allow passing arguments to the application when using aa-exec
- kill with SIGTERM, then try again with SIGKILL
- always use os.execv() in forks. Using cmd() when not specifying '-d' created
  different behaviors between debug and non-debug mode
- better cleanup Xpra when aa-exec command fails
- use the full dummy.xorg.conf, which gives us the correct modelines for large
  displays. This fixes the issue "Server's virtual screen is too small .... You
  may see strange behavior." which should up when the window's size was bigger
  than the 'current server resolution'
2012-08-27 15:27:30 -05:00
Jamie Strandboge
3ad2820ebd utils/apparmor/sandbox.py:
- cleanup environment handling
- refactor cleanup code
- verify Xsecurity is setup correctly (ie, interpret output of xhost)
- add generation of .Xauthority-sandbox...
- explitly use SECURITY extension
2012-08-27 10:54:26 -05:00
Jamie Strandboge
fd4986e726 manpage updates 2012-08-24 12:16:20 -05:00
Jamie Strandboge
bb58f40ae3 add utils/aa-sandbox.pod 2012-08-24 12:07:19 -05:00
Jamie Strandboge
ec5973a3e6 utils/apparmor/sandbox.py: change 'resolution' to 'geometry' 2012-08-24 12:06:54 -05:00
Jamie Strandboge
72dbf597cc utils/apparmor/sandbox.py: use pkexec if '--with-x' is specified 2012-08-24 11:21:21 -05:00
Jamie Strandboge
c062a8a841 utils/apparmor/sandbox.py:
- fix detection of xdummy driver
- update comments
- add '--no-tray' to 'xpra attach'
2012-08-24 11:09:35 -05:00
Jamie Strandboge
056e642d2b utils/apparmor/sandbox.py: bail if we don't have xdummy 2012-08-24 10:57:28 -05:00
Jamie Strandboge
3fe45e4a9b utils/apparmor/sandbox.py: sleep for 0.5 seconds initially, then poll every
second
2012-08-24 10:52:22 -05:00
Jamie Strandboge
064887dfbd catch exception for x.start() 2012-08-24 10:49:24 -05:00
Jamie Strandboge
a13efcfe0a utils/apparmor/sandbox.py: detect if xpra is running before attach 2012-08-24 10:47:01 -05:00
Jamie Strandboge
cf24f21a77 utils/apparmor/sandbox.py: fix up arg validation for --with-xserver 2012-08-24 10:34:14 -05:00
Jamie Strandboge
5ce539c432 utils/apparmor/sandbox.py:
- add xpra3d server option which uses Xdummy
- update debugging output
2012-08-24 10:21:48 -05:00
Jamie Strandboge
7756e48197 utils/apparmor/sandbox.py:
- add --profile option
- small cleanups
2012-08-23 21:52:52 -05:00
Jamie Strandboge
ed0f41c650 utils/apparmor/sandbox.py:
- whitespace cleanups
- move setting DISPLAY into the start() method
- add extra options to xpra attach
2012-08-23 21:19:37 -05:00
Jamie Strandboge
80a59da4b8 adjust sandbox code:
- for python3
- to add xpra support
- refactoring
- cleanups
2012-08-23 20:49:12 -05:00
Jamie Strandboge
cafd8c9b3e drop globalmenu support for now 2012-08-23 20:47:58 -05:00
Jamie Strandboge
d7b2cb6a50 small cleanups for prettier output 2012-08-23 20:39:19 -05:00
Jamie Strandboge
c0821032fb remove and add some comments 2012-08-23 20:25:29 -05:00
Jamie Strandboge
51256d8fe7 move X server search code into classes 2012-08-23 19:56:18 -05:00
Jamie Strandboge
1fdc3a5e99 utils/apparmor/sandbox.py:
- add --xserver option and support both xephyr and xpra
- refactoring
2012-08-23 19:36:25 -05:00
Jamie Strandboge
7157a62d2b utils/apparmor/sandbox.py: detect next DISPLAY to use 2012-08-23 17:37:31 -05:00
Jamie Strandboge
354486e326 utils/apparmor/sandbox.py: slightly cleanup the gen_policy_name 2012-08-23 17:15:51 -05:00
Jamie Strandboge
f826be087d utils/aa-sandbox: use msq() instead of print
utils/apparmor/common.py: adjust for python3 (ie, make bi-lingual)
utils/apparmor/sandbox.py:
- set reasonable default template
- gen_policy_name() uses full pathname
- adjust for python3
2012-08-23 17:12:14 -05:00
Jamie Strandboge
a995c08356 fix up debug handling
add required binaries
2012-08-23 16:29:48 -05:00
Jamie Strandboge
1e80b85296 merge from trunk 2012-08-23 15:53:33 -05:00
John Johansen
5a026afd9f Merge branch 'bzr/master' 2012-08-16 16:29:16 -07:00
John Johansen
c0b5035b1a apparmor: abstract out the directory walking routine
The apparmor_parser has 3 different directory walking routines. Abstract
them out and use a single common routine.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-16 16:26:03 -07:00
Jamie Strandboge
175120fdd7 Gnome applications are now quite interested in reading
/usr/share/poppler/cMap/**. These files are included in the poppler-data
package on Ubuntu, and their 'r' denials create quite a bit of noise.
Apparently they are needed to display PDF documents containing CJK
characters with libpoppler. I added it to the gnome abstraction because
several applications not linked against poppler are consulting this
data.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-14 14:31:58 -05:00
Jamie Strandboge
1b2aaaa440 Gnome applications are now quite interested in reading
/usr/share/poppler/cMap/**. These files are included in the poppler-data
package on Ubuntu, and their 'r' denials create quite a bit of noise.
Apparently they are needed to display PDF documents containing CJK
characters with libpoppler. I added it to the gnome abstraction because
several applications not linked against poppler are consulting this
data.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-14 14:31:58 -05:00
Jamie Strandboge
bf2eebd54d CAP_EPOLLWAKEUP was renamed to CAP_BLOCK_SUSPEND. Update severity.db for that.
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-14 13:46:10 -05:00
Jamie Strandboge
19a6b9673e update fonts abstraction for new fontconfig paths
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-14 13:40:58 -05:00
John Johansen
9c42360b34 apparmor: correct apparmor_parser -N command privilege
Fix the apparmor_parsers -N command (which dumps the list of profile
names found in a policy file) to be available without privilege and
also make it be recognized as a command instead of an option so that
it can conflict with -a -r -R -S and -o.

Currently it can be specified with these commands but will cause the
parser to short circuit just dumping the names and not doing the actual
profile compile or load.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-13 16:59:00 -07:00
John Johansen
8eb069cce5 apparmor: update apparmor_parser man page
Rework and update the apparmor_parser man page. It reworks some of the
text but mostly just reorganizes the commands and options into logical
grouping to make it easier to sort out how the various commands and
options work.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-13 16:58:46 -07:00
John Johansen
55d6f869fc apparmor: add clearing the profile cache when inconsistent
Add the ability to clear out the binary profile cache. This removes the
need to have a separate script to handle the logic of checking and
removing the cache if it is out of date.

The parser already does all the checking to determine cache validity
so it makes sense to allow the parser to clear out inconsistent cache
when it has been instructed to update the cache.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-08-13 16:58:33 -07:00
Christian Boltz
aa4f2813e4 /bin/ping moved to /usr/bin/ping on openSUSE (usrMerge)
Update the profile to make sure it's still used.

Acked-by: John Johansen <john.johansen@canonical.com>
2012-08-10 00:51:40 +02:00
Christian Boltz
ee71bf3b71 ls moved from /bin/ to /usr/bin/ on openSUSE (usrMove)
Acked-by: John Johansen <john.johansen@canonical.com>
2012-08-06 13:56:31 +02:00
John Johansen
d64d860c93 The previous patch to fix policy compilation around the network flag had a
serious flaw. The test for the network flag was being applied against both
the kernel flags and the cache flags. This means that if either the kernel
or the cache did not have the flag set then network mediation would be
turned off.

Thus if a kernel was booted without the flag, and a cache was generated
based on that kernel and then the system was rebooted into a kernel with
the network flag present, the parser on generating the new policy would
detect the old cache did not support network and turn it off for the
new policy as well.

This can be fixed by either removing the old cache first or regenerating
the cache twice. As the first generation will write that networking is
supported in the cache (even though the policy will have it disabled), and
the second generation will generate the correct policy.

The following patch moves the test so that it is only applied to the kernel
flags set.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-07-17 16:03:32 -07:00
Jamie Strandboge
83a48dd395 Author: Mark Ramsell <mramsell@qazonline.net>
Description: ubuntu-integration does not work properly with exo-open
Bug-Ubuntu: https://launchpad.net/bugs/987578

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-07-05 12:37:03 -05:00
Jamie Strandboge
58646ebf20 Description: let sanitized-helper also allow access to /usr/local. Patch based
on work by Reuben Thomas
Bug-Ubuntu: https://launchpad.net/bugs/1013887

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-07-05 12:36:01 -05:00
Jamie Strandboge
f7d1df0aab Description: update ubuntu-browsers.d/java for IcedTea 7
Bug-Ubuntu: https://launchpad.net/bugs/1003856

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-07-05 12:34:45 -05:00
Jamie Strandboge
e7da3d81d1 use PYTHON in utils/python-tools-setup.py if it is defined
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-07-01 09:12:29 -05:00
John Johansen
3d4a98bed9 Fix the parser so it checks for the presence of the network feature in the
compatibility interface. Previously it was assuming that if the compatibility
interface was present that network rules where also present, this is not
necessarily true and causes apparmor to break when only the compatibility
patch is applied.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-07-01 01:36:37 -07:00
John Johansen
a465a211c2 Have build check for presence of awk and fail with a sensible error message
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-06-29 16:54:12 -07:00
Jamie Strandboge
09ab5e4d65 CAP_EPOLLWAKEUP was added to the 3.5 series in:
http://thread.gmane.org/gmane.linux.kernel/1289986

This allows for drivers that support poll to prevent suspend. Adjust
utils/severity.db for this.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-06-29 13:48:28 -05:00
Jamie Strandboge
87d912e4db Initial port to python3 for utilities. Thanks to Dmitrijs Ledkovs
Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-06-29 13:35:57 -05:00
Dmitrijs Ledkovs
18ea588e5c typo 2012-06-12 14:30:57 +01:00
Dmitrijs Ledkovs
3418d895f2 Remaining typos 2012-06-12 14:28:41 +01:00
Dmitrijs Ledkovs
5fcbcf3ddc python2/3 compatible ac_python_devel.m4 2012-06-12 13:56:57 +01:00
Dmitrijs Ledkovs
9f19fb7b53 * Use with open('file') as f, to prevent leaking file descriptors
* More print -> sys.stdXXX.write() conversions
* Use `except Error as ex` & no sys.version checks
* add with_statement import for py2.5 compat
* remove unused import
2012-06-12 11:37:36 +01:00
Dmitrijs Ledkovs
00505ab2dc newline parity with print statement vs sys.stdout.write 2012-06-11 18:31:31 +01:00
Dmitrijs Ledkovs
dac3c00862 Initial port to python3 for utilities. 2012-06-11 17:56:21 +01:00
John Johansen
5b6b2bbc01 Original Author: mancha@mancha.user.oftc.net
create-apparmor.vim.py was failing on systems with python 2.5, fix that

Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Steve Beattie <sbeattie@ubuntu.com>
2012-06-08 14:30:22 -07:00
John Johansen
ad7fecf48e While integrating 3.4-rc1, I ran into a problem where network rules
weren't being processed. It ultimately boiled down to a kernel issue
but I found it useful to see what the parser thought it was working
with. Since the parser already has a debugging mode that will show things
like capabilities, it was an obvious extension to add network rules.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-06-07 00:41:04 -07:00
John Johansen
cc06a43142 Change version to 2.8.95 to reflect this is the development version 2012-06-07 00:34:08 -07:00
Christian Boltz
79aa2d1138 move generation of file rules to create-apparmor.vim
This patch moves the generation of file rules from apparmor.vim.in to
create-apparmor.vim.py. It also adds support for
- filenames in quotes
- reverse syntax (permissions first)

The patch also removes an outdated $Id header in apparmor.vim.in and
updates the copyright year.


Acked-By: John Johansen <john.johansen@canonical.com>
2012-06-05 21:18:30 +02:00
John Johansen
1fd88819be Set apparmor_2.8.0 release tag 2012-05-31 10:29:35 -07:00
John Johansen
7b98d8a227 Bump version to apparmor 2.8.0 2012-05-31 10:27:48 -07:00
John Johansen
b0443467aa Bump version number to 2.8.0 2012-05-31 10:25:02 -07:00
John Johansen
41b454f2e5 Older C++ compilers complain about the use of a class with a non trivial
constructor in a union.  Change the ProtoState class to use an init fn
instead of a constructor.
2012-05-30 14:31:41 -07:00
John Johansen
2347b6628d Kernel patches for v3.2, v3.3, v3.4 kernels 2012-05-21 20:23:15 -07:00
Jamie Strandboge
64a8698a5f Adjust path for thunderbird to include non-versioned path
Bug-Ubuntu: https://launchpad.net/bugs/990931

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-05-18 15:30:22 -05:00
Jamie Strandboge
cc1c57727d utils/apparmor/sandbox.py:
- print what template we are using on stdout
- don't default to a specific template (may change in future)
- add username to profile name
2012-05-10 06:43:52 -07:00
Jamie Strandboge
af26d11dd2 fix up option parsing
implement profile loading and transition (sudo for now)
2012-05-10 01:17:56 -07:00
Jamie Strandboge
ac3628c1fd make parser optional 2012-05-09 22:56:53 -07:00
Jamie Strandboge
41a960ecc7 pass a parser to parse_args() so we can call it multiple times 2012-05-09 22:38:05 -07:00
Jamie Strandboge
89933a4cb0 add preliminary aa-sandbox which starts an X application in Xephyr. Currently
does not add policy
2012-05-09 11:33:36 -07:00
Jamie Strandboge
352542d12b merge from upstream 2012-05-09 11:29:21 -07:00
Jamie Strandboge
d418a16703 mark easyprof and easyprof test scripts as executable 2012-05-09 11:05:07 -07:00
Christian Boltz
440e9c3d5d various changes in building techdoc.tex:
- make table of contents, footnotes etc. clickable hyperlinks
- use timestamp of techdoc.tex (instead of build time) as creationdate
  in the PDF metadata
- don't include build date on first page of the PDF
- make clean:
  - delete techdoc.out (created by pdftex)
  - fix deletion of techdoc.txt (was techdo_r_.txt)

The initial target was to get reproduceable PDF builds (therefore the 
timestamp-related changes), the other things came up during discussing
this patch with David Haller.

The only remaining difference in the PDF from build to build is the /ID
line.  This line can't be controlled in pdflatex and is now filtered 
out by build-compare in the openSUSE build service (bnc#760867).

Credits go to David Haller for writing large parts of this patch
(but he didn't notice the techdo_r_.txt ;-)


Signed-Off-By: Christian Boltz <apparmor@cboltz.de>
2012-05-09 00:41:06 +02:00
Jamie Strandboge
1db463f4de This patchset is broken into 4 parts:
* the application, library, documentation and installation script
* the initial templates and policy groups. This will undoubtedly need
  refinement as we get feedback from users. Initial policy is based on Ubuntu's
  Application Review Board (ARB) requirements[2].
* tests for the library
* Makefile integration

Templates are stored in /usr/share/apparmor/easyprof/templates and policy
groups in /usr/share/apparmor/easyprof/policygroups. This can be adjusted via
/etc/apparmor/easyprof.conf.

The aa-easyprof.pod has complete documentation on usage with some
additional information in utils/easyprof/README (mostly duplicated
here).

Testing can be performed in a number of ways:
$ cd utils ; make check # runs unit tests and pyflakes

Unit tests manually:
$ ./test/test-aa-easyprof.py

In source manual testing:
$ ./aa-easyprof --templates-dir=./easyprof/templates \
                --policy-groups-dir=./easyprof/policygroups \
                ... \
                /opt/foo/bin/foo

Post-install manual testing:
$ make DESTDIR=/tmp/test PERLDIR=/tmp/test/usr/share/perl5/Immunix install
$ cd /tmp/test
$ PYTHONPATH=/tmp/test/usr/local/.../dist-packages ./usr/bin/aa-easyprof \
    --templates-dir=/tmp/test/usr/share/apparmor/easyprof/templates \
    --policy-groups-dir=/tmp/test/usr/share/apparmor/easyprof/policygroups \
    /opt/bin/foo

(you may also adjust /tmp/test/etc/apparmor/easyprof.conf to avoid
specifying --templates-dir and --policy-groups-dir).

Committing this now based on conversation with John and Steve.

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-05-07 22:37:48 -07:00
Jamie Strandboge
279b5945cb Allow Google Chrome and chromium-browser to work under sanitized helper. While
the chromium and chrome sandboxes are setuid root, they only link in limited
libraries so glibc's secure execution should be enough to not require the
santized_helper (ie, LD_PRELOAD will only use standard system paths (man
ld.so)). Also allow some paths in /opt for Chrome.

Ubuntu-Bug: https://launchpad.net/bugs/964510

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-05-02 07:44:55 -05:00
Jamie Strandboge
d2bcf440e8 Allow software center to work again from browsers. It was blocked by
sanitized_helper. For now this only allows software-center scripts in
/usr/share, but we may need to increase what is allowed in /usr/share if more
things are denied when they shouldn't be.

Ubuntu-Bug: https://launchpad.net/bugs/972367

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-05-02 07:43:30 -05:00
Kees Cook
33557e22ed The m4 shipped to handle Python was incorrectly clearing
$CPPFLAGS. Additionally, do not repeat compiler flags for automake
targets that already include them, and pass more flags to the Perl build.

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-25 12:15:19 -07:00
Kees Cook
67ce4c3bd9 Include IceWeasel in ubuntu-browsers abstraction.
Author: Intrigeri <intrigeri@debian.org>
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661176

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-04-25 12:13:15 -07:00
Kees Cook
dd91c7791b Updates the X abstraction to include gdm3 path.
Author: Intrigeri <intrigeri@debian.org>
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660079

Signed-off-by: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-25 11:36:51 -07:00
Steve Beattie
fc6b59e8b1 Subject: fix aa-logprof rewrite of PUx modes.
When writing out a profile, aa-logprof incorrectly converts PUx execute
permission modes to the syntactically invalid UPx mode, because the
function that converts the internal representation of permissions to
a string emits the U(nconfined) mode bit before the P bit.

This patch corrects this by reordering the way the exec permissions
are emitted, so that P and C modes come before U and i. Based on
http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference#Execute_rules
this should emit the modes correctly in all combined exec modes.
Other approaches to fixing this would require adjusting the data
structure that contains the permission modes, resulting in a more
invasive patch.

Bug: https://launchpad.net/bugs/982619
2012-04-24 11:00:18 -07:00
Christian Boltz
ebe8803e80 If tftp server for dnsmasq is configured it won't serve the boot
file. This patch adds read permissions for /srv/tftpboot/

References: https://bugzilla.novell.com/show_bug.cgi?id=738905

Somehow ;-) [1] Acked-By: John Johansen

[1] see mailinglist for details ;-)
2012-04-16 23:10:43 +02:00
Steve Beattie
a078c1feb5 With the fixing of the change_profile rules to automatically allow
access to /proc/*/attr/{current,exec}, the onexec testcase that
attempted to do things without explicit access granted to
/proc/*/attr/exec in the testsuite passes instead of fails. This commit
takes that into account.
2012-04-11 23:17:52 -07:00
John Johansen
b6c08d74a6 bump version tag for apparmor 2.8 beta-5 2012-04-11 17:24:07 -07:00
John Johansen
68297d9398 Fix change_profile to grant access to api
http://bugs.launchpad.net/bugs/979135

Currently a change_profile rule does not grant access to the
/proc/<pid>/attr/{current,exec} interfaces that are needed to perform
a change_profile or change_onexec, requiring that an explicit rule allowing
access to the interface be granted.

Make it so change_profile implies the necessary
  /proc/@{PID}/attr/{current,exec} w,

rule just like the presence of hats does for change_hat


Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 16:04:33 -07:00
John Johansen
6f27ba3abb Fix protocol error when loading policy to kernels without compat patches
http://bugs.launchpad.net/bugs/968956

The parser is incorrectly generating network rules for kernels that can
not support them.  This occurs on kernels with the new features directory
but not the compatibility patches applied.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 16:03:21 -07:00
John Johansen
7afa066be3 Fix change_onexec for profiles without attachment specification
This fix is needed for the userspace portion of both 
BugLink: http://bugs.launchpad.net/bugs/963756
BugLink: http://bugs.launchpad.net/bugs/978038

change_onexec fails for profiles that don't have an attachment specification
  eg. unconfined

This is because change_onexec goes through 2 permission checks.  The first
at the api call point, which is a straight match of the profile name

  eg.
    /bin/foo
    unconfined

and a second test at exec time, tying the profile to change to to the
exec.  This allows restricting the transition to specific execs.  This
is mapped as a two entry check

  /executable/name\x00profile_name

where the executable name must be marked with the change_onexec permission
and the subsequent profile name as well.

The previous "fix" only covered adding onexec to executable names and
also works for the initial change_onexec request when the profile is
an executable.

However it does not fix the case for when the profile being transitioned
to is not an executable.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 16:02:13 -07:00
John Johansen
562eb63964 expand automated profile generation to to allow profile generation from stdin
This extends the auto-profile generation so that it can take profiles formated
in standard profile language augemented by a few special variables for
the automatically generated rules.  This will all extended the regression
tests in ways that are not currently supported, because mkprofile format
does not match of the profile language.

the special apparmorish variables are
@{gen_elf name} - generate rules for elf binaries
@{gen_bin name} - generate rules for a binary
@{gen_def} - generate default rules
@{gen name} - do @{gen_def} @{gen_bin name}

To generate a profile you do

genprofile --stdin <<EOF
/profile/name {
@{gen /profile/name}
}
EOF

eg. to generate the equivalent of
  genprofile
you would do
  genprofile --stdin <<EOF
  $test {
  @{gen $test}
  }
EOF

and the equiv of
  genprofile $file:rw
would be
  genprofile --stdin <<EOF
  $test {
  @{gen $test}
  $file rw,
  }


while it takes a little more to generate a base profile than the old syntax, it
use the actual profile language (augmented with the special variables), it is a
lot more flexible, and a lot easier to expand when new rule types are added.

eg. of something not possible with the current auto generation
    Generate a profile with a child profile and hat and a trailing profile

genprofile --stdin <<EOF
$test {
@{gen $test}

  profile $bin/open {
@{gen $bin/open}
  }

  ^hatfoo {
     $file rw,
  }
}
profile $bin/exec {
@{gen $bin/exec}
}
EOF

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 15:55:54 -07:00
Jamie Strandboge
852907e1cc clarifications for mount rules
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-04-11 16:34:22 -05:00
Jamie Strandboge
50aa2335eb remove unintended comma from parser/apparmor.d.pod
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 11:53:16 -05:00
Jamie Strandboge
3ff29d2e4b Attached is a patch to add --stderr to the common rules for generating
manpages (and adjust it so that it's one rule instead of eight). It
also fixes the above problem and a similar problem in the aa-exec
manpage.

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-04-11 11:16:47 -05:00
Jamie Strandboge
24e46508d5 parser/apparmor.d.pod: add mount rule syntax and usage. Refinements and
clarifications thanks to Steve Beattie.

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-04-11 11:10:29 -05:00
Steve Beattie
f7ce93b27c libapparmor: add support for ip addresses and ports
Bugs: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/800826
  https://bugzilla.novell.com/show_bug.cgi?id=755923

This patch modifies the libapparmor log parsing code to add support
for the additional ip address and port keywords that can occur in
network rejection rules. The laddr and faddr keywords stand for local
address and foreign address respectively.

The regex used to match an ip address is not very strict, to hopefully
catch the formats that the kernel emits for ipv6 addresses; however,
because this is in a context triggered by the addr keywords, it should
not over-eagerly consume non-ip addresses. Said addresses are returned
as strings in the struct to be processed by the calling application.

Bug: https://launchpad.net/bugs/800826
2012-04-06 15:59:04 -07:00
Christian Boltz
f67168cf2d the usr.lib.dovecot.imap-login profile should allow inet6 in addition to inet
References: https://bugzilla.novell.com/show_bug.cgi?id=755923 

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-04-05 23:51:17 +02:00
Steve Beattie
c80254eb3f Restructure the apparmor.vim creation script a bit to do a bit of
re-use and to structure things to make understanding clearer.
2012-04-05 14:39:57 -07:00
Steve Beattie
01fe7f42a0 Subject: call autodep when creating a child profile
This patch calls autodep on the 'exec'ed binary when the user selects
to place that execution in a child profile. Previously, logprof would
create an entirely empty child profile in complain mode (this fix
still leaves the child profile in complain mode).
2012-03-27 17:21:22 -07:00
Steve Beattie
f37f59f47b Subject: fix autodep profile construction
This patch fixes a couple of issue with autodep:

  1) The initial profile construction had not been adjusted to include
     the 'allow' or 'deny' hash prefixing the path elements. This
     fixes it by eliminating the path portion entirely and pushing
     the path based accesses to the later analysis section of code.

  2) the mode of the original binary was accidentally getting reset
     to 0, when it was intended to initialize the audit field to 0.
2012-03-27 17:18:44 -07:00
Steve Beattie
521b237e8b Subject: autodep - add bash abstraction when using dash script
On Ubuntu and Debian, by default /bin/sh is a symlink to /bin/dash. When
autodep'ing a shell script, the bash abstraction was not being included.
2012-03-27 17:17:25 -07:00
Steve Beattie
daa5b9f496 Subject: aa-logprof - fix handling of 'exec' events (LP: #872446)
Bug: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/872446

Due to logging changes for 'exec' events, 'exec' events in aa-logprof
were being skipped when a profile is in enforcing mode. This patch
addresses the issue.

Bug: https://launchpad.net/bugs/872446
2012-03-27 17:15:50 -07:00
John Johansen
18ddf78dbe Make mount operations aware of 'in' keyword so they can affect the flags build list
Bug #959560 - part 2/3 of fix

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-26 06:19:21 -07:00
John Johansen
3356dc4edd Update the parser to support the 'in' keyword for value lists
Bug #959560 Part 1/3 of fix

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-26 06:17:40 -07:00
John Johansen
c1722cdfdb Fix permission mapping for change_profile onexec
Bug #963756

The kernel has an extended test for change_profile when used with
onexec, that allows it to only work against set executables.

The parser is not correctly mapping change_profile for this test
update the mapping so change_onexec will work when confined.

Note: the parser does not currently support the extended syntax
that the kernel test allows for, this just enables it to work
for the generic case.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-26 06:11:16 -07:00
John Johansen
5c09f44f8b Fix the changehat_wrapper regression test
The capabilities tests where failing in the changehat_wrapper test.  This was because
they could not the changehat_wrapper sub executable, which trying to exec a binary
in the tmpdir.

Specifically if the test was for syscall_ptrace.  It would generate a profile with
a hat for ^syscall_ptrace and attempt to execute ./syscall_ptrace.  However this
was failing in some situations, including when trying to debug from the tmpdir,
as the syscall_XXX binary is no longer local.

Instead use the fully qualified path for the hat name, and the exec path.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-26 06:10:18 -07:00
John Johansen
40588d182a Modifify regression test infrastructure to stop on failure when retainingtmpdir
The retaining of the tmpdir is used during debugging of test failures, but currently
when a test fails, the next test is run overwritting the previous tmpdir value. This
is a problem even when manually running individual test shell scripts if the failure
is not the last test in the script.

Instead cause testing to about when retaintmpdir is true, which will cover the debugging
needs for the majority of failure cases.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-26 06:09:04 -07:00
Jamie Strandboge
83ead1217f clean up utils/vim/common symlink on clean
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-23 11:02:20 -05:00
Jamie Strandboge
4a89f974f6 utils/aa-exec: update copyright year to be 2011-2012 since it was committed
in 2012
2012-03-22 18:07:07 -05:00
Jamie Strandboge
93308e4a29 Use linux/capability.h instead of sys/capability.h
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 16:41:08 -05:00
John Johansen
593cb59d38 bump revision and set tag for apparmor_2.8-beta4 2012-03-22 13:29:46 -07:00
Steve Beattie
1439d006cd Subject: add apparmor.vim install target to utils/ install
This patch adds a make install target for the generated apparmor.vim
file, installing by default into /usr/share/apparmor based on IRC
discussions; alternate suggestions welcome. (Installing directly
into the vim syntax tree is difficult as the system path by default
contains the vim version number.)
2012-03-22 13:27:29 -07:00
Steve Beattie
b4feb99841 Subject: rewrite apparmor.vim generation and integrate into build
This patch replaces the apparmor.vim generating script with a python
version that eliminates the need for using the replace tool from the
mysql-server package. It makes use of the automatically generated
lists of capabilities and network protocols provided by the build
infrastructure. I did not capture all the notes and TODOs that
Christian had in the shell script; I can do so if desired.

It also hooks the generation of the apparmor.vim file into the utils/
build and clean stages.
2012-03-22 13:26:20 -07:00
Steve Beattie
63c43ae9f5 Subject: add missing capabilities to severity.db
This patch adds several missing capabilities to the utils/
severity.db file as detected by the newly added make check target,
along with corresponding severity levels that I believe :re appropriate
(discussion welcome):

  CAP_MAC_ADMIN 10
  CAP_MAC_OVERRIDE 10
  CAP_SETFCAP 9
  CAP_SYSLOG 8
  CAP_WAKE_ALARM 8

The latter two are undocumented in the capabilities(7) man page
provided in Ubuntu 12.04; the syslog one is the separation out of
accessing the dmesg buffer from CAP_SYSADMIN, and the CAP_WAKE_ALARM
allows setting alarms that would wake a system from a suspended state,
if my reading is correct.

This also fixes a trailing whitespace on CAP_CHOWN, moves
CAP_DAC_READ_SEARCH to the end of the section of capabilities it's
in due to its lower priority level (7).
2012-03-22 13:24:12 -07:00
Steve Beattie
a31e1349ce Subject: utils/: add check to ensure severity.db contains all
capabilities

This patch adds a new make target, check_severity_db, to the
utils/Makefile. It greps the severity.db for the presence of each
capability, as computed by the newly abstracted out variable in
common/Make.rules, and issues a build time error if it finds any
missing.

It also silences the check targets, so that only the output from them
will be emitted.
2012-03-22 13:23:19 -07:00
John Johansen
f4240fcc74 Rename and invert logic of is_null to is_accept to better reflect its use
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 13:21:55 -07:00
Steve Beattie
8eaeb44f56 Subject: abstract out cap and net proto generation to common/Make.rules
This patch abstracts out the generation of the lists of capabilities
and network protocol names to the common Make.rules file that is
included in most locations in the build tree, to allow it to be
re-used in the utils/ tree and possibly elsewhere.

It provides the lists in both make variables and as make targets.

It also sorts the resulting lists, which causes it to output differently
than the before case. I did confirm that the results for the generated
files used in the parser build were the same after taking the sorting
into account.
2012-03-22 13:19:27 -07:00
Steve Beattie
bfc1032fc1 Subject: toplevel makefile: correct location of libapparmor
This patch fixes an issue with the toplevel make clean target that did
not take into account where the libapparmor tree had been moved to.
2012-03-22 13:17:48 -07:00
Jamie Strandboge
65f90c0942 fix distro-specific apparmor.vim man page
Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-03-22 15:15:20 -05:00
John Johansen
4fcd1f33dc Fix aa-exec file mode to be 751 so that it can be exec'd 2012-03-22 12:52:58 -07:00
John Johansen
86527a2f4c Fix the return size of aa_getprocattr
aa_getprocattr is returning the size of the buffer not the size of the
data read that it is supposed to return.  Also update the man page to
reflect the return value as documented in the functions, and update
the test cases to check the return value.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:58:18 -07:00
John Johansen
648166ecca Fix error case of aa_getprocattr to set buffers to NULL
While aa_getprocattr does return the documented error code on failure
the **buf and **mode parameters can point into the buffer that was
allocated and then discarded on failure.

Set them to null on failure so that even if the error code is ignored
they do not point to heap data.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:57:18 -07:00
John Johansen
2e3b5ff134 Fix mnt_flags passed for remount
Remount should not be screening off the set of flags it is.  They are
the set of flags that the kernel is masking out for make_type and
should not be used on remount. Instead just screen off the other cmds
that can have their own rules generated.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:55:58 -07:00
John Johansen
3c9cdfb841 rework the is_null test to not include deny
The deny information is not used as valid accept state information,
so remove it from the is_null test.  This does not change the dfa
generated but does result in the dumped information changing,
as states that don't have any accept information are no longer
reported as accepting. This is what changes the number of states
reported in the minimize tests.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:55:00 -07:00
John Johansen
e7f6e0f9f1 Fix dfa minimization around the nonmatching state
The same mappings routine had two bugs in it, that in practice haven't
manifested because of partition ordering during minimization.  The
result is that some states may fail comparison and split, resulting
in them not being eliminated when they could be.

The first is that direct comparison to the nonmatching state should
not be done as it is a candiate for elimination, instead its partion
should be compared against.  This simplifies the first test


The other error is the comparison
  if (rep->otherwise != nonmatching)

again this is wrong because nomatching should not be directly
compared against.  And again can result in the current rep->otherwise
not being eliminated/replaced by the partion.  Again resulting in
extra trap states.

These tests where original done the way they were because
 ->otherwise could be null, which was used to represent nonmatching.
The code was cleaned up a while ago to remove this, ->otherwise is
always a valid pointer now.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:50:35 -07:00
John Johansen
7fcbd543d7 Factor all the permissions dump code into a single perms method
Also make sure the perms method properly switches to hex and back to dec
as some of the previous perm dump code did not.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-22 07:49:43 -07:00
John Johansen
2f603cc73e Add the aa-exec command line utility
The aa-exec command can be used to launch an application under a specified
confinement, which may be different for what regular profile attachment
would apply.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-20 11:45:13 -07:00
Steve Beattie
69dc13efdf This patch adds testcases that confirm that using a bare
file,

rule will allow access to both the '/' directory and other directories.
2012-03-15 16:46:50 -07:00
John Johansen
456220db56 Bump revision and tag for 2.8-beta3 2012-03-15 12:57:13 -07:00
John Johansen
c50858a877 Update permission mapping for changes made to the upstream kernel patch.
The changes are around how user data is handled.

1. permissions are mapped before data is matched
2. If data is to be mapped a AA_CONT_MATCH flag is set in the permissions
   which allows data matching to continue.
3. If data auditing is to occur the AA_AUDIT_MNT_DATA flag is set

This allows better control over matching and auditing of data which can
be binary and should not be matched or audited

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 12:54:34 -07:00
John Johansen
a11efe838a Fix the bare file rule so that it grants access to to root
file, should grant access to all files paths on the system but it does
not currently allow access to /

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 12:16:56 -07:00
John Johansen
d6dc04d737 Fix pivot_root to support named transitions correctly
Rename the pivotroot rule to pivot_root to match the command and the fn
and fix it to support named transition correctly leveraging the parsing
action used for exec transitions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 12:14:15 -07:00
John Johansen
feeea88a58 Fix the case where no flags match
Currently the backend doesn't like it (blows up) when the a vector entry is
empty.  For the case where no flags match build_mnt_flags generates an
alternation of an impossible entry and nothing

  (impossible|)

This provides the effect of a null entry without having an empty vector
entry.  Unfortunately the impossible entry is not correct.

Note: how this is done needs to be changed and fixed in the next release
this is just a minimal patch to get it working for 2.8


Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 12:10:35 -07:00
John Johansen
36d44a3b25 Fix the mount flags set generated by the parser
When generating the flag set the parser was not generating the complete
set when flags where not consecutive.  This is because the len value
was not being reset for each flag considered, so once it was set for
a flag, then the next flag would have to be set to reset it else the
output string was still incremented by the old len value.

  Eg.
  echo "/t { mount options=rbind, }" | apparmor_parser -QT -D rule-exprs

  results in
  rule: \x07[^\000]*\x00[^\000]*\x00[^\000]*\x00\x0d  ->

  however \x0d only covers the bind and not the recursive flag

This is fixed by adding a continue to the flags generation loop for the
else case.

  resulting the dump from above generating

  rule: \x07[^\000]*\x00[^\000]*\x00[^\000]*\x00\x0d\x0f  ->

  \x0d\x0f covers both of the required flags

Also fix the flags output to allow for the allow any flags case.  This
was being screened out.  By masking the flags even when no flags where
specified.

  this results in a difference of

  echo "/t { mount, }" | apparmor_parser -QT -D rule-exprs

    rule: \x07[^\000]*\x00[^\000]*\x00[^\000]*\x00(\x01|)(\x02|)(\x03|)(\x04|)(\x05|)\x00[^\000]*

  becoming
    \x07[^\000]*\x00[^\000]*\x00[^\000]*\x00[^\000]*\x00[^\000]*

  which is simplified and covers all permissions vs. the first rule output

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 09:03:48 -07:00
John Johansen
fc5f4dc86f Revert commit: -r 1955 Default profiles to be chroot relative
This commit causes policy problems because we do not have chroot rules
and policy extension to support it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-15 08:59:56 -07:00
John Johansen
59c0bb0f46 Fix minimize.sh test to screen out more parser error messages by grepping
closer to the expected -O dfa-states output
2012-03-09 06:48:03 -08:00
John Johansen
fae11e12cf Mark the minimize test as executable 2012-03-09 05:54:54 -08:00
John Johansen
e0a74881bf Bump version for 2.8-beta2 2012-03-09 04:44:37 -08:00
John Johansen
ce38857061 tag apparmor_2.8-beta2 2012-03-09 04:27:47 -08:00
John Johansen
c8e134930f Fix the "Kernel features are written to cache:" test
the cache test is failing because it assumes that kernel features are
stored in a file instead of a directory

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:25:03 -08:00
John Johansen
3876299fa0 Fix caching when used with a newer kernel with the feature directory
On newer kernels the features directory causes the creation of a
cache/.feature file that contains newline characters.  This causes the
feature comparison to fail, because get_flags_string() uses fgets
which stop reading in the feature file after the first newline.

This caches the features comparision to compare a single line of the
file against the full kernel feature directory resulting in caching
failure.

Worse this also means the cache won't get updated as the parser doesn't
change what set gets caches after the .feature file gets created.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:24:20 -08:00
John Johansen
b0b2bde160 Fix permissions attached to the bare file keyword
file,

was not given the correct permissions.  It was only being given the owner
set of permissions.  This would result in rejects when trying look at
files owned by other users

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:23:25 -08:00
John Johansen
3a1b7bb54c Fix infinite loop bug in normalization.
There are some rare occassions, when lots of alternations are used that
tree simplification can result in an expression of
  (E | (E | E)) or (E . (E . E))   where E is the epsnode

both of these expressions will lead to an inifinite loop in normalize_tree
as the epsnode test
       if ((&epsnode == t->child[dir]) &&
       	        (&epsnode != t->child[!dir]) &&
		      	         dynamic_cast<TwoChildNode *>(t)) {

and the tree node rotation test
    	} else if ((dynamic_cast<AltNode *>(t) &&
	           dynamic_cast<AltNode *>(t->child[dir])) ||
		   			   (dynamic_cast<CatNode *>(t) &&
					   			    dynamic_cast<CatNode *>(t->child[dir]))) {

end up undoing each others work, ie.

                eps flip                 rotate
  (E | (E | E)) --------> ((E | E) | E) -------> (E | (E | E))

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:22:42 -08:00
John Johansen
04ef92ca94 Fix a couple build warnings in mount.c
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:21:54 -08:00
John Johansen
d7a6860a23 Fix Make file for mount.c so that warnings are emitted during a build
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:21:06 -08:00
John Johansen
5e361a4a05 Fix dfa minimization to deal with exec conflicts
Minimization was failing because it was too agressive.  It was minimizing
as if there was only 1 accept condition.  This allowed it to remove more
states but at the cost of loosing unique permission sets, they where
being combined into single commulative perms.  This means that audit,
deny, xtrans, ... info on one path would be applied to all other paths
that it was combined with during minimization.

This means that we need to retain the unique accept states, not allowing
them to be combined into a single state.  To do this we put each unique
permission set into its own partition at the start of minimization.

The states within a partition have the  same permissions and can be combined
within the other states in the partition as the loss of unique path
information is will not result in a conflict.

This is similar to what perm hashing used to do but deny information is
still being correctly applied and carried.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:20:19 -08:00
John Johansen
cf5f7ef9c2 Fix the x intersection consistency test
The in x intersection consistency test for minimization was failing because
it was screening off the AA_MAY_EXEC permission before passing the exec
information to the consistency test fn.  This resulted in the consistency
test fn not testing the consistency because it treated the permission set
as not having x permissions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:19:24 -08:00
John Johansen
811d8aefa3 Fix transition character reporting of dfa dumps
Make them report a hex value strings instead of the default C++
\vvvvv

Make them consistent,
- Dump to report the default transition and what isn't transitioned
  on it.


Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-03-09 04:18:35 -08:00
John Johansen
37f446dd79 Fix/cleanup the permission reporting for the dfa dumps
The permission reporting was not reporting the full set of permission
flags and was inconsistent between the dump routines.

Report permissions as the quad (allow/deny/audit/quiet) in hex.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:17:47 -08:00
John Johansen
1a01b5c296 Fix/cleanup the dfa dump routines output to provide state label
Fix the transitions states output so that they output the state label
instead of the state address.  That is
  {1} -> 0x10831a0:  /
now becomes
  {1} -> {2}:  /

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-09 04:14:34 -08:00
Jamie Strandboge
b47197b881 allow read access to ~/.drirc
Bug-Ubuntu: https://launchpad.net/bugs/941506

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-02 15:09:21 -06:00
Jamie Strandboge
3e5ae57164 Description: allow read access to /usr/share/texmf/fonts
Bug-Ubuntu: https://launchpad.net/bugs/941503

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-03-02 15:08:03 -06:00
Jamie Strandboge
a0048ec064 ubuntu-browsers.d/java: update to fix LP: #945019 2012-03-02 13:03:04 -06:00
Jamie Strandboge
c35e10f875 fix path to java in ubuntu-browsers.d/java
Bug-Ubuntu: https://launchpad.net/bugs/943161

Acked-By: Jamie Strandboge <jamie@canonical.com>
2012-03-02 11:18:11 -06:00
Jamie Strandboge
46d9aae952 include /etc/drirc in the X abstraction
Bug-Ubuntu: https://launchpad.net/bugs/918879

Acked-By: Jamie Strandboge <jamie@canonical.com>
Signed-off-by: Kees Cook <kees@ubuntu.com>
2012-02-28 12:50:20 -06:00
John Johansen
bd67bb909a tag apparmor 2.8 beta1 release as 2.7.99 2012-02-24 04:38:24 -08:00
John Johansen
c454964e5b Update current mount tests to reflect how they should behave with mount rules
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:29:08 -08:00
John Johansen
e61b7b9241 Update the copyright dates for the apparmor_parser
Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:21:59 -08:00
John Johansen
954dc6f694 Fix hexdigit conversion in the pcre parser
The pcre parser in the dfa backend is not correctly converting escaped
hex string like 
  \0x0d

This is the minimal patch to fix, and we should investigate just using
the C/C++ conversion routines here.

I also I nominated for the 2.7 series.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@gmail.com>
2012-02-24 04:20:46 -08:00
John Johansen
c9e31b7fbd Add mount rules
Add the ability to control mounting and unmounting

The basic form of the rules are.

  [audit] [deny] mount [conds]* [device] [ -> [conds] path],
  [audit] [deny] remount [conds]* [path],
  [audit] [deny] umount [conds]* [path],
  [audit] [deny] pivotroot [oldroot=<value>] <path> -> <profile>

  remount is just a short cut for mount options=remount

  where [conds] can be
    fstype=<expr>
    options=<expr>


  conds follow the extended conditional syntax of allowing either:

  * a single value after the equals, which has the same character range as
    regular IDS (ie most anything but it can't be terminated with a , (comma)
    and if spaces or other characters are needed it can be quoted

    eg.
       options=foo
       options = foo
       options="foo bar"

  * a list of values after the equals, the list of values is enclosed within
    parenthesis () and its has a slightly reduced character set but again
    elements can be quoted.

    the separation between elements is whitespace and commas.

    eg.
      options=(foo bar)
      options=(foo, bar)
      options=(foo , bar)
      options=(foo,bar)


The rules are flexible and follow a similar pattern as network, capability,
etc.

  mount,	# allow all mounts, but not umount or pivotroot

  mount fstype=procfs,  # allow mounting procfs anywhere

  mount options=(bind, ro) /foo -> /bar,  # readonly bind mount

  mount /dev/sda -> /mnt,

  mount /dev/sd** -> /mnt/**,

  mount fstype=overlayfs options=(rw,upperdir=/tmp/upper/,lowerdir=/) overlay -> /mnt/

  umount,

  umount /m*,


Currently variables and regexs are are supported on the device and mount
point. ie.
  mount <devince> -> <mount point>,

Regexes are supported in fstype and options.  The options have a further
caveat that regexs only work if the option is fs specific option.

  eg. options=(upperdir=/tmp/*,lowerdir=/)

regex's will not currently work against the standard options like ro, rw
nosuid


Conditionals (fstype) can only be applied to the device (source) at this
time and will be disregarded in situations where the mount is manipulating
an existing mount (bind, remount).

Options can be specified multiple times
  mount option=rw option=(nosuid,upperdir=/foo),

and will be combined together into a single set of values

The ordering of the standard mount options (rw,ro, ...) does not matter
but the ordering of fs specific options does.

Specifying that the value of a particular option does not matter can be
acheived by providing both the positive and negative forms of and option
  option=(rw,ro) options=(suid,nosuid)

For the fs specific options specifying that a particular value does not
matter is achieve using a regex with alternations.

Improvements to the syntax and order restrictions are planned for the
future.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:19:38 -08:00
John Johansen
df46234c55 Generate the features list from the features directory
Newer versions of AppArmor use a features directory instead of a file
update the parser to use this to determine features and match string

This is just a first pass at this to get things up quickly.  A much
more comprehensive rework that can parse and use the full information
set is needed.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-24 04:18:45 -08:00
John Johansen
662ad60cd7 Extend the information dumped by -D rule-exprs to include permissions
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-24 04:17:19 -08:00
John Johansen
a5640ec89c Default profiles to be chroot relative
Due to changes in path looks and the work going forward default profiles
to resolve relative to the chroot instead of the namespace.

This will only affect profiles that are used on tasks within a chroot.
For now it will be possible to get the old default namespace relative
behavior by passing the namespace_relative flag to the profile

eg.
  profile /example (namespace_relative) { .. }

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-24 04:14:00 -08:00
John Johansen
93cd01d7e6 Add const to yyerror parameter to get rid of compile warning
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:17:41 -08:00
John Johansen
ca9b813aea Add missing ifdefs in parser.h
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:16:18 -08:00
John Johansen
cbe3f33daf Add Basic infrastructure support for the policydb
policydb is the new matching format, that combines the matching portions
of different rules into a single dfa/hfa.  This patch only lays some ground
work it does not add encoding of any rules into the policydb

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-16 08:14:46 -08:00
John Johansen
b8f36df713 Make value_list generic so it can be reused.
value_list can be reused by conditionals and list values, so pull it out
and abstract it some more.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:07:28 -08:00
John Johansen
e087db57b2 Allow the 'file' keyword to be optionally used on file rules.
Add the optional 'file' keyword to the language/grammer.  The main reason
for doing this is to support false token injection.  Which is needed
to move towards the parser being broken out into an api that can be
used to parse individual rule types, separate from parsing the whole file.

Since we are adding the token to the grammar expose it to userspace with
the 'file' keyword.  While not needed it helps bring consistency, as all
the other rule types start with a keyword (capability, network, rlimit, ...).

Also allow the bare keyword to be used to represent allowing all file
operations, just as with network and capability.  Domain transitions are
defaulted to ix.  Thus

  file,

is equivalent to

  /** rwlkmix,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:06:04 -08:00
John Johansen
dd7427d1eb Remove setting of capabilities from the syntax
The ability to set capabilities from a profile has been removed from the
kernel for several releases.  Remove it from the parser as well.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:04:04 -08:00
John Johansen
4a4ec1c54a Make expressing all capabilities easier
Allow the capability rule to be bare to represent all capabilities similar
to how network, and other rule types work.

  capability,

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 08:01:47 -08:00
John Johansen
18c87e98bf Enable the parser to pass the next token to be returned to the lexer
Currently the parser can not directly influence the lexer output.  This
limits the grammar and also how the parser can be invoked.  Allow the
parser to pass the next TOKEN that the lexer will return.

This is has two uses:  It allows us to trick the bison parser into having
multiple start symbols, allowing us to say invoke the parser on an
individual network or file rule.  It also allows the semantic analysis of
the parser to change the language recognized.  This can be leveraged to
overcome some of the limitation of bison's LALR parse generator.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:59:23 -08:00
John Johansen
8a3edd677c Require matched mode strings to terminate
mode strings overlap with other potential commands, or strings, and as
currently written can be match as a leading substring of an ID.  Eliminate
the leading substring case by requiring that for a mode string to be
recognized it must be terminated by whitespace, eol, eof, or
comma (end of rule).

The other cases where modes string overlap are ambiguous and the ID should
be quoted to remove the ambiguity.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:56:53 -08:00
John Johansen
def8c20168 Instead of using a special flags= token and keyword use TOK_CONDID
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:53:04 -08:00
John Johansen
613997fd7e Add generic support extended conditional syntax
extended conditionals use a syntax of
    cond=value
    cond=(value1 value2)
    cond=(value1,value2)
  where the comma is optional and supported as such because the
  flags syntax used them

  The mount patch extends, and improves on this patch, the changes probably
  should have been separated out but ...

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:51:33 -08:00
John Johansen
eabeb4f7b3 Convert FLAGS_MODE start condition to a generic list of values start cond
Signed-off-by: John Johansen <john.johansen@canonical.com>
jj@ortho:~/apparmor/aa-test/parser$ guilt header
Convert FLAGS_MODE start condition to a generic list of values start cond

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:49:12 -08:00
John Johansen
ac6c7dd37f Rework the definition of ID and POST_VAR_ID to use a define for the charset
ID and POST_VAR_ID define a set of characters that is reused, pull this
out to avoid making mistakes when updating the character set.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:46:43 -08:00
John Johansen
e7c550243c Make second minimization pass optional
The removal of deny information is a one way operation, that can result
in a smaller dfa, but also results in a dfa that should not be used in
future operations because the deny rules from the precomputed dfa would
not get applied.

For now default filtering out of deny information to off, as it takes
extra time and seldom results in further state reduction.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:43:02 -08:00
John Johansen
6f95ff5637 Track full permission set through all stages of DFA construction.
Previously permission information was thrown away early and permissions
where packed to their CHFA form at the start of DFA construction.  Because
of this permissions hashing to setup the initial DFA partitions was
required as x transition conflicts, etc. could not be resolved.

Move the mapping of permissions to CHFA construction, and track the full
permission set through DFA construction.  This allows removal of the
perm_hashing hack, which prevented a full minimization from happening
in some DFAs.  It also could result in x conflicts not being correctly
detected, and deny rules not being fully applied in some situations.

Eg.
 pre full minimization
   Created dfa: states 33451
   Minimized dfa: final partitions 17033

 with full minimization
   Created dfa: states 33451
   Minimized dfa: final partitions 9550
   Dfa minimization no states removed: partitions 9550

The tracking of deny rules through to the completed DFA construction creates
a new class of states.  That is states that are marked as being accepting
(carry permission information) but infact are non-accepting as they
only carry deny information.  We add a second minimization pass where such
states have their permission information cleared and are thus moved into the
non-accepting partion.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-16 07:41:40 -08:00
John Johansen
82a20d9bb8 Track deny and quiet perms during DFA construction
Delay the packing of audit and quiet permissions until chfa construction,
and track deny and quiet perms during DFA construction, so that we will
be able to do full minimization.  Also delay the packing of audit and

Signed-off-by: John Johansen <john.johansen@canonical.com>
2012-02-16 07:40:21 -08:00
Steve Beattie
fb55e9cddc Two patches in one:
From: Kees Cook <kees@ubuntu.com>
This is a trivial manpage fix that makes pod2man stop yelling at me.
Acked-By: Steve Beattie <sbeattie@ubuntu.com>

From: Steve Beattie <sbeattie@ubuntu.com>
This patch adds --stderr to pod2man to make it report errors, as well as
fixes a few other minor text issues I noticed.
Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-15 16:34:03 -08:00
Christian Boltz
4d406621ee update apparmor.vim to support "capability," (which allows all
capabilities). The rule will be marked in the "dangerous capability"
color.

Additionally, the patch removes the (already commented out) code for 
"set capability".

Acked-by: Kees Cook <kees@ubuntu.com>
2012-02-15 23:44:39 +01:00
Christian Boltz
e074def743 Add the missing k permission for /etc/.pwd.lock to the userdel profile.
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-02-13 10:50:37 +01:00
Jamie Strandboge
13e959f8c0 Author: Jamie Strandboge <jamie@canonical.com>
Description: glibc's __get_nprocs() now checks /sys/devices/system/cpu/online
 in addition to /proc/stat for the number of processors. This is used in the
 _SC_NPROCESSORS_ONLN implementation, a part of sysconf. This was introduced in
 upstream glibc commit:
 84e2a551a7
Bug-Ubuntu: https://launchpad.net/bugs/929531

Acked-By: Jamie Strandboge <jamie@canonical.com>
Acked-By: Christian Boltz <apparmor@cboltz.de>
2012-02-09 21:06:24 -06:00
Jamie Strandboge
5151168071 abstractions/ubuntu-helpers: use Pixr instead of Pix in case we have an
interpreted file
2012-01-24 09:00:32 -06:00
Christian Boltz
77f37e84eb Update abstractios for KDE4
(At least) openSUSE uses ~/.kde4 to store KDE4 settings.
This patch changes ~/.kde/ to ~/.kde{,4} in all abstractions.

The patch is mostly from Velery Valery, I only fixed a merge conflict 
and added the kmail{,2} part in private-files-strict.

References: https://bugzilla.novell.com/show_bug.cgi?id=741592

Acked-By: Steve Beattie <sbeattie@ubuntu.com> for both trunk and 2.7.
2012-01-19 15:20:28 +01:00
Jamie Strandboge
8e3b75c40a update p11-kit to allow mmap of libraries in pkcs directories
Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-18 16:22:08 -06:00
Jamie Strandboge
4037c3ae65 Adjust dnsmasq profile for read access to /{,var/}run/nm-dns-dnsmasq.conf
which is needed by NetworkManager integration in Ubuntu. (LP: #917628)

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-18 16:20:43 -06:00
Steve Beattie
c817e01774 Bug: https://bugs.launchpad.net/bugs/917859
A bug in Ubuntu reported that the aspell abstraction does
not allow write access to the user customizable dictionaries, the
personal dictionary (~/.aspell.$LANG.pws) and the personal replacement
dictionary (~/.aspell.$LANG.prepl). It also adjusts the abstraction
to add the owner modifier to the personal dictionaries.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>

Bug: https://launchpad.net/bugs/917859
2012-01-18 10:15:57 -08:00
Jamie Strandboge
8d1e8c9c2e ubuntu-browsers.d/plugins-common: include the ubuntu-helpers profile here as
it is needed by pretty much all of the browser abstractions. aa-update-browser
unconditionally adds the plugins-common abstraction, so this should be
sufficient.
2012-01-17 08:22:11 -06:00
Jamie Strandboge
b0ad1303ac update ubuntu-integration abstraction for multiarch with gst-plugin-scanner
(LP: #917641)

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-17 08:00:56 -06:00
Jamie Strandboge
e4e173233c update ubuntu-browsers.d/text-editors to work with emacs2[2-9] 2012-01-17 07:10:33 -06:00
Jamie Strandboge
dd1756ba9e profiles/apparmor.d/abstractions/ubuntu-helpers: add inet6 too 2012-01-13 11:19:55 +01:00
Steve Beattie
cec0d50cfd Regression testsuite: remove a bit more code that's no longer needed
in prologue.inc.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 12:37:24 +01:00
Steve Beattie
1ef2d7e757 Regression testsuite: the coredump checkcorefile() function did not
properly quote the _known variable (set when the tests are marked as
expected failures) when the expectation was that the testcase would
produce a corefile. This would result in a failed testcase reporting
XFAIL incorrectly.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 12:32:32 +01:00
Steve Beattie
03976a038e Regression testsuite: remove unneeded parsing of permissions on the
suffix of an image= flag, as it's no longer needed. It also eliminates
code that emitted the permissions based on the result of the parse.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen@canonical.com
2012-01-12 12:31:25 +01:00
Steve Beattie
83a3de91f8 Regression testsuite: add a flag to mkprofile.pl to not automatically
add 'rix' permissions on executable images (but still auto-generate
ldd dependencies), for use when specifying alternate permissions
on executables.

Where appropriate, it also converts a few testcases to make use of
the option.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 12:29:10 +01:00
Steve Beattie
e7cc3e2094 Regression testsuite: add the ability to add multiple binaries to a
generated profile and have the ldd auto-generation of rules occur on
it. It also kills all testcase usage of $dynlibs, which had stopped
being generated by prologue.inc in a prior patch.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 12:23:51 +01:00
Steve Beattie
4fa434a3d0 Regression testsuite: move the ldd analysis of binaries to the
mkprofile.pl helper and take the convoluted code out of the bash
prologue.inc. It also detects if the binary is a script and performs
ldd analysis on the interpreter.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 12:20:22 +01:00
Steve Beattie
44ca1c0f11 Regression testsuite: rename the emit_ functions to gen_ which reflects
their purpose a little more accurately; renames the dump_flags to
emit_flags for the same reason, and also adds a modicum a function
prototype information to the function declarations.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 11:49:32 +01:00
Steve Beattie
a0fbc1f26c Regression testsuite: move the generation of the rules that grant
write access to /proc/*/attr/current to mkprofile.pl from prologue.inc.

Signed-Off-By: Steve Beattie <sbeattie@ubuntu.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-12 11:39:57 +01:00
John Johansen
62a7934ea6 Disable caching when a namespace is specified
Profile loads when specifying namespaces currently conflict with caching.
If the profile (ignoring the specified namespace) is in the cache, then
the cached profile will be loaded, replacing the profile in the current
namespace instead of loading the profile to the new namespace.

Fix this by disabling caching when a namespace is specified, forcing the
profile to be compiled.

NOTE: this will not affect profiles loaded from within a namespace using
      either the same or a separate directory as the base to load a namespac
      from.  This only affects loading profiles directly into a child
      namespace.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-11 17:26:51 +01:00
John Johansen
5fdf33c689 Add an option to allow setting the cache's location.
Currently the cache location is fixed and links are needed to move it.
Add an option that can be set in the apparmor_parser.conf file so distros
can locate the cache where ever makes sense for them.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-11 17:25:18 +01:00
John Johansen
7031a91aec Disable revalidation/revocation tests
The behavior for revalidation/revocation of open files has changed
with the current kernel code, resulting in these tests being reported
as failing even though they are showing expected behavior.

Under the current kernel module this form of revalidation/revocation
can not be tested reliably, so just changing the expected result is
not enough, completely disable the tests for now.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-11 16:50:34 +01:00
Jamie Strandboge
39a3f5b08d Add profiles/apparmor.d/abstractions/ubuntu-helpers:
Lenient profile that is intended to be used when 'Ux' is desired but
does not provide enough environment sanitizing. This effectively is an
open profile that blacklists certain known dangerous files and also
does not allow any capabilities. For example, it will not allow 'm' on files
owned be the user invoking the program. While this provides some additional
protection, please use with care as applications running under this profile
are effectively running without any AppArmor protection. Use this profile
only if the process absolutely must be run (effectively) unconfined.

Limitations:
1. This does not work for root owned processes, because of the way we use
   owner matching in the sanitized helper. We could do a better job with
   this to support root, but it would make the policy harder to understand
   and going unconfined as root is not desirable anyway.

2. For this sanitized_helper to work, the program running in the sanitized
   environment must open symlinks directly in order for AppArmor to mediate
   it. This is confirmed to work with:
    - compiled code which can load shared libraries
    - python imports
   It is known not to work with:
    - perl includes

3. Going forward it might be useful to try sanitizing ruby and java

Use at your own risk. This profile was developed as an interim workaround for
LP: #851986 until AppArmor implements proper environment filtering.

Acked-by: Jamie Strandboge <jamie@canonical.com>



Adjust ubuntu abstractions to use sanitized_helper instead of (P)Ux.

Acked-by: Jamie Strandboge <jamie@canonical.com>



Update launchpad-integration to use a sanitized helper in a similar manner
as that in ubuntu-helpers.

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-11 15:20:42 +01:00
Jamie Strandboge
7eee94290b add xdg-desktop abstraction to gnome and kde. Acked via discussions 2012-01-11 14:17:32 +01:00
Jamie Strandboge
45e7265c82 Create an xdg-desktop abstraction based on the upstream documentation for
creating owner writes on things like ~/.cache and ~/.config

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-11 13:00:34 +01:00
Jamie Strandboge
3c2684b674 merge from trunk 2012-01-11 09:48:22 +01:00
Jamie Strandboge
b1a8e7cf44 fix up comments in launchpad-integration 2012-01-11 09:27:22 +01:00
Jamie Strandboge
7887d5906d don't #include ubuntu-helpers in the abstractions. This can only be included
once in policy, otherwise you will get an error regarding multiple definitions
for sanitized_helper
2012-01-11 09:00:35 +01:00
Jamie Strandboge
b0ef4d2b6a add note to ubuntu-helpers regarding needing to only include it once 2012-01-11 08:50:47 +01:00
Jamie Strandboge
c626e62da6 fix missing '}' in ubuntu-helpers 2012-01-11 08:48:07 +01:00
Jamie Strandboge
b93c49974c update ubuntu-browsers to also Cx the firefox.sh in /usr/lib 2012-01-11 00:59:38 +01:00
Jamie Strandboge
d045d609be update launchpad-integration to use a sanitized helper 2012-01-10 20:54:57 +01:00
Jamie Strandboge
333cd41d33 update ubuntu abstractions to use the sanitized helper 2012-01-10 20:54:38 +01:00
Jamie Strandboge
2526933747 ubuntu-helpers: account for lib32 and lib64 2012-01-10 19:57:58 +01:00
Christian Boltz
a33c5822a9 when using smbldap-useradd using this smb.conf entry
add machine script = /usr/sbin/smbldap-useradd -t 5 -w "%u"
smbd obviously needs x permissions for smbldap-useradd.

The commit also adds a new profile for usr.sbin.smbldap-useradd (based on 
the audit.log from Alexis Pellicier).

Additionally, I moved the "/etc/samba/* rwk" rule next to the other 
/etc-related rules in the smbd profile.

References: https://bugzilla.novell.com/show_bug.cgi?id=738041
2012-01-10 19:06:24 +01:00
Jamie Strandboge
d6c4f56da8 add profiles/apparmor.d/abstractions/ubuntu-helpers:
Lenient profile that is intended to be used when 'Ux' is desired but
does not provide enough environment sanitizing. This effectively is an
open profile that blacklists certain known dangerous files and also
does not allow any capabilities. For example, it will not allow 'm' on files
owned be the user invoking the program. While this provides some additional
protection, please use with care as applications running under this profile
are effectively running without any AppArmor protection. Use this profile
only if the process absolutely must be run (effectively) unconfined.

Limitations:
1. This does not work for root owned processes, because of the way we use
   owner matching in the sanitized helper. We could do a better job with
   this to support root, but it would make the policy harder to understand
   and going unconfined as root is not desirable any way.

2. For this sanitized_helper to work, the program running in the sanitized
   environment must open symlinks directly in order for AppArmor to mediate
   it. This is confirmed to work with:
    - compiled code which can load shared libraries
    - python imports
   It is known not to work with:
    - perl includes

3. Going forward it might be useful to try sanitizing ruby and java

Use at your own risk. This profile was developed as an interim workaround for
LP: #851986 until AppArmor implements proper environment filtering.
2012-01-10 18:36:14 +01:00
Steve Beattie
25f800ac7d Fix from Felix Geyer: block write access to ~/.kde/env because KDE
automatically sources scripts in that folder on startup.

Bug: https://launchpad.net/bugs/914190
2012-01-10 11:54:12 +01:00
Steve Beattie
ad0f942bb5 Fix from Felix Geyer: in the enchant abstraction, allow the creation of
enchant .config directory.

Bug: https://launchpad.net/bugs/914184
2012-01-10 11:37:54 +01:00
Steve Beattie
1ff5a08f60 utils/Immunix/AppArmor.pm: fixes the profile autogeneration code to
include read access to the script itself for interpreted scripts.
2012-01-09 17:42:55 +01:00
Steve Beattie
8a223ce3d5 utils/Immunix/AppArmor.pm: update the initial profile generation
for python and ruby scripts to include the respective abstractions.
2012-01-09 17:39:31 +01:00
Christian Boltz
2f85e0b7d2 according to Peter Czanik, the openSUSE syslog-ng maintainer, syslog-ng
needs capability dac_read_search.

References: https://bugzilla.novell.com/show_bug.cgi?id=731876

ACKed-by: Steve Beattie <steve@nxnw.org>
2012-01-09 13:28:25 +01:00
Jamie Strandboge
6d55882b4a add p11-kit abstraction (LP: #912754, LP: #912752)
From the README in the toplevel source:
"[P11-KIT] Provides a way to load and enumerate PKCS#11 modules. Provides a
standard configuration setup for installing PKCS#11 modules in such a way that
they're discoverable."

File locatations are described in [1]. There is a global configuration file in
/etc/pkcs11/pkcs11.conf. Per module configuration happens in
/etc/pkcs11/<module name>. There is also user configuration in ~/.pkcs11, but
IMO this should not be allowed in the abstraction. Example configuration can be
seen in the upstream documentation[2].

This will likely need to be refined as more applications use p11-kit.

[1]http://p11-glue.freedesktop.org/doc/p11-kit/config-locations.html
[2]http://p11-glue.freedesktop.org/doc/p11-kit/config-example.html

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>


Also add p11-kit to authentication abstraction

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 17:01:39 -06:00
Jamie Strandboge
c5ccbb50d2 add p11-kit to authentication abstraction
Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-06 11:46:52 -06:00
Jamie Strandboge
572bab7e84 add p11-kit abstraction (LP: #912754, LP: #912752)
From the README in the toplevel source:
"[P11-KIT] Provides a way to load and enumerate PKCS#11 modules. Provides a
standard configuration setup for installing PKCS#11 modules in such a way that
they're discoverable."

File locatations are described in [1]. There is a global configuration file in
/etc/pkcs11/pkcs11.conf. Per module configuration happens in
/etc/pkcs11/<module name>. There is also user configuration in ~/.pkcs11, but
IMO this should not be allowed in the abstraction. Example configuration can be
seen in the upstream documentation[2].

This will likely need to be refined as more applications use p11-kit.

[1]http://p11-glue.freedesktop.org/doc/p11-kit/config-locations.html
[2]http://p11-glue.freedesktop.org/doc/p11-kit/config-example.html

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-06 11:45:44 -06:00
John Johansen
f561b8cdfe Make hfa::match not need to walk a string twice
Currently hfa::match calls hfa::match_len to do matching.  However this
requires walking the input string twice.  Instead provide a match routine
for input that is supposed to terminate at a given input character.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 09:04:36 -08:00
John Johansen
3ff8b4d19a Add basic string matching to the hfa
Add the ability to match strings directly from the hfa instead of needing
to build a cfha.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 09:03:20 -08:00
Jamie Strandboge
47280bb483 Description: allow read of @{HOME}/.cups/client.conf and
@{HOME}/.cups/lpoptions
Bug-Ubuntu: https://launchpad.net/bugs/887992

Added owner match per Steve Beattie and lpoptions per Steve and Christian Boltz
2012-01-06 10:45:34 -06:00
Jamie Strandboge
2b4e235ffd Description: allow read access of /etc/python{2,3}.[0-7]*/sitecustomize.py
in python abstraction. This script is used by apport aware python applications
Bug-Ubuntu: https://launchpad.net/bugs/860856

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-06 10:38:06 -06:00
Jamie Strandboge
27dacf2eca Description: update dovecot deliver profile to access various .conf files for
dovecot
Bug-Ubuntu: https://launchpad.net/bugs/458922

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-06 10:34:44 -06:00
Jamie Strandboge
15e4f8a05f Description: updates for usr.bin.sshd example profile to work with zsh4, dash
and systems where /var/run moved to /run. Also allows read of
 /etc/default/locale.
Bug-Ubuntu: https://launchpad.net/bugs/817956

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-06 10:33:10 -06:00
Jamie Strandboge
0cb4e48344 Description: Disallow writing and linking to @{HOME}/.pki/nssdb/ .so files
Bug-Ubuntu: https://launchpad.net/bugs/911847

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 10:29:32 -06:00
John Johansen
f29c0cc377 Remove asprintf warning and fix invalid test
asprintf is marked with warn_unused_result and its return value should
not be ignored, even casting to (void) will not remove this warning.

The current code ignored the result and used the value of newfmt to
make a decision.  This is however not correct in that according to the
asprintf man page newfmt is undefined if asprintf returns an error.

Fix the warning and error by using the return value of asprintf

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-06 07:09:12 -08:00
Christian Boltz
960d19b6cb according to Lars Müller (a samba developer) smbd needs access to some
more files in /usr/lib*/samba/ in some cases.

References: https://bugzilla.novell.com/show_bug.cgi?id=725967#c5

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2012-01-05 23:47:03 +01:00
Christian Boltz
4b34c77a39 Split off various permissions from the httpd2-prefork profile to
abstractions/apache2-common. Additionally, add read permissions
for /**/.htaccess and /dev/urandom to apache2-common.

The patch is based on a profile abstraction from darix. I made some 
things more strict (compared to darix' profile), and OTOH added some 
things that are needed on my servers.

*** BACKWARDS-INCOMPATIBLE CHANGES ***

^HANDLING_UNTRUSTED_INPUT
- don't allow /.htaccess (.htaccess files in subdirectories are still allowed)
- don't allow *.htaccess files (the old /**.htaccess rule was too generous)
2012-01-05 23:28:17 +01:00
Jamie Strandboge
61b614543c add audacity to the ubuntu-media-players abstraction (LP: #899963) 2012-01-04 11:45:43 -06:00
Jamie Strandboge
30c8dfe12c allow software-center in the ubuntu-integration abstraction for
apt: URLs (LP: #662906)
2012-01-04 09:36:21 -06:00
Jamie Strandboge
3d42221ba8 allow fireclam plugin to work in Ubuntu multimedia abstraction
(LP: #562831)
2012-01-03 17:50:00 -06:00
Jamie Strandboge
bd56500d03 Author: James Troup
Description: fix typo when adding multiarch lines for gconv
Bug-Ubuntu: https://launchpad.net/bugs/904548

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-03 17:27:26 -06:00
Jamie Strandboge
401363854a Author: Felix Geyer
Description: allow avahi to do dbus introspection
Bug-Ubuntu: https://launchpad.net/bugs/769148

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-03 17:26:00 -06:00
Jamie Strandboge
a6d274dcb0 Author: Felix Geyer
Description: abstractions/fonts should allow access to ~/.fonts.conf.d
Bug-Ubuntu: https://launchpad.net/bugs/870992

Acked-by: Jamie Strandboge <jamie@canonical.com>
2012-01-03 17:25:10 -06:00
Jamie Strandboge
9d20afa95c Nvidia users need access to /dev/nvidia* files for various plugins
to work right. Since these are all focused around multimedia, add the
accesses to ubuntu-browsers.d/multimedia
2012-01-03 17:24:04 -06:00
Jamie Strandboge
32362d2f79 allow access to Thunar as well as thunar in ubuntu-integration abstraction
(LP: #890894)
2012-01-03 17:23:23 -06:00
Jamie Strandboge
3a201bf72b allow ixr access to exo-open in Ubuntu integration abstraction
(LP: #890894)
2012-01-03 17:22:27 -06:00
Jamie Strandboge
d15fcb69ab update binaries for for transmission in ubuntu-bittorrent-clients
(LP: #852062)
2012-01-03 17:21:40 -06:00
Jamie Strandboge
c1850f9855 add kate to Ubuntu text editors browser abstraction
fix for LP: #884748
2012-01-03 17:20:54 -06:00
Christian Boltz
b9bbcdc45c Create /etc/apparmor.d/tunables/multiarch.d directory in profiles/Makefile
(otherwise it's created as a file, which is wrong)

Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-03 23:41:07 +01:00
John Johansen
ff98d79963 Rework how the lexer identifies hat names following a ^
Reworking this code is a step to getting rid of the SUB_NAME2 start
condition.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:49:31 -08:00
John Johansen
6ef6f605b0 Update parsing of the 'hat' and 'profile' keyword to use SUB_NAME
Change how we handle the parsing of the hat and profile keywords this allows
us to get rid of the SUB_NAME2 start condition because the the whitespace
that is allowed by these rules are now consumed by matching the keyword

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:48:53 -08:00
John Johansen
7f9c79e345 Add new processid fn that handles both quoted and unquoted ids
There is a lot of duplication of code calling processqunquoted and
processquoted.  Move all this code to use the new processid fn.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:48:44 -08:00
John Johansen
37e2975d4d Simple rename to reflect the ( ) are not always used by flags (in the future)
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:48:34 -08:00
John Johansen
49142c74a5 Update the flex scanner to use a stack for its start conditions
This is the first step in reducing the number of shared rules between the
different start conditions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:48:24 -08:00
John Johansen
98f196506a Remove extaneous BEGIN(INITIAL) from comment rule.
The affected comment rule is already in the INITIAL start condition
so BEGIN(INITIAL) is extraneous and will cause problems when switching
to a stack of start conditions.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:48:14 -08:00
John Johansen
c52f417406 Move rlimit start condition and rules up to be with other start conditions.
The rlimit start condition was separating different rules of the base
set making the lexer grammer harder to read than necessary.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 16:47:32 -08:00
Christian Boltz
ec68828a30 Fix a syntax error in abstractions/python introduced in r1854.
According to https://launchpad.net/bugs/840734 pyconfig.h should have r 
permissions.

Acked-by: John Johansen <john.johansen@canonical.com>
2012-01-03 00:51:12 +01:00
John Johansen
c259deb5b2 Fix apparmor_parser when removing a profile from an alternate namespace
The module interface calls for names with namespaces to be in the format of

  :namespace:profile or :namespace://profile

but the parser was generating
  namespace:profile

causing profile lookup to fail, or removal of the wrong profile as it was
done against the current namespace, instead of the specified namespace

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 15:35:21 -08:00
John Johansen
f0f520eeff Update the documented error codes for aa_change_profile() and aa_change_onexe()
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 15:34:23 -08:00
John Johansen
a9697cec28 Fix apparmor_parser when removing a profile from an alternate namespace
The module interface calls for names with namespaces to be in the format of

  :namespace:profile or :namespace://profile

but the parser was generating
  namespace:profile

causing profile lookup to fail, or removal of the wrong profile as it was
done against the current namespace, instead of the specified namespace
    
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2012-01-02 15:32:36 -08:00
Christian Boltz
9e6a13fa78 smbd needs read access to /etc/netgroup.
References: https://bugzilla.novell.com/show_bug.cgi?id=738041
2011-12-29 17:34:01 +01:00
Jamie Strandboge
95015dae9f Merge from Simon Deziel for TFTP read-only access for dnsmasq. Fixes
LP: #905412

Acked-by: Jamie Strandboge <jamie@canonical.com>
2011-12-21 12:45:59 -06:00
Simon Deziel
cba77b26a5 dnsmasq's TFTP server provides read-only access. 2011-12-17 12:20:53 -05:00
Simon Deziel
0069bf82a6 Allow dnsmasq's profile to read and write to /var/tftp (configurable) 2011-12-16 12:15:12 -05:00
John Johansen
9e9a7ff572 update version number to indicate we are in a dev version, using the
proposed .99 versioning to fix the version problem we had with using
alpha, beta, etc. because apt and rpm have different version comparisons
2011-12-15 10:08:13 -08:00
John Johansen
18821b079b To reduce memory overhead of dfa creation convert to using a Node Vector
instead of a NodeSet.

We need to store sets of Nodes, to compute the dfa but the C++ set is
not the most efficient way to do this as, it has a has a lot of overhead
just to store a single pointer.

Instead we can use an array of tightly packed pointers + a some header
information.  We can do this because once the Set is finalized it will
not change, we just need to be able to reference and compare to it.

We don't use C++ Vectors as they have more overhead than a plain array
and we don't need their additional functionality.

We only replace the use of hashedNodeSets for non-accepting states as
these sets are only used in the dfa construction, and dominate the memory
usage.  The accepting states still may need to be modified during
minimization and there are only a small number of entries (20-30), so
it does not make sense to convert them.

Also introduce a NodeVec cache that serves the same purpose as the NodeSet
cache that was introduced earlier.

This is not abstracted this out as nicely as might be desired but avoiding
the use of a custom iterator and directly iterating on the Node array
allows for a small performance gain, on larger sets.

This patch reduces the amount of heap memory used by dfa creation by about
4x - overhead.  So for small dfas the savings is only 2-3x but on larger
dfas the savings become more and more pronounced.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:16:03 -08:00
John Johansen
2674a8b708 Split the nodeset used in computing the dfa into two sets, accepting and
non-accepting, and have the proto-state use them.

To reduce memory overhead each set gains its own "cache" that make sure
there is only a single instance of each NodeSet generated.  And since
we have a cache abstraction, move relavent stats into it.

Also refactor code slightly to make caches and work_queue etc, DFA member
variables instead of passing them as parameters.

The split + caching results in a small reduction in memory use as the
cost of ProtoState + Caching is less than the redundancy that is eliminated.
However this results in a small decrease in performance.

Sorry I know this really should have been split into multiple patches
but the patch evolved and I got lazy and decided to just not bother
splitting it.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:14:37 -08:00
John Johansen
8bc30c8851 Replace usage of NodeSet with ProtoState in dfa creation.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:12:30 -08:00
John Johansen
bd10235397 Add a new class hashedNodeSet.
It is the functional equivalent of ProtoState.  We do this to provide a
new level of abstraction that ProtoState can leverage, when the node types
are split.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:11:09 -08:00
John Johansen
35b7ee91eb Now that we have a proper class we don't need a functor to do comparisons,
we can fold it into the classes operator<.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:09:47 -08:00
John Johansen
d452f53576 Begin preparing to split accept nodes and non-accept nodes.
Create a new ProtoState class that will encapsulate the split, but for
this patch it will just contain what was done previously with NodeSet

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-12-15 05:08:31 -08:00
John Johansen
9d374d4726 Rename compressed_hfa.{c,h} and TransitionTable within them to chfa. This
is done to be clear what TransitionTable is, as we will then add matching
capabilities.  Renaming the files is just to make them consistent with
the class in the file.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:06:32 -08:00
John Johansen
4beee46c52 Make sure that state always has otherwise set
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 05:01:35 -08:00
John Johansen
319cd6c038 Now that State Cases have been renamed, rename NodeCases back to Cases.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 04:59:55 -08:00
John Johansen
bd66fba55f This helps make the meaning of things a little clearer and provides a clear
distinction betwen NodeCases, and State transitions

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-12-15 04:58:33 -08:00
John Johansen
3c11c66ff2 AppArmor 2.7 tag 2011-12-15 04:39:29 -08:00
John Johansen
c52cf4d537 AppArmor 2.7 2011-12-15 04:20:50 -08:00
Steve Beattie
1e8dc4f375 This fixes the libapparmor log parsing library to properly parse log
entries where the comm entry has been hex-encoded. This occurs when the
binary being confined contains a space or other problematic character in
its filename. A test case is included.
2011-11-30 11:07:48 -08:00
Steve Beattie
7988124de5 Add a testcase for libapparmor for encoded profiles to ensure that
https://bugs.launchpad.net/apparmor/+bug/897957/ is in the utils and not
the parsing library itself.
2011-11-30 09:53:04 -08:00
Steve Beattie
f0aa65c832 abstractions/python: for some reason, the python runtimes need access
to pyconfig.h

Bug: https://launchpad.net/bugs/840734
2011-11-30 08:56:45 -08:00
Christian Boltz
1c96c09ec9 /usr/sbin/traceroute6 is a symlink to /usr/sbin/traceroute.
This patch allows "network inet6 raw" in addition to the ipv4 rule.

References: https://bugzilla.novell.com/show_bug.cgi?id=733312

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-11-30 13:15:21 +01:00
Christian Boltz
9685aae967 rpmlint complains about an outdated FSF address in parser/COPYING.GPL.
This commit upgrades the COPYING.GPL file to the latest version from
http://www.gnu.org/licenses/gpl-2.0.txt - which means some small text 
and whitespace changes and of course the correct address.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-11-27 13:52:06 +01:00
John Johansen
c7a6608777 bzr tag apparmor_2.7.0-rc2 2011-11-10 09:59:36 -08:00
John Johansen
bca67d3d27 apparmor-2.7~rc2 2011-11-10 09:51:18 -08:00
John Johansen
9c39909a9c Author: Michael (kensington)
When executing apparmor_status from rc functions and utils are not installed, this message is received:

AppArmor is enabled,
Install the apparmor-utils package to receive more detailed
status information here (or examine directly).

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-11-10 09:43:10 -08:00
John Johansen
f278505db2 Author: Michael (kensington)
parser/Makefile has a number of issues.

* Some warnings are produced: "make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule."
* CXX is not always respected
* LDFLAGS are not always respected

modified to apply and retain $(Q) by John Johansen

Signed-off-by: John Johansen <john.johansen@canoncial.com>
2011-11-10 09:36:52 -08:00
John Johansen
e91cc118df Author: Michael (kensington)
When running installing apparmor-utils from Makefile, some warnings are
generated: make[1]: warning: jobserver unavailable: using -j1. Add
 `+' to parent make rule.

Use $(MAKE) instead of make

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-11-10 09:27:29 -08:00
John Johansen
e1763ba13c Auther: Michael (kensington)
libapparmor python bindings fail to build with python-3.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-11-10 09:22:09 -08:00
Seth Arnold
cad0c3c8a9 Include mknod in file operations aa-logprof / aa-genprof processing 2011-11-08 19:06:49 -08:00
Christian Boltz
49103b30f2 Make abstractions/winbind work on 64bit systems (valid.dat etc. are in
/usr/lib64/samba/ in openSUSE 64bit installations)

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-11-01 18:35:29 +01:00
Christian Boltz
df47a59ecb Allow loading the libraries used for Samba "vfs objects = ..."
References: https://bugzilla.novell.com/show_bug.cgi?id=725967

Signed-off-by: Christian Boltz <apparmor@cboltz.de>

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-11-01 18:28:49 +01:00
Christian Boltz
091ec763f9 split off abstractions/ldapclient from abstractions/nameservice
Original openSUSE changelog entry:

Thu Jan  6 16:23:19 UTC 2011 - rhafer@suse.de

- Splitted ldap related things from nameservice into separate
  profile and added some missing paths (bnc#662761)
2011-11-01 17:08:37 +01:00
Christian Boltz
33b7c5316f create the directory /etc/apparmor.d/disable which is required by aa-disable
Acked-by: John Johansen <john.johansen@canonical.com>
2011-10-20 00:23:19 +02:00
Christian Boltz
986093cf8d More helpful error message for "aa-notify -p" if a user is not member of
the group configured in notify.conf / use_group=...

Acked-by: John Johansen <john.johansen@canonical.com>
2011-10-20 00:20:02 +02:00
John Johansen
33c62acc5c Update version to 2.7~rc1 2011-10-12 16:45:45 -07:00
Christian Boltz
8b671f013a add the option --display to set the $DISPLAY environment variable in aa-notify.
If $DISPLAY is not set and --display is not used, aa-notify prints a 
warning that notifications won't be shown (exact warning text depends if 
using sudo or not).

Acked-by: John Johansen <john.johansen@canonical.com>
2011-10-12 13:08:25 +02:00
Christian Boltz
5789ab84a6 allow read access for /proc/*/mounts in the dovecot profile
Reported by Tim Edwards in the opensuse-factory	mailinglist.


Acked-by: John Johansen <john.johansen@canonical.com>
2011-10-12 13:05:00 +02:00
Christian Boltz
6d6e04dc12 fix a syntax error in remove_profiles() in rc.apparmor.functions by
adding a forgotten pipe.

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-10-12 00:45:11 +02:00
John Johansen
7a7c99f3a1 Commit the example parser.conf file that was supposed to be part of
commit r1834

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-10-09 20:15:03 -07:00
John Johansen
9896f5edbd Add an example parser.conf file
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
2011-10-07 14:43:54 -07:00
John Johansen
12a98135bf Provide a more user friendly error message when cache is
requested and fails to be created.  Also don't make the
warning output conditional on the showcache flag as we
should be showing warning/errors by default.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-10-07 14:42:55 -07:00
Jamie Strandboge
a30dfb6b19 utils/aa-notify:
- set HOME (and DISPLAY) only once on startup to avoid NSS lookups

Acked-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Christian Boltz <opensuse@cboltz.de>
2011-09-30 18:00:52 -05:00
Christian Boltz
a4d4eddd92 while aa-eventd is deprecated and no longer installed, parser/Makefile
happily continued to install the initscript for aa-eventd.

This was reported by Jiri Srain as part of 
https://bugzilla.novell.com/show_bug.cgi?id=720617

This commit removes the lines that install the aaeventd initscript
from parser/Makefile.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-10-01 00:23:39 +02:00
Christian Boltz
b393893c7a sudo resets the environment variable $HOME and removes $DISPLAY on
openSUSE, which results in non-working desktop notifications in aa-notify
because $notify_exe is unable to connect to DBUS to display the message.

This patch sets the correct value for $HOME.

The code for setting $DISPLAY is still under discussion, therefore only
a TODO note is included in this commit for $DISPLAY.

Acked-By: John Johansen <john.johansen@canonical.com>
2011-09-24 13:19:10 +02:00
John Johansen
572fb7e943 AppArmor_2.7-beta2
Signed-off-by: John Johansen@canonical.com
2011-09-15 13:55:48 -07:00
John Johansen
7173d7a6a5 Remove extra space insert at from of ${TAG_VERSION} when doing the ~ to -
substitution.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-09-15 13:28:01 -07:00
John Johansen
7b577d72b5 Remove ~ based tags again
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-09-15 12:50:10 -07:00
Christian Boltz
5a140c2e5c while debugging the issue in rc.apparmor.suse (see patch for
rc.apparmor.suse), I noticed that "rcapparmor restart" is
totally silent.

The attached patch prints a message in __apparmor_restart().

It also replaces the hardcoded "return 0" with $?. I'm quite sure this
won't catch all errors, but it's still better than the hardcoded success
message.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-09-15 21:23:25 +02:00
Christian Boltz
e922cdb113 sbin.syslog-ng profile:
- fix permissions for additional-log-sockets.conf (the comma in {var/,} 
  was at the wrong place, which broke the /var/run/ case)
- add read permissions for /sys/devices/system/cpu/online
  (that was even new for Peter, but I trust him not to post faked 
  audit.log lines ;-)

Acked-by: John Johansen <john.johansen@canonical.com>
2011-09-15 21:21:57 +02:00
Christian Boltz
189da8236c the last patch to the usr.sbin.dnsmasq profile (r1758) contained a wrong
filename.

References: https://bugzilla.novell.com/show_bug.cgi?id=678749#c11

Acked-by: John Johansen <john.johansen@canonical.com>
2011-09-15 20:58:54 +02:00
Christian Boltz
2c62d802b6 It looks like rc.apparmor.functions renamed "aa_log_action_begin()" to
"aa_log_action_start()" (probably for 2.6), but the rc.apparmor.suse 
initscript was not updated.

This patch fixes the function name in the rc.apparmor.suse initscript.

References: https://bugzilla.novell.com/show_bug.cgi?id=717707

Acked-by: John Johansen <john.johansen@canonical.com>
2011-09-15 20:20:23 +02:00
Christian Boltz
23df761b70 Make the VENDOR_PERL directoy autodetected in utils/Makefile instead of
hardcoding it.

Acked-by: Kees Cook <kees@ubuntu.com>
2011-09-15 20:17:58 +02:00
Christian Boltz
6a80641ee2 perl modules don't need execute permissions.
This patch installs the perl modules with mode 644 instead of 755.

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-09-13 20:58:24 +02:00
Christian Boltz
02e1e94ab9 add a missing "make install" call to README in the libapparmor section.
Acked-by: John Johansen <john.johansen@canonical.com>
2011-09-12 22:30:17 +02:00
Jamie Strandboge
f28b91b8cf add gwenview to abstractions/ubuntu-browsers.d/multimedia. This is the
default image viewer in Kubuntu (LP: #840973)
2011-09-07 15:00:45 -05:00
Jamie Strandboge
6849615de6 adjust ubuntu-email abstraction for thunderbird rapid release process 2011-09-02 13:21:06 -05:00
John Johansen
743f84099d Allow passing of DEBUG from make into the compile
Fix the build so
    
  make DEBUG=1
    
results in a compile with DEBUG turned on.
    
Also fix build errors in the compile with DEBUG is defined
    
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-09-01 11:57:54 -07:00
John Johansen
a041b1738c Remove apparmor_2.6.0~rc1 and apparmor_2.6.0~rc1 tags so git can sync
yet again!

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-31 16:15:44 -07:00
John Johansen
1056ef8418 Add missing documentation updates for aa_is_confined and aa_get_con.
This documentation should have been checked in as part of the patches
that added aa_is_confined and aa_get_con.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-31 16:07:55 -07:00
John Johansen
ac77e10a0f Fix missing pid_t dependency in apparmor.h
The define for pid_t is missing in apparmor.h so that if it is included
in programs that don't also include sys/types.h the compile will break.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-08-31 16:01:54 -07:00
John Johansen
eae6f0525c Add missing introspection regression test that should have been checked in
with the introspection patches.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-31 15:58:27 -07:00
John Johansen
341b7e61da Add compatibility patches for linux kernel 3.1 2011-08-27 12:56:53 -07:00
John Johansen
eb6d2224bd Updated kernel compatibilty patches for linux 3.0 2011-08-27 12:25:22 -07:00
Christian Boltz
bb1b5f986b Add permissions needed for Active Directory authentification to Samba
profiles.

References: https://bugzilla.novell.com/show_bug.cgi?id=713728

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-27 20:50:42 +02:00
Steve Beattie
1c1cc65cbd Update useradd and userdel profiles to use wutmp abstraction. 2011-08-26 18:58:31 -07:00
Steve Beattie
5dedd16bf5 Cleanup no longer necessary wutmp permission now that it's covered by
the wutmp abstraction.
2011-08-26 18:51:03 -07:00
Christian Boltz
66d51b575d From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-profiles: Add samba config files
References: bnc#679182 bnc#666450

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

- updated to match trunk
- added changed path to nmbd profile (/var/cache/samba has moved to 
  /var/lib/samba on (at least) openSUSE 11.4), bnc#679182#c8
  For backward compability, it also allows /var/spool/samba.
- Note: The smbd profile already contains both locations.
by Christian Boltz <apparmor@cboltz.de>

updated according to the comments from Steve Beattie
by Christian Boltz <apparmor@cboltz.de>

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-27 01:52:27 +02:00
Christian Boltz
f26df713c0 Dovecot profile update:
- allow /var/spool/mail, not only the /var/mail symlink
- allow @{HOME}/Mail/
- allow capability fsetid, read access to /etc/lsb-release and 
  SuSE-release and k for /var/{lib,run}/dovecot in usr.bin.dovecot

References:
- dovecot: Added support for /var/spool/mail (bnc#691072)
- Updated dovecot profile (bnc#681267).

Patch taken from openSUSE:11.4:Update:Test, file apparmor-profiles-dovecot
updated to match trunk by Christian Boltz <apparmor@cboltz.de>

Change compared to the patch posted to the ML:
- link rule instead of adding l permissions for /var/lib/dovecot and 
  /var/run/dovecot (as proposed by John Johansen)

Acked-By: John Johansen <john.johansen@canonical.com> on IRC
2011-08-27 01:12:10 +02:00
Steve Beattie
b8f486dee9 Attached is a patch to make the initscript not fail if /tmp is full
by converting the comm(1) usage on temporary files to an embedded
awk script. On both Ubuntu and OpenSUSE, a version of awk (mawk in
Ubuntu, gawk in OpenSUSE) is either a direct or indirect dependency
on the minimal or base package set, and the original reporter also
mentioned that an awk-based solution would be palatable in a way that
converting to bash, or using perl or python here would not be.

In the embedded awk script, I've tried to avoid gawk or mawk specific
behaviors or extensions; e.g. this is the reason for the call to sort
on the output of the awk script, rather than using gawk's asort(). But
please let me know if you see anything that shouldn't be portable
across awk implementations.

An additional issue that is fixed in both scripts is handling child
profiles (e.g. hats) during reload. If child profiles are filtered
out (via grep -v '//') of the list to consider, then on reloading
a profile where a child profile has been removed or renamed, that
child profile will continue to stick around. However, if the profile
containing child profiles is removed entirely, if the initscript
attempts to unload the child profiles after the parent is removed,
this will fail because they were unloaded when the parent was unloaded.
Thus I removed any filtering of child profiles out, but do a post-awk
reverse sort which guarantees that any child profiles will be removed
before their parent is. I also added the LC_COLLATE=C (based on the
Ubuntu version) to the sort call to ensure a consistent sort order.

To restate, the problem with the existing code is that it creates
temporary files in $TMPDIR (by default /tmp) and if that partition
is full, problems with the reload action ensue. Alternate solutions
include switching the initscript to use bash and its <$() extension
or setting TMPDIR to /dev/shm/. The former is unpalatable to some
(particularly for an initscript), and for the latter, /dev/shm is
only guaranteed to exist on GNU libc based systems (glibc apparently
expects /dev/shm to exist for its POSIX shared memory implementation;
see shm_overview(7)).  So to me, awk (sans GNU extensions) looks to
be the least bad option here.

Bug: https://launchpad.net/bugs/775785
2011-08-26 15:55:43 -07:00
Christian Boltz
ac7e66684c Add various capabilities to smbd that are needed for the way powerpoint
handles files. See bnc#705319 for details.

References: https://bugzilla.novell.com/show_bug.cgi?id=705319

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-26 23:19:30 +02:00
Steve Beattie
be3d2bc1a4 Update traceroute profile to include installed path on Ubuntu/Debian. 2011-08-25 15:36:30 -07:00
Christian Boltz
8f28eebe5a Add capability setuid and setgid to nscd profile. Needed by unscd
to switch to a non-root user. unscd is installed as /usr/sbin/nscd
at least at openSUSE.

Original changelog entry from unscd package:
Mon Sep  7 17:30:36 CEST 2009 - pbaudis[at]suse.cz
- Provide the /etc/apparmor.d/usr.sbin.nscd file and make it allow
  for change to the nobody user [bnc#535467]

Currently the nscd package from glibc and the unscd package both contain
a usr.sbin.nscd profile which needs to maintained/updated manually.
With this patch, the profile could be moved back to the
apparmor-profiles package.


Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-24 00:57:42 +02:00
Christian Boltz
d17a87bd28 bnc#685674 - The "-I" flag of traceroute is blocked by apparmor
* Do Apr 07 2011 jeffm@suse.de
- Add raw network access to traceroute profile (bnc#685674).

Acked-By: Steve Beattie <steve@nxnw.org>
2011-08-23 02:10:14 +02:00
Christian Boltz
59eb0af705 nscd: allow mkdir for /var/run/nscd/
References: https://bugzilla.novell.com/show_bug.cgi?id=647718

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-23 01:22:41 +02:00
Christian Boltz
7d5840d449 apparmor.vim:
- allow "deny [filename] x" rules
- add support for "make clean"

Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-21 23:49:25 +02:00
John Johansen
fb7f0ddaaa Remove tags
apparmor_2.6.0~rc1
  apparmor_2.6.1~rc1

that have crept in yet again!!!
2011-08-19 16:57:30 -07:00
John Johansen
4bdc7ea51a From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: Add support for creds and path operations
References: bnc#564316

 2.6.29 introduced the path security_operations and credentials

 This patch adds support for those operations to the log parser.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Resolved merge conflict and removal operation already supported by
the log parser.
Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-18 16:29:48 -07:00
Kees Cook
3ac9f7e676 Due to the Ubuntu multiarch project, internal paths to things keep
changing. Since we arguably shouldn't be hardcoding this kind of
thing, this changes a path around to use the C preprocessor to do the
work of finding the kernel definitions.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-18 18:26:02 -05:00
Kees Cook
843ef93202 As /var/log/messages has been phased out, start preferring syslog
instead.

Needed at least on upgraded Ubuntu machines that went from messages to
syslog recently. If this causes problems, we can easily revert it.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-18 18:17:22 -05:00
Kees Cook
00726ed51a The printk ratelimit needs to be disabled when running genprof via
syslog, otherwise audit events will get dropped.

This runs the risk of having the kernel log wrap around, but that
is a less common case that what this solves. This is a work-around
that will go away when complain info takes a different path in the
future.
2011-08-18 18:15:41 -05:00
Christian Boltz
0cbad5b99b Allow pux and PUx permissions in apparmor.vim
I intentionally don't allow pUx and Pux since the behaviour of those is 
very unexpected (the first letter decides if the environment is cleaned 
up or not - at least that's the result of the discussion in April) and 
the average user won't know this.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-19 00:28:10 +02:00
Christian Boltz
d180252c52 This commit adds "capability syslog" to the syslogd and syslog-ng
profiles.

It also adds a comment to the klogd profile that capability sys_admin is 
only needed for backward compatibility with older kernels.

Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-19 00:27:03 +02:00
Christian Boltz
ca5cd28d48 add syslog capability to apparmor.vim
Acked-by: John Johansen <john.johansen@canonical.com>
2011-08-19 00:24:48 +02:00
Christian Boltz
12e0d064cd openSUSE patch klog-needs-CAP_SYSLOG
This patch adds the syslog capability to parser/parser_misc.c
and to the sbin.klogd profile.
2011-08-18 23:54:24 +02:00
Steve Beattie
386a5abc7d logprof and genprof were creating Px and Cx execute permissions with
the modifiers as lowercase (meaning to pass on sensitive environment
variables to the exec'ed process) even if the user told them not to
when prompted. This patch fixes the issue.
2011-08-17 16:26:41 -07:00
Jamie Strandboge
084233a207 utils/aa-notify:
aa-notify would abort if it could not stat the logfile, as can happen
when using auditd and the directory perms for the logfile do not allow access
(x). Add raise_privileges() and drop_privileges() helper functions and adjust
get_logfile_size() and get_logfile_inode() to raise then drop privileges if the
logfile parent directory is not executable. Also adjust reopen_logfile() to use
these helpers.

When error checking in these helpers, use '$> == ...' instead of '$> = ... or
die...' since perl always dies when raising privs in this manner even though
the euid did change (and $!, $@, $^E, and $? are all the same). Not sure why
this is happening but the '==' check should be sufficient.
2011-08-17 13:47:52 -05:00
Jamie Strandboge
94e665b3fa utils/aa-notify:
aa-notify would abort if it could not stat the logfile, as can happen
when using auditd and the directory perms for the logfile do not allow access
(x). Add raise_privileges() and drop_privileges() helper functions and adjust
get_logfile_size() and get_logfile_inode() to raise then drop privileges if the
logfile parent directory is not executable. Also adjust reopen_logfile() to use
these helpers.

When error checking, use '$> == ...' instead of '$> = ... or die...' since perl
always dies when raising privs in this manner even though the euid did change
(and $!, $@, $^E, and $? are all the same). Not sure why this is happening but
the '==' check should be sufficient.
2011-08-17 09:48:12 -05:00
Jamie Strandboge
0a5c4fa159 utils/aa-notify:
- drop supplemental group privileges too. While POSIX::setgid() works nice in
  that it will set both the real uid and euid, it doesn't do anything with the
  supplemental groups (sigh). Instead, assign to $( and $) in a manner that
  clears the supplemental groups.
2011-08-17 08:35:52 -05:00
Jamie Strandboge
9fddd7a716 utils/aa-notify.pod: update to clarify '-u' argument when using '-p' 2011-08-17 07:49:00 -05:00
Steve Beattie
92473dfc46 This patch adds multiarch support for the X DRI paths.
Bug: https://launchpad.net/bugs/826914
2011-08-16 22:47:34 -07:00
Steve Beattie
8ee0292d8e This patch fixes up a conflicting execute permission that was added
in merging in the opensuse fixes to the dhclient profile. It does so
by merging them, using the profile for dhclient-script if it exists
and inheriting dhclient's profile if it does not.
2011-08-16 16:35:57 -07:00
Christian Boltz
174105b9fa From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: Fix handling of files in /
References: bnc#397883

 The separate handling of files and directories with realpath is broken.

 For files e.g. /foo, $dir ends up being empty since the / is eaten by
 the regex. realpath resolves an empty argument as the current directory,
 resulting in an incorrect path.

 There's no explanation of why the separate handling was used in the
 first place.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-17 00:06:07 +02:00
Christian Boltz
7f45708c86 Merge k permission for /var/log/lastlog into abstractions/wutmp
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-16 12:26:44 +02:00
Christian Boltz
015229d551 From: Jeff Mahoney <jeffm@suse.com>
Subject: Fix for sshd profile
References: bnc#457072

 Without this patch, sshd won't work in enforce mode.

 libselinux accesses /proc/filesystems to determine if it's enabled
 bash won't execute
 audit_control is probably from libselinux too

Updated by Christian Boltz <apparmor@cboltz.de>:
- add /proc/*/oom_adj and oom_score_adj rw
- add /var/log/btmp r
- add /var/log/lastlog k
- removed capability sys_ptrace - doesn't seem to be needed
- changed all login shells to rUx, not only bash
- removed /proc/filesystems (already part of abstractions/base)

Acked-By: John Johansen <john.johansen@canonical.com>
with the following note:
 ACK because I don't see a choice right now but for the 3.0 release
 (next year) I'll ask you to retest and add newer audit controls.
2011-08-13 22:43:33 +02:00
Christian Boltz
267e9610c7 openSUSE patch to remove the "-f" parameter from startproc in rc.aaeventd.suse /
start_aa_event().

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-13 14:22:35 +02:00
Christian Boltz
32797f5780 openSUSE patch to add systemd support to rc.apparmor.functions
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-13 14:15:58 +02:00
Christian Boltz
ce85512673 openSUSE patch with some changes in the initscripts.
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-13 14:13:49 +02:00
Christian Boltz
5f630f2c5d From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: Add check_for_apparmor helper.

 This should be an alias but those get complicated quickly in perl.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-13 14:11:20 +02:00
Christian Boltz
4fc9106d37 From: Jeff Mahoney <jeffm@suse.com>
Subject: apparmor-utils: setprofileflags() drops leading whitespace
References: bnc#480795

 setprofileflags() drops leading whitespace for subprofiles. writeheader()
 properly indents subprofiles 2 spaces per nesting level but when
 genprof sets the profile to enforce mode at completion, the whitespace
 is removed.

 This patch adds the whitespace globbing to the regexp and uses it to
 prefix the sub-profile with the correct spacing.

 Reported at: https://bugzilla.novell.com/show_bug.cgi?id=480795

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-13 14:09:53 +02:00
Christian Boltz
614c051a71 moved rules for /var/lib/libvirt/dnsmasq/ in dnsmasq profile to one place
Pre-Acked by Steve Beattie <sbeattie@ubuntu.com>
2011-08-12 22:14:00 +02:00
Kees Cook
94f06d23c0 add missing libraries/libapparmor/doc/aa_find_mountpoint.pod from https://lists.ubuntu.com/archives/apparmor/2011-July/001280.html 2011-08-10 22:52:05 -07:00
Kees Cook
a8e0b0d0a3 add missed libraries/libapparmor/doc/aa_getcon.pod from https://lists.ubuntu.com/archives/apparmor/2011-July/001282.html 2011-08-10 22:49:16 -07:00
John Johansen
0f3263f710 Gah really make it beta1 instead of RC1 2011-08-10 15:56:17 -07:00
John Johansen
2a81cadd27 Update version to 2.7-beta1. No new feature except maybe pending
feature freeze exception for dbus mediation.
2011-08-10 15:54:51 -07:00
John Johansen
f69822107f Update apparmor's handling of rlimits for cpu limit and more natural units
Allow for rlimit cpu to specified which is now supported by the kernel.

Previously the rlimit units where limited to K, M, G and would fail when
KB, MB, GB where used.  Allow for both, also allow for units on lengths
of time, by specifying "seconds", "minutes", "hours".. or any unique subset
eg. "s", "sec", "m", "min", "h", "hour" ..

NOTE:
This patch does not extend rlimits to be able to handle setting of tasks
that are confined by other profiles.

 Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-10 15:53:39 -07:00
John Johansen
4dec6cab65 Add the ability for the parser to have a basic conf file, that defaults
to /etc/apparmor/parser.conf (NOTE option to allow changing this is not
provided currently).

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-09 06:52:43 -07:00
John Johansen
0287ce0c9d Function to test if apparmor support is enabled.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-08-09 06:48:56 -07:00
John Johansen
aae597bfde Library function to find the apparmorfs filesystem mount point
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-09 06:48:17 -07:00
John Johansen
8347fb69c2 Library interface for tasks introspecting confinement.
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-08-09 06:47:40 -07:00
John Johansen
685632db0c Add the ability to read proc attr interfaces
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-08-09 06:45:51 -07:00
Christian Boltz
5169b4556a Replace the last occurrence of /var/run with /{,var/}run/
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-09 12:20:50 +02:00
Steve Beattie
3f099da257 .bzrignore: ignore the generated testfiles in the parser testsuite, all
25000+ of them. I swore we used to have this already.
2011-08-09 01:17:42 -07:00
Steve Beattie
d4c4cbe62b It's possible that git doesn't like to create empty directories, so
create the generated_* directories themselves if they don't exist before
running the script to generate them.

Also modify the default invocation of prove to add -f, which reports the
details of failing test cases.
2011-08-09 01:10:19 -07:00
Steve Beattie
c66975ffc5 Make parser's 'tests' target depend on the apparmor_parser binary having
been generated first; otherwise, 'make clean tests' fails.
2011-08-09 00:54:14 -07:00
Christian Boltz
c35ac067b2 My last commit (r1759) accidently did not include
/{,var/}run/cups/ rw,
Adding it now.
2011-08-09 00:42:38 +02:00
Christian Boltz
851a8c8b3a Various cupsd profile fixes/additions
Changed /var/run/cups/** rw, to
  /{,var/}run/cups/ rw,
  /{,var/}run/cups/** rw,
as requested by Steve Beattie

With this change:
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-08 23:18:54 +02:00
Christian Boltz
d081f7cb85 From: Jeff Mahoney <jeffm@suse.com>
Subject: dnsmasq: Profile fixes
References: bnc#666090 bnc#678749

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Updated to match master by
Christian Boltz <apparmor@cboltz.de>

Updated for systemd (/{,var/},run/ instead of /var/run/) by
Christian Boltz <apparmor@cboltz.de> as requested by Steve Beattie

With this change:
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
(final confirmation on IRC in #apparmor)
2011-08-08 23:13:15 +02:00
Christian Boltz
2c5534ca18 syslog-ng profile fixes/additions
updated to match master by
Christian Boltz <apparmor@cboltz.de>

updated to work with systemd (/{,var/}run/ instead of /var/run)
Christian Boltz <apparmor@cboltz.de> as requested by Steve Beattie

With this change:
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-08 22:59:28 +02:00
Christian Boltz
08fb58e10d From: Jeff Mahoney <jeffm@suse.com>
Subject: profiles: update dhclient
References: bnc#561152

Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-08 22:54:23 +02:00
Christian Boltz
13c3e40044 From: Jeff Mahoney <jeffm@suse.com>
Subject: dhcpd: Fix apparmor profile
References: bnc#692428

 This patch adds the network rules needed, corrects the path to dhcpd.leases,
 and adds the path for TSIG DNS keys.

Reported-by: Andrew Beames <suseforum@roocomputing.co.uk>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>

updated to match trunk by
Christian Boltz <apparmor@cboltz.de>

updated to use
    /var/lib/dhcp/{db/,}dhcpd.leases*    rwl,
(instead of just /var/lib/dhcp/db/dhcpd.leases* rwl) to keep the profile
Ubuntu-compatible as requested by Steve Beattie.

With this change:
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-08 22:29:45 +02:00
Christian Boltz
b5e525b251 From: Jeff Mahoney <jeffm@suse.com>
Subject: profiles: Add openssl abstraction
References: bnc#623886

 Profiles that use openssl have been adding the openssl files piecemeal.

 This patch creates a new openssl abstraction that can be inherited by
 all profiles that use it.


Signed-off-by: Jeff Mahoney <jeffm@suse.com>

Patch for 
- profiles/apparmor.d/abstractions/ssl_certs 
- profiles/apparmor/profiles/extras/usr.sbin.httpd2-prefork (second chunk)
updated by Christian Boltz <apparmor@cboltz.de>
(didn't apply to trunk)

Acked-By: Steve Beattie <sbeattie@ubuntu.com>

Copyright header in profiles/apparmor.d/abstractions/openssl added by
Christian Boltz <apparmor@cboltz.de>
2011-08-08 22:22:03 +02:00
Christian Boltz
663698c7a6 From: Jeff Mahoney <jeffm@suse.com>
Subject: profile: ntpd -N needs sys_nice
References: bnc#657054

 ntpd -N allows the administrator to increase or decrease priority of the
 ntp server. Since the profile doesn't allow it, the operation is denied.

 This patch adds support for that operation.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-08-08 22:16:06 +02:00
Christian Boltz
957f1ae00f Fix syntax error (introduced in r1751) 2011-08-06 01:35:37 +02:00
Steve Beattie
763855fe9e From: Christian Boltz <apparmor@cboltz.de>
Based on https://bugzilla.novell.com/show_bug.cgi?id=643387

Update man profile and abstraction.
2011-08-05 13:12:35 -07:00
Steve Beattie
e6880f9584 Bug: https://bugs.launchpad.net/bugs/794974
Add openal config support to abstractions/audio.

Bug: https://launchpad.net/bugs/794974
2011-08-04 16:52:45 -07:00
Steve Beattie
786f592d7e From: Arkadiusz Miskiewicz <arekm@maven.pl>
Actually skip loading profiles that we report we're skipping.
2011-08-04 16:20:26 -07:00
Jamie Strandboge
38d83c3c76 fix LP: #815883 2011-07-27 09:30:18 -05:00
Jamie Strandboge
7897ba2293 fix LP: #815883
- update dnsmasq profile for new libvirt lease file path
2011-07-25 08:28:04 -05:00
John Johansen
a43931e987 Update the man page for change_hat/change_profile
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-07-22 05:20:06 -07:00
John Johansen
2fec4eb2b4 Make setprocattr more abstract so it will work for any pid
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-07-21 11:10:35 -07:00
John Johansen
3f59259dec Abstract out the construction of proc path generation more.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-07-21 11:09:22 -07:00
John Johansen
2c110ed3d5 Abstract the libraries getting of the tid
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-07-21 11:06:57 -07:00
Marc Deslauriers
0d9a39bd26 This adds a blurb about the new profiles repository to aa-genprof,
along with a link to the wiki page. This helps users locate profiles
that possibly already exist for the application they are attempting to
confine, and suggests they contribute the profile when they're done.
2011-07-18 10:34:49 -04:00
Jamie Strandboge
5e273b0892 update profiles/apparmor.d/abstractions/audio to fixup shm patch from
yesterday. Thanks to Christian Boltz.
2011-07-15 13:53:35 -05:00
Jamie Strandboge
e91c83964a adjustments for /var/run -> /run, /var/lock -> /run/lock and /dev/shm ->
/run/shm transition (LP: #810270)
2011-07-14 11:29:54 -05:00
Jamie Strandboge
35acee98d5 and last one for /dev/shm to /run/shm 2011-07-14 08:21:01 -05:00
Jamie Strandboge
8434463621 make a similar change for /var/lock 2011-07-14 08:09:19 -05:00
Jamie Strandboge
20f117500f update for /var/run -> /run udev transition. For compatibility, distributions
(eg Ubuntu) are providing a symlink from /var/run to /run, so our profiles
should handle both situations.
2011-07-14 07:57:57 -05:00
Jamie Strandboge
850bce2754 Add /usr/share/gnome/applications/mimeinfo.cache to gnome abstraction 2011-07-12 15:24:52 -05:00
Jamie Strandboge
7c05b9ed91 profiles/apparmor.d/abstractions/gnome: add read access to
/usr/share/gnome/applications/mimeinfo.cache, which is now needed by
 Gnome applications.
2011-07-12 07:38:17 -05:00
John Johansen
5abb79d5be Add documentation directory and start of the dfa variables documentation
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-06-27 10:32:04 +01:00
John Johansen
70a06835b8 Remove tags with ~ in them
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-06-27 10:24:08 +01:00
Jamie Strandboge
2e73225586 allow owner read access to /var/run/lightdm/authority/[0-9]* in the X
abstraction
2011-06-22 22:26:14 -05:00
Jamie Strandboge
65c7473407 profiles/apparmor.d/abstractions/ssl_certs: allow access to
/usr/local/share/ca-certificates
2011-06-22 16:42:22 -05:00
John Johansen
901e67a83f Rename tags
apparmor_2.6.1~rc1 to apparmor_2.6.1-rc1
  apparmor_2.6.0~rc1 to apparmor_2.6.0-rc1

to be consistent with the new format and to enable mirroring to a git
repository
2011-06-02 21:08:42 -07:00
Steve Beattie
33c615e5f9 This patch adjusts the tag make target to use a separate version with
'~' replaced by '-'. This is needed for mirroring to git as git can't
handle '~'s embedded in tag or branch names.

Tested by setting up a separate tag_version target like so:

tag_version:
	echo ${TAG_VERSION}
2011-06-02 18:54:56 -07:00
Steve Beattie
fdae9784f4 Bug: https://bugs.launchpad.net/apparmor/+bug/788616
This patch fixes the init scripts helper functions file to
filter out the hat/child process separator as currently used
by the parser, '//' rather than what used to be used, the '^'
symbol. This fixes bugs where profiles that covered regexs (e.g.
'/usr/lib/firefox-4.0.1/firefox{,*[^s][^h]}') and thus were being
improperly filtered away and unloaded when reloading apparmor policy.
2011-06-01 07:52:35 -07:00
Kees Cook
25f7aa6621 adjust documentation "release" name to match other manpages.
Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-27 15:04:42 -07:00
Kees Cook
156a980c30 In some cases, it is desirable to build the parser without building the
binary portions (Hurd). This patch splits up the build targets so this is
possible:

"main" becomes "arch"

"indep" is created and depends on "docs"
po building is moved from "main" to "indep"

"all" has "tests" removed (standard build practices are to "make" then
"make check" so I think "tests"/"check" should stay separate from "all").

redundant chunk is removed (this exists twice in the Makefile):
-.SILENT: check
-check: tests

"install" is split into "install-indep" and "install-arch"

"install-arch" requires "arch" and only installs the binaries

"install-indep" requires "indep" and only install non-binaries

Additionally, update the README to mention the "check" target both for the
parser and the utils.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: Steve Beattie <steve@nxnw.org>
2011-05-27 14:57:43 -07:00
Kees Cook
e9d5d491b8 define PATH_MAX when missing from limits.h
Some non-Linux systems do not define PATH_MAX (Hurd). Since I have no
interest in supporting a fully dynamic PATH_MAX in AppArmor, work around
this by just defining a static value that matches Linux's limits.h value.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-27 14:20:03 -07:00
Marc Deslauriers
b9bfc10d0f - added new aa-status tool rewritten in Python
- moved old Perl aa-status tool to the deprecated directory
2011-05-27 15:08:50 -04:00
Steve Beattie
12876afa07 This patch fixes up a bit that leaked into kees' commit rev 1727
to support a top level make clean target.
2011-05-23 16:05:10 -07:00
Kees Cook
e66e56b020 Add pending local commits. 2011-05-23 11:30:11 -07:00
Kees Cook
6a7a20da88 include explicit parser_common.o rule, thanks to Steve Beattie 2011-05-23 11:29:41 -07:00
Kees Cook
35cdeebe19 fix sprintf arguments 2011-05-23 11:28:26 -07:00
Steve Beattie
c2fdcf7d39 This patch makes it possible to override the default set of language
translations to be built via the LANGS make argument whitelist. For
example:

  cd parser; make all install "LANGS=en_US fr"

will build and install the en_US and fr .mo files for the parser.
2011-05-20 13:34:29 -07:00
John Johansen
627638a6cf Add debugging dump for DFA partition minimization
Allow dumping out which states where dropped during partition minimization
and which state became the partitions representative state.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-20 09:26:44 -07:00
John Johansen
414e5bf560 Fix the dfa-graph dump
The dfa graph dump was broken by previous dfa cleanups so that the graph
transition target is the output of a pointer instead of the dfa state
number.
    
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-05-20 09:24:40 -07:00
John Johansen
343749dc26 Add kernel patches for 2.6.39 2011-05-19 10:57:20 -07:00
Kees Cook
6a68aa2ecb [v2: added clean-ups, backed off on some of the build silencing]
This is a rather large rearrangement of how a subset of the parser global
variables are defined. Right now, there are unit tests built without
linking against parser_main.c. As a result, none of the globals defined in
parser_main.c could be used in the code that is built for unit tests
(misc, regex, symtab, variable). To get a clean build, either stubs needed
to be added to "#ifdef UNIT_TEST" blocks in each .c file, or we had to
depend on link-time optimizations that would throw out the unused routines.

First, this is a problem because all the compile-time warnings had to be
explicitly silenced, so reviewing the build logs becomes difficult on
failures, and we can potentially (in really unlucky situations) test
something that isn't actually part of the "real" parser.

Second, not all compilers will allow this kind of linking (e.g. mips gcc),
and the missing symbols at link time will fail the entire build even though
they're technically not needed.

To solve all of this, I've moved all of the global variables used in lex,
yacc, and main to parser_common.c, and adjusted the .h files. On top of
this, I made sure to fully link the tst builds so all symbols are resolved
(including aare lib) and removedonly  tst build-log silencing (for now,
deferring to another future patchset to consolidate the build silencing).

Signed-off-by: Kees Cook <kees.cook@canonical.com>
2011-05-13 02:12:49 -07:00
Jamie Strandboge
70bb296a70 profiles/apparmor.d/abstractions/dbus-session: Per discussion with John
Johansen, use 'ix' instead of 'Pix' for dbus-launch since if someone happens to
define a profile for dbus-launch and it is loosely confined, then users of this
abstraction could end up launching a program via dbus-launch in a less confined
manner than intended. This sort of thing should not be possible via an
abstraction (and people are always free to profile using Pix if they prefer).
2011-05-09 18:09:24 +02:00
Kees Cook
a25a2ec0d9 On Hurd and kfreebsd under Debian, I have disabled the build of the parser
since things go extremely badly when capabilities disappear. If someone
wants to work on it, I have some initial patch attempts, but it was getting
too time-consuming, so I back-burnered the parser. A very small change was
needed to get the libraries to build, and this is it.

Description: Workaround non-Linux environments to build everything but the
 parser.
Author: Kees Cook <kees@debian.org>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-02 13:38:12 -07:00
Kees Cook
1644ce31e7 Description: Improve generated test readability and build-time cleanup.
Author: Kees Cook <kees@debian.org>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-02 13:36:55 -07:00
Kees Cook
abcf66292d Description: adjust for missing or incorrect includes.
Author: Kees Cook <kees@ubuntu.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-02 13:34:58 -07:00
Kees Cook
42a5483ba9 Description: fix minor manpage type pointed out by lintian.
Author: Kees Cook <kees@debian.org>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-05-02 13:33:31 -07:00
Jamie Strandboge
83282f8700 add kwallet to ubuntu-browsers.d/user-files 2011-04-19 06:03:35 -05:00
Jamie Strandboge
8485c8e417 profiles/apparmor.d/abstractions/private-files:
- add zsh files (LP: #761217)
- add .inputrc (bash)
- add .login and .logout (csh, tcsh, etc)
2011-04-19 05:55:32 -05:00
Kees Cook
4670afee7c Nothing in deprecated/ should be built any more, much less shipped in the
tarball. Let's drop this from future tarball creation.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2011-04-18 18:09:29 -07:00
Jamie Strandboge
e946b88d82 ubuntu-browsers.d/multimedia: add f-spot, shotwell and digikam to image viewers
since they are invoked when using sites such as Facebook
2011-04-18 09:32:14 -05:00
Jamie Strandboge
780ae4663d profiles/apparmor.d/abstractions/private-files:
- add zsh files (LP: #761217)
- add .inputrc (bash)
- add .login and .logout (csh, tcsh, etc)
2011-04-18 08:55:50 -05:00
Christian Boltz
34676334b6 added some missing permissions to profiles/extra
ACKed by Kees Cook
2011-04-12 00:10:41 +02:00
Christian Boltz
d799edbcc6 create-apparmor.vim.sh:
- move cap_sys_module and cap_sys_rawio to "dangerous" capabilities
- sorted sdKapKeyDanger

Proposed by Seth Arnold,
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-04-09 18:47:42 +02:00
Jamie Strandboge
00f32d555d adjust ubuntu-media-players abstraction to allow (LP: #750381):
- reading of configs required by gnash
- owner writing of @{HOME}/.gnash
2011-04-07 09:50:20 -05:00
Steve Beattie
b7a8a01ac7 This patch fixes a compilation warning that was trying to tell us
about an actual bug in the parser; namely that when handling strings
encapsulated in quotes, that our handling of octals is busted. It
fixes this by fixing the case entries so that 3 digit octals will
get parsed correctly, rather than dropped.

It also adds a bunch of unit tests for the processquoted() function.
2011-04-05 20:55:19 -07:00
Steve Beattie
3a8546732a This patch fixes warnings emitted by the compiler when compiling on a
32bit arch, due to size_t objects being passed to fprintf with format
strings expecting longs. It does this by adjusting the fprintf rules
to expect size_t objects.
2011-04-05 20:53:35 -07:00
Steve Beattie
d656afa1d5 This patch fixes the parser's dfa generation library makefile to use
the default compilation rules when compiling C++ files, so that things
like CFLAGS et al will be honored. Without this, doing 'make DEBUG=y'
in the parser/ tree will not have its added -pg flag honored, breaking
profiling of the parser.
2011-04-05 20:51:02 -07:00
Christian Boltz
5b3190d39c Add files to generate apparmor.vim to bzr.
Basically the files will generate apparmor.vim as included in openSUSE 
11.4 (and posted here before at the end of january). The only difference 
is that the patch that Steve posted some days ago is already included 
(patch summary: sdGlob: first character of variable name has to be 
 :alpha:, followed by any number of :alnum: or _)
2011-04-05 23:56:14 +02:00
Christian Boltz
c5dca95504 apparmor.d.pod:
- fix ALPHANUMERIC to include 0...9 instead of 1...9
- enforce linebreaks for network example rules

Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-04-01 20:35:14 +02:00
Steve Beattie
dce1d5d5e6 Bah, fix up screwed up testcase. 2011-03-29 02:46:09 -07:00
Steve Beattie
bb31faff1b This patch extends the stress profile generator to add variable
definition and references.
2011-03-28 21:07:44 -07:00
Steve Beattie
162b49b417 This patch attempts to address the over-aggressive behavior of the
stress tests on the parser, by dropping the maximum number of rules
each profile can have, as well as reducing the number of profiles to
generate by default to 50. It also cleans up the emitted profiles
a little, creates the profile names with the suffix .sd [1], fixes
stress.sh to actually honor the -p (alternate parser) argument, fixes
the profile flags generation to not generate duplicates flags, and
fixes the file rules to always start with a constant randomly-generated
prefix element (rather than a regex or variable) to greatly reduce
the possibility of X dominance collisions in the parser
2011-03-28 20:48:30 -07:00
Steve Beattie
f8b43d5ba9 The parser's lexer supports variables defined matching the regex
'[[:alpha:]][[:alnum:]_]*' (i.e. a single alpha followed by any number
of alphanumerics or underscores). Unfortunately, the code that expends
variables inside a profile does not match this, it incorrectly matched
'([[:alpha:]]|_)+' (one or more alphas or underscores). This patch
corrects the behavior there as well as synchronizing the expected
variable names in the apparmor.d manpage and apparmor.vim syntax file.

It also adds unit tests and testcases to verify the behavior.

Signed-off-by: Steve Beattie <sbeattie@ubuntu.com>
2011-03-28 10:52:02 -07:00
Steve Beattie
e8f297db5a Fix up the profiles make install target for the tunables/multiarch.d/
change.
2011-03-23 16:10:33 -07:00
Steve Beattie
4d332ff241 Fix multi-arch comment tyop, thanks to Kees for pointing it out. 2011-03-23 13:44:51 -07:00
Steve Beattie
83007d7600 Author: Jamie Strandboge <jamie@canonical.com>,
Steve Langasek <steve.langasek@linaro.org>,
 Steve Beattie <sbeattie@ubuntu.com>
Description: add multiarch support to abstractions
Bug-Ubuntu: https://bugs.launchpad.net/bugs/736870

This patch add multiarch support for common shared library locations, as
well as a tunables file and directory to ease adding addiotional
multiarch paths.

Bug: https://launchpad.net/bugs/736870
2011-03-23 12:24:11 -07:00
Steve Beattie
5f72ae98eb Update the toplevel README file to discuss the needed apparmor
compatibility patches, mention the profile consistency check, and
remove some variables that no longer need to be set at build time.
2011-03-18 23:13:58 -07:00
Steve Beattie
940ead1fb8 disable the local include in the extras firefox profile; the build
process does not generate local files for things in extras, and even if
it did, this one is named in a non-standard fashion (usr.bin.firefox vs.
usr.lib.firefox.firefox).
2011-03-18 22:38:55 -07:00
Steve Beattie
bb28ca5371 profiles/Makefile: fix 'check' target to iterate over the profiles in
the extras directory as intended and fail the make if a parse failure
occurs. Also, set the default parser and logprof to be the intree ones;
the system ones can still be used by setting environment variables.
Finally, have the 'all' target generate the local files. Also, set the
parser base directory to the apparmor.d directory (rather than as an
added include, to avoid outside contamination from system profiles and
includes).

With these changes, make && make check should verify the profile set is
compilable and mostly consistent. (Alas, the current profiles are not
quite consistent).
2011-03-18 22:31:26 -07:00
Steve Beattie
0edae73a9a This fixes the apparmor apache2 module to link correctly against the
built libapparmor, as well as working around libtool so that the
libapparmor library build directory does not get added as an rpath to
the module.

Bug: https://launchpad.net/bugs/737074
2011-03-17 23:32:34 -07:00
Steve Beattie
19a2d6d169 Reduce the number of network protocols filtered from the parser.
https://bugs.launchpad.net/bugs/732837

Bug: https://launchpad.net/bugs/732837
2011-03-17 10:50:53 -07:00
Steve Beattie
f3b847c4b0 Fix from PLD/Arkadiusz Miskiewicz <arekm@maven.pl> to the initscript
helper functions to correct some log messages and to unload hats first,
before their parents.
2011-03-17 10:21:06 -07:00
John Johansen
1a2484e5bc Finish renaming regexp to regex
Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-03-13 06:01:21 -07:00
John Johansen
6ed55cb1d5 Update Makefile dependencies
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 06:00:31 -07:00
John Johansen
099f19f99c Update the licence for apparmor_re.h
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:59:48 -07:00
John Johansen
7d2a6b53d4 Lindent parse + hand cleanups
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@gmail.com>
2011-03-13 05:58:54 -07:00
John Johansen
6f0c68a4d4 Lindent + some hand cleanups expr-tree
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@gmail.com>
2011-03-13 05:57:39 -07:00
John Johansen
9a377bb9da Lindent + some hand cleanups hfa
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@gmail.com>
2011-03-13 05:55:25 -07:00
John Johansen
3cfe47d3f0 Lindent + hand cleanups compressed-dfa
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:54:18 -07:00
John Johansen
84c0bba1ef Lindent + hand cleanups aare_rules
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:53:08 -07:00
John Johansen
6aad970d1c Split out compressed dfa "transition table" compression
Split hfa into hfa and compressed_hfa files.  The hfa portion focuses on
creating an manipulating hfas, while compressed_hfa is used for creating
compressed hfas that can be used/reused at run time with much less memory
usage than the full blown hfa.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:50:34 -07:00
John Johansen
298a36bffb Split out aare_rules which are used to encapsulate creating the dfa
Split out the aare_rule bits that encapsulate the convertion of apparmor
rules into the final compressed dfa.

This patch will not compile because of the it needs hfa to export an interface
but hfa is going to be split so just delay until hfa and transtable are
split and they can each export their own interface.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:49:15 -07:00
John Johansen
846cee5066 Split out parsing and expression trees from regexp.y
Start of splitting regexp.y into logical components instead of the mess
it is today.  Split out the expr-tree and parsing components from regexp.y
int expr-tree.x and parse.y and since regexp.y no longer does parsing
rename it to hfa.cc

Some code cleanups snuck their way into this patch and since I am to
lazy to redo it, I have left them in.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-By: Steve Beattie <sbeattie@ubuntu.com>
2011-03-13 05:46:29 -07:00
Steve Beattie
50760ef05b Adjust version to indicate that 2.6 has branched off and that trunk is
working towards a 2.7.0 or 3.0.0 release.
2011-03-10 10:25:55 -08:00
John Johansen
0b383ad769 Add tests to ensure parser is checking its own time stamp wrt profile cache
Signed-off-by: Steve Beattie <steve@nxnw.org>
Acked-by: John Johansen <john.johansen@canonical.com>
2011-03-08 14:52:32 -08:00
John Johansen
55bad42088 apparmor_parser doesn't use its time stamp when determining if cache is stale
If the apparmor_parser is updated (outside of current packaging), when
doing profile loads it will use the existing cache of compiled profiles,
instead of forcing a recompile on profiles.

This can cause apparmor to load bad policy if the parser contains a bug
fix for the previous version of the parser.

This can be worked around in packaging by invalidating the cache and
forcing a profile reload when the parser is upgraded.

Signed-off-by: John Johansen <john.johansen@canonical.com>
2011-03-08 14:49:03 -08:00
John Johansen
258c39d4a5 Profiles that specify a name and attachment specification fail to attach when the
attachment specification doesn't contain globbing.

eg.
   # profile name and attachment the same - attaches as expected
   profile /usr/lib/chromium-browser/chromium-browser

   # profile without attachment specification - does not attach as expected
  profile chromium-browser

  # profile with name and attachment specification where the attachment specification uses globbing - attaches as expected
  profile chromium-browser /usr/lib/chromium-browser/chromium-broswer*

  # profile with name and attachment specification without globbing - FAILS to attach when it should
  profile chromium-browser /usr/lib/chromium-browser/chromium-browser


This occurs because the xmatch_len is not set correctly for the profiles that specify
a name and an attachment specification, where the attachment specification does not
contain globbing characters.

In this situation the correct length for the xmatch_len is the length of the name, as
the shortest possible unambiguous match is the name length.

This patch does not fix a related bug where an attachment specification of ** will not
match (/**) will.
2011-03-08 10:12:09 -08:00
John Johansen
9819bf5df0 Ensure that the buffer read from /proc/sys/kernel/osrelease is null terminated
Signed-off-by: Jamie Strandboge <jamie@canonical.com>
Acked-by: John Johansen <john.johansen@canonical.com>
2011-03-03 15:53:23 -08:00
John Johansen
174c89f772 override AF_MAX for kernels that don't support proper masking
Older versions of the apparmor kernel patches didn't handle receiving
network tables of a larger size than expected.

Allow the parser to detect the kernel version and override the AF_MAX
value for those kernels.

This also replaces the hack using a hardcoded limit of 36 for kernels
missing the features flag.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees.cook@canonical.com>
2011-03-03 15:45:10 -08:00
Steve Beattie
52e14b5c93 merged:
Kees Cook 2011-03-02 update AA url in README
2011-03-02 20:12:27 -08:00
Kees Cook
83ef426514 update AA url in README 2011-03-02 12:19:35 -08:00
Steve Beattie
e14c6c39f1 Make tcp test support current network syntax, reanable tcp test 2011-03-02 05:02:45 -08:00
2587 changed files with 166824 additions and 108947 deletions

View File

@@ -1,28 +1,70 @@
apparmor-*
cscope.*
binutils/aa-enabled
binutils/aa-enabled.1
binutils/aa-exec
binutils/aa-exec.1
binutils/po/*.mo
parser/po/*.mo
parser/af_names.h
parser/cap_names.h
parser/tst_lib
parser/tst_misc
parser/tst_regex
parser/tst_symtab
parser/tst_variable
parser/tst/simple_tests/generated_*/*
parser/parser_lex.c
parser/parser_version.h
parser/parser_yacc.c
parser/parser_yacc.h
parser/pod2htm*.tmp
parser/af_rule.o
parser/af_unix.o
parser/common_optarg.o
parser/dbus.o
parser/lib.o
parser/libapparmor_re/aare_rules.o
parser/libapparmor_re/chfa.o
parser/libapparmor_re/expr-tree.o
parser/libapparmor_re/hfa.o
parser/libapparmor_re/libapparmor_re.a
parser/libapparmor_re/parse.o
parser/mount.o
parser/network.o
parser/parser_alias.o
parser/parser_common.o
parser/parser_include.o
parser/parser_interface.o
parser/parser_lex.o
parser/parser_main.o
parser/parser_merge.o
parser/parser_misc.o
parser/parser_policy.o
parser/parser_regex.o
parser/parser_symtab.o
parser/parser_variable.o
parser/parser_yacc.o
parser/policy_cache.o
parser/profile.o
parser/ptrace.o
parser/rule.o
parser/signal.o
parser/*.7
parser/*.5
parser/*.8
parser/*.7.html
parser/*.5.html
parser/*.8.html
parser/common
parser/apparmor_parser
parser/libapparmor_re/parse.cc
parser/libapparmor_re/regexp.cc
parser/techdoc.aux
parser/techdoc.log
parser/techdoc.pdf
parser/techdoc.toc
profiles/apparmor.d/local/*
!profiles/apparmor.d/local/README
libraries/libapparmor/Makefile
libraries/libapparmor/Makefile.in
libraries/libapparmor/aclocal.m4
@@ -39,27 +81,61 @@ libraries/libapparmor/install-sh
libraries/libapparmor/libtool
libraries/libapparmor/ltmain.sh
libraries/libapparmor/missing
libraries/libapparmor/test-driver
libraries/libapparmor/ylwrap
libraries/libapparmor/doc/Makefile
libraries/libapparmor/doc/Makefile.in
libraries/libapparmor/doc/*.2
libraries/libapparmor/doc/aa_*.3
libraries/libapparmor/include/Makefile
libraries/libapparmor/include/Makefile.in
libraries/libapparmor/include/sys/Makefile
libraries/libapparmor/include/sys/Makefile.in
libraries/libapparmor/src/.deps
libraries/libapparmor/src/.libs
libraries/libapparmor/src/Makefile
libraries/libapparmor/src/Makefile.in
libraries/libapparmor/src/PMurHash.lo
libraries/libapparmor/src/PMurHash.o
libraries/libapparmor/src/af_protos.h
libraries/libapparmor/src/change_hat.lo
libraries/libapparmor/src/features.lo
libraries/libapparmor/src/features.o
libraries/libapparmor/src/grammar.lo
libraries/libapparmor/src/grammar.o
libraries/libapparmor/src/kernel.lo
libraries/libapparmor/src/kernel.o
libraries/libapparmor/src/kernel_interface.lo
libraries/libapparmor/src/kernel_interface.o
libraries/libapparmor/src/libaalogparse.lo
libraries/libapparmor/src/libaalogparse.o
libraries/libapparmor/src/libimmunix_warning.lo
libraries/libapparmor/src/policy_cache.lo
libraries/libapparmor/src/policy_cache.o
libraries/libapparmor/src/private.lo
libraries/libapparmor/src/private.o
libraries/libapparmor/src/scanner.lo
libraries/libapparmor/src/scanner.o
libraries/libapparmor/src/libapparmor.pc
libraries/libapparmor/src/libapparmor.la
libraries/libapparmor/src/libimmunix.la
libraries/libapparmor/src/grammar.c
libraries/libapparmor/src/grammar.h
libraries/libapparmor/src/scanner.c
libraries/libapparmor/src/scanner.h
libraries/libapparmor/src/test-suite.log
libraries/libapparmor/src/tst_aalogmisc
libraries/libapparmor/src/tst_aalogmisc.log
libraries/libapparmor/src/tst_aalogmisc.o
libraries/libapparmor/src/tst_aalogmisc.trs
libraries/libapparmor/src/tst_features
libraries/libapparmor/src/tst_features.log
libraries/libapparmor/src/tst_features.o
libraries/libapparmor/src/tst_features.trs
libraries/libapparmor/src/tst_kernel
libraries/libapparmor/src/tst_kernel.log
libraries/libapparmor/src/tst_kernel.o
libraries/libapparmor/src/tst_kernel.trs
libraries/libapparmor/swig/Makefile
libraries/libapparmor/swig/Makefile.in
libraries/libapparmor/swig/perl/LibAppArmor.bs
@@ -68,14 +144,33 @@ libraries/libapparmor/swig/perl/Makefile
libraries/libapparmor/swig/perl/Makefile.PL
libraries/libapparmor/swig/perl/Makefile.in
libraries/libapparmor/swig/perl/Makefile.perl
libraries/libapparmor/swig/perl/Makefile.perle
libraries/libapparmor/swig/perl/MYMETA.json
libraries/libapparmor/swig/perl/MYMETA.yml
libraries/libapparmor/swig/perl/blib
libraries/libapparmor/swig/perl/libapparmor_wrap.c
libraries/libapparmor/swig/perl/libapparmor_wrap.o
libraries/libapparmor/swig/perl/pm_to_blib
libraries/libapparmor/swig/python/LibAppArmor.py
libraries/libapparmor/swig/python/build/
libraries/libapparmor/swig/python/libapparmor_wrap.c
libraries/libapparmor/swig/python/Makefile
libraries/libapparmor/swig/python/Makefile.in
libraries/libapparmor/swig/python/setup.py
libraries/libapparmor/swig/python/test/Makefile
libraries/libapparmor/swig/python/test/Makefile.in
libraries/libapparmor/swig/python/test/test-suite.log
libraries/libapparmor/swig/python/test/test_python.py
libraries/libapparmor/swig/python/test/test_python.py.log
libraries/libapparmor/swig/python/test/test_python.py.trs
libraries/libapparmor/swig/ruby/LibAppArmor.so
libraries/libapparmor/swig/ruby/LibAppArmor_wrap.c
libraries/libapparmor/swig/ruby/LibAppArmor_wrap.o
libraries/libapparmor/swig/ruby/Makefile
libraries/libapparmor/swig/ruby/Makefile.in
libraries/libapparmor/swig/ruby/Makefile.new
libraries/libapparmor/swig/ruby/Makefile.ruby
libraries/libapparmor/swig/ruby/mkmf.log
libraries/libapparmor/testsuite/.deps
libraries/libapparmor/testsuite/.libs
libraries/libapparmor/testsuite/Makefile
@@ -91,17 +186,23 @@ libraries/libapparmor/testsuite/lib/Makefile.in
libraries/libapparmor/testsuite/libaalogparse.test/Makefile
libraries/libapparmor/testsuite/libaalogparse.test/Makefile.in
libraries/libapparmor/testsuite/test_multi/out
libraries/libapparmor/testsuite/test_multi_multi-test_multi.o
changehat/mod_apparmor/.libs
changehat/mod_apparmor/common
changehat/pam_apparmor/common
changehat/tomcat_apparmor/common
utils/common
utils/*.8
utils/*.8.html
utils/*.5
utils/*.5.html
utils/*.tmp
utils/po/*.mo
utils/apparmor/*.pyc
utils/apparmor/rule/*.pyc
utils/test/common_test.pyc
utils/test/.coverage
utils/test/htmlcov/
utils/vim/apparmor.vim
utils/vim/apparmor.vim.5
utils/vim/apparmor.vim.5.html
utils/vim/pod2htmd.tmp
tests/regression/apparmor/access
tests/regression/apparmor/changehat
tests/regression/apparmor/changehat_fail
@@ -163,3 +264,5 @@ tests/regression/apparmor/unix_fd_server
tests/regression/apparmor/unlink
tests/regression/apparmor/xattrs
tests/regression/apparmor/coredump
**/__pycache__/
*.orig

54
.gitlab-ci.yml Normal file
View File

@@ -0,0 +1,54 @@
---
image: ubuntu:latest
before_script:
- export DEBIAN_FRONTEND=noninteractive && apt-get update -qq && apt-get install --no-install-recommends -y build-essential apache2-dev autoconf automake bison dejagnu flex libpam-dev libtool perl liblocale-gettext-perl pkg-config python-all-dev python3-all-dev pyflakes3 ruby-dev swig lsb-release python3-notify2 python3-psutil python3-setuptools zlib1g-dev
- lsb_release -a
- uname -a
# XXX - add a deploy stage to publish man pages, docs, and coverage
# reports
stages:
- build
- test
build-all:
stage: build
artifacts:
name: ${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
expire_in: 30 days
untracked: true
paths:
- libraries/libapparmor/
- parser/
- binutils/
- utils/
- changehat/mod_apparmor/
- changehat/pam_apparmor/
- profiles/
script:
- cd libraries/libapparmor && ./autogen.sh && PYTHON=/usr/bin/python3 ./configure --with-perl --with-python --prefix=/usr && make PYTHON=/usr/bin/python3 && cd ../.. || { cat config.log ; exit 1 ; }
- make -C parser
- make -C binutils
- make -C utils
- make -C changehat/mod_apparmor
- make -C changehat/pam_apparmor
- make -C profiles
test-all:
stage: test
script:
- make -C libraries/libapparmor check PYTHON=/usr/bin/python3
- make -C parser check
- make -C binutils check
- make -C utils check PYFLAKES=/usr/bin/pyflakes3 PYTHON_VERSIONS=/usr/bin/python3
- make -C changehat/mod_apparmor check
- make -C profiles check-parser
# Disabled due to aa-logprof dependency on /sbin/apparmor_parser existing
# - make -C profiles check-profiles
# test-pam_apparmor:
# - stage: test
# - script:
# - cd changehat/pam_apparmor && make check

View File

@@ -1,59 +1,90 @@
#
#
OVERRIDE_TARBALL=yes
.PHONY: all
all:
@echo "*** See README for information how to build AppArmor ***"
exit 1
include common/Make.rules
COMMONDIR=common
include ${COMMONDIR}/Make.rules
DIRS=parser \
profiles \
DIRS=libraries/libapparmor \
binutils \
parser \
utils \
changehat/libapparmor \
changehat/mod_apparmor \
changehat/pam_apparmor \
management/apparmor-dbus \
management/applets/apparmorapplet-gnome \
management/yastui \
common \
profiles \
tests
REPO_URL?=lp:apparmor
# alternate possibilities to export from
#REPO_URL=.
#REPO_URL="bzr+ssh://bazaar.launchpad.net/~sbeattie/+junk/apparmor-dev/"
# with conversion to git, we don't export from the remote
REPO_URL?=git@gitlab.com:apparmor/apparmor.git
REPO_BRANCH?=apparmor-2.11
COVERITY_DIR=cov-int
RELEASE_DIR=apparmor-${VERSION}
__SETUP_DIR?=.
# We create a separate version for tags because git can't handle tags
# with embedded ~s in them. No spaces around '-' or they'll get
# embedded in ${VERSION}
# apparmor version tag format 'vX.Y.ZZ'
# apparmor branch name format 'apparmor-X.Y'
TAG_VERSION="v$(subst ~,-,${VERSION})"
# Add exclusion entries arguments for tar here, of the form:
# --exclude dir_to_exclude --exclude other_dir
TAR_EXCLUSIONS=
.PHONY: tarball
tarball: clean
REPO_VERSION=`$(value REPO_VERSION_CMD)` ; \
make export_dir __EXPORT_DIR=${RELEASE_DIR} __REPO_VERSION=$${REPO_VERSION} ; \
make setup __SETUP_DIR=${RELEASE_DIR} ; \
tar cvzf ${RELEASE_DIR}.tar.gz ${RELEASE_DIR}
REPO_VERSION=`$(value REPO_VERSION_CMD)` && \
make export_dir __EXPORT_DIR=${RELEASE_DIR} __REPO_VERSION=$${REPO_VERSION} && \
make setup __SETUP_DIR=${RELEASE_DIR} && \
tar ${TAR_EXCLUSIONS} -cvzf ${RELEASE_DIR}.tar.gz ${RELEASE_DIR}
.PHONY: snapshot
snapshot: clean
REPO_VERSION=`$(value REPO_VERSION_CMD)` ; \
SNAPSHOT_DIR=apparmor-${VERSION}~$${REPO_VERSION} ;\
make export_dir __EXPORT_DIR=$${SNAPSHOT_DIR} __REPO_VERSION=$${REPO_VERSION} ; \
make setup __SETUP_DIR=$${SNAPSHOT_DIR} ; \
tar cvzf $${SNAPSHOT_DIR}.tar.gz $${SNAPSHOT_DIR} ;
$(eval REPO_VERSION:=$(shell $(value REPO_VERSION_CMD)))
$(eval SNAPSHOT_NAME=apparmor-$(VERSION)~$(shell echo $(REPO_VERSION) | cut -d '-' -f 2-))
$(MAKE) export_dir __EXPORT_DIR=${SNAPSHOT_NAME} __REPO_VERSION=${REPO_VERSION} && \
$(MAKE) setup __SETUP_DIR=${SNAPSHOT_NAME} && \
tar ${TAR_EXCLUSIONS} -cvzf ${SNAPSHOT_NAME}.tar.gz ${SNAPSHOT_NAME}
.PHONY: coverity
coverity: snapshot
cd $(SNAPSHOT_NAME)/libraries/libapparmor && ./configure --with-python
$(foreach dir, $(filter-out utils profiles tests, $(DIRS)), \
cov-build --dir $(COVERITY_DIR) -- make -C $(SNAPSHOT_NAME)/$(dir); \
mv $(COVERITY_DIR)/build-log.txt $(COVERITY_DIR)/build-log-$(subst /,.,$(dir)).txt ;)
$(foreach dir, libraries/libapparmor utils, \
cov-build --dir $(COVERITY_DIR) --no-command --fs-capture-search $(SNAPSHOT_NAME)/$(dir); \
mv $(COVERITY_DIR)/build-log.txt $(COVERITY_DIR)/build-log-python-$(subst /,.,$(dir)).txt ;)
tar -cvzf $(SNAPSHOT_NAME)-$(COVERITY_DIR).tar.gz $(COVERITY_DIR)
.PHONY: export_dir
export_dir:
mkdir $(__EXPORT_DIR)
/usr/bin/bzr export --per-file-timestamps -r $(__REPO_VERSION) $(__EXPORT_DIR) $(REPO_URL)
echo "$(REPO_URL) $(__REPO_VERSION)" > $(__EXPORT_DIR)/common/.stamp_rev
/usr/bin/git archive --prefix=$(__EXPORT_DIR)/ --format tar $(__REPO_VERSION) | tar xv
echo "$(REPO_URL) $(REPO_BRANCH) $(__REPO_VERSION)" > $(__EXPORT_DIR)/common/.stamp_rev
.PHONY: clean
clean:
-rm -rf ${RELEASE_DIR} ./apparmor-${VERSION}~*
-rm -rf ${RELEASE_DIR} ./apparmor-${VERSION}~* ${COVERITY_DIR}
for dir in $(DIRS); do \
make -C $$dir clean; \
done
.PHONY: setup
setup:
cd $(__SETUP_DIR)/libraries/libapparmor && ./autogen.sh
# parser has an extra doc to build
make -C $(__SETUP_DIR)/parser extra_docs
# libraries/libapparmor needs configure to have run before
# building docs
$(foreach dir, $(filter-out libraries/libapparmor tests, $(DIRS)), \
make -C $(__SETUP_DIR)/$(dir) docs;)
.PHONY: tag
tag:
bzr tag apparmor_${VERSION}
git tag -m 'AppArmor $(VERSION)' -s $(TAG_VERSION)

155
README
View File

@@ -1,155 +0,0 @@
------------
Introduction
------------
AppArmor protects systems from insecure or untrusted processes by
running them in restricted confinement, while still allowing processes
to share files, exercise privilege and communicate with other processes.
AppArmor is a Mandatory Access Control (MAC) mechanism which uses the
Linux Security Module (LSM) framework. The confinement's restrictions
are mandatory and are not bound to identity, group membership, or object
ownership. The protections provided are in addition to the kernel's
regular access control mechanisms (including DAC) and can be used to
restrict the superuser.
The AppArmor kernel module and accompanying user-space tools are
available under the GPL license (the exception is the libapparmor
library, available under the LGPL license, which allows change_hat(2)
and change_profile(2) to be used by non-GPL binaries).
For more information, you can read the techdoc.pdf (available after
building the parser) and http://apparmor.wiki.kernel.org.
-------------
Source Layout
-------------
AppArmor consists of several different parts:
changehat/ source for using changehat with Apache, PAM and Tomcat
common/ common makefile rules
desktop/ empty
kernel-patches/ patches for various kernel versions
libraries/ libapparmor source and language bindings
parser/ source for parser/loader and corresponding documentation
profiles/ configuration files, reference profiles and abstractions
tests/ regression and stress testsuites
utils/ high-level utilities for working with AppArmor
------------------------------------------
Building and Installing AppArmor Userspace
------------------------------------------
To build and install AppArmor userspace on your system, build and install in
the following order.
libapparmor:
$ cd ./libraries/libapparmor
$ sh ./autogen.sh
$ sh ./configure --prefix=/usr --with-perl
$ make
$ make check
Utilities:
$ cd utils
$ make
$ make install
parser:
$ cd parser
$ make
$ make tests # not strictly necessary as they are run during the
# build by default
$ make install
Apache mod_apparmor:
$ cd changehat/mod_apparmor
$ LIBS="-lapparmor" make
$ make install
PAM AppArmor:
$ cd changehat/pam_apparmor
$ LIBS="-lapparmor -lpam" make
$ make install
Profiles:
$ cd profiles
$ make
$ make install
-------------------
AppArmor Testsuites
-------------------
A number of testsuites are in the AppArmor sources. Most have documentation on
usage and how to update and add tests. Below is a quick overview of their
location and how to run them.
Regression tests
----------------
For details on structure and adding tests, see
tests/regression/apparmor/README.
To run:
$ cd tests/regression/apparmor (requires root)
$ make
$ sudo make tests
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
Parser tests
------------
For details on structure and adding tests, see parser/tst/README.
To run:
$ cd parser/tst
$ make
$ make tests
Libapparmor
-----------
For details on structure and adding tests, see libraries/libapparmor/README.
$ cd libraries/libapparmor
$ make check
Stress Tests
------------
To run AppArmor stress tests:
$ make all
Use these:
$ ./change_hat
$ ./child
$ ./kill.sh
$ ./open
$ ./s.sh
Or run all at once:
$ ./stress.sh
Please note that the above will stress the system so much it may end up
invoking the OOM killer.
To run parser stress tests (requires /usr/bin/ruby):
$ ./stress.sh
(see stress.sh -h for options)
-----------------------------------------------
Building and Installing AppArmor Kernel Patches
-----------------------------------------------
TODO

341
README.md Normal file
View File

@@ -0,0 +1,341 @@
# AppArmor
[![Build status](https://gitlab.com/apparmor/apparmor/badges/master/build.svg)](https://gitlab.com/apparmor/apparmor/commits/master)
[![Overall test coverage](https://gitlab.com/apparmor/apparmor/badges/master/coverage.svg)](https://gitlab.com/apparmor/apparmor/pipelines)
[![Core Infrastructure Initiative Best Practices](https://bestpractices.coreinfrastructure.org/projects/1699/badge)](https://bestpractices.coreinfrastructure.org/projects/1699)
------------
Introduction
------------
AppArmor protects systems from insecure or untrusted processes by
running them in restricted confinement, while still allowing processes
to share files, exercise privilege and communicate with other processes.
AppArmor is a Mandatory Access Control (MAC) mechanism which uses the
Linux Security Module (LSM) framework. The confinement's restrictions
are mandatory and are not bound to identity, group membership, or object
ownership. The protections provided are in addition to the kernel's
regular access control mechanisms (including DAC) and can be used to
restrict the superuser.
The AppArmor kernel module and accompanying user-space tools are
available under the GPL license (the exception is the libapparmor
library, available under the LGPL license, which allows change_hat(2)
and change_profile(2) to be used by non-GPL binaries).
For more information, you can read the techdoc.pdf (available after
building the parser) and by visiting the https://apparmor.net/ web
site.
----------------
Getting in Touch
----------------
Please send all complaints, feature requests, rants about the software,
and questions to the
[AppArmor mailing list](https://lists.ubuntu.com/mailman/listinfo/apparmor).
Bug reports can be filed against the AppArmor project on
[launchpad](https://bugs.launchpad.net/apparmor) or reported to the mailing
list directly for those who wish not to register for an account on
launchpad. See the
[wiki page](https://gitlab.com/apparmor/apparmor/wikis/home#reporting-bugs)
for more information.
Security issues can be filed as security bugs on launchpad
or directed to `security@apparmor.net`. Additional details can be found
in the [wiki](https://gitlab.com/apparmor/apparmor/wikis/home#reporting-security-vulnerabilities).
--------------
Privacy Policy
--------------
The AppArmor security project respects users privacy and data and does not collect data from or on its users beyond what is required for a given component to function.
The AppArmor kernel security module will log violations to the audit subsystem, and those will be logged/forwarded/recorded on the user's system(s) according to how the administrator has logging configured. Again this is not forwarded to or collected by the AppArmor project.
The AppArmor userspace tools do not collect information on the system user beyond the logs and information needed to interact with the user. This is not forwarded to, nor collected by the AppArmor project.
Users may submit information as part of an email, bug report or merge request, etc. and that will be recorded as part of the mailing list, bug/issue tracker, or code repository but only as part of a user initiated action.
The AppArmor project does not collect information from contributors beyond their interactions with the AppArmor project, code, and community. However contributors are subject to the terms and conditions and privacy policy of the individual platforms (currently GitLab and LaunchPad) should they choose to contribute through those platforms. And those platforms may collect data on the user that the AppArmor project does not.
Currently both GitLab an LaunchPad require a user account to submit patches or report bugs and issues. If a contributor does not wish to create an account for these platforms the mailing list is available. Membership in the list is not required. Content from non-list members will be sent to moderation, to ensure that it is on topic, so there may be a delay in choosing to interact in this way.
-------------
Source Layout
-------------
AppArmor consists of several different parts:
```
binutils/ source for basic utilities written in compiled languages
changehat/ source for using changehat with Apache, PAM and Tomcat
common/ common makefile rules
desktop/ empty
kernel-patches/ compatibility patches for various kernel versions
libraries/ libapparmor source and language bindings
parser/ source for parser/loader and corresponding documentation
profiles/ configuration files, reference profiles and abstractions
tests/ regression and stress testsuites
utils/ high-level utilities for working with AppArmor
```
--------------------------------------
Important note on AppArmor kernel code
--------------------------------------
While most of the kernel AppArmor code has been accepted in the
upstream Linux kernel, a few important pieces were not included. These
missing pieces unfortunately are important bits for AppArmor userspace
and kernel interaction; therefore we have included compatibility
patches in the kernel-patches/ subdirectory, versioned by upstream
kernel (2.6.37 patches should apply cleanly to 2.6.38 source).
Without these patches applied to the kernel, the AppArmor userspace
will not function correctly.
------------------------------------------
Building and Installing AppArmor Userspace
------------------------------------------
To build and install AppArmor userspace on your system, build and install in
the following order. Some systems may need to export various python-related
environment variables to complete the build. For example, before building
anything on these systems, use something along the lines of:
```
$ export PYTHONPATH=$(realpath libraries/libapparmor/swig/python)
$ export PYTHON=/usr/bin/python3
$ export PYTHON_VERSION=3
$ export PYTHON_VERSIONS=python3
```
libapparmor:
```
$ cd ./libraries/libapparmor
$ sh ./autogen.sh
$ sh ./configure --prefix=/usr --with-perl --with-python # see below
$ make
$ make check
$ make install
```
[an additional optional argument to libapparmor's configure is --with-ruby, to
generate Ruby bindings to libapparmor.]
Binary Utilities:
```
$ cd binutils
$ make
$ make check
$ make install
```
parser:
```
$ cd parser
$ make # depends on libapparmor having been built first
$ make check
$ make install
```
Utilities:
```
$ cd utils
$ make
$ make check PYFLAKES=/usr/bin/pyflakes3
$ make install
```
Apache mod_apparmor:
```
$ cd changehat/mod_apparmor
$ make # depends on libapparmor having been built first
$ make install
```
PAM AppArmor:
```
$ cd changehat/pam_apparmor
$ make # depends on libapparmor having been built first
$ make install
```
Profiles:
```
$ cd profiles
$ make
$ make check # depends on the parser having been built first
$ make install
```
[Note that for the parser, binutils, and utils, if you only wish to build/use
some of the locale languages, you can override the default by passing
the LANGS arguments to make; e.g. make all install "LANGS=en_US fr".]
-------------------
AppArmor Testsuites
-------------------
A number of testsuites are in the AppArmor sources. Most have documentation on
usage and how to update and add tests. Below is a quick overview of their
location and how to run them.
Regression tests
----------------
For details on structure and adding tests, see
tests/regression/apparmor/README.
To run:
```
$ cd tests/regression/apparmor (requires root)
$ make
$ sudo make tests
$ sudo bash open.sh -r # runs and saves the last testcase from open.sh
```
Parser tests
------------
For details on structure and adding tests, see parser/tst/README.
To run:
```
$ cd parser/tst
$ make
$ make tests
```
Libapparmor
-----------
For details on structure and adding tests, see libraries/libapparmor/README.
```
$ cd libraries/libapparmor
$ make check
```
Utils
-----
Tests for the Python utilities exist in the test/ subdirectory.
```
$ cd utils
$ make check
```
The aa-decode utility to be tested can be overridden by
setting up environment variable APPARMOR_DECODE; e.g.:
```
$ APPARMOR_DECODE=/usr/bin/aa-decode make check
```
Profile checks
--------------
A basic consistency check to ensure that the parser and aa-logprof parse
successfully the current set of shipped profiles. The system or other
parser and logprof can be passed in by overriding the PARSER and LOGPROF
variables.
```
$ cd profiles
$ make && make check
```
Stress Tests
------------
To run AppArmor stress tests:
```
$ make all
```
Use these:
```
$ ./change_hat
$ ./child
$ ./kill.sh
$ ./open
$ ./s.sh
```
Or run all at once:
```
$ ./stress.sh
```
Please note that the above will stress the system so much it may end up
invoking the OOM killer.
To run parser stress tests (requires /usr/bin/ruby):
```
$ ./stress.sh
```
(see stress.sh -h for options)
Coverity Support
----------------
Coverity scans are available to AppArmor developers at
https://scan.coverity.com/projects/apparmor.
In order to submit a Coverity build for analysis, the cov-build binary
must be discoverable from your PATH. See the "To Setup" section of
https://scan.coverity.com/download?tab=cxx to obtain a pre-built copy of
cov-build.
To generate a compressed tarball of an intermediate Coverity directory:
```
$ make coverity
```
The compressed tarball is written to
apparmor-<SNAPSHOT_VERSION>-cov-int.tar.gz, where <SNAPSHOT_VERSION>
is something like 2.10.90~3328, and must be uploaded to
https://scan.coverity.com/projects/apparmor/builds/new for analysis. You must
include the snapshot version in Coverity's project build submission form, in
the "Project Version" field, so that it is quickly obvious to all AppArmor
developers what snapshot of the AppArmor repository was used for the analysis.
-----------------------------------------------
Building and Installing AppArmor Kernel Patches
-----------------------------------------------
TODO
-----------------
Required versions
-----------------
The AppArmor userspace utilities are written with some assumptions about
installed and available versions of other tools. This is a (possibly
incomplete) list of known version dependencies:
The Python utilities require a minimum of Python 2.7 (deprecated) or Python 3.3.
Python 3.x is recommended. Python 2.x support is deprecated since AppArmor 2.11.
Some utilities (aa-exec, aa-notify and aa-decode) require Perl 5.10.1 or newer.
Most shell scripts are written for POSIX-compatible sh. aa-decode expects
bash, probably version 3.2 and higher.

157
binutils/Makefile Normal file
View File

@@ -0,0 +1,157 @@
# ----------------------------------------------------------------------
# Copyright (c) 2015
# Canonical Ltd. (All rights reserved)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# ----------------------------------------------------------------------
NAME=aa-binutils
all:
COMMONDIR=../common/
include $(COMMONDIR)/Make.rules
DESTDIR=/
BINDIR=${DESTDIR}/usr/bin
LOCALEDIR=/usr/share/locale
MANPAGES=aa-enabled.1 aa-exec.1
WARNINGS = -Wall
EXTRA_WARNINGS = -Wsign-compare -Wmissing-field-initializers -Wformat-security -Wunused-parameter
CPP_WARNINGS =
ifndef CFLAGS
CFLAGS = -g -O2 -pipe
ifdef DEBUG
CFLAGS += -pg -D DEBUG
endif
ifdef COVERAGE
CFLAGS = -g -pg -fprofile-arcs -ftest-coverage
endif
endif #CFLAGS
EXTRA_CFLAGS = ${CFLAGS} ${CPPFLAGS} ${EXTRA_CXXFLAGS} ${CPP_WARNINGS}
#INCLUDEDIR = /usr/src/linux/include
INCLUDEDIR =
ifdef INCLUDEDIR
CFLAGS += -I$(INCLUDEDIR)
endif
# Internationalization support. Define a package and a LOCALEDIR
EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
SRCS = aa_enabled.c
HDRS =
TOOLS = aa-enabled aa-exec
AALIB = -Wl,-Bstatic -lapparmor -Wl,-Bdynamic -lpthread
ifdef USE_SYSTEM
# Using the system libapparmor so Makefile dependencies can't be used
LIBAPPARMOR_A =
INCLUDE_APPARMOR =
APPARMOR_H =
LIBAPPARMOR_LDFLAGS =
else
LIBAPPARMOR_SRC = ../libraries/libapparmor/
LOCAL_LIBAPPARMOR_INCLUDE = $(LIBAPPARMOR_SRC)/include
LOCAL_LIBAPPARMOR_LDPATH = $(LIBAPPARMOR_SRC)/src/.libs
LIBAPPARMOR_A = $(LOCAL_LIBAPPARMOR_LDPATH)/libapparmor.a
INCLUDE_APPARMOR = -I$(LOCAL_LIBAPPARMOR_INCLUDE)
APPARMOR_H = $(LOCAL_LIBAPPARMOR_INCLUDE)/sys/apparmor.h
LIBAPPARMOR_LDFLAGS = -L$(LOCAL_LIBAPPARMOR_LDPATH)
endif
EXTRA_CFLAGS += $(INCLUDE_APPARMOR)
LDFLAGS += $(LIBAPPARMOR_LDFLAGS)
ifdef V
VERBOSE = 1
endif
ifndef VERBOSE
VERBOSE = 0
endif
ifeq ($(VERBOSE),1)
BUILD_OUTPUT =
Q =
else
BUILD_OUTPUT = > /dev/null 2>&1
Q = @
endif
export Q VERBOSE BUILD_OUTPUT
po/%.pot: %.c
$(MAKE) -C po $(@F) NAME=$* SOURCES=$*.c
# targets arranged this way so that people who don't want full docs can
# pick specific targets they want.
arch: $(TOOLS)
manpages: $(MANPAGES)
docs: manpages
indep: docs
$(Q)$(MAKE) -C po all
all: arch indep
.PHONY: coverage
coverage:
$(MAKE) clean $(TOOLS) COVERAGE=1
ifndef USE_SYSTEM
$(LIBAPPARMOR_A):
@if [ ! -f $@ ]; then \
echo "error: $@ is missing. Pick one of these possible solutions:" 1>&2; \
echo " 1) Build against the in-tree libapparmor by building it first and then trying again. See the top-level README for help." 1>&2; \
echo " 2) Build against the system libapparmor by adding USE_SYSTEM=1 to your make command." 1>&2;\
exit 1; \
fi
endif
aa-enabled: aa_enabled.c $(LIBAPPARMOR_A)
$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
aa-exec: aa_exec.c $(LIBAPPARMOR_A)
$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
.SILENT: check
.PHONY: check
check: check_pod_files tests
.SILENT: tests
tests: $(TOOLS) $(TESTS)
echo "no tests atm"
.PHONY: install
install: install-indep install-arch
.PHONY: install-arch
install-arch: arch
install -m 755 -d ${BINDIR}
install -m 755 ${TOOLS} ${BINDIR}
.PHONY: install-indep
install-indep: indep
$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
$(MAKE) install_manpages DESTDIR=${DESTDIR}
ifndef VERBOSE
.SILENT: clean
endif
.PHONY: clean
clean: pod_clean
rm -f core core.* *.o *.s *.a *~ *.gcda *.gcno
rm -f gmon.out
rm -f $(TOOLS) $(TESTS)
$(MAKE) -s -C po clean

94
binutils/aa-enabled.pod Normal file
View File

@@ -0,0 +1,94 @@
# This publication is intellectual property of Canonical Ltd. Its contents
# can be duplicated, either in part or in whole, provided that a copyright
# label is visibly located on each copy.
#
# All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy.
# Neither Canonical Ltd, the authors, nor the translators shall be held
# liable for possible errors or the consequences thereof.
#
# Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. Canonical Ltd
# essentially adheres to the manufacturer's spelling.
#
# Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions.
#
=pod
=head1 NAME
aa-enabled - test whether AppArmor is enabled
=head1 SYNOPSIS
B<aa-enabled> [options]
=head1 DESCRIPTION
B<aa-enabled> is used to determine if AppArmor is enabled.
=head1 OPTIONS
B<aa-enabled> accepts the following arguments:
=over 4
=item -h, --help
Display a brief usage guide.
=item -q, --quiet
Do not output anything to stdout. This option is intended to be used by
scripts that simply want to use the exit code to determine if AppArmor is
enabled.
=back
=head1 EXIT STATUS
Upon exiting, B<aa-enabled> will set its exit status to the following values:
=over 4
=item 0:
if AppArmor is enabled.
=item 1:
if AppArmor is not enabled/loaded.
=item 2:
intentionally not used as an B<aa-enabled> exit status.
=item 3:
if the AppArmor control files aren't available under /sys/kernel/security/.
=item 4:
if B<aa-enabled> doesn't have enough privileges to read the apparmor control files.
=item 64:
if any unexpected error or condition is encountered.
=back
=head1 BUGS
If you find any bugs, please report them at
L<https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO
apparmor(7), apparmor.d(5), aa_is_enabled(2), and L<https://wiki.apparmor.net>.
=cut

93
binutils/aa-exec.pod Normal file
View File

@@ -0,0 +1,93 @@
# This publication is intellectual property of Canonical Ltd. Its contents
# can be duplicated, either in part or in whole, provided that a copyright
# label is visibly located on each copy.
#
# All information found in this book has been compiled with utmost
# attention to detail. However, this does not guarantee complete accuracy.
# Neither Canonical Ltd, the authors, nor the translators shall be held
# liable for possible errors or the consequences thereof.
#
# Many of the software and hardware descriptions cited in this book
# are registered trademarks. All trade names are subject to copyright
# restrictions and may be registered trade marks. Canonical Ltd
# essentially adheres to the manufacturer's spelling.
#
# Names of products and trademarks appearing in this book (with or without
# specific notation) are likewise subject to trademark and trade protection
# laws and may thus fall under copyright restrictions.
#
=pod
=head1 NAME
aa-exec - confine a program with the specified AppArmor profile
=head1 SYNOPSIS
B<aa-exec> [options] [--] [I<E<lt>commandE<gt>> ...]
=head1 DESCRIPTION
B<aa-exec> is used to launch a program confined by the specified profile
and or namespace. If both a profile and namespace are specified command
will be confined by profile in the new policy namespace. If only a namespace
is specified, the profile name of the current confinement will be used. If
neither a profile or namespace is specified command will be run using
standard profile attachment (ie. as if run without the aa-exec command).
If the arguments are to be pasted to the I<E<lt>commandE<gt>> being invoked
by aa-exec then -- should be used to separate aa-exec arguments from the
command.
aa-exec -p profile1 -- ls -l
=head1 OPTIONS
B<aa-exec> accepts the following arguments:
=over 4
=item -p PROFILE, --profile=PROFILE
confine I<E<lt>commandE<gt>> with PROFILE. If the PROFILE is not specified
use the current profile name (likely unconfined).
=item -n NAMESPACE, --namespace=NAMESPACE
use profiles in NAMESPACE. This will result in confinement transitioning
to using the new profile namespace.
=item -i, --immediate
transition to PROFILE before doing executing I<E<lt>commandE<gt>>. This
subjects the running of I<E<lt>commandE<gt>> to the exec transition rules
of the current profile.
=item -v, --verbose
show commands being performed
=item -d, --debug
show commands and error codes
=item --
Signal the end of options and disables further option processing. Any
arguments after the -- are treated as arguments of the command. This is
useful when passing arguments to the I<E<lt>commandE<gt>> being invoked by
aa-exec.
=back
=head1 BUGS
If you find any bugs, please report them at
L<https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO
aa-stack(8), aa-namespace(8), apparmor(7), apparmor.d(5), aa_change_profile(3),
aa_change_onexec(3) and L<https://wiki.apparmor.net>.
=cut

92
binutils/aa_enabled.c Normal file
View File

@@ -0,0 +1,92 @@
/*
* Copyright (C) 2015 Canonical Ltd.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of version 2 of the GNU General Public
* License published by the Free Software Foundation.
*/
#include <errno.h>
#include <locale.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <libintl.h>
#define _(s) gettext(s)
#include <sys/apparmor.h>
void print_help(const char *command)
{
printf(_("%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"),
command);
exit(1);
}
/* Exit statuses and meanings are documented in the aa-enabled.pod file */
static void exit_with_error(int saved_errno, int quiet)
{
int err;
switch(saved_errno) {
case ENOSYS:
if (!quiet)
printf(_("No - not available on this system.\n"));
exit(1);
case ECANCELED:
if (!quiet)
printf(_("No - disabled at boot.\n"));
exit(1);
case ENOENT:
if (!quiet)
printf(_("Maybe - policy interface not available.\n"));
exit(3);
case EPERM:
case EACCES:
if (!quiet)
printf(_("Maybe - insufficient permissions to determine availability.\n"));
exit(4);
}
if (!quiet)
printf(_("Error - %s\n"), strerror(saved_errno));
exit(64);
}
int main(int argc, char **argv)
{
int enabled;
int quiet = 0;
setlocale(LC_MESSAGES, "");
bindtextdomain(PACKAGE, LOCALEDIR);
textdomain(PACKAGE);
if (argc > 2) {
printf(_("unknown or incompatible options\n"));
print_help(argv[0]);
} else if (argc == 2) {
if (strcmp(argv[1], "--quiet") == 0 ||
strcmp(argv[1], "-q") == 0) {
quiet = 1;
} else if (strcmp(argv[1], "--help") == 0 ||
strcmp(argv[1], "-h") == 0) {
print_help(argv[0]);
} else {
printf(_("unknown option '%s'\n"), argv[1]);
print_help(argv[0]);
}
}
enabled = aa_is_enabled();
if (!enabled)
exit_with_error(errno, quiet);
if (!quiet)
printf(_("Yes\n"));
exit(0);
}

218
binutils/aa_exec.c Normal file
View File

@@ -0,0 +1,218 @@
/*
* Copyright (c) 2015
* Canonical, Ltd. (All rights reserved)
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of version 2 of the GNU General Public
* License published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, contact Novell, Inc. or Canonical
* Ltd.
*/
#include <errno.h>
#include <getopt.h>
#include <libintl.h>
#include <limits.h>
#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <sys/apparmor.h>
#include <unistd.h>
#define _(s) gettext(s)
static const char *opt_profile = NULL;
static const char *opt_namespace = NULL;
static bool opt_debug = false;
static bool opt_immediate = false;
static bool opt_verbose = false;
static void usage(const char *name, bool error)
{
FILE *stream = stdout;
int status = EXIT_SUCCESS;
if (error) {
stream = stderr;
status = EXIT_FAILURE;
}
fprintf(stream,
_("USAGE: %s [OPTIONS] <prog> <args>\n"
"\n"
"Confine <prog> with the specified PROFILE.\n"
"\n"
"OPTIONS:\n"
" -p PROFILE, --profile=PROFILE PROFILE to confine <prog> with\n"
" -n NAMESPACE, --namespace=NAMESPACE NAMESPACE to confine <prog> in\n"
" -d, --debug show messages with debugging information\n"
" -i, --immediate change profile immediately instead of at exec\n"
" -v, --verbose show messages with stats\n"
" -h, --help display this help\n"
"\n"), name);
exit(status);
}
#define error(fmt, args...) _error(_("aa-exec: ERROR: " fmt "\n"), ## args)
static void _error(const char *fmt, ...)
{
va_list args;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
va_end(args);
exit(EXIT_FAILURE);
}
#define debug(fmt, args...) _debug(_("aa-exec: DEBUG: " fmt "\n"), ## args)
static void _debug(const char *fmt, ...)
{
va_list args;
if (!opt_debug)
return;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
va_end(args);
}
#define verbose(fmt, args...) _verbose(_(fmt "\n"), ## args)
static void _verbose(const char *fmt, ...)
{
va_list args;
if (!opt_verbose)
return;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
va_end(args);
}
static void verbose_print_argv(char **argv)
{
if (!opt_verbose)
return;
fprintf(stderr, _("exec"));
for (; *argv; argv++)
fprintf(stderr, " %s", *argv);
fprintf(stderr, "\n");
}
static char **parse_args(int argc, char **argv)
{
int opt;
struct option long_opts[] = {
{"debug", no_argument, 0, 'd'},
{"help", no_argument, 0, 'h'},
{"profile", required_argument, 0, 'p'},
{"namespace", required_argument, 0, 'n'},
{"immediate", no_argument, 0, 'i'},
{"verbose", no_argument, 0, 'v'},
};
while ((opt = getopt_long(argc, argv, "+dhp:n:iv", long_opts, NULL)) != -1) {
switch (opt) {
case 'd':
opt_debug = true;
break;
case 'h':
usage(argv[0], false);
break;
case 'p':
opt_profile = optarg;
break;
case 'n':
opt_namespace = optarg;
break;
case 'i':
opt_immediate = true;
break;
case 'v':
opt_verbose = true;
break;
default:
usage(argv[0], true);
break;
}
}
if (optind >= argc)
usage(argv[0], true);
return argv + optind;
}
static void build_name(char *name, size_t name_len,
const char *namespace, const char *profile)
{
size_t required_len = 1; /* reserve 1 byte for NUL-terminator */
if (namespace)
required_len += 1 + strlen(namespace) + 3; /* :<NAMESPACE>:// */
if (profile)
required_len += strlen(profile);
if (required_len > name_len)
error("name too long (%zu > %zu)", required_len, name_len);
name[0] = '\0';
if (namespace) {
strcat(name, ":");
strcat(name, namespace);
strcat(name, "://");
}
if (profile)
strcat(name, profile);
}
int main(int argc, char **argv)
{
char name[PATH_MAX];
int rc = 0;
argv = parse_args(argc, argv);
if (opt_namespace || opt_profile)
build_name(name, sizeof(name), opt_namespace, opt_profile);
else
goto exec;
if (opt_immediate) {
verbose("aa_change_profile(\"%s\")", name);
rc = aa_change_profile(name);
debug("%d = aa_change_profile(\"%s\")", rc, name);
} else {
verbose("aa_change_onexec(\"%s\")", name);
rc = aa_change_onexec(name);
debug("%d = aa_change_onexec(\"%s\")", rc, name);
}
if (rc) {
if (errno == ENOENT || errno == EACCES) {
error("%s '%s' does not exist\n",
opt_profile ? "profile" : "namespace", name);
} else if (errno == EINVAL) {
error("AppArmor interface not available");
} else {
error("%m");
}
}
exec:
verbose_print_argv(argv);
execvp(argv[0], argv);
error("Failed to execute \"%s\": %m", argv[0]);
}

19
binutils/po/Makefile Normal file
View File

@@ -0,0 +1,19 @@
# ----------------------------------------------------------------------
# Copyright (C) 2015 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
# ----------------------------------------------------------------------
all:
# As translations get added, they will automatically be included, unless
# the lang is explicitly added to DISABLED_LANGS; e.g. DISABLED_LANGS=en es
DISABLED_LANGS=
COMMONDIR=../../common
include $(COMMONDIR)/Make-po.rules
XGETTEXT_ARGS+=--language=C --keyword=_ $(shell if [ -f ${NAME}.pot ] ; then echo -n -j ; fi)

View File

@@ -0,0 +1,66 @@
# Copyright (C) 2015 Canonical Ltd
# This file is distributed under the same license as the AppArmor package.
# John Johansen <john.johansen@canonical.com>, 2015.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=CHARSET\n"
"Content-Transfer-Encoding: 8bit\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr ""
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr ""
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr ""
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr ""
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr ""

68
binutils/po/de.po Normal file
View File

@@ -0,0 +1,68 @@
# German translation for apparmor
# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2016.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2016-03-20 01:58+0000\n"
"Last-Translator: Tobias Bannert <Unknown>\n"
"Language-Team: German <de@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2016-03-21 05:15+0000\n"
"X-Generator: Launchpad (build 17947)\n"
"Language: de\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr ""
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "Unbekannte Option »%s«\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Ja\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Nein auf diesem System nicht verfügbar.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Nein beim Start deaktiviert.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr ""
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr ""
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Fehler - »%s«\n"

72
binutils/po/en_GB.po Normal file
View File

@@ -0,0 +1,72 @@
# English (United Kingdom) translation for apparmor
# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2016.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2016-02-18 06:22+0000\n"
"Last-Translator: Andi Chandler <Unknown>\n"
"Language-Team: English (United Kingdom) <en_GB@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2016-02-19 05:10+0000\n"
"X-Generator: Launchpad (build 17925)\n"
"Language: en_GB\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "unknown or incompatible options\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "unknown option '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Yes\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "No - not available on this system.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "No - disabled at boot.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Maybe - policy interface not available.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Maybe - insufficient permissions to determine availability.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Error - '%s'\n"

72
binutils/po/id.po Normal file
View File

@@ -0,0 +1,72 @@
# Indonesian translation for apparmor
# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2016.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2016-01-20 08:59+0000\n"
"Last-Translator: Ari Setyo Wibowo <mr.a.contact@gmail.com>\n"
"Language-Team: Indonesian <id@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2016-02-02 05:11+0000\n"
"X-Generator: Launchpad (build 17908)\n"
"Language: id\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [options]\n"
" pilihan:\n"
" -q | --quiet Jangan tampilkan pesan apapun\n"
" -h | --help Tampilkan bantuan\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "pilihan yang tidak dikenali atau tidak kompatibel\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "pilihan tidak dikenali '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Ya\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Tidak - tidak tersedia di sistem ini.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Tidak - nonaktifkan saat boot.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Mungkin - kebijakan antarmuka tidak tersedia.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Mungkin - izin tidak memadai untuk menentukan ketersediaan.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Kesalahan - '%s'\n"

72
binutils/po/pt.po Normal file
View File

@@ -0,0 +1,72 @@
# Portuguese translation for apparmor
# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2016.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2016-03-03 08:34+0000\n"
"Last-Translator: Ivo Xavier <ivofernandes12@gmail.com>\n"
"Language-Team: Portuguese <pt@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2016-03-04 04:35+0000\n"
"X-Generator: Launchpad (build 17936)\n"
"Language: pt\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [opções]\n"
" opções:\n"
" -q | --silencioso Não mostrar mensagens\n"
" -h | --ajuda Mostar ajuda\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "opções desconhecidas ou incompatíveis\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "opção desconhecida '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Sim\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Não - não disponível neste sistema.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Não - desligado ao iniciar.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Talvez - política de interface não disponível.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Talvez - permissões insuficientes para determinar disponibilidade.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Erro - '%s'\n"

72
binutils/po/ru.po Normal file
View File

@@ -0,0 +1,72 @@
# Russian translation for apparmor
# Copyright (c) 2016 Rosetta Contributors and Canonical Ltd 2016
# This file is distributed under the same license as the apparmor package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2016.
#
msgid ""
msgstr ""
"Project-Id-Version: apparmor\n"
"Report-Msgid-Bugs-To: AppArmor list <apparmor@lists.ubuntu.com>\n"
"POT-Creation-Date: 2015-11-28 10:23-0800\n"
"PO-Revision-Date: 2016-03-29 14:46+0000\n"
"Last-Translator: Eugene Marshal <Unknown>\n"
"Language-Team: Russian <ru@li.org>\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"X-Launchpad-Export-Date: 2016-03-30 05:13+0000\n"
"X-Generator: Launchpad (build 17967)\n"
"Language: ru\n"
#: ../aa_enabled.c:26
#, c-format
msgid ""
"%s: [options]\n"
" options:\n"
" -q | --quiet Don't print out any messages\n"
" -h | --help Print help\n"
msgstr ""
"%s: [параметры]\n"
" параметры:\n"
" -q | --quiet не выводить никакие сообщения\n"
" -h | --help вывести справку\n"
#: ../aa_enabled.c:45
#, c-format
msgid "unknown or incompatible options\n"
msgstr "неизвестные или несовместимые параметры\n"
#: ../aa_enabled.c:55
#, c-format
msgid "unknown option '%s'\n"
msgstr "неизвестный параметр '%s'\n"
#: ../aa_enabled.c:64
#, c-format
msgid "Yes\n"
msgstr "Да\n"
#: ../aa_enabled.c:71
#, c-format
msgid "No - not available on this system.\n"
msgstr "Нет - недоступно на этой системе.\n"
#: ../aa_enabled.c:74
#, c-format
msgid "No - disabled at boot.\n"
msgstr "Нет - выключено при загрузке.\n"
#: ../aa_enabled.c:77
#, c-format
msgid "Maybe - policy interface not available.\n"
msgstr "Возможно - интерфейс политики недоступен.\n"
#: ../aa_enabled.c:81
#, c-format
msgid "Maybe - insufficient permissions to determine availability.\n"
msgstr "Возможно - недостаточно разрешений для определения доступности.\n"
#: ../aa_enabled.c:84
#, c-format
msgid "Error - '%s'\n"
msgstr "Ошибка - '%s'\n"

View File

@@ -1,5 +1,6 @@
# ----------------------------------------------------------------------
# Copyright (c) 2004, 2005 NOVELL (All rights reserved)
# Copyright (c) 2016 Canonical, Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
@@ -17,13 +18,7 @@ NAME:=apache2-mod_apparmor
all:
COMMONDIR=../../common/
include common/Make.rules
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
ifeq ($(COMMONDIR_EXISTS), true)
common/Make.rules: $(COMMONDIR)/Make.rules
ln -sf $(COMMONDIR) .
endif
include $(COMMONDIR)/Make.rules
TARGET:=mod_apparmor.so
MANPAGES=mod_apparmor.8
@@ -41,12 +36,51 @@ APXS:=$(shell if [ -x "/usr/sbin/apxs2" ] ; then \
fi )
APXS_INSTALL_DIR=$(shell ${APXS} -q LIBEXECDIR)
DESTDIR=
LIBAPPARMOR_FLAGS="-I../../libraries/libapparmor/src -L../../libraries/libapparmor/src/.libs -lapparmor"
ifdef USE_SYSTEM
LIBAPPARMOR = $(shell if pkg-config --exists libapparmor ; then \
pkg-config --silence-errors --libs libapparmor ; \
elif ldconfig -p | grep -q libapparmor\.so$$ ; then \
echo -lapparmor ; \
fi )
ifeq ($(strip $(LIBAPPARMOR)),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
Unable to find libapparmor installed on this system; either${nl}\
install libapparmor devel packages, set the LIBAPPARMOR variable${nl}\
manually, or build against in-tree libapparmor.${nl}\
************************************************************************${nl})
endif # LIBAPPARMOR not set
LDLIBS += $(LIBAPPARMOR)
else
LIBAPPARMOR_SRC := ../../libraries/libapparmor/
LIBAPPARMOR_INCLUDE = $(LIBAPPARMOR_SRC)/include
LIBAPPARMOR_PATH := $(LIBAPPARMOR_SRC)/src/.libs/
ifeq ($(realpath $(LIBAPPARMOR_PATH)/libapparmor.a),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
$(LIBAPPARMOR_PATH)/libapparmor.a is missing; either build against${nl}\
the in-tree libapparmor by building it first and then trying again${nl}\
(see the top-level README for help) or build against the system${nl}\
libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
************************************************************************${nl})
endif
# Need to pass -Wl twice here to get past both apxs2 and libtool, as
# libtool will add the path to the RPATH of the library if passed -L/some/path
LIBAPPARMOR_FLAGS = -I$(LIBAPPARMOR_INCLUDE) -Wl,-Wl,-L$(LIBAPPARMOR_PATH)
LDLIBS = -lapparmor
endif
all: $(TARGET) ${MANPAGES} ${HTMLMANPAGES}
.PHONY: libapparmor_check
.SILENT: libapparmor_check
libapparmor_check: ; $(ERROR_MESSAGE)
all: libapparmor_check $(TARGET) docs
.PHONY: docs
docs: ${MANPAGES} ${HTMLMANPAGES}
%.so: %.c
${APXS} ${LIBAPPARMOR_FLAGS} -c $<
${APXS} ${LIBAPPARMOR_FLAGS} -c $< ${LDLIBS}
mv .libs/$@ .
.PHONY: install
@@ -56,6 +90,9 @@ install: ${TARGET} ${MANPAGES}
make install_manpages DESTDIR=${DESTDIR}
.PHONY: clean
clean: _clean
clean: pod_clean
rm -rf .libs
rm -f *.la *.lo *.so *.o *.slo Make.rules
rm -f *.la *.lo *.so *.o *.slo
.PHONY: check
check: check_pod_files

View File

@@ -1,215 +0,0 @@
# ----------------------------------------------------------------------
# Copyright (c) 2004, 2005 NOVELL (All rights reserved)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ----------------------------------------------------------------------
# norootforbuild
# Check first to see if distro is already defined.
# I hate rpm macros
%if ! %{?distro:1}0
%if %{?suse_version:1}0
%define distro suse
%endif
%if %{?fedora_version:1}0
%define distro redhat
%endif
%endif
%if ! %{?distro:1}0
%define distro suse
%endif
# this is required to be underscore
%define module_name mod_apparmor
Summary: AppArmor module for apache2.
Name: apache2-mod_apparmor
Version: @@immunix_version@@
Release: @@repo_version@@
Group: Applications/System
Source0: %{name}-%{version}-@@repo_version@@.tar.gz
License: LGPL
BuildRoot: %{?_tmppath:}%{!?_tmppath:/var/tmp}/%{name}-%{version}-build
Url: http://forge.novell.com/modules/xfmod/project/?apparmor
Obsoletes: mod_change_hat mod-change-hat mod-apparmor apache2-mod-apparmor
Provides: mod_change_hat mod-change-hat mod-apparmor apache2-mod-apparmor
%if %{distro} == "suse"
%if 0%{?suse_version} < 1010
BuildRequires: libimmunix
%else
%if 0%{?suse_version} < 1030
BuildRequires: libapparmor
%else
BuildRequires: libapparmor-devel
%endif
%endif
%else
BuildRequires: libapparmor-devel
%endif
%if %{distro} == "suse"
%define apxs /usr/sbin/apxs2
%define apache_mmn %(MMN=$(%{apxs} -q LIBEXECDIR)_MMN; test -x $MMN && $MMN)
Prereq: apache2-prefork
Prereq: apparmor-parser
BuildRequires: apache2-devel
Requires: apache2 %{apache_mmn}
%else
%if %{distro} == "redhat" || %{distro} == "rhel4"
%define apxs /usr/sbin/apxs
Prereq: httpd
BuildRequires: httpd-devel
%endif
%endif
%define module_path %(%{apxs} -q LIBEXECDIR)
%define apache_sysconfdir %(%{apxs} -q SYSCONFDIR)
%description
apache2-mod_apparmor adds support to apache2 to provide AppArmor confinement
to individual cgi scripts handled by apache modules like mod_php and
mod_perl.
This package is part of a suite of tools that used to be named SubDomain.
%prep
%setup -q
%build
make APXS=%{apxs}
%install
make install DESTDIR=${RPM_BUILD_ROOT} DISTRO=%{distro} MANDIR=%{_mandir}
%if %{distro} == "suse"
mkdir -p ${RPM_BUILD_ROOT}%{_libdir}/apache2-prefork/
ln -s %{module_path}/%{module_name}.so ${RPM_BUILD_ROOT}%{_libdir}/apache2-prefork/%{module_name}.so
%else
%if %{distro} == "redhat" || %{distro} == "rhel4"
mkdir -p ${RPM_BUILD_ROOT}/%{apache_sysconfdir}.d/
install -m 644 %{module_name}.conf ${RPM_BUILD_ROOT}/%{apache_sysconfdir}.d/
%endif
%endif
%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
%{module_path}
%if %{distro} == "suse"
%{_libdir}/apache2-prefork/%{module_name}.so
%else
%if %{distro} == "redhat" || %{distro} == "rhel4"
%{apache_sysconfdir}.d/%{module_name}.conf
%endif
%endif
%doc COPYING.LGPL
%{_mandir}/man*/*
%doc *.[0-9].html
%doc common/apparmor.css
%post
%if %{distro} == "suse"
/usr/sbin/a2enmod apparmor
%endif
%preun
%if %{distro} == "suse"
if [ $1 = 0 ] ; then
/usr/sbin/a2dismod apparmor
fi
%endif
%triggerpostun -- mod_change_hat mod-change-hat
%if %{distro} == "suse"
/usr/sbin/a2enmod apparmor
%endif
%changelog
* Sun Jul 29 2007 - sbeattie@suse.de
- Convert builddep on libapparmor to libapparmor-devel
* Tue Apr 3 2007 - sbeattie@suse.de
- Add mod_apparmor manpage to package
* Wed Sep 06 2006 - poeml@suse.de
- rename to apache2-mod_apparmor
- use a2enmod instead of frob_sysconfig
- remove SuSEconfig calls
* Fri May 26 2006 - schwab@suse.de
- Don't strip binaries.
* Wed Apr 12 2006 - Steve Beattie <sbeattie@suse.de>
- Move to novell forge svn repo; fix build issue with new layout
* Thu Mar 30 2006 - Seth Arnold <seth.arnold@suse.de> 2.0-7.2
- Relicense to LGPL
* Mon Jan 30 2006 - Steve Beattie <sbeattie@suse.de> 2.0-7.1
- Renamed apache config options:
ImmhatName -> AAHatName
ImmDefaultHatName -> AADefaultHatName
* Mon Jan 30 2006 - poeml@suse.de
- removed libapr-util1-devel from BuildRequires (apache2-devel does
require it)
* Fri Jan 27 2006 Steve Beattie <sbeattie@suse.de> 2.0-6.1
- No more neededforbuild in STABLE
* Wed Jan 25 2006 Steve Beattie <sbeattie@suse.de> 2.0-6
- Fix linking against libapparmor.so
* Sun Jan 8 2006 Steve Beattie <sbeattie@suse.de> 2.0-5
- More SUSE autobuild fixups.
* Wed Jan 4 2006 Steve Beattie <sbeattie@suse.de> 2.0-4
- Fixup SUSE autobuild require on apache-devel-packages
- Add svn revision to the source tarball
* Sun Dec 18 2005 Steve Beattie <sbeattie@novell.com> 2.0-3
- Include symlink in %{_libdir}/apache2-prefork/
* Thu Dec 8 2005 Steve Beattie <sbeattie@novell.com> 2.0-2
- Rename to apache2-mod-apparmor for consistency w/SUSE packages
- Rename module to mod_apparmor.so
* Wed Dec 7 2005 Steve Beattie <sbeattie@novell.com> 2.0-1
- Reset version for inclusion in SUSE autobuild
* Mon Dec 5 2005 Steve Beattie <sbeattie@novell.com> 1.99-9
- Rename package to mod-apparmor
* Wed Nov 30 2005 Steve Beattie <sbeattie@novell.com> 1.99-8
- Minor packaging cleanups
* Wed Nov 30 2005 Steve Beattie <sbeattie@novell.com> 1.99-7_imnx
- Convert license to GPL
* Thu Jun 23 2005 Steve Beattie <sbeattie@novell.com> 1.99-6_imnx
- Add trigger for mod_change_hat => mod-change-hat upgrades
- Don't run SuSEconfig on SuSE 9.3 or newer
* Mon May 23 2005 Steve Beattie <sbeattie@novell.com> 1.99-5_imnx
- Fix package uninstall on RHEL4.
* Fri Mar 11 2005 Steve Beattie <steve@immunix.com> 1.99-4_imnx
- Rename to be consistent with other packages
* Fri Feb 18 2005 Steve Beattie <steve@immunix.com> 1.99-3_imnx
- Cleanup some non-64bit clean code, sigh.
- Fix install locations on 64-bit platform.
* Fri Feb 4 2005 Seth Arnold <sarnold@immunix.coM> 1.99-1_imnx
- Reversion to 1.99
* Fri Nov 12 2004 Steve Beattie <steve@immunix.com> 1.2-2_imnx
- Add configuration file for redhat build
* Tue Oct 12 2004 Steve Beattie <steve@immunix.com> 1.2-1_imnx
- Bump version after shass-1.1 branched off
* Mon Sep 20 2004 Dominic Reynolds <dominic@immunix.com> 1.0-7_imnx_(redhat|suse)
- Modified to build separate versions for suse/redhat (EL3).
- Note:RH version does not currently setup the module configuraiton
- in apache.
* Tue Aug 31 2004 Steve Beattie <steve@immunix.com> 1.0-6_imnx
- Got location and per server config directives working somewhat
correctly :-)
- copyright fixups.
* Fri Aug 20 2004 Steve Beattie <steve@immunix.com> 1.0-5_imnx
- added support for <Location> hatname </Location>
* Wed Jul 21 2004 Steve Beattie <steve@immunix.com> 1.0-4_imnx
- reduced loglevel of some debug messages
- add change_hat to list of apache modules
* Tue Jul 20 2004 Steve Beattie <steve@immunix.com> 1.0-2_imnx
- got module actually working, at least in simple cases.
* Thu Jul 15 2004 Steve Beattie <steve@immunix.com> 1.0-1_imnx
- Initial package creation.

View File

@@ -1,12 +1,13 @@
/*
* Copyright (c) 2004, 2005, 2006 NOVELL (All rights reserved)
* Copyright (c) 2014 Canonical, Ltd. (All rights reserved)
*
* The mod_apparmor module is licensed under the terms of the GNU
* Lesser General Public License, version 2.1. Please see the file
* COPYING.LGPL.
*
* mod_apparmor - (apache 2.0.x)
* Author: Steve Beattie <sbeattie@suse.de>
* Author: Steve Beattie <steve@nxnw.org>
*
* This currently only implements change_hat functionality, but could be
* extended for other stuff we decide to do.
@@ -17,183 +18,240 @@
#include "http_config.h"
#include "http_request.h"
#include "http_log.h"
#include "http_main.h"
#include "http_protocol.h"
#include "util_filter.h"
#include "apr.h"
#include "apr_strings.h"
#include "apr_lib.h"
#include <apparmor.h>
#include <sys/apparmor.h>
#include <unistd.h>
/* #define DEBUG */
#ifndef __unused
#define __unused __attribute__((unused))
#endif
/* should the following be configurable? */
#define DEFAULT_HAT "HANDLING_UNTRUSTED_INPUT"
#define DEFAULT_URI_HAT "DEFAULT_URI"
/* Compatibility with apache 2.2 */
#if AP_SERVER_MAJORVERSION_NUMBER == 2 && AP_SERVER_MINORVERSION_NUMBER < 3
#define APLOG_TRACE1 APLOG_DEBUG
server_rec *ap_server_conf = NULL;
#endif
#ifdef APLOG_USE_MODULE
APLOG_USE_MODULE(apparmor);
#endif
module AP_MODULE_DECLARE_DATA apparmor_module;
static unsigned int magic_token = 0;
static unsigned long magic_token = 0;
static int inside_default_hat = 0;
typedef struct {
const char * hat_name;
char * path;
} immunix_dir_cfg;
const char *hat_name;
char *path;
} apparmor_dir_cfg;
typedef struct {
const char * hat_name;
int is_initialized;
} immunix_srv_cfg;
const char *hat_name;
int is_initialized;
} apparmor_srv_cfg;
/* immunix_init() gets invoked in the post_config stage of apache.
/* aa_init() gets invoked in the post_config stage of apache.
* Unfortunately, apache reads its config once when it starts up, then
* it re-reads it when goes into its restart loop, where it starts it's
* children. This means we cannot call change_hat here, as the modules
* memory will be wiped out, and the magic_token will be lost, so apache
* wouldn't be able to change_hat back out. */
static int
immunix_init (apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
static int
aa_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
{
apr_file_t * file;
apr_size_t size = sizeof (magic_token);
apr_file_t *file;
apr_size_t size = sizeof(magic_token);
int ret;
ret = apr_file_open (&file, "/dev/urandom", APR_READ, APR_OS_DEFAULT, p);
if (!ret) {
apr_file_read (file, (void *) &magic_token, &size);
apr_file_close (file);
apr_file_read(file, (void *) &magic_token, &size);
apr_file_close(file);
} else {
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "Failed to open /dev/urandom");
ap_log_error(APLOG_MARK, APLOG_ERR, errno, ap_server_conf,
"Failed to open /dev/urandom");
}
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "Opened /dev/urandom successfully");
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, ap_server_conf,
"Opened /dev/urandom successfully");
return OK;
}
/* As each child starts up, we'll change_hat into a default hat, mostly
* to protect ourselves from bugs in parsing network input, but before
* we change_hat to the uri specific hat. */
static void
immunix_child_init (apr_pool_t *p, server_rec *s)
static void
aa_child_init(apr_pool_t *p, server_rec *s)
{
int ret;
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "init: calling change_hat");
ret = change_hat (DEFAULT_HAT, magic_token);
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, ap_server_conf,
"init: calling change_hat with '%s'", DEFAULT_HAT);
ret = aa_change_hat(DEFAULT_HAT, magic_token);
if (ret < 0) {
change_hat (NULL, magic_token);
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "Failed to change_hat to '%s'",
DEFAULT_HAT);
ap_log_error(APLOG_MARK, APLOG_ERR, errno, ap_server_conf,
"Failed to change_hat to '%s'", DEFAULT_HAT);
} else {
inside_default_hat = 1;
}
}
}
#ifdef DEBUG
static void
debug_dump_uri (apr_uri_t * uri)
debug_dump_uri(request_rec *r)
{
if (uri)
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "Dumping uri info "
"scheme='%s' host='%s' path='%s' query='%s' fragment='%s'",
uri->scheme, uri->hostname, uri->path, uri->query,
uri->fragment);
apr_uri_t *uri = &r->parsed_uri;
if (uri)
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "Dumping uri info "
"scheme='%s' host='%s' path='%s' query='%s' fragment='%s'",
uri->scheme, uri->hostname, uri->path, uri->query,
uri->fragment);
else
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "Asked to dump NULL uri");
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "Asked to dump NULL uri");
}
#else
static void
debug_dump_uri (apr_uri_t * __unused uri) { }
#endif
/*
immunix_enter_hat will attempt to change_hat in the following order:
(1) to a hatname in a location directive
(2) to the uri
(3) to a per-server default
(4) to DEFAULT_URI
(5) back to the parent profile
*/
static int
immunix_enter_hat (request_rec *r)
{
int sd_ret = -1;
immunix_dir_cfg * dcfg = (immunix_dir_cfg *)
ap_get_module_config (r->per_dir_config, &apparmor_module);
immunix_srv_cfg * scfg = (immunix_srv_cfg *)
ap_get_module_config (r->server->module_config, &apparmor_module);
debug_dump_uri (&r->parsed_uri);
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "in immunix_enter_hat (%s) n:0x%lx p:0x%lx main:0x%lx",
dcfg->path, (unsigned long) r->next, (unsigned long) r->prev,
(unsigned long) r->main);
/*
aa_enter_hat will attempt to change_hat in the following order:
(1) to a hatname in a location directive
(2) to the server name or a defined per-server default
(3) to the server name + "-" + uri
(4) to the uri
(5) to DEFAULT_URI
(6) back to the parent profile
*/
static int
aa_enter_hat(request_rec *r)
{
int aa_ret = -1;
apparmor_dir_cfg *dcfg = (apparmor_dir_cfg *)
ap_get_module_config(r->per_dir_config, &apparmor_module);
apparmor_srv_cfg *scfg = (apparmor_srv_cfg *)
ap_get_module_config(r->server->module_config, &apparmor_module);
const char *aa_hat_array[6] = { NULL, NULL, NULL, NULL, NULL, NULL };
int i = 0;
char *aa_label, *aa_mode, *aa_hat;
const char *vhost_uri;
debug_dump_uri(r);
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "aa_enter_hat (%s) n:0x%lx p:0x%lx main:0x%lx",
dcfg->path, (unsigned long) r->next, (unsigned long) r->prev,
(unsigned long) r->main);
/* We only call change_hat for the main request, not subrequests */
if (r->main)
return OK;
if (r->main)
return OK;
if (inside_default_hat) {
change_hat (NULL, magic_token);
inside_default_hat = 0;
aa_change_hat(NULL, magic_token);
inside_default_hat = 0;
}
if (dcfg != NULL && dcfg->hat_name != NULL) {
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "calling change_hat [dcfg] %s", dcfg->hat_name);
sd_ret = change_hat (dcfg->hat_name, magic_token);
if (sd_ret < 0) {
change_hat (NULL, magic_token);
} else {
return OK;
}
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[dcfg] adding hat '%s' to aa_change_hat vector", dcfg->hat_name);
aa_hat_array[i++] = dcfg->hat_name;
}
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "calling change_hat [uri] %s", r->uri);
sd_ret = change_hat (r->uri, magic_token);
if (sd_ret < 0) {
change_hat (NULL, magic_token);
if (scfg) {
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "Dumping scfg info: "
"scfg='0x%lx' scfg->hat_name='%s'",
(unsigned long) scfg, scfg->hat_name);
} else {
return OK;
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "scfg is null");
}
if (scfg != NULL) {
if (scfg->hat_name != NULL) {
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[scfg] adding hat '%s' to aa_change_hat vector", scfg->hat_name);
aa_hat_array[i++] = scfg->hat_name;
} else {
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[scfg] adding server_name '%s' to aa_change_hat vector",
r->server->server_hostname);
aa_hat_array[i++] = r->server->server_hostname;
}
vhost_uri = apr_pstrcat(r->pool, r->server->server_hostname, "-", r->uri, NULL);
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[vhost+uri] adding vhost+uri '%s' to aa_change_hat vector", vhost_uri);
aa_hat_array[i++] = vhost_uri;
}
if (scfg != NULL && scfg->hat_name != NULL) {
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "calling change_hat [scfg] %s", scfg->hat_name);
sd_ret = change_hat (scfg->hat_name, magic_token);
if (sd_ret < 0) {
change_hat (NULL, magic_token);
} else {
return OK;
}
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[uri] adding uri '%s' to aa_change_hat vector", r->uri);
aa_hat_array[i++] = r->uri;
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"[default] adding '%s' to aa_change_hat vector", DEFAULT_URI_HAT);
aa_hat_array[i++] = DEFAULT_URI_HAT;
aa_ret = aa_change_hatv(aa_hat_array, magic_token);
if (aa_ret < 0) {
ap_log_rerror(APLOG_MARK, APLOG_WARNING, errno, r, "aa_change_hatv call failed");
}
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "calling change_hat DEFAULT_URI");
sd_ret = change_hat (DEFAULT_URI_HAT, magic_token);
if (sd_ret < 0) change_hat (NULL, magic_token);
/* Check to see if a defined AAHatName or AADefaultHatName would
* apply, but wasn't the hat we landed up in; report a warning if
* that's the case. */
aa_ret = aa_getcon(&aa_label, &aa_mode);
if (aa_ret < 0) {
ap_log_rerror(APLOG_MARK, APLOG_WARNING, errno, r, "aa_getcon call failed");
} else {
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
"AA checks: aa_getcon result is '%s', mode '%s'", aa_label, aa_mode);
/* TODO: use libapparmor get hat_name fn here once it is implemented */
aa_hat = strstr(aa_label, "//");
if (aa_hat != NULL && strcmp(aa_mode, "enforce") == 0) {
aa_hat += 2; /* skip "//" */
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
"AA checks: apache is in hat '%s', mode '%s'", aa_hat, aa_mode);
if (dcfg != NULL && dcfg->hat_name != NULL) {
if (strcmp(aa_hat, dcfg->hat_name) != 0)
ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
"AAHatName '%s' applies, but does not appear to be a hat in the apache apparmor policy",
dcfg->hat_name);
} else if (scfg != NULL && scfg->hat_name != NULL) {
if (strcmp(aa_hat, scfg->hat_name) != 0 &&
strcmp(aa_hat, r->uri) != 0)
ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
"AADefaultHatName '%s' applies, but does not appear to be a hat in the apache apparmor policy",
scfg->hat_name);
}
}
free(aa_label);
}
return OK;
}
static int
immunix_exit_hat (request_rec *r)
static int
aa_exit_hat(request_rec *r)
{
int sd_ret;
immunix_dir_cfg * dcfg = (immunix_dir_cfg *)
ap_get_module_config (r->per_dir_config, &apparmor_module);
/* immunix_srv_cfg * scfg = (immunix_srv_cfg *)
ap_get_module_config (r->server->module_config, &apparmor_module); */
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "exiting change_hat - dir hat %s path %s", dcfg->hat_name, dcfg->path);
change_hat (NULL, magic_token);
int aa_ret;
apparmor_dir_cfg *dcfg = (apparmor_dir_cfg *)
ap_get_module_config(r->per_dir_config, &apparmor_module);
/* apparmor_srv_cfg *scfg = (apparmor_srv_cfg *)
ap_get_module_config(r->server->module_config, &apparmor_module); */
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "exiting change_hat: dir hat %s dir path %s",
dcfg->hat_name, dcfg->path);
sd_ret = change_hat (DEFAULT_HAT, magic_token);
if (sd_ret < 0) {
change_hat (NULL, magic_token);
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "Failed to change_hat to '%s'",
DEFAULT_HAT);
/* can convert the following back to aa_change_hat() when the
* aa_change_hat() bug addressed in trunk commit 2329 lands in most
* system libapparmors */
aa_change_hatv(NULL, magic_token);
aa_ret = aa_change_hat(DEFAULT_HAT, magic_token);
if (aa_ret < 0) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, errno, r,
"Failed to change_hat to '%s'", DEFAULT_HAT);
} else {
inside_default_hat = 1;
}
@@ -202,15 +260,15 @@ immunix_exit_hat (request_rec *r)
}
static const char *
aa_cmd_ch_path (cmd_parms * cmd, void * mconfig, const char * parm1)
aa_cmd_ch_path(cmd_parms *cmd, void *mconfig, const char *parm1)
{
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL, "config change hat %s",
parm1 ? parm1 : "DEFAULT");
immunix_dir_cfg * dcfg = mconfig;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, "directory config change hat %s",
parm1 ? parm1 : "DEFAULT");
apparmor_dir_cfg *dcfg = mconfig;
if (parm1 != NULL) {
dcfg->hat_name = parm1;
dcfg->hat_name = parm1;
} else {
dcfg->hat_name = "DEFAULT";
dcfg->hat_name = "DEFAULT";
}
return NULL;
}
@@ -218,26 +276,27 @@ aa_cmd_ch_path (cmd_parms * cmd, void * mconfig, const char * parm1)
static int path_warn_once;
static const char *
immunix_cmd_ch_path (cmd_parms * cmd, void * mconfig, const char * parm1)
immunix_cmd_ch_path(cmd_parms *cmd, void *mconfig, const char *parm1)
{
if (path_warn_once == 0) {
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, "ImmHatName is "
"deprecated, please use AAHatName instead");
path_warn_once = 1;
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf, "ImmHatName is "
"deprecated, please use AAHatName instead");
path_warn_once = 1;
}
return aa_cmd_ch_path(cmd, mconfig, parm1);
}
static const char *
aa_cmd_ch_srv (cmd_parms * cmd, void * mconfig, const char * parm1)
aa_cmd_ch_srv(cmd_parms *cmd, void *mconfig, const char *parm1)
{
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, NULL, "config change hat %s",
parm1 ? parm1 : "DEFAULT");
immunix_srv_cfg * scfg = mconfig;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, "server config change hat %s",
parm1 ? parm1 : "DEFAULT");
apparmor_srv_cfg *scfg = (apparmor_srv_cfg *)
ap_get_module_config(cmd->server->module_config, &apparmor_module);
if (parm1 != NULL) {
scfg->hat_name = parm1;
scfg->hat_name = parm1;
} else {
scfg->hat_name = "DEFAULT";
scfg->hat_name = "DEFAULT";
}
return NULL;
}
@@ -245,27 +304,29 @@ aa_cmd_ch_srv (cmd_parms * cmd, void * mconfig, const char * parm1)
static int srv_warn_once;
static const char *
immunix_cmd_ch_srv (cmd_parms * cmd, void * mconfig, const char * parm1)
immunix_cmd_ch_srv(cmd_parms *cmd, void *mconfig, const char *parm1)
{
if (srv_warn_once == 0) {
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, "ImmDefaultHatName is "
"deprecated, please use AADefaultHatName instead");
srv_warn_once = 1;
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf, "ImmDefaultHatName is "
"deprecated, please use AADefaultHatName instead");
srv_warn_once = 1;
}
return aa_cmd_ch_srv(cmd, mconfig, parm1);
}
static void *
immunix_create_dir_config (apr_pool_t * p, char * path)
aa_create_dir_config(apr_pool_t *p, char *path)
{
immunix_dir_cfg * newcfg = (immunix_dir_cfg *) apr_pcalloc(p, sizeof(* newcfg));
apparmor_dir_cfg *newcfg = (apparmor_dir_cfg *) apr_pcalloc(p, sizeof(*newcfg));
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "in immunix_create_dir (%s)", path ? path : ":no path:");
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, ap_server_conf,
"aa_create_dir_cfg (%s)", path ? path : ":no path:");
if (newcfg == NULL) {
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "immunix_create_dir: couldn't alloc dir config");
return NULL;
ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf,
"aa_create_dir_config: couldn't alloc dir config");
return NULL;
}
newcfg->path = apr_pstrdup (p, path ? path : ":no path:");
newcfg->path = apr_pstrdup(p, path ? path : ":no path:");
return newcfg;
}
@@ -273,83 +334,85 @@ immunix_create_dir_config (apr_pool_t * p, char * path)
/* XXX: Should figure out an appropriate action to take here, if any
static void *
immunix_merge_dir_config (apr_pool_t * p, void * parent, void * child)
aa_merge_dir_config(apr_pool_t *p, void *parent, void *child)
{
immunix_dir_cfg * newcfg = (immunix_dir_cfg *) apr_pcalloc(p, sizeof(* newcfg));
apparmor_dir_cfg *newcfg = (apparmor_dir_cfg *) apr_pcalloc(p, sizeof(*newcfg));
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "in immunix_merge_dir ()");
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, ap_server_conf, "in immunix_merge_dir ()");
if (newcfg == NULL)
return NULL;
return NULL;
return newcfg;
}
*/
static void *
immunix_create_srv_config (apr_pool_t * p, server_rec * srv)
aa_create_srv_config(apr_pool_t *p, server_rec *srv)
{
immunix_srv_cfg * newcfg = (immunix_srv_cfg *) apr_pcalloc(p, sizeof(* newcfg));
apparmor_srv_cfg *newcfg = (apparmor_srv_cfg *) apr_pcalloc(p, sizeof(*newcfg));
ap_log_error (APLOG_MARK, APLOG_DEBUG, 0, NULL, "in immunix_create_srv");
ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, ap_server_conf,
"in aa_create_srv_config");
if (newcfg == NULL) {
ap_log_error (APLOG_MARK, APLOG_ERR, 0, NULL, "immunix_create_srv: couldn't alloc srv config");
return NULL;
ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf,
"aa_create_srv_config: couldn't alloc srv config");
return NULL;
}
return newcfg;
}
static const command_rec immunix_cmds[] = {
static const command_rec mod_apparmor_cmds[] = {
AP_INIT_TAKE1 (
AP_INIT_TAKE1(
"ImmHatName",
immunix_cmd_ch_path,
NULL,
ACCESS_CONF,
""
immunix_cmd_ch_path,
NULL,
ACCESS_CONF,
""
),
AP_INIT_TAKE1 (
AP_INIT_TAKE1(
"ImmDefaultHatName",
immunix_cmd_ch_srv,
NULL,
RSRC_CONF,
""
immunix_cmd_ch_srv,
NULL,
RSRC_CONF,
""
),
AP_INIT_TAKE1 (
AP_INIT_TAKE1(
"AAHatName",
aa_cmd_ch_path,
NULL,
ACCESS_CONF,
""
aa_cmd_ch_path,
NULL,
ACCESS_CONF,
""
),
AP_INIT_TAKE1 (
AP_INIT_TAKE1(
"AADefaultHatName",
aa_cmd_ch_srv,
NULL,
RSRC_CONF,
""
aa_cmd_ch_srv,
NULL,
RSRC_CONF,
""
),
{ NULL }
};
static void
register_hooks (apr_pool_t *p)
static void
register_hooks(apr_pool_t *p)
{
ap_hook_post_config (immunix_init, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_child_init (immunix_child_init, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_access_checker(immunix_enter_hat, NULL, NULL, APR_HOOK_FIRST);
/* ap_hook_post_read_request(immunix_enter_hat, NULL, NULL, APR_HOOK_FIRST); */
ap_hook_log_transaction(immunix_exit_hat, NULL, NULL, APR_HOOK_LAST);
ap_hook_post_config(aa_init, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_child_init(aa_child_init, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_access_checker(aa_enter_hat, NULL, NULL, APR_HOOK_FIRST);
/* ap_hook_post_read_request(aa_enter_hat, NULL, NULL, APR_HOOK_FIRST); */
ap_hook_log_transaction(aa_exit_hat, NULL, NULL, APR_HOOK_LAST);
}
module AP_MODULE_DECLARE_DATA apparmor_module = {
STANDARD20_MODULE_STUFF,
immunix_create_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
/* immunix_merge_dir_config, */ /* dir merger --- default is to override */
immunix_create_srv_config, /* server config */
NULL, /* merge server config */
immunix_cmds, /* command table */
register_hooks /* register hooks */
aa_create_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
/* immunix_merge_dir_config, */ /* dir merger --- default is to override */
aa_create_srv_config, /* server config */
NULL, /* merge server config */
mod_apparmor_cmds, /* command table */
register_hooks /* register hooks */
};

View File

@@ -40,11 +40,15 @@ apache2(8)/httpd(8) configuration files, and restart Apache. Make sure that
apparmor is also functioning.
Once mod_apparmor is loaded within Apache, all requests to Apache will
cause mod_apparmor to attempt to change into a hat named by the URI
(e.g. /app/some.cgi). If no such hat is found, it will fall back to
attempting to use the hat DEFAULT_URI; if that also does not exist,
it will fall back to using the global Apache profile. Most static web
pages can simply make use of the DEFAULT_URI hat.
cause mod_apparmor to attempt to change into a hat that matches the
ServerName for the server/vhost. If no such hat is found, it will
first fall back by attempting to change into a hat composed of the
ServerName-URI (e.g. "www.example.com-/app/some.cgi"). If that hat
is not found, it will fall back to attempting to use the hat named
by the URI (e.g. "/app/some.cgi"). If that hat is not found, it will
fall back to attempting to use the hat DEFAULT_URI; if that also does
not exist, it will fall back to using the global Apache profile. Most
static web pages can simply make use of the DEFAULT_URI hat.
Additionally, before any requests come in to Apache, mod_apparmor
will attempt to change hat into the HANDLING_UNTRUSTED_INPUT hat.
@@ -60,8 +64,8 @@ provides the AAHatName and AADefaultHatName Apache configuration options.
=item B<AAHatName>
AAHatName allows you to specify a hat to be used for a given Apache
E<lt>DirectoryE<gt>, E<lt>DirectoryMatch>, E<lt>LocationE<gt> or
E<lt>LocationMatchE<gt> directive (see the Apache documenation for more
E<lt>DirectoryE<gt>, E<lt>DirectoryMatchE<gt>, E<lt>LocationE<gt> or
E<lt>LocationMatchE<gt> directive (see the Apache documentation for more
details). Note that mod_apparmor behavior can become confused if
E<lt>Directory*E<gt> and E<lt>Location*E<gt> directives are intermingled
and it is recommended to use one type of directive. If the hat specified by
@@ -72,11 +76,11 @@ behavior described above.
AADefaultHatName allows you to specify a default hat to be used for
virtual hosts and other Apache server directives, so that you can have
different defaults for different virtual hosts. This can be overridden by
the AAHatName directive and is checked for only if there isn't a matching
AAHatName or hat named by the URI. If the AADefaultHatName hat does not
exist, it falls back to the DEFAULT_URI hat if it exists (as described
above).
different defaults for different virtual hosts. This can be overridden
by the AAHatName directive and is checked for only if there isn't
a matching AAHatName. The default value of AADefaultHatName is the
ServerName for the server/vhost configuration. If the AADefaultHatName
hat does not exist, then it falls back to the behavior described above.
=back
@@ -91,20 +95,35 @@ On each URI request, mod_apparmor will first aa_change_hat(2) into
Then, after performing the initial parsing of the request, mod_apparmor
will:
=over 2
=over 4
1. try to aa_change_hat(2) into a matching AAHatName hat if it exists and
=item 1
try to aa_change_hat(2) into a matching AAHatName hat if it exists and
applies, otherwise it will
2. try to aa_change_hat(2) into the URI itself, otherwise it will
=item 2
3. try to aa_change_hat(2) into an AADefaultHatName hat if it has been defined
for the server/vhost, otherwise it will
try to aa_change_hat(2) into an AADefaultHatName hat, either the
ServerName (the default) or the configuration value specified by the
AADefaultHatName directive, for the server/vhost, otherwise it will
4. try to aa_change_hat(2) into the DEFAULT_URI hat, if it exists, otherwise it
=item 3
try to aa_change_hat(2) into the ServerName-URI, otherwise it will
=item 4
try to aa_change_hat(2) into the URI itself, otherwise it will
=item 5
try to aa_change_hat(2) into the DEFAULT_URI hat, if it exists, otherwise it
will
5. fall back to the global Apache policy
=item 6
fall back to the global Apache policy
=back
@@ -112,14 +131,15 @@ will
mod_apparmor() currently only supports apache2, and has only been tested
with the prefork MPM configuration -- threaded configurations of Apache
may not work correctly.
may not work correctly. For Apache 2.4 users, you should enable the mpm_prefork
module.
There are likely other bugs lurking about; if you find any, please report
them at L<http://https://bugs.launchpad.net/apparmor/+filebug>.
them at L<https://bugs.launchpad.net/apparmor/+filebug>.
=head1 SEE ALSO
apparmor(7), subdomain.conf(5), apparmor_parser(8), aa_change_hat(2) and
L<http://wiki.apparmor.net>.
L<https://wiki.apparmor.net>.
=cut

View File

@@ -1,5 +1,6 @@
# ----------------------------------------------------------------------
# Copyright (c) 1999, 2004, 2005 NOVELL (All rights reserved)
# Copyright (c) 2016 Canonical, Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
@@ -16,22 +17,57 @@
NAME=pam_apparmor
all:
COMMONDIR=../../common/
MAKE_RULES=common/Make.rules
include ${MAKE_RULES}
include $(COMMONDIR)/Make.rules
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
ifeq ($(COMMONDIR_EXISTS), true)
common/Make.rules: $(COMMONDIR)/Make.rules
ln -sf $(COMMONDIR) .
ifdef USE_SYSTEM
LIBAPPARMOR = $(shell if pkg-config --exists libapparmor ; then \
pkg-config --silence-errors --libs libapparmor ; \
elif ldconfig -p | grep -q libapparmor\.so$$ ; then \
echo -lapparmor ; \
fi )
ifeq ($(strip $(LIBAPPARMOR)),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
Unable to find libapparmor installed on this system; either${nl}\
install libapparmor devel packages, set the LIBAPPARMOR variable${nl}\
manually, or build against in-tree libapparmor.${nl}\
************************************************************************${nl})
endif
LIBAPPARMOR_INCLUDE =
AA_LDLIBS = $(LIBAPPARMOR)
AA_LINK_FLAGS =
else
LIBAPPARMOR_SRC := ../../libraries/libapparmor/
LIBAPPARMOR_INCLUDE_PATH = $(LIBAPPARMOR_SRC)/include
LIBAPPARMOR_PATH := $(LIBAPPARMOR_SRC)/src/.libs/
ifeq ($(realpath $(LIBAPPARMOR_PATH)/libapparmor.a),)
ERROR_MESSAGE = $(error ${nl}\
************************************************************************${nl}\
$(LIBAPPARMOR_PATH)/libapparmor.a is missing; either build against${nl}\
the in-tree libapparmor by building it first and then trying again${nl}\
(see the top-level README for help) or build against the system${nl}\
libapparmor by adding USE_SYSTEM=1 to your make command.${nl}\
************************************************************************${nl})
endif
LIBAPPARMOR_INCLUDE = -I$(LIBAPPARMOR_INCLUDE_PATH)
AA_LINK_FLAGS = -L$(LIBAPPARMOR_PATH)
AA_LDLIBS = -lapparmor
endif
EXTRA_CFLAGS=$(CFLAGS) -fPIC -shared -Wall -I../../libraries/libapparmor/src/
LINK_FLAGS=-Xlinker -x -L../../libraries/libapparmor/src/.libs
LIBS=-lpam -lapparmor
EXTRA_CFLAGS=$(CFLAGS) $(CPPFLAGS) -fPIC -shared -Wall $(LIBAPPARMOR_INCLUDE)
LINK_FLAGS=-Xlinker -x $(AA_LINK_FLAGS) $(LDFLAGS)
LIBS=-lpam $(AA_LDLIBS)
OBJECTS=${NAME}.o get_options.o
all: $(NAME).so
.PHONY: libapparmor_check
.SILENT: libapparmor_check
libapparmor_check: ; $(ERROR_MESSAGE)
all: libapparmor_check $(NAME).so docs
.PHONY: docs
# docs: we should have some
docs:
$(NAME).so: ${OBJECTS}
$(CC) $(EXTRA_CFLAGS) $(LINK_FLAGS) -o $@ ${OBJECTS} $(LIBS)
@@ -49,7 +85,5 @@ install: $(NAME).so
install -m 555 $(NAME).so $(SECDIR)/
.PHONY: clean
clean: ${MAKE_RULES}
clean:
rm -f core core.* *.so *.o *.s *.a *~
rm -f ${NAME}-*.tar.gz Make.rules

View File

@@ -27,7 +27,7 @@
#include <grp.h>
#include <syslog.h>
#include <errno.h>
#include <apparmor.h>
#include <sys/apparmor.h>
#include <security/pam_ext.h>
#include <security/pam_modutil.h>
@@ -111,6 +111,7 @@ int pam_sm_open_session(pam_handle_t *pamh, int flags,
sizeof(magic_token));
if (retval < 0) {
pam_syslog(pamh, LOG_ERR, "Can't read from /dev/urandom\n");
close(fd);
return PAM_PERM_DENIED;
}
} while ((magic_token == 0) || (retval != sizeof(magic_token)));

View File

@@ -1,83 +0,0 @@
#
# spec file for package pam_apparmor (Version 2)
#
# Copyright (c) 2005 SUSE LINUX Products GmbH, Nuernberg, Germany.
# This file and all modifications and additions to the pristine
# package are under the same license as the package itself.
#
# Please submit bugfixes or comments via http://www.suse.de/feedback/
#
# norootforbuild
Name: pam_apparmor
License: GPL
Group: Productivity/Security
Autoreqprov: on
Version: @@immunix_version@@
Release: @@repo_version@@
Summary: Pam module to add AppArmor change_hat functionality
URL: http://forge.novell.com/modules/xfmod/project/?apparmor
Source: pam_apparmor-%{version}-@@repo_version@@.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: pam-devel
Requires: pam
Prereq: pam
%if %{?suse_version:1}0
%if 0%{?suse_version} < 1030
BuildRequires: libapparmor
%else
BuildRequires: libapparmor-devel
%endif
%else
BuildRequires: libapparmor-devel
%endif
%description
The pam_apparmor module provides the means for any pam applications that
call pam_open_session() to automatically perform an AppArmor change_hat
operation in order to switch to a user-specific security policy.
Authors:
--------
Jesse Michael jmichael@suse.de
%prep
%setup -q
%build
make CFLAGS="${RPM_OPT_FLAGS}"
%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
make install DESTDIR=${RPM_BUILD_ROOT} SECDIR=${RPM_BUILD_ROOT}/%{_lib}/security
%clean
[ "${RPM_BUILD_ROOT}" != "/" ] && rm -rf ${RPM_BUILD_ROOT}
%files
%defattr(444,root,root,755)
%doc README COPYING
%attr(555,root,root) /%{_lib}/security/pam_apparmor.so
%changelog -n pam_apparmor
* Tue Oct 31 2006 Jesse Michael <jmichael@suse.de>
- Add debug option
* Tue Oct 31 2006 Steve Beattie <sbeattie@suse.de>
- Add configuration options to order attempted hat changes
* Wed Oct 25 2006 Steve Beattie <sbeattie@suse.de>
- remove auto-editing of pam's common-session
- honor RPM's CFLAGS when building
- add license (same as Linux PAM package).
* Thu Sep 14 2006 Jesse Michael <jmichael@suse.de>
- header comment was incorrect
- use pam_get_user() instead of pam_get_item()
- fix read from urandom if 0
* Fri Jan 13 2006 Steve Beattie <sbeattie@suse.de>
- Add svn repo number to tarball
* Fri Jan 13 2006 Jesse Michael <jmichael@suse.de>
- Make magic tokens harder to guess by pulling them from /dev/urandom
* Wed Dec 21 2005 - jmichael@suse.de
- initial

View File

@@ -17,13 +17,7 @@ NAME = tomcat_apparmor
all:
COMMONDIR=../../../common/
include common/Make.rules
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
ifeq ($(COMMONDIR_EXISTS), true)
common/Make.rules: $(COMMONDIR)/Make.rules
ln -sf $(COMMONDIR) .
endif
include $(COMMONDIR)/Make.rules
LIB = lib
CATALINA_HOME = /usr/share/tomcat5
@@ -34,7 +28,6 @@ all:
clean:
ant clean
rm -f tomcat_apparmor.spec ${NAME}-*.tar.gz Make.rules
install: $(SPECFILE)
ant -Dversion=$(VERSION) -Drelease=$(RELEASE) -Dcatalina_home=${CATALINA_HOME} -Dinstall_lib=${LIB} install_jar install_jni
install:
ant -Dversion=$(VERSION) -Drelease=$(MAN_RELEASE) -Dcatalina_home=${CATALINA_HOME} -Dinstall_lib=${LIB} install_jar install_jni

View File

@@ -13,7 +13,7 @@
#include "jni.h"
#include <errno.h>
#include "sys/apparmor.h"
#include <sys/apparmor.h>
#include "com_novell_apparmor_JNIChangeHat.h"
/* c intermediate lib call for Java -> JNI -> c library execution of the change_hat call */

View File

@@ -1,85 +0,0 @@
# ----------------------------------------------------------------------
# Copyright (c) 2006 NOVELL (All rights reserved)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ----------------------------------------------------------------------
# norootforbuild
# Check first to see if distro is already defined.
%if ! %{?distro:1}0
%define distro suse
%endif
%if %{distro} == "suse"
%define CATALINA_HOME /usr/share/tomcat5
%endif
%define APPARMOR_DOC_DIR /usr/share/doc/packages/apparmor-docs/
%define JNI_SO libJNIChangeHat.so
%define JAR_FILE changeHatValve.jar
Summary: Tomcat 5 plugin for AppArmor change_hat
Name: tomcat_apparmor
Version: @@immunix_version@@
Release: @@repo_version@@
Group: System/Libraries
Source0: %{name}-%{version}-@@repo_version@@.tar.gz
License: LGPL
BuildRoot: %{?_tmppath:}%{!?_tmppath:/var/tmp}/%{name}-%{version}-build
Url: http://developer.novell.com/wiki/index.php/Novell_AppArmor
Prereq: tomcat5, servletapi5, libapparmor
BuildRequires: tomcat5, servletapi5 ant, java, libapparmor, java2-devel-packages, apparmor-docs
Provides: tomcat_apparmor
%description
tomcat_apparmor - is a plugin for Apache Tomcat version 5.x that provides
support for AppArmor change_hat for creating AppArmor containers that are
bound to discrete elements of processing within the Tomcat servlet
container. The AppArmor containers, or "hats", can be created for invidual
URL processing or per servlet.
%prep
%setup -q
%build
[ "${RPM_BUILD_ROOT}" != "/" ] && rm -rf ${RPM_BUILD_ROOT}
ant -Ddist=${RPM_BUILD_DIR}/%{name}-%{version} -Dtarget=1.4 jar jni_so
%install
ant -Ddist=${RPM_BUILD_DIR}/%{name}-%{version} -Dversion=%{version} -Drelease=%{release} -Dcatalina_home=%{CATALINA_HOME} -Dinstall_root=${RPM_BUILD_ROOT} -Dinstall_lib=%{_lib} install_jar install_jni
mkdir -p ${RPM_BUILD_ROOT}%{APPARMOR_DOC_DIR}
install ${RPM_BUILD_DIR}/%{name}-%{version}/README.tomcat_apparmor ${RPM_BUILD_ROOT}%{APPARMOR_DOC_DIR}
%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
%{CATALINA_HOME}/server/lib/%{JAR_FILE}
/%{_lib}/lib*
/%{_libdir}/lib*
%{APPARMOR_DOC_DIR}/README.tomcat_apparmor
%post
ldconfig
%postun
ldconfig
%changelog
* Mon Oct 9 2006 - dreynolds@suse.de
- Initial package creation.

View File

@@ -17,13 +17,7 @@ NAME = tomcat_apparmor
all:
COMMONDIR=../../../common/
include common/Make.rules
COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
ifeq ($(COMMONDIR_EXISTS), true)
common/Make.rules: $(COMMONDIR)/Make.rules
ln -sf $(COMMONDIR) .
endif
include $(COMMONDIR)/Make.rules
LIB = lib
CATALINA_HOME = /usr/share/tomcat55
@@ -34,7 +28,6 @@ all:
clean:
ant clean
rm -f tomcat_apparmor.spec ${NAME}-*.tar.gz Make.rules
install: $(SPECFILE)
ant -Dversion=$(VERSION) -Drelease=$(RELEASE) -Dcatalina_home=${CATALINA_HOME} -Dinstall_lib=${LIB} install_jar install_jni
install:
ant -Dversion=$(VERSION) -Drelease=$(MAN_RELEASE) -Dcatalina_home=${CATALINA_HOME} -Dinstall_lib=${LIB} install_jar install_jni

View File

@@ -13,7 +13,7 @@
#include "jni.h"
#include <errno.h>
#include <apparmor.h>
#include <sys/apparmor.h>
#include "com_novell_apparmor_JNIChangeHat.h"
/* c intermediate lib call for Java -> JNI -> c library execution of the change_hat call */

View File

@@ -1,86 +0,0 @@
# ----------------------------------------------------------------------
# Copyright (c) 2006 NOVELL (All rights reserved)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ----------------------------------------------------------------------
# norootforbuild
# Check first to see if distro is already defined.
%if ! %{?distro:1}0
%define distro suse
%endif
%if %{distro} == "suse"
%define CATALINA_HOME /usr/share/tomcat55
%endif
%define APPARMOR_DOC_DIR /usr/share/doc/packages/apparmor-docs/
%define JNI_SO libJNIChangeHat.so
%define JAR_FILE changeHatValve.jar
Summary: Tomcat 5 plugin for AppArmor change_hat
Name: tomcat_apparmor
Version: @@immunix_version@@
Release: @@repo_version@@
Group: System/Libraries
Source0: %{name}-%{version}-@@repo_version@@.tar.gz
License: LGPL
BuildRoot: %{?_tmppath:}%{!?_tmppath:/var/tmp}/%{name}-%{version}-build
Url: http://developer.novell.com/wiki/index.php/Novell_AppArmor
Prereq: tomcat55, servletapi5
BuildRequires: tomcat55, servletapi5, ant, java, libapparmor-devel, java2-devel-packages, apparmor-docs
%description
tomcat_apparmor - is a plugin for Apache Tomcat version 5.x that provides
support for AppArmor change_hat for creating AppArmor containers that are
bound to discrete elements of processing within the Tomcat servlet
container. The AppArmor containers, or "hats", can be created for invidual
URL processing or per servlet.
%prep
%setup -q
%build
[ "${RPM_BUILD_ROOT}" != "/" ] && rm -rf ${RPM_BUILD_ROOT}
ant -Dinstall_lib=%{_lib} -Dcatalina_home=%{CATALINA_HOME} -Ddist=${RPM_BUILD_DIR}/%{name}-%{version} -Dtarget=1.4 jar jni_so
%install
ant -Ddist=${RPM_BUILD_DIR}/%{name}-%{version} -Dversion=%{version} -Drelease=%{release} -Dcatalina_home=%{CATALINA_HOME} -Dinstall_root=${RPM_BUILD_ROOT} -Dinstall_lib=%{_lib} install_jar install_jni
mkdir -p ${RPM_BUILD_ROOT}%{APPARMOR_DOC_DIR}
install ${RPM_BUILD_DIR}/%{name}-%{version}/README.tomcat_apparmor ${RPM_BUILD_ROOT}%{APPARMOR_DOC_DIR}
%clean
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
%{CATALINA_HOME}/server/lib/%{JAR_FILE}
/%{_lib}/lib*
/%{_libdir}/lib*
doc %attr(0644,root,root) %{APPARMOR_DOC_DIR}/README.tomcat_apparmor
%post
ldconfig
%postun
ldconfig
%changelog
* Mon Jul 20 2007 - sbeattie@suse.de
- Convert builddep on libapparmor to libapparmor-devel
* Mon Oct 9 2006 - dreynolds@suse.de
- Initial package creation.

View File

@@ -1,7 +1,7 @@
# ------------------------------------------------------------------
#
# Copyright (c) 1999-2008 NOVELL (All rights reserved)
# Copyright 2009-2010 Canonical Ltd.
# Copyright 2009-2015 Canonical Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
@@ -21,13 +21,14 @@
# exist
LOCALEDIR=/usr/share/locale
XGETTEXT_ARGS=--copyright-holder="NOVELL, Inc." --msgid-bugs-address=apparmor@lists.ubuntu.com -d ${NAME}
XGETTEXT_ARGS=--copyright-holder="Canonical Ltd" --msgid-bugs-address=apparmor@lists.ubuntu.com -d ${NAME}
# When making the .pot file, it's expected that the parent Makefile will
# pass in the list of sources in the SOURCES variable
PARENT_SOURCES=$(foreach source, ${SOURCES}, ../${source})
LANGS=$(patsubst %.po, %, $(wildcard *.po))
# Can override by passing LANGS=whatever here
LANGS?=$(patsubst %.po, %, $(wildcard *.po))
TARGET_MOS=$(foreach lang, $(filter-out $(DISABLED_LANGS),$(LANGS)), ${lang}.mo)
.PHONY: all

View File

@@ -1,7 +1,7 @@
# ------------------------------------------------------------------
#
# Copyright (C) 2002-2005 Novell/SUSE
# Copyright (C) 2010 Canonical, Ltd.
# Copyright (C) 2010-2015 Canonical, Ltd.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
@@ -15,141 +15,99 @@
# You should have received a copy of the GNU General Public License
# along with this program; if not, contact Novell, Inc.
# ------------------------------------------------------------------
# Make.rules - common make targets and variables for building the SHASS
# product.
# Make.rules - common make targets and variables for building AppArmor
#
# NOTES:
# - must define the package NAME before including this file.
# - After checking in to cvs, you'll need to delele the hardlinked
# Make.rules files that already exist in the individual application
# directories
# Before including this file in your Makefile, you should
# - define COMMONDIR (the location of the common/ directory)
# - define the default rule (usually 'all:'). (Note: you can redefine
# it later in your Makefile)
.PHONY: common_Make.rules_is_a_bad_target
common_Make.rules_is_a_bad_target:
@echo "*** default target in common/Make.rules hit - either you did something strange, or something is broken... ***"
exit 1
DISTRIBUTION=AppArmor
VERSION=$(shell cat common/Version)
VERSION=$(shell cat $(COMMONDIR)/Version)
# OVERRIDABLE variables
# Set these variables before including Make.rules to change its behavior
# SPECFILE - for packages that have a non-standard specfile name
# EXTERNAL_PACKAGE - for packages that have upstream versions that
# we're locally modifying (e.g. imnxcerttool/gnutls).
#
# use 'make BUILDIR=/some/where/else/' to override the /usr/src/redhat
# location -- it *should* pick out the right thing to do based on the
# .rpmmacros file, but you can still use BUILDDIR to override that.
TESTBUILDDIR=$(shell [ -f ${HOME}/.rpmmacros ] && awk '/^%_topdir/ {print $$2}' ${HOME}/.rpmmacros)
ifndef BUILDDIR
BUILDDIR=$(shell if [ -d "${TESTBUILDDIR}" ] ; then \
echo ${TESTBUILDDIR} | sed "s^/$$^^" ; \
elif [ -d "/usr/src/redhat" ] ; then \
echo "/usr/src/redhat" ; \
elif [ -d "/usr/src/packages" ] ; then \
echo "/usr/src/packages" ; \
else \
echo "/tmp/${NAME}" ; \
fi ;)
endif
ifndef DISTRO
DISTRO=$(shell if [ -f /etc/slackware-version ] ; then \
echo slackware ; \
elif [ -f /etc/debian_version ] ; then \
echo debian ;\
elif which rpm > /dev/null ; then \
if [ "$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
echo suse ;\
elif [ "$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
echo rhel4 ;\
elif [ "$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
echo rhel4 ;\
else \
echo unknown ;\
fi ;\
else \
echo unknown ;\
fi)
endif
RPMARG=--define "_topdir $(BUILDDIR:/=)" \
--define "vendor NOVELL, Inc." \
--define "distribution ${DISTRIBUTION}" \
--define "debug_package %{nil}" \
--define "immunix_version ${VERSION}" \
$(shell [ -d ${BUILDDIR}/BUILDROOT ] && echo --define \"buildroot $(BUILDDIR:/=)/BUILDROOT\") \
$(shell [ -n "${DISTRO}" ] && echo --define \"distro ${DISTRO}\")
# Convenience functions
pathsearch = $(firstword $(wildcard $(addsuffix /$(1),$(subst :, ,$(PATH)))))
map = $(foreach a,$(2),$(call $(1),$(a)))
REPO_VERSION_CMD=([ -x /usr/bin/bzr ] && /usr/bin/bzr version-info . 2> /dev/null || awk '{ print "revno: "$2 }' common/.stamp_rev) | awk '/^revno:/ { print $2 }'
ifdef EXTERNAL_PACKAGE
RPMARG+=--define "_sourcedir $(shell pwd)"
AWK:=$(shell which awk)
ifndef AWK
$(error awk utility required for build but not available)
endif
ifndef SPECFILE
SPECFILE = $(NAME).spec
endif
RELEASE_DIR = $(NAME)-$(VERSION)
TAR = /bin/tar czvp -h --exclude .svn --exclude .bzr --exclude .bzrignore --exclude ${RELEASE_DIR}/${RELEASE_DIR} $(shell test -f ${NAME}.exclude && echo "-X ${NAME}.exclude")
LDCONFIG = /sbin/ldconfig
define nl
RPMSUBDIRS=SOURCES SPECS BUILD BUILDROOT SRPMS RPMS/i386 RPMS/i586 \
RPMS/i686 RPMS/athlon RPMS/noarch RPMS/x86_64
BUILDRPMSUBDIRS=$(foreach subdir, $(RPMSUBDIRS), $(BUILDDIR:/=)/$(subdir))
endef
ifdef EXTERNAL_PACKAGE
.PHONY: rpm
rpm: clean $(BUILDRPMSUBDIRS)
rpmbuild -ba ${RPMARG} ${SPECFILE}
REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || awk '{ print $2 }' common/.stamp_rev
else
.PHONY: rpm
rpm: clean $(BUILDRPMSUBDIRS)
__REPO_VERSION=`$(value REPO_VERSION_CMD)` ; \
__TARBALL=$(NAME)-$(VERSION)-$${__REPO_VERSION}.tar.gz ; \
make $${__TARBALL} ; \
cp $${__TARBALL} $(BUILDDIR)/SOURCES/
cp ${SPECFILE} $(BUILDDIR)/SPECS/
rpmbuild -ba ${RPMARG} ${SPECFILE}
.PHONY: ${SPECFILE}
${SPECFILE}: ${SPECFILE}.in
__REPO_VERSION=`$(value REPO_VERSION_CMD)` ; \
sed -e "s/@@immunix_version@@/${VERSION}/g" \
-e "s/@@repo_version@@/$${__REPO_VERSION}/g" $< > $@
%.tar.gz: clean ${SPECFILE}
-rm -rf $(RELEASE_DIR)
mkdir $(RELEASE_DIR)
$(TAR) --exclude $@ . | tar xz -C $(RELEASE_DIR)
$(TAR) --exclude $@ -f $@ $(RELEASE_DIR)
rm -rf $(RELEASE_DIR)
ifndef OVERRIDE_TARBALL
.PHONY: tarball
tarball: clean $(TARBALL)
ifndef PYTHON_VERSIONS
PYTHON_VERSIONS = $(call map, pathsearch, python2 python3)
endif
ifndef PYTHON
PYTHON = $(firstword ${PYTHON_VERSIONS})
endif
#Helper function to be used with $(call pyalldo, run_test_with_all.py)
pyalldo=set -e; $(foreach py, $(PYTHON_VERSIONS), $(py) $(1);)
.PHONY: version
.SILENT: version
version:
rpm -q --define "_sourcedir ." ${RPMARG} --specfile ${SPECFILE}
echo $(VERSION)
.PHONY: repo_version
.SILENT: repo_version
repo_version:
$(value REPO_VERSION_CMD)
echo $(shell $(value REPO_VERSION_CMD))
.PHONY: build_dir
build_dir: $(BUILDRPMSUBDIRS)
$(BUILDRPMSUBDIRS):
mkdir -p $(BUILDRPMSUBDIRS)
.PHONY: _clean
.SILENT: _clean
_clean:
-rm -f ${NAME}-${VERSION}-*.tar.gz
.PHONY: pod_clean
ifndef VERBOSE
.SILENT: pod_clean
endif
pod_clean:
-rm -f ${MANPAGES} *.[0-9].gz ${HTMLMANPAGES} pod2htm*.tmp
# =====================
# generate list of capabilities based on
# /usr/include/linux/capabilities.h for use in multiple locations in
# the source tree
# =====================
# emits defined capabilities in a simple list, e.g. "CAP_NAME CAP_NAME2"
CAPABILITIES=$(shell echo "\#include <linux/capability.h>" | cpp -dM | LC_ALL=C sed -n -e '/CAP_EMPTY_SET/d' -e 's/^\#define[ \t]\+CAP_\([A-Z0-9_]\+\)[ \t]\+\([0-9xa-f]\+\)\(.*\)$$/CAP_\1/p' | LC_ALL=C sort)
.PHONY: list_capabilities
list_capabilities: /usr/include/linux/capability.h
@echo "$(CAPABILITIES)"
# =====================
# generate list of network protocols based on
# sys/socket.h for use in multiple locations in
# the source tree
# =====================
# These are the families that it doesn't make sense for apparmor
# to mediate. We use PF_ here since that is what is required in
# bits/socket.h, but we will rewrite these as AF_.
FILTER_FAMILIES=PF_UNIX
__FILTER=$(shell echo $(strip $(FILTER_FAMILIES)) | sed -e 's/ /\\\|/g')
# emits the AF names in a "AF_NAME NUMBER," pattern
AF_NAMES=$(shell echo "\#include <sys/socket.h>" | cpp -dM | LC_ALL=C sed -n -e '/$(__FILTER)/d' -e 's/PF_LOCAL/PF_UNIX/' -e 's/^\#define[ \t]\+PF_\([A-Z0-9_]\+\)[ \t]\+\([0-9]\+\).*$$/AF_\1 \2,/p' | sort -n -k2)
.PHONY: list_af_names
list_af_names:
@echo "$(AF_NAMES)"
# =====================
# manpages
# =====================
@@ -172,29 +130,8 @@ install_manpages: $(MANPAGES)
MAN_RELEASE="AppArmor ${VERSION}"
%.1: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=1 > $@
%.2: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=2 > $@
%.3: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=3 > $@
%.4: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=4 > $@
%.5: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=5 > $@
%.6: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=6 > $@
%.7: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=7 > $@
%.8: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --section=8 > $@
%.1 %.2 %.3 %.4 %.5 %.6 %.7 %.8: %.pod
$(POD2MAN) $< --release=$(MAN_RELEASE) --center=AppArmor --stderr --section=$(subst .,,$(suffix $@)) > $@
%.1.html: %.pod
$(POD2HTML) --header --css apparmor.css --infile=$< --outfile=$@
@@ -228,3 +165,7 @@ ENSCRIPT_ARGS=-C -2jGr -f Courier6 -E
%.pm.ps: %.pm
enscript ${ENSCRIPT_ARGS} -o $@ $<
.PHONY: check_pod_files
check_pod_files:
LANG=C podchecker -warning -warning *.pod

View File

@@ -1 +1 @@
2.6.0
2.11.3

View File

@@ -1 +0,0 @@
Matt Barringer <mbarringer@suse.de>

View File

@@ -1,340 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.

View File

@@ -1,167 +0,0 @@
Basic Installation
==================
These are generic installation instructions.
The `configure' shell script attempts to guess correct values for
various system-dependent variables used during compilation. It uses
those values to create a `Makefile' in each directory of the package.
It may also create one or more `.h' files containing system-dependent
definitions. Finally, it creates a shell script `config.status' that
you can run in the future to recreate the current configuration, a file
`config.cache' that saves the results of its tests to speed up
reconfiguring, and a file `config.log' containing compiler output
(useful mainly for debugging `configure').
If you need to do unusual things to compile the package, please try
to figure out how `configure' could check whether to do them, and mail
diffs or instructions to the address given in the `README' so they can
be considered for the next release. If at some point `config.cache'
contains results you don't want to keep, you may remove or edit it.
The file `configure.in' is used to create `configure' by a program
called `autoconf'. You only need `configure.in' if you want to change
it or regenerate `configure' using a newer version of `autoconf'.
The simplest way to compile this package is:
1. `cd' to the directory containing the package's source code and type
`./configure' to configure the package for your system. If you're
using `csh' on an old version of System V, you might need to type
`sh ./configure' instead to prevent `csh' from trying to execute
`configure' itself.
Running `configure' takes a while. While running, it prints some
messages telling which features it is checking for.
2. Type `make' to compile the package.
3. Type `make install' to install the programs and any data files and
documentation.
4. You can remove the program binaries and object files from the
source code directory by typing `make clean'.
Compilers and Options
=====================
Some systems require unusual options for compilation or linking that
the `configure' script does not know about. You can give `configure'
initial values for variables by setting them in the environment. Using
a Bourne-compatible shell, you can do that on the command line like
this:
CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure
Or on systems that have the `env' program, you can do it like this:
env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure
Compiling For Multiple Architectures
====================================
You can compile the package for more than one kind of computer at the
same time, by placing the object files for each architecture in their
own directory. To do this, you must use a version of `make' that
supports the `VPATH' variable, such as GNU `make'. `cd' to the
directory where you want the object files and executables to go and run
the `configure' script. `configure' automatically checks for the
source code in the directory that `configure' is in and in `..'.
If you have to use a `make' that does not supports the `VPATH'
variable, you have to compile the package for one architecture at a time
in the source code directory. After you have installed the package for
one architecture, use `make distclean' before reconfiguring for another
architecture.
Installation Names
==================
By default, `make install' will install the package's files in
`/usr/local/bin', `/usr/local/man', etc. You can specify an
installation prefix other than `/usr/local' by giving `configure' the
option `--prefix=PATH'.
You can specify separate installation prefixes for
architecture-specific files and architecture-independent files. If you
give `configure' the option `--exec-prefix=PATH', the package will use
PATH as the prefix for installing programs and libraries.
Documentation and other data files will still use the regular prefix.
If the package supports it, you can cause programs to be installed
with an extra prefix or suffix on their names by giving `configure' the
option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
Optional Features
=================
Some packages pay attention to `--enable-FEATURE' options to
`configure', where FEATURE indicates an optional part of the package.
They may also pay attention to `--with-PACKAGE' options, where PACKAGE
is something like `gnu-as' or `x' (for the X Window System). The
`README' should mention any `--enable-' and `--with-' options that the
package recognizes.
For packages that use the X Window System, `configure' can usually
find the X include and library files automatically, but if it doesn't,
you can use the `configure' options `--x-includes=DIR' and
`--x-libraries=DIR' to specify their locations.
Specifying the System Type
==========================
There may be some features `configure' can not figure out
automatically, but needs to determine by the type of host the package
will run on. Usually `configure' can figure that out, but if it prints
a message saying it can not guess the host type, give it the
`--host=TYPE' option. TYPE can either be a short name for the system
type, such as `sun4', or a canonical name with three fields:
CPU-COMPANY-SYSTEM
See the file `config.sub' for the possible values of each field. If
`config.sub' isn't included in this package, then this package doesn't
need to know the host type.
If you are building compiler tools for cross-compiling, you can also
use the `--target=TYPE' option to select the type of system they will
produce code for and the `--build=TYPE' option to select the type of
system on which you are compiling the package.
Sharing Defaults
================
If you want to set default values for `configure' scripts to share,
you can create a site shell script called `config.site' that gives
default values for variables like `CC', `cache_file', and `prefix'.
`configure' looks for `PREFIX/share/config.site' if it exists, then
`PREFIX/etc/config.site' if it exists. Or, you can set the
`CONFIG_SITE' environment variable to the location of the site script.
A warning: not all `configure' scripts look for a site script.
Operation Controls
==================
`configure' recognizes the following options to control how it
operates.
`--cache-file=FILE'
Use and save the results of the tests in FILE instead of
`./config.cache'. Set FILE to `/dev/null' to disable caching, for
debugging `configure'.
`--help'
Print a summary of the options to `configure', and exit.
`--quiet'
`--silent'
`-q'
Do not print messages saying which checks are being made.
`--srcdir=DIR'
Look for the package's source code in directory DIR. Usually
`configure' can determine that directory automatically.
`--version'
Print the version of Autoconf used to generate the `configure'
script, and exit.
`configure' also accepts some other, not widely useful, options.

View File

@@ -1,5 +0,0 @@
# not a GNU package. You can remove this line, if
# have all needed files, that a GNU package needs
AUTOMAKE_OPTIONS = foreign 1.4
SUBDIRS = src

View File

@@ -1,8 +0,0 @@
In order to actually use aadbus, you need to tell auditd to use it as a dispatcher. It's simple:
* As root, edit /etc/auditd.conf
* Add the following line (using the correct path, of course):
dispatcher=/usr/local/bin/apparmor-dbus
* Restart auditd

View File

@@ -1,43 +0,0 @@
#
# spec file for package apparmor-dbus
#
# norootforbuild
Name: apparmor-dbus
BuildRequires: audit-devel dbus-1-devel pkgconfig libapparmor-devel
Requires: libapparmor
Version: 2.3
Release: 0
License: GPL
Group: System/Management
BuildRoot: %{_tmppath}/%{name}-%{version}-build
Source0: %{name}-%{version}.tar.bz2
Summary: -
%description
-
%prep
%setup -n %{name}-%{version}
%build
autoreconf --force --install
export CFLAGS="$RPM_OPT_FLAGS"
%{?suse_update_config:%{suse_update_config -f}}
./configure --prefix=%{_prefix}
make
%install
rm -rf %{buildroot}
%makeinstall
%clean
rm -rf %{buildroot}
%files
%defattr(-, root, root)
%{_prefix}/bin/apparmor-dbus
%changelog
* Thu Sep 13 2007 - sbeattie@suse.de
- Bump to revision 1.2

View File

@@ -1,31 +0,0 @@
#!/bin/sh
DIE=0
(autoconf --version) < /dev/null > /dev/null 2>&1 || {
echo
echo "You must have autoconf installed to compile $package."
echo "Download the appropriate package for your distribution,"
echo "or get the source tarball at ftp://ftp.gnu.org/pub/gnu/"
DIE=1
}
(automake --version) < /dev/null > /dev/null 2>&1 || {
echo
echo "You must have automake installed to compile $package."
echo "Download the appropriate package for your system,"
echo "or get the source from one of the GNU ftp sites"
echo "listed in http://www.gnu.org/order/ftp.html"
DIE=1
}
if test "$DIE" -eq 1; then
exit 1
fi
echo "Running aclocal"
aclocal
echo "Running autoconf"
autoconf --force
echo "Running automake -ac"
automake -ac

View File

@@ -1,16 +0,0 @@
AC_INIT(configure.in)
AM_INIT_AUTOMAKE(apparmor-dbus, 2.3)
AC_LANG_C
AC_PROG_CC
AC_CHECK_HEADERS(libaudit.h,,AC_MSG_ERROR([libaudit header file not found!]))
AC_CHECK_LIB(audit, audit_open)
AC_CHECK_HEADERS(aalogparse/aalogparse.h)
AC_CHECK_LIB(apparmor, parse_record)
PKG_CHECK_MODULES(DBUS, dbus-1 >= 0.60)
CFLAGS="${CFLAGS} ${DBUS_CFLAGS}"
AC_CHECK_LIB(dbus-1, exit,,AC_MSG_ERROR([dbus-1 not found!]))
AC_OUTPUT(Makefile src/Makefile)

View File

@@ -1,2 +0,0 @@
bin_PROGRAMS = apparmor-dbus
apparmor_dbus_SOURCES = aadbus.c

View File

@@ -1,322 +0,0 @@
#define DBUS_API_SUBJECT_TO_CHANGE
#include <stdio.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <unistd.h>
#include <stdlib.h>
#include <signal.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include <locale.h>
#include <libaudit.h>
#include <dbus/dbus.h>
#include <aalogparse/aalogparse.h>
#define NULLSPACE(x) (x == NULL) ? &empty_string : &x
#define NULLSTRLEN(x) (x == NULL) ? 1 : (strlen(x) + 1)
// Local data
static volatile int signaled = 0;
static int pipe_fd;
// Local functions
static int event_loop(void);
static int is_reject(char *data);
// SIGTERM handler
static void term_handler( int sig )
{
signaled = 1;
}
/*
* main is started by auditd. See dispatcher in auditd.conf
*/
int main(int argc, char *argv[])
{
struct sigaction sa;
setlocale (LC_ALL, "");
#ifndef DEBUG
/* Make sure we are root */
if (getuid() != 0) {
printf("You must be root to run this program.\n");
return 4;
}
#endif
// register sighandlers
sa.sa_flags = 0 ;
sa.sa_handler = term_handler;
sigemptyset( &sa.sa_mask ) ;
sigaction( SIGTERM, &sa, NULL );
sa.sa_handler = term_handler;
sigemptyset( &sa.sa_mask ) ;
sigaction( SIGCHLD, &sa, NULL );
sa.sa_handler = SIG_IGN;
sigaction( SIGHUP, &sa, NULL );
(void)chdir("/");
// change over to pipe_fd
pipe_fd = dup(0);
close(0);
open("/dev/null", O_RDONLY);
fcntl(pipe_fd, F_SETFD, FD_CLOEXEC);
// Start the program
return event_loop();
}
/* This function is needed for "old" messages which lumped
* everything together under one audit ID.
*/
static int is_reject (char *data)
{
int ret = -1;
/* Look for the first space */
char *start = strchr(data, ' ');
if ((start != NULL) && (strlen(start) > 9))
{
if (strncmp(start + 1, "REJECTING", 9) == 0)
{
ret = 0;
}
}
return ret;
}
static int event_loop(void)
{
void* data;
char *empty_string = " "; /* This is a quick way to indicate a 'null' value in our DBUS message */
struct iovec vec[2];
struct audit_dispatcher_header hdr;
DBusError error; /* Error, if any */
DBusMessage *message; /* Message to send */
static DBusConnection *con = NULL; /* Connection to DBUS server */
DBusMessageIter iter, /* The main message iterator */
profileIter,
nameIter,
name2Iter,
parentIter,
activeIter,
dataIter;
char *line = NULL, *parsable_line = NULL;
int real_data_size;
aa_log_record *record;
int is_rejection = 0;
if (con && !dbus_connection_get_is_connected(con))
{
dbus_connection_unref(con);
con = NULL;
}
if (!con)
{
dbus_error_init(&error);
con = dbus_bus_get(DBUS_BUS_SYSTEM, &error);
if (!con)
{
dbus_error_free(&error);
return 1;
}
}
//message = dbus_message_new_signal("/com/Novell/AppArmor","com.novell.apparmor", "Reject");
/* allocate data structures */
data = malloc(MAX_AUDIT_MESSAGE_LENGTH);
if (data == NULL)
{
printf("Cannot allocate buffer\n");
return 1;
}
memset(data, 0, MAX_AUDIT_MESSAGE_LENGTH);
memset(&hdr, 0, sizeof(hdr));
do
{
int rc;
parsable_line = NULL;
is_rejection = 0;
struct timeval tv;
fd_set fd;
tv.tv_sec = 1;
tv.tv_usec = 0;
FD_ZERO(&fd);
FD_SET(pipe_fd, &fd);
rc = select(pipe_fd+1, &fd, NULL, NULL, &tv);
if (rc == 0)
continue;
else if (rc == -1)
break;
/* Get header first. it is fixed size */
vec[0].iov_base = (void*)&hdr;
vec[0].iov_len = sizeof(hdr);
memset(data, 0, MAX_AUDIT_MESSAGE_LENGTH);
// Next payload
vec[1].iov_base = data;
vec[1].iov_len = MAX_AUDIT_MESSAGE_LENGTH;
rc = readv(pipe_fd, vec, 2);
if (rc == 0 || rc == -1) {
printf("rc == %d(%s)\n", rc, strerror(errno));
break;
}
/* Handle the AppArmor events.
* 1500 is used for "old" style messages.
* 1503 is used for APPARMOR_DENIED messages.
*/
if ((hdr.type == 1500) || (hdr.type == 1503))
{
line = (char *) data;
record = NULL;
if (hdr.type == 1503)
is_rejection = 1;
if ((hdr.type == 1500) && (is_reject(line) == 0))
is_rejection = 1;
/* We only care about REJECTING messages */
if (is_rejection == 1)
{
/* parse_record expects things like they appear in audit.log -
* which means we need to prepend TYPE=APPARMOR (if hdr.type is 1500)
* or type=APPARMOR_DENIED (if hdr.type is 1503). This is not ideal.
*/
real_data_size = strlen(line);
if (hdr.type == 1500)
{
parsable_line = (char *) malloc(real_data_size + 20);
snprintf(parsable_line, real_data_size + 19, "type=APPARMOR msg=%s", line);
}
else
{
parsable_line = (char *) malloc(real_data_size + 27);
snprintf(parsable_line, real_data_size + 26, "type=APPARMOR_DENIED msg=%s", line);
}
record = parse_record(parsable_line);
message = dbus_message_new_signal("/com/Novell/AppArmor","com.novell.apparmor", "REJECT");
dbus_message_iter_init_append(message, &iter);
/*
* The message has a number of fields appended to it,
* all of which map to the aa_log_record struct that we get back from
* parse_record(). If an entry in the struct is NULL or otherwise invalid,
* the field is still appended as a single blank space (in the case of strings), or a
* 0 in case of integers (which are all PIDs and unlikely to ever be 0).
*
* TODO: Pass a bitmask int along for the denied & requested masks
*
* 1 - The full string - BYTE ARRAY
* 2 - The PID (record->pid) - DBUS_TYPE_INT64
* 3 - The task (record->task) - DBUS_TYPE_INT64
* 4 - The audit ID (record->audit_id) - DBUS_TYPE_STRING
* 5 - The operation (record->operation: "Exec" "ptrace" etc) - DBUS_TYPE_STRING
* 6 - The denied mask (record->denied_mask: "rwx" etc) - DBUS_TYPE_STRING
* 7 - The requested mask (record->requested_mask) - DBUS_TYPE_STRING
* 8 - The name of the profile (record->profile) - BYTE ARRAY
* 9 - The first name field (record->name) - BYTE ARRAY
* 10- The second name field (record->name2) - BYTE ARRAY
* 11- The attribute (record->attribute) - DBUS_TYPE_STRING
* 12- The parent task (record->parent) - BYTE ARRAY
* 13- The magic token (record->magic_token) - DBUS_TYPE_INT64
* 14- The info field (record->info) - BYTE ARRAY
* 15- The active hat (record->active_hat) - BYTE ARRAY
*/
if (record != NULL)
{
/* Please note: NULLSPACE is defined at the top of this file, and will expand to
a ternary conditional:
(record->audit_id == NULL) ? &empty_string : &record->audit_id
for example.
The way we handle strings is ugly - some of the characters we allow (0x80, for example) are invalid Unicode,
which will cause our DBus connection to be dropped if we send them as a DBUS_TYPE_STRING.
Instead, we send a bunch of containers, each with a byte array. Perhaps a struct would be better?
*/
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &dataIter);
dbus_message_iter_append_fixed_array(&dataIter, DBUS_TYPE_BYTE, &data, strlen(data) + 1);
dbus_message_iter_close_container(&iter, &dataIter);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_INT64, &record->pid);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_INT64, &record->task);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->audit_id));
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->operation));
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->denied_mask));
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->requested_mask));
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &profileIter);
dbus_message_iter_append_fixed_array(&profileIter,
DBUS_TYPE_BYTE,
NULLSPACE(record->profile),
NULLSTRLEN(record->profile));
dbus_message_iter_close_container(&iter, &profileIter);
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &nameIter);
dbus_message_iter_append_fixed_array(&nameIter,
DBUS_TYPE_BYTE,
NULLSPACE(record->name),
NULLSTRLEN(record->name));
dbus_message_iter_close_container(&iter, &nameIter);
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &name2Iter);
dbus_message_iter_append_fixed_array(&name2Iter,
DBUS_TYPE_BYTE,
NULLSPACE(record->name2),
NULLSTRLEN(record->name2));
dbus_message_iter_close_container(&iter, &name2Iter);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->attribute));
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &parentIter);
dbus_message_iter_append_fixed_array(&parentIter,
DBUS_TYPE_BYTE,
NULLSPACE(record->parent),
NULLSTRLEN(record->parent));
dbus_message_iter_close_container(&iter, &parentIter);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_INT64, &record->magic_token);
dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, NULLSPACE(record->info));
dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, DBUS_TYPE_BYTE_AS_STRING, &activeIter);
dbus_message_iter_append_fixed_array(&activeIter,
DBUS_TYPE_BYTE,
NULLSPACE(record->active_hat),
NULLSTRLEN(record->active_hat));
dbus_message_iter_close_container(&iter, &activeIter);
}
dbus_connection_send(con, message, NULL);
dbus_connection_flush(con);
dbus_message_unref(message);
free_record(record);
if (parsable_line != NULL)
free(parsable_line);
}
}
} while(!signaled);
if (con)
dbus_connection_unref(con);
free(data);
return 0;
}

View File

@@ -1 +0,0 @@
Matt Barringer <mbarringer@suse.de>

View File

@@ -1,340 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.

View File

@@ -1,167 +0,0 @@
Basic Installation
==================
These are generic installation instructions.
The `configure' shell script attempts to guess correct values for
various system-dependent variables used during compilation. It uses
those values to create a `Makefile' in each directory of the package.
It may also create one or more `.h' files containing system-dependent
definitions. Finally, it creates a shell script `config.status' that
you can run in the future to recreate the current configuration, a file
`config.cache' that saves the results of its tests to speed up
reconfiguring, and a file `config.log' containing compiler output
(useful mainly for debugging `configure').
If you need to do unusual things to compile the package, please try
to figure out how `configure' could check whether to do them, and mail
diffs or instructions to the address given in the `README' so they can
be considered for the next release. If at some point `config.cache'
contains results you don't want to keep, you may remove or edit it.
The file `configure.in' is used to create `configure' by a program
called `autoconf'. You only need `configure.in' if you want to change
it or regenerate `configure' using a newer version of `autoconf'.
The simplest way to compile this package is:
1. `cd' to the directory containing the package's source code and type
`./configure' to configure the package for your system. If you're
using `csh' on an old version of System V, you might need to type
`sh ./configure' instead to prevent `csh' from trying to execute
`configure' itself.
Running `configure' takes a while. While running, it prints some
messages telling which features it is checking for.
2. Type `make' to compile the package.
3. Type `make install' to install the programs and any data files and
documentation.
4. You can remove the program binaries and object files from the
source code directory by typing `make clean'.
Compilers and Options
=====================
Some systems require unusual options for compilation or linking that
the `configure' script does not know about. You can give `configure'
initial values for variables by setting them in the environment. Using
a Bourne-compatible shell, you can do that on the command line like
this:
CC=c89 CFLAGS=-O2 LIBS=-lposix ./configure
Or on systems that have the `env' program, you can do it like this:
env CPPFLAGS=-I/usr/local/include LDFLAGS=-s ./configure
Compiling For Multiple Architectures
====================================
You can compile the package for more than one kind of computer at the
same time, by placing the object files for each architecture in their
own directory. To do this, you must use a version of `make' that
supports the `VPATH' variable, such as GNU `make'. `cd' to the
directory where you want the object files and executables to go and run
the `configure' script. `configure' automatically checks for the
source code in the directory that `configure' is in and in `..'.
If you have to use a `make' that does not supports the `VPATH'
variable, you have to compile the package for one architecture at a time
in the source code directory. After you have installed the package for
one architecture, use `make distclean' before reconfiguring for another
architecture.
Installation Names
==================
By default, `make install' will install the package's files in
`/usr/local/bin', `/usr/local/man', etc. You can specify an
installation prefix other than `/usr/local' by giving `configure' the
option `--prefix=PATH'.
You can specify separate installation prefixes for
architecture-specific files and architecture-independent files. If you
give `configure' the option `--exec-prefix=PATH', the package will use
PATH as the prefix for installing programs and libraries.
Documentation and other data files will still use the regular prefix.
If the package supports it, you can cause programs to be installed
with an extra prefix or suffix on their names by giving `configure' the
option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'.
Optional Features
=================
Some packages pay attention to `--enable-FEATURE' options to
`configure', where FEATURE indicates an optional part of the package.
They may also pay attention to `--with-PACKAGE' options, where PACKAGE
is something like `gnu-as' or `x' (for the X Window System). The
`README' should mention any `--enable-' and `--with-' options that the
package recognizes.
For packages that use the X Window System, `configure' can usually
find the X include and library files automatically, but if it doesn't,
you can use the `configure' options `--x-includes=DIR' and
`--x-libraries=DIR' to specify their locations.
Specifying the System Type
==========================
There may be some features `configure' can not figure out
automatically, but needs to determine by the type of host the package
will run on. Usually `configure' can figure that out, but if it prints
a message saying it can not guess the host type, give it the
`--host=TYPE' option. TYPE can either be a short name for the system
type, such as `sun4', or a canonical name with three fields:
CPU-COMPANY-SYSTEM
See the file `config.sub' for the possible values of each field. If
`config.sub' isn't included in this package, then this package doesn't
need to know the host type.
If you are building compiler tools for cross-compiling, you can also
use the `--target=TYPE' option to select the type of system they will
produce code for and the `--build=TYPE' option to select the type of
system on which you are compiling the package.
Sharing Defaults
================
If you want to set default values for `configure' scripts to share,
you can create a site shell script called `config.site' that gives
default values for variables like `CC', `cache_file', and `prefix'.
`configure' looks for `PREFIX/share/config.site' if it exists, then
`PREFIX/etc/config.site' if it exists. Or, you can set the
`CONFIG_SITE' environment variable to the location of the site script.
A warning: not all `configure' scripts look for a site script.
Operation Controls
==================
`configure' recognizes the following options to control how it
operates.
`--cache-file=FILE'
Use and save the results of the tests in FILE instead of
`./config.cache'. Set FILE to `/dev/null' to disable caching, for
debugging `configure'.
`--help'
Print a summary of the options to `configure', and exit.
`--quiet'
`--silent'
`-q'
Do not print messages saying which checks are being made.
`--srcdir=DIR'
Look for the package's source code in directory DIR. Usually
`configure' can determine that directory automatically.
`--version'
Print the version of Autoconf used to generate the `configure'
script, and exit.
`configure' also accepts some other, not widely useful, options.

View File

@@ -1,2 +0,0 @@
SUBDIRS = src doc

View File

@@ -1,5 +0,0 @@
default: all
all:
srcdir=`pwd` sh macros/autogen.sh

View File

@@ -1,6 +0,0 @@
The profile editor requires wxWidgets 2.6 or higher. Your distro probably has a
binary package you could install, or you can install from a source distribution
from http://www.wxwidgets.org
This program is released under the GPL, except for all source files under
the src/wxStyledTextCtrl directory. Check there for license details for those files.

View File

@@ -1,55 +0,0 @@
AC_INIT(src/profileeditor.cpp)
AM_INIT_AUTOMAKE(profileeditor, 0.9)
AC_PROG_CXX
AC_PROG_INSTALL
AC_LIBTOOL_DLOPEN
AC_PROG_LIBTOOL
CPPFLAGS="$CPPFLAGS -Wall -g -fexceptions"
CXXFLAGS="$CPPFLAGS -Wall -g -fexceptions"
WXCONFIG=wx-config
AC_ARG_WITH(wx-config,
[[ --with-wx-config=FILE Use the given path to wx-config when determining
wxWidgets configuration; defaults to "wx-config"]],
[
if test "$withval" != "yes" -a "$withval" != ""; then
WXCONFIG=$withval
fi
])
wxversion=0
AC_DEFUN([WXTEST],
[
AC_REQUIRE([AC_PROG_AWK])
AC_MSG_CHECKING([wxWidgets version])
if wxversion=`$WXCONFIG --version`; then
AC_MSG_RESULT([$wxversion])
else
AC_MSG_RESULT([not found])
AC_MSG_ERROR([wxWidgets is required. Try --with-wx-config.])
fi])
# Call WXTEST func
WXTEST
# Verify minimus requires
vers=`echo $wxversion | $AWK 'BEGIN { FS = "."; } { printf "% d", ($1 * 1000 + $2) * 1000 + $3;}'`
if test -n "$vers" && test "$vers" -ge 2006000; then
WX_CPPFLAGS="`$WXCONFIG --cppflags`"
WX_CXXFLAGS="`$WXCONFIG --cxxflags | sed -e 's/-fno-exceptions//'`"
WX_LIBS="`$WXCONFIG --libs`"
else
AC_MSG_ERROR([wxWidgets 2.6.0 or newer is required])
fi
CPPFLAGS="$CPPFLAGS $WX_CPPFLAGS"
CXXFLAGS="$CXXFLAGS $WX_CPPFLAGS"
AC_SUBST(WX_LIBS)
AC_OUTPUT(Makefile src/Makefile src/wxStyledTextCtrl/Makefile doc/Makefile)

View File

@@ -1,4 +0,0 @@
docdir = $(datadir)/doc/@PACKAGE@
doc_DATA = \
en/AppArmorProfileEditor.htb

View File

@@ -1,342 +0,0 @@
# Makefile.in generated by automake 1.9.6 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
# 2003, 2004, 2005 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
srcdir = @srcdir@
top_srcdir = @top_srcdir@
VPATH = @srcdir@
pkgdatadir = $(datadir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
top_builddir = ..
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
INSTALL = @INSTALL@
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = doc
DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/configure.in
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_CLEAN_FILES =
SOURCES =
DIST_SOURCES =
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
am__installdirs = "$(DESTDIR)$(docdir)"
docDATA_INSTALL = $(INSTALL_DATA)
DATA = $(doc_DATA)
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMDEP_FALSE = @AMDEP_FALSE@
AMDEP_TRUE = @AMDEP_TRUE@
AMTAR = @AMTAR@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CXX = @CXX@
CXXCPP = @CXXCPP@
CXXDEPMODE = @CXXDEPMODE@
CXXFLAGS = @CXXFLAGS@
CYGPATH_W = @CYGPATH_W@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
ECHO = @ECHO@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
EXEEXT = @EXEEXT@
F77 = @F77@
FFLAGS = @FFLAGS@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
LDFLAGS = @LDFLAGS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
OBJEXT = @OBJEXT@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
RANLIB = @RANLIB@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
WX_LIBS = @WX_LIBS@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_CXX = @ac_ct_CXX@
ac_ct_F77 = @ac_ct_F77@
ac_ct_RANLIB = @ac_ct_RANLIB@
ac_ct_STRIP = @ac_ct_STRIP@
am__fastdepCC_FALSE = @am__fastdepCC_FALSE@
am__fastdepCC_TRUE = @am__fastdepCC_TRUE@
am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@
am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
datadir = @datadir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
prefix = @prefix@
program_transform_name = @program_transform_name@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
docdir = $(datadir)/doc/@PACKAGE@
doc_DATA = \
en/AppArmorProfileEditor.htb
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
&& exit 0; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu doc/Makefile'; \
cd $(top_srcdir) && \
$(AUTOMAKE) --gnu doc/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
distclean-libtool:
-rm -f libtool
uninstall-info-am:
install-docDATA: $(doc_DATA)
@$(NORMAL_INSTALL)
test -z "$(docdir)" || $(mkdir_p) "$(DESTDIR)$(docdir)"
@list='$(doc_DATA)'; for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
f=$(am__strip_dir) \
echo " $(docDATA_INSTALL) '$$d$$p' '$(DESTDIR)$(docdir)/$$f'"; \
$(docDATA_INSTALL) "$$d$$p" "$(DESTDIR)$(docdir)/$$f"; \
done
uninstall-docDATA:
@$(NORMAL_UNINSTALL)
@list='$(doc_DATA)'; for p in $$list; do \
f=$(am__strip_dir) \
echo " rm -f '$(DESTDIR)$(docdir)/$$f'"; \
rm -f "$(DESTDIR)$(docdir)/$$f"; \
done
tags: TAGS
TAGS:
ctags: CTAGS
CTAGS:
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \
list='$(DISTFILES)'; for file in $$list; do \
case $$file in \
$(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
$(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \
esac; \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \
if test "$$dir" != "$$file" && test "$$dir" != "."; then \
dir="/$$dir"; \
$(mkdir_p) "$(distdir)$$dir"; \
else \
dir=''; \
fi; \
if test -d $$d/$$file; then \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
fi; \
cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
else \
test -f $(distdir)/$$file \
|| cp -p $$d/$$file $(distdir)/$$file \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
all-am: Makefile $(DATA)
installdirs:
for dir in "$(DESTDIR)$(docdir)"; do \
test -z "$$dir" || $(mkdir_p) "$$dir"; \
done
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-am
install-strip:
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
`test -z '$(STRIP)' || \
echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
distclean: distclean-am
-rm -f Makefile
distclean-am: clean-am distclean-generic distclean-libtool
dvi: dvi-am
dvi-am:
html: html-am
info: info-am
info-am:
install-data-am: install-docDATA
install-exec-am:
install-info: install-info-am
install-man:
installcheck-am:
maintainer-clean: maintainer-clean-am
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
pdf: pdf-am
pdf-am:
ps: ps-am
ps-am:
uninstall-am: uninstall-docDATA uninstall-info-am
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
distclean distclean-generic distclean-libtool distdir dvi \
dvi-am html html-am info info-am install install-am \
install-data install-data-am install-docDATA install-exec \
install-exec-am install-info install-info-am install-man \
install-strip installcheck installcheck-am installdirs \
maintainer-clean maintainer-clean-generic mostlyclean \
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
uninstall uninstall-am uninstall-docDATA uninstall-info-am
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

View File

@@ -1,2 +0,0 @@
KDE_DOCS = profileeditor
KDE_LANG = en

View File

@@ -1,6 +0,0 @@
#!/bin/sh
aclocal
libtoolize --automake --force --copy
automake -a -c
autoconf

View File

@@ -1,44 +0,0 @@
# norootforbuild
Name: apparmor-profile-editor
BuildRequires: wxGTK-devel gcc-c++
Version: 0.9
Release: 1
Vendor: Novell
Copyright: GPL
Summary: AppArmor profile editor
Group: Application/Editors
Packager: mbarringer@suse.de
BuildRoot: %{_tmppath}/%{name}-root
Source: apparmor-profile-editor-0.9.tar.gz
%description
AppArmor profile editor
%prep
%setup -q -n %{name}-%{version}
%build
autoreconf --force --install
export CFLAGS="$RPM_OPT_FLAGS -DSCI_LEXER -DLINK_LEXERS -fPIC -DPIC -DWX_PRECOMP -DNO_GCC_PRAGMA -D__WX"
export CXXFLAGS="$RPM_OPT_FLAGS -DSCI_LEXER -DLINK_LEXERS -fPIC -DPIC -DWX_PRECOMP -DNO_GCC_PRAGMA -D__WX"
%{?suse_update_config:%{suse_update_config -f}}
./configure --prefix=%{_prefix} --disable-debug --enable-debug=no
make
%install
strip $RPM_BUILD_ROOT%{_prefix}/bin/* || :
rm -rf %{buildroot}
%makeinstall
%clean
rm -rf %{buildroot}
%post -p /sbin/ldconfig
%postun -p /sbin/ldconfig
%files
%defattr(-, root, root)
%{_prefix}/bin/profileeditor
%{_prefix}/share/doc/profileeditor/AppArmorProfileEditor.htb
%dir %{_prefix}/share/doc/profileeditor
%doc AUTHORS COPYING ChangeLog NEWS README TODO
%changelog

View File

@@ -1,114 +0,0 @@
/* AppArmor Profile Editor (C) 2006 Novell, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
*/
#include "wx/wxprec.h"
#ifndef WX_PRECOMP
#include "wx/wx.h"
#endif
#include <wx/wfstream.h>
#include "AboutDialog.h"
#include "opensuse_logo.xpm"
IMPLEMENT_DYNAMIC_CLASS(AboutDialog, wxDialog)
BEGIN_EVENT_TABLE(AboutDialog, wxDialog)
END_EVENT_TABLE()
AboutDialog::AboutDialog()
{
}
AboutDialog::AboutDialog(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style)
{
Create(parent, id, caption, pos, size, style);
}
bool AboutDialog::Create(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style)
{
mpLogoBitmap = NULL;
mpVersionStaticText = NULL;
mpCopyrightStaticText = NULL;
mpOkButtonSizer = NULL;
mpOkButton = NULL;
SetExtraStyle(GetExtraStyle() | wxWS_EX_BLOCK_EVENTS);
wxDialog::Create(parent, id, caption, pos, size, style);
CreateControls();
GetSizer()->Fit(this);
GetSizer()->SetSizeHints(this);
Centre();
return true;
}
void AboutDialog::CreateControls()
{
SetBackgroundColour(wxColour(255, 255, 255));
wxBoxSizer* mainSizer = new wxBoxSizer(wxVERTICAL);
SetSizer(mainSizer);
wxBitmap mpLogoBitmapBitmap(opensuse_logo_xpm);
mpLogoBitmap = new wxStaticBitmap(this,
wxID_ANY,
mpLogoBitmapBitmap,
wxDefaultPosition,
wxSize(223, 137),
0);
mainSizer->Add(mpLogoBitmap, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
mpVersionStaticText = new wxStaticText(this,
wxID_ANY,
VERSION_STRING,
wxDefaultPosition,
wxDefaultSize,
0);
mainSizer->Add(mpVersionStaticText, 0, wxALIGN_CENTER_HORIZONTAL|wxALL|wxADJUST_MINSIZE, 5);
mpCopyrightStaticText = new wxStaticText(this,
wxID_ANY,
_("(C) 2006 Novell, Inc\n"),
wxDefaultPosition,
wxDefaultSize,
0);
mainSizer->Add(mpCopyrightStaticText, 0, wxALIGN_CENTER_HORIZONTAL|wxALL|wxADJUST_MINSIZE, 5);
mpLicenseTextCtrl = new wxTextCtrl(this,
wxID_ANY,
_T(""),
wxDefaultPosition,
wxSize(400, -1),
wxTE_MULTILINE|wxTE_READONLY);
mpLicenseTextCtrl->SetValue(GPL_STRING);
mainSizer->Add(mpLicenseTextCtrl, 0, wxGROW|wxALL, 5);
mpOkButtonSizer = new wxStdDialogButtonSizer;
mainSizer->Add(mpOkButtonSizer, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
mpOkButton = new wxButton(this,
wxID_OK,
_("&OK"),
wxDefaultPosition,
wxDefaultSize,
0);
mpOkButtonSizer->AddButton(mpOkButton);
mpOkButtonSizer->Realize();
}

View File

@@ -1,56 +0,0 @@
#ifndef _ABOUTDIALOG_H_
#define _ABOUTDIALOG_H_
#define VERSION_STRING _("AppArmor Profile Editor version 0.9")
#define GPL_STRING _(" \
Portions of this software (C) 1998-2003 by Neil Hodgson <neilh@scintilla.org>\n\n \
This rest of this program is free software; you can redistribute it and/or modify \
it under the terms of the GNU General Public License as published by \
the Free Software Foundation; either version 2 of the License, or \
(at your option) any later version. \
\n\n \
This program is distributed in the hope that it will be useful, \
but WITHOUT ANY WARRANTY; without even the implied warranty of \
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \
GNU General Public License for more details. \
\n\n \
You should have received a copy of the GNU General Public License \
along with this program; if not, write to the Free Software \
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA \
")
/**
* The "About" dialog
*/
class AboutDialog: public wxDialog
{
DECLARE_DYNAMIC_CLASS(AboutDialog)
DECLARE_EVENT_TABLE()
public:
AboutDialog();
AboutDialog(wxWindow* parent,
wxWindowID id = wxID_ANY,
const wxString& caption = _T("About"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX);
bool Create(wxWindow* parent,
wxWindowID id = wxID_ANY,
const wxString& caption = _T("About"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX);
void CreateControls();
private:
wxStaticBitmap* mpLogoBitmap;
wxStaticText* mpVersionStaticText;
wxStaticText* mpCopyrightStaticText;
wxStdDialogButtonSizer* mpOkButtonSizer;
wxTextCtrl* mpLicenseTextCtrl;
wxButton* mpOkButton;
};
#endif
// _ABOUTDIALOG_H_

View File

@@ -1,185 +0,0 @@
/* AppArmor Profile Editor (C) 2006 Novell, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
*/
#include "wx/wxprec.h"
#ifndef WX_PRECOMP
#include "wx/wx.h"
#endif
#include <wx/config.h>
#include "Configuration.h"
// Initialize all of the static variables
wxString Configuration::mProfileDirectory = wxEmptyString;
wxString Configuration::mProfileEditorExecutable = wxEmptyString;
wxString Configuration::mParserCommand = wxEmptyString;
wxString Configuration::mTemplateText = wxEmptyString;
wxColour Configuration::mCommentColour = wxColour(DEFAULT_COMMENT_COLOUR);
wxColour Configuration::mIncludeColour = wxColour(DEFAULT_INCLUDE_COLOUR);
wxColour Configuration::mCapColour = wxColour(DEFAULT_CAP_COLOUR);
wxColour Configuration::mPathColour = wxColour(DEFAULT_PATH_COLOUR);
wxColour Configuration::mPermColour = wxColour(DEFAULT_PERM_COLOUR);
wxFont Configuration::mCapabilityFont(10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_NORMAL, wxFONTWEIGHT_NORMAL);
wxFont Configuration::mCommentFont(10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_ITALIC, wxFONTWEIGHT_NORMAL);
wxFont Configuration::mIncludeFont(10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_NORMAL, wxFONTWEIGHT_NORMAL);
wxFont Configuration::mPathFont(10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_NORMAL, wxFONTWEIGHT_BOLD);
wxFont Configuration::mPermsFont(10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_NORMAL,wxFONTWEIGHT_NORMAL);
int Configuration::mWindowX;
int Configuration::mWindowY;
int Configuration::mWindowHeight;
int Configuration::mWindowWidth;
/**
* Reads in the initial variables
*/
void Configuration::Initialize()
{
// Read in all of the values
mProfileEditorExecutable = wxTheApp->argv[0];
mWindowX = wxConfig::Get()->Read(_("WindowX"), 50);
mWindowY = wxConfig::Get()->Read(_("WindowY"), 50);
mWindowWidth = wxConfig::Get()->Read(_("WindowWidth"), 800);
mWindowHeight = wxConfig::Get()->Read(_("WindowHeight"), 600);
mProfileDirectory = wxConfig::Get()->Read(_("ProfileDirectory"), Configuration::BestGuessProfileDirectory());
mParserCommand = wxConfig::Get()->Read(_("Parser"), BestGuessParserCommand());
mTemplateText = wxConfig::Get()->Read(_("ProfileTemplate"), wxEmptyString);
mCommentColour = _ReadColour(_("CommentColour"), mCommentColour);
mIncludeColour = _ReadColour(_("IncludeColour"), mIncludeColour);
mCapColour = _ReadColour(_("CapabilityColour"), mCapColour);
mPathColour = _ReadColour(_("PathColour"), mPathColour);
mPermColour = _ReadColour(_("PermissionColour"), mPermColour);
_ReadFont(_("CommentFont"), mCommentFont);
_ReadFont(_("IncludeFont"), mIncludeFont);
_ReadFont(_("CapabilityFont"), mCapabilityFont);
_ReadFont(_("PathFont"), mPathFont);
_ReadFont(_("PermsFont"), mPermsFont);
}
/**
* Profiles are most likely stored in either /etc/subdomain.d or
* /etc/apparmor.d. Stat each to see which.
* @param void
* @return profile directory
*/
wxString Configuration::BestGuessProfileDirectory(void)
{
if (wxDirExists(_("/etc/apparmor.d")))
return (_("/etc/apparmor.d"));
else if (wxDirExists(_("/etc/subdomain.d")))
return (_("/etc/subdomain.d"));
else
return (_("/"));
}
/**
* The parser is probably apparmor_parser or
* subdomain_parser. If it's neither, the user
* will need to set it manually, so return /bin/false
* @return the path to the parser
*/
wxString Configuration::BestGuessParserCommand()
{
if (wxFileExists(_("/sbin/apparmor_parser")))
return _("/sbin/apparmor_parser");
else if (wxFileExists(_("/sbin/subdomain_parser")))
return _("/sbin/subdomain_parser");
else
return _("/bin/false");
}
/**
* Writes all of the values to disk
* @return only true for now
*/
bool Configuration::CommitChanges()
{
wxConfig::Get()->Write(_("ProfileDirectory"), mProfileDirectory);
wxConfig::Get()->Write(_("Parser"), mParserCommand);
wxConfig::Get()->Write(_("ProfileTemplate"), mTemplateText);
_WriteColour(_("CommentColour"), mCommentColour);
_WriteColour(_("IncludeColour"), mIncludeColour);
_WriteColour(_("CapabilityColour"), mCapColour);
_WriteColour(_("PathColour"), mPathColour);
_WriteColour(_("PermissionColour"), mPermColour);
wxConfig::Get()->Write(_("CommentFont"), mCommentFont.GetNativeFontInfoDesc());
wxConfig::Get()->Write(_("IncludeFont"), mIncludeFont.GetNativeFontInfoDesc());
wxConfig::Get()->Write(_("CapabilityFont"), mCapabilityFont.GetNativeFontInfoDesc());
wxConfig::Get()->Write(_("PathFont"), mPathFont.GetNativeFontInfoDesc());
wxConfig::Get()->Write(_("PermsFont"), mPermsFont.GetNativeFontInfoDesc());
wxConfig::Get()->Flush();
return true;
}
/**
* Writes the given window settings to the configuration file.
* This is kept separately from CommitChanges() because:
* a) There's no reason to re-write all configuration changes on exit and
* b) There's no reason to update the window position and size on every OnSize() event
*/
void Configuration::WriteWindowSettings(const wxPoint &pos, const wxSize& size)
{
wxConfig::Get()->Write(_("WindowX"), pos.x);
wxConfig::Get()->Write(_("WindowY"), pos.y);
wxConfig::Get()->Write(_("WindowWidth"), size.GetWidth());
wxConfig::Get()->Write(_("WindowHeight"), size.GetHeight());
wxConfig::Get()->Flush();
}
/**
* Reads a colour setting from the config file and translates it into
* a wxColour. If it can't convert the stored value, or the stored value
* does not exist, it will return whatever is passed as defaultColour.
* @param key the configuration key
* @param defaultColour a colour to return
* @return a colour
*/
wxColour Configuration::_ReadColour(const wxString& key, const wxColour& defaultColour)
{
wxColour ret;
wxString tmpStr = wxConfig::Get()->Read(key, wxEmptyString);
if (tmpStr.Length() == 6)
{
ret.Set(wxHexToDec(tmpStr.Mid(0,2)), // Red
wxHexToDec(tmpStr.Mid(2,2)), // Green
wxHexToDec(tmpStr.Mid(4,2)) // Blue
);
}
if (ret.Ok())
return ret;
else
return defaultColour;
}
/**
* Reads a font from the configuration file, and sets it as the 'font'
* @param key configuration key
* @param font the font to set
*/
void Configuration::_ReadFont(const wxString& key, wxFont& font)
{
wxString tmpStr;
if (wxConfig::Get()->Read(key, &tmpStr))
font.SetNativeFontInfo(tmpStr);
}
/**
* Takes a wxColour and converts it to a hex string for writing to disk.
* @param key configuration key
* @param colour the colour to convert
*/
void Configuration::_WriteColour(const wxString& key, const wxColour& colour)
{
wxConfig::Get()->Write(key, wxString::Format(_T("%02x%02x%02x"),
colour.Red(),
colour.Green(),
colour.Blue()));
}

View File

@@ -1,84 +0,0 @@
#ifndef CONFIGURATION_H
#define CONFIGURATION_H
#define DEFAULT_COMMENT_COLOUR 31, 31, 210
#define DEFAULT_INCLUDE_COLOUR 56, 136, 31
#define DEFAULT_CAP_COLOUR 229, 33, 204
#define DEFAULT_PATH_COLOUR 1, 1, 1
#define DEFAULT_PERM_COLOUR 160, 32, 240
class wxConfig;
/**
* The configuration details class
*/
class Configuration
{
public:
static void Initialize();
static wxString BestGuessProfileDirectory();
static wxString BestGuessParserCommand();
static bool CommitChanges();
static wxString GetProfileDirectory() { return mProfileDirectory; }
static wxString GetEditorExecutable() { return mProfileEditorExecutable; }
static wxString GetTemplateText() { return mTemplateText; }
static wxString GetParserCommand() { return mParserCommand; }
static wxColour GetCommentColour() { return mCommentColour; }
static wxColour GetIncludeColour() { return mIncludeColour; }
static wxColour GetCapColour() { return mCapColour; }
static wxColour GetPathColour() { return mPathColour; }
static wxColour GetPermColour() { return mPermColour; }
static wxFont GetCapabilityFont() { return mCapabilityFont; }
static wxFont GetCommentFont() { return mCommentFont; }
static wxFont GetIncludeFont() { return mIncludeFont; }
static wxFont GetPathFont() { return mPathFont; }
static wxFont GetPermFont() { return mPermsFont; }
static wxSize GetWindowSize() { return wxSize(mWindowWidth, mWindowHeight); }
static wxPoint GetWindowPos() { return wxPoint(mWindowX, mWindowY); }
static void WriteWindowSettings(const wxPoint &pos, const wxSize& size);
static void SetProfileDirectory(const wxString& profileDirectory)
{ mProfileDirectory = profileDirectory; }
static void SetEditorExecutable(const wxString& executable) { mProfileEditorExecutable = executable; }
static void SetParserCommand(const wxString& parserCommand) { mParserCommand = parserCommand; }
static void SetTemplateText(const wxString& templateText) { mTemplateText = templateText; }
static void SetCommentColour(const wxColour& commentColour) { mCommentColour = commentColour; }
static void SetIncludeColour(const wxColour& includeColour) { mIncludeColour = includeColour; }
static void SetCapColour(const wxColour& capColour) { mCapColour = capColour; }
static void SetPathColour(const wxColour& pathColour) { mPathColour = pathColour; }
static void SetPermColour(const wxColour& permColour) { mPermColour = permColour; }
static void SetCapabilityFont(const wxFont& capabilityFont) { mCapabilityFont = capabilityFont; }
static void SetCommentFont(const wxFont& commentFont) { mCommentFont = commentFont; }
static void SetIncludeFont(const wxFont& includeFont) { mIncludeFont = includeFont; }
static void SetPathFont(const wxFont& pathFont) { mPathFont = pathFont; }
static void SetPermFont(const wxFont& permsFont) { mPermsFont = permsFont; }
private:
static void _WriteColour(const wxString& key, const wxColour& colour);
static wxColour _ReadColour(const wxString& key, const wxColour& defaultColour);
static void _ReadFont(const wxString& key, wxFont& font);
static wxString mProfileDirectory;
static wxString mProfileEditorExecutable;
static wxString mParserCommand;
static wxString mTemplateText;
static wxColour mCommentColour;
static wxColour mIncludeColour;
static wxColour mCapColour;
static wxColour mPathColour;
static wxColour mPermColour;
static wxFont mCapabilityFont;
static wxFont mCommentFont;
static wxFont mIncludeFont;
static wxFont mPathFont;
static wxFont mPermsFont;
static int mWindowX; // These are just the settings from the
static int mWindowY; // config file, they are *NOT* updated
static int mWindowWidth; // in any size events
static int mWindowHeight;
};
#endif

View File

@@ -1,24 +0,0 @@
# these are the headers for your project
noinst_HEADERS = ProfileDirectoryTraverser.h ProfileTextCtrl.h Preferences.h \
AboutDialog.h opensuse_logo.xpm SearchAllProfiles.h Configuration.h
#########################################################################
# APPLICATION SECTION
#########################################################################
# this is the program that gets installed. it's name is used for all
# of the other Makefile.am variables
bin_PROGRAMS = profileeditor
# the application source, library search path, and link libraries
profileeditor_SOURCES = ProfileTextCtrl.cpp Preferences.cpp AboutDialog.cpp \
SearchAllProfiles.cpp Configuration.cpp profileeditor.cpp
profileeditor_LDFLAGS = $(WX_LIBS)
SUBDIRS = wxStyledTextCtrl
profileeditor_LDADD =\
$(top_builddir)/src/wxStyledTextCtrl/libAppArmorStyledTextCtrl.a
AM_CXXFLAGS = \
-DHELP_FILE_LOCATION=\"$(datadir)/doc/@PACKAGE@/AppArmorProfileEditor.htb\"

View File

@@ -1,322 +0,0 @@
/* AppArmor Profile Editor (C) 2006 Novell, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
*/
#include "wx/wxprec.h"
#ifndef WX_PRECOMP
#include "wx/wx.h"
#endif
#include <wx/propdlg.h>
#include <wx/config.h>
#include <wx/colordlg.h>
#include <wx/fontdlg.h>
#include "Configuration.h"
#include "ProfileTextCtrl.h"
#include "Preferences.h"
IMPLEMENT_DYNAMIC_CLASS(PreferencesDialog, wxDialog)
BEGIN_EVENT_TABLE(PreferencesDialog, wxDialog)
EVT_BUTTON(ID_COMMENT_COLOUR_BUTTON, PreferencesDialog::OnColourButton)
EVT_BUTTON(ID_INCLUDES_COLOUR_BUTTON, PreferencesDialog::OnColourButton)
EVT_BUTTON(ID_PERMS_COLOUR_BUTTON, PreferencesDialog::OnColourButton)
EVT_BUTTON(ID_CAPABILITIES_COLOUR_BUTTON, PreferencesDialog::OnColourButton)
EVT_BUTTON(ID_PATHS_COLOUR_BUTTON, PreferencesDialog::OnColourButton)
EVT_BUTTON(ID_COMMENT_FONT_BUTTON, PreferencesDialog::OnFontButton)
EVT_BUTTON(ID_INCLUDES_FONT_BUTTON, PreferencesDialog::OnFontButton)
EVT_BUTTON(ID_CAPABILITIES_FONT_BUTTON, PreferencesDialog::OnFontButton)
EVT_BUTTON(ID_PATHS_FONT_BUTTON, PreferencesDialog::OnFontButton)
EVT_BUTTON(ID_PERMS_FONT_BUTTON, PreferencesDialog::OnFontButton)
END_EVENT_TABLE()
PreferencesDialog::PreferencesDialog( )
{
}
PreferencesDialog::PreferencesDialog(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style)
{
Create(parent, id, caption, pos, size, style);
}
bool PreferencesDialog::Create(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style)
{
mpPrefsNotebook = NULL;
mpProfileDir = NULL;
mpParserCommand = NULL;
mpTemplateTextCtrl = NULL;
mpCommentsButton = NULL;
mpIncludesButton = NULL;
mpPermsButton = NULL;
mpCapabilitiesButton = NULL;
mpPathsButton = NULL;
mpCommentsFontButton = NULL;
mpIncludesFontButton = NULL;
mpCapabilitiesFontButton = NULL;
mpPathsFontButton = NULL;
SetExtraStyle(GetExtraStyle()|wxWS_EX_BLOCK_EVENTS);
wxDialog::Create( parent, id, caption, pos, size, style );
CreateControls();
GetSizer()->Fit(this);
GetSizer()->SetSizeHints(this);
Centre();
return true;
}
void PreferencesDialog::CreateControls()
{
wxBoxSizer* mainSizer = new wxBoxSizer(wxVERTICAL);
SetSizer(mainSizer);
mpPrefsNotebook = new wxNotebook(this, ID_PREFERENCES_NOTEBOOK, wxDefaultPosition, wxDefaultSize, wxNB_TOP );
// The paths pane
wxPanel* pathsPanel = new wxPanel( mpPrefsNotebook, wxID_ANY, wxDefaultPosition, wxDefaultSize, wxSUNKEN_BORDER|wxTAB_TRAVERSAL );
wxGridSizer* prefsGridSizer = new wxGridSizer(2, 2, 0, 0);
pathsPanel->SetSizer(prefsGridSizer);
wxStaticText* profileDirectoryText = new wxStaticText( pathsPanel, wxID_ANY, _("Profile Directory:"), wxDefaultPosition, wxDefaultSize, 0 );
prefsGridSizer->Add(profileDirectoryText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpProfileDir = new wxTextCtrl( pathsPanel, wxID_ANY, Configuration::GetProfileDirectory(), wxDefaultPosition, wxSize(200, -1), 0 );
prefsGridSizer->Add(mpProfileDir, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* parserCommandText = new wxStaticText( pathsPanel, wxID_ANY, _("Path to apparmor_parser:"), wxDefaultPosition, wxDefaultSize, 0 );
prefsGridSizer->Add(parserCommandText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpParserCommand = new wxTextCtrl( pathsPanel, wxID_ANY, Configuration::GetParserCommand(), wxDefaultPosition, wxSize(200, -1), 0 );
prefsGridSizer->Add(mpParserCommand, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpPrefsNotebook->AddPage(pathsPanel, _("Paths"));
// The colours pane //
wxPanel* coloursPanel = new wxPanel( mpPrefsNotebook, wxID_ANY, wxDefaultPosition, wxDefaultSize, wxSUNKEN_BORDER|wxTAB_TRAVERSAL );
wxBoxSizer* colorFontBoxSizer = new wxBoxSizer(wxHORIZONTAL);
coloursPanel->SetSizer(colorFontBoxSizer);
wxStaticBox* colourBoxSizer = new wxStaticBox(coloursPanel, wxID_ANY, _("Colours"));
wxStaticBoxSizer* colourStaticBoxSizer = new wxStaticBoxSizer(colourBoxSizer, wxVERTICAL);
colorFontBoxSizer->Add(colourStaticBoxSizer, 0, wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxGridSizer* colourSubSizer = new wxGridSizer(4, 2, 0, 0);
colourStaticBoxSizer->Add(colourSubSizer, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
wxStaticText* commentsText = new wxStaticText( coloursPanel, wxID_STATIC, _("Comments"), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(commentsText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpCommentsButton = new wxButton( coloursPanel, ID_COMMENT_COLOUR_BUTTON, _T(""), wxDefaultPosition, wxDefaultSize, 0 );
mpCommentsButton->SetBackgroundColour(Configuration::GetCommentColour());
colourSubSizer->Add(mpCommentsButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* includesText = new wxStaticText( coloursPanel, wxID_STATIC, _("Includes"), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(includesText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpIncludesButton = new wxButton( coloursPanel, ID_INCLUDES_COLOUR_BUTTON, _T(""), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(mpIncludesButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpIncludesButton->SetBackgroundColour(Configuration::GetIncludeColour());
wxStaticText* capabilitiesText = new wxStaticText( coloursPanel, wxID_STATIC, _("Capabilities"), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(capabilitiesText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpCapabilitiesButton = new wxButton( coloursPanel, ID_CAPABILITIES_COLOUR_BUTTON, _T(""), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(mpCapabilitiesButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpCapabilitiesButton->SetBackgroundColour(Configuration::GetCapColour());
wxStaticText* pathsText = new wxStaticText( coloursPanel, wxID_STATIC, _("Paths"), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(pathsText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpPathsButton = new wxButton( coloursPanel, ID_PATHS_COLOUR_BUTTON, _T(""), wxDefaultPosition, wxDefaultSize, 0 );
mpPathsButton->SetBackgroundColour(Configuration::GetPathColour());
colourSubSizer->Add(mpPathsButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* permsText = new wxStaticText( coloursPanel, wxID_STATIC, _("Permissions"), wxDefaultPosition, wxDefaultSize, 0 );
colourSubSizer->Add(permsText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpPermsButton = new wxButton( coloursPanel, ID_PERMS_COLOUR_BUTTON, _T(""), wxDefaultPosition, wxDefaultSize, 0 );
mpPermsButton->SetBackgroundColour(Configuration::GetPermColour());
colourSubSizer->Add(mpPermsButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
// Fonts pane //
wxStaticBox* fontSubSizer = new wxStaticBox(coloursPanel, wxID_ANY, _("Fonts"));
wxStaticBoxSizer* fontBoxSizer = new wxStaticBoxSizer(fontSubSizer, wxVERTICAL);
colorFontBoxSizer->Add(fontBoxSizer, 0, wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxGridSizer* fontsGridSizer = new wxGridSizer(4, 2, 0, 0);
fontBoxSizer->Add(fontsGridSizer, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
wxStaticText* commentFontText = new wxStaticText( coloursPanel, wxID_STATIC, _("Comments"), wxDefaultPosition, wxDefaultSize, 0 );
fontsGridSizer->Add(commentFontText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpCommentsFontButton = new wxButton( coloursPanel, ID_COMMENT_FONT_BUTTON, _("ABCdef"), wxDefaultPosition, wxDefaultSize, 0 );
mpCommentsFontButton->SetFont(Configuration::GetCommentFont());
fontsGridSizer->Add(mpCommentsFontButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* includesFontText = new wxStaticText( coloursPanel, wxID_STATIC, _("Includes"), wxDefaultPosition, wxDefaultSize, 0 );
fontsGridSizer->Add(includesFontText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpIncludesFontButton = new wxButton( coloursPanel, ID_INCLUDES_FONT_BUTTON, _("ABCdef"), wxDefaultPosition, wxDefaultSize, 0 );
mpIncludesFontButton->SetFont(Configuration::GetIncludeFont());
fontsGridSizer->Add(mpIncludesFontButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* capabilitiesFontText = new wxStaticText( coloursPanel, wxID_STATIC, _("Capabilities"), wxDefaultPosition, wxDefaultSize, 0 );
fontsGridSizer->Add(capabilitiesFontText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpCapabilitiesFontButton = new wxButton( coloursPanel, ID_CAPABILITIES_FONT_BUTTON, _("ABCdef"), wxDefaultPosition, wxDefaultSize, 0 );
mpCapabilitiesFontButton->SetFont(Configuration::GetCapabilityFont());
fontsGridSizer->Add(mpCapabilitiesFontButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* pathsFontText = new wxStaticText( coloursPanel, wxID_STATIC, _("Paths"), wxDefaultPosition, wxDefaultSize, 0 );
fontsGridSizer->Add(pathsFontText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpPathsFontButton = new wxButton( coloursPanel, ID_PATHS_FONT_BUTTON, _("ABCdef"), wxDefaultPosition, wxDefaultSize, 0 );
mpPathsFontButton->SetFont(Configuration::GetPathFont());
fontsGridSizer->Add(mpPathsFontButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxStaticText* permsFontText = new wxStaticText( coloursPanel, wxID_STATIC, _("Permissions"), wxDefaultPosition, wxDefaultSize, 0 );
fontsGridSizer->Add(permsFontText, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpPermsFontButton = new wxButton( coloursPanel, ID_PERMS_FONT_BUTTON, _("ABCdef"), wxDefaultPosition, wxDefaultSize, 0 );
mpPermsFontButton->SetFont(Configuration::GetPermFont());
fontsGridSizer->Add(mpPermsFontButton, 0, wxALIGN_CENTER_HORIZONTAL|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpPrefsNotebook->AddPage(coloursPanel, _("Colours & Fonts"));
// Templates pane //
mpTemplateTextCtrl = new ProfileTextCtrl (mpPrefsNotebook, wxID_ANY, wxDefaultPosition, wxDefaultSize);
mpTemplateTextCtrl->SetText(Configuration::GetTemplateText());
mpPrefsNotebook->AddPage(mpTemplateTextCtrl, _("New Profile Template"));
mainSizer->Add(mpPrefsNotebook, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
wxBoxSizer* buttonBoxSizer = new wxBoxSizer(wxHORIZONTAL);
mainSizer->Add(buttonBoxSizer, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
wxStdDialogButtonSizer* buttonSizer = new wxStdDialogButtonSizer;
buttonBoxSizer->Add(buttonSizer, 0, wxALIGN_CENTER_VERTICAL|wxALL, 5);
wxButton* okButton = new wxButton( this, wxID_OK, _("&OK"), wxDefaultPosition, wxDefaultSize, 0 );
buttonSizer->AddButton(okButton);
wxButton* cancelButton = new wxButton( this, wxID_CANCEL, _("&Cancel"), wxDefaultPosition, wxDefaultSize, 0 );
buttonSizer->AddButton(cancelButton);
buttonSizer->Realize();
}
void PreferencesDialog::OnColourButton(wxCommandEvent &event)
{
wxColourData currentData;
switch (event.GetId())
{
case ID_COMMENT_COLOUR_BUTTON:
currentData.SetColour(mpCommentsButton->GetBackgroundColour());
break;
case ID_INCLUDES_COLOUR_BUTTON:
currentData.SetColour(mpIncludesButton->GetBackgroundColour());
break;
case ID_CAPABILITIES_COLOUR_BUTTON:
currentData.SetColour(mpCapabilitiesButton->GetBackgroundColour());
break;
case ID_PATHS_COLOUR_BUTTON:
currentData.SetColour(mpPathsButton->GetBackgroundColour());
break;
case ID_PERMS_COLOUR_BUTTON:
currentData.SetColour(mpPermsButton->GetBackgroundColour());
break;
default:
currentData.SetColour(*wxWHITE);
break;
}
wxColourDialog *colourPicker = new wxColourDialog(this, &currentData);
if (colourPicker->ShowModal() == wxID_OK)
{
currentData = colourPicker->GetColourData();
wxColour currentColour = currentData.GetColour();
switch (event.GetId())
{
case ID_COMMENT_COLOUR_BUTTON:
mpCommentsButton->SetBackgroundColour(currentColour);
break;
case ID_INCLUDES_COLOUR_BUTTON:
mpIncludesButton->SetBackgroundColour(currentColour);
break;
case ID_CAPABILITIES_COLOUR_BUTTON:
mpCapabilitiesButton->SetBackgroundColour(currentColour);
break;
case ID_PATHS_COLOUR_BUTTON:
mpPathsButton->SetBackgroundColour(currentColour);
break;
case ID_PERMS_COLOUR_BUTTON:
mpPermsButton->SetBackgroundColour(currentColour);
break;
default:
break;
}
}
colourPicker->Destroy();
}
void PreferencesDialog::OnFontButton(wxCommandEvent &event)
{
wxFontData fontData;
switch (event.GetId())
{
case ID_COMMENT_FONT_BUTTON:
fontData.SetInitialFont(mpCommentsFontButton->GetFont());
break;
case ID_INCLUDES_FONT_BUTTON:
fontData.SetInitialFont(mpIncludesFontButton->GetFont());
break;
case ID_CAPABILITIES_FONT_BUTTON:
fontData.SetInitialFont(mpCapabilitiesFontButton->GetFont());
break;
case ID_PATHS_FONT_BUTTON:
fontData.SetInitialFont(mpPathsFontButton->GetFont());
break;
case ID_PERMS_FONT_BUTTON:
fontData.SetInitialFont(mpPermsFontButton->GetFont());
break;
default:
break;
}
wxFontDialog *fontDialog = new wxFontDialog(this, fontData);
if (fontDialog->ShowModal() == wxID_OK)
{
fontData = fontDialog->GetFontData();
wxFont newFont = fontData.GetChosenFont();
// Write it back to disk
switch (event.GetId())
{
case ID_COMMENT_FONT_BUTTON:
mpCommentsFontButton->SetFont(newFont);
break;
case ID_INCLUDES_FONT_BUTTON:
mpIncludesFontButton->SetFont(newFont);
break;
case ID_CAPABILITIES_FONT_BUTTON:
mpCapabilitiesFontButton->SetFont(newFont);
break;
case ID_PATHS_FONT_BUTTON:
mpPathsFontButton->SetFont(newFont);
break;
case ID_PERMS_FONT_BUTTON:
mpPermsFontButton->SetFont(newFont);
break;
default:
break;
}
}
fontDialog->Destroy();
}

View File

@@ -1,102 +0,0 @@
#ifndef PREFERENCES_H
#define PREFERENCES_H
#include <wx/notebook.h>
#define CONFIG_NAME "AppArmorProfileEditor"
#define DEFAULT_COMMENT_COLOUR_R 31
#define DEFAULT_COMMENT_COLOUR_G 31
#define DEFAULT_COMMENT_COLOUR_B 210
#define DEFAULT_INCLUDE_COLOUR_R 56
#define DEFAULT_INCLUDE_COLOUR_G 136
#define DEFAULT_INCLUDE_COLOUR_B 31
#define DEFAULT_CAP_COLOUR_R 229
#define DEFAULT_CAP_COLOUR_G 33
#define DEFAULT_CAP_COLOUR_B 204
#define DEFAULT_PATH_COLOUR_R 1
#define DEFAULT_PATH_COLOUR_G 1
#define DEFAULT_PATH_COLOUR_B 1
#define DEFAULT_PERM_COLOUR_R 160
#define DEFAULT_PERM_COLOUR_G 32
#define DEFAULT_PERM_COLOUR_B 240
enum
{
ID_COMMENT_COLOUR_BUTTON,
ID_PERMS_COLOUR_BUTTON,
ID_INCLUDES_COLOUR_BUTTON,
ID_CAPABILITIES_COLOUR_BUTTON,
ID_PATHS_COLOUR_BUTTON,
ID_COMMENT_FONT_BUTTON,
ID_PERMS_FONT_BUTTON,
ID_INCLUDES_FONT_BUTTON,
ID_CAPABILITIES_FONT_BUTTON,
ID_PATHS_FONT_BUTTON,
ID_PREFERENCES_NOTEBOOK,
};
/**
* The preferences dialog
*/
class PreferencesDialog: public wxDialog
{
DECLARE_DYNAMIC_CLASS( PreferencesDialog )
DECLARE_EVENT_TABLE()
public:
PreferencesDialog();
PreferencesDialog(wxWindow* parent,
wxWindowID id,
const wxString& caption = _("Preferences"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX);
bool Create(wxWindow* parent,
wxWindowID,
const wxString& caption = _("Preferences"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX );
void CreateControls();
wxString BestGuessProfileDirectory ();
wxString BestGuessParserCommand ();
// Event handlers
void OnColourButton(wxCommandEvent &event);
void OnFontButton (wxCommandEvent &event);
// Various accessor functions so we can save the data
wxColour GetCommentButtonColour(void) { return mpCommentsButton->GetBackgroundColour(); }
wxColour GetIncludeButtonColour(void) { return mpIncludesButton->GetBackgroundColour(); }
wxColour GetCapabilityButtonColour(void) { return mpCapabilitiesButton->GetBackgroundColour(); }
wxColour GetPathButtonColour(void) { return mpPathsButton->GetBackgroundColour(); }
wxColour GetPermButtonColour(void) { return mpPermsButton->GetBackgroundColour(); }
wxFont GetCommentButtonFont(void) { return mpCommentsFontButton->GetFont(); }
wxFont GetIncludeButtonFont(void) { return mpIncludesFontButton->GetFont(); }
wxFont GetPathButtonFont(void) { return mpPathsFontButton->GetFont(); }
wxFont GetCapabilityButtonFont(void) { return mpCapabilitiesFontButton->GetFont(); }
wxFont GetPermButtonFont(void) { return mpPermsFontButton->GetFont(); }
wxString GetProfileDir(void) { return mpProfileDir->GetValue(); }
wxString GetParser(void) { return mpParserCommand->GetValue(); }
wxString GetTemplateText(void) { return mpTemplateTextCtrl->GetText(); }
private:
wxNotebook* mpPrefsNotebook;
wxTextCtrl* mpProfileDir;
wxTextCtrl* mpParserCommand;
ProfileTextCtrl* mpTemplateTextCtrl;
wxButton* mpCommentsButton;
wxButton* mpIncludesButton;
wxButton* mpPermsButton;
wxButton* mpCapabilitiesButton;
wxButton* mpPathsButton;
wxButton* mpCommentsFontButton;
wxButton* mpIncludesFontButton;
wxButton* mpCapabilitiesFontButton;
wxButton* mpPathsFontButton;
wxButton* mpPermsFontButton;
};
#endif

View File

@@ -1,43 +0,0 @@
#ifndef PROFILE_DIRECTORY_TRAVERSER
#define PROFILE_DIRECTORY_TRAVERSER
/**
* The wxDirTraverser that searches through the profile directory
*/
class ProfileDirectoryTraverser : public wxDirTraverser
{
public:
ProfileDirectoryTraverser(wxTreeCtrl* profileTree,
const wxTreeItemId& startNode,
const wxString& profileDirectory)
: mpProfileTree(profileTree),
mCurNode(startNode),
mOriginalNode(startNode),
mProfileDirectory(profileDirectory) {}
virtual wxDirTraverseResult OnFile(const wxString& filename)
{
ProfileTreeData* data = new ProfileTreeData(filename);
// OnDir isn't called when the traverser starts
// going through the files in the top level directory,
// so we do this to keep the profiles in the right place
if (wxFileName(filename).GetPath() == mProfileDirectory)
mCurNode = mOriginalNode;
mpProfileTree->AppendItem(mCurNode, wxFileName(filename).GetFullName(), -1, -1, data);
return wxDIR_CONTINUE;
}
virtual wxDirTraverseResult OnDir(const wxString& dirname)
{
mCurNode = mpProfileTree->AppendItem(mOriginalNode, wxFileName(dirname).GetName());
return wxDIR_CONTINUE;
}
private:
wxTreeCtrl* mpProfileTree;
wxTreeItemId mCurNode, mOriginalNode;
wxString mProfileDirectory;
};
#endif

View File

@@ -1,115 +0,0 @@
/* AppArmor Profile Editor (C) 2006 Novell, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
*/
#include "wx/wxprec.h"
#ifndef WX_PRECOMP
#include "wx/wx.h"
#endif
#include <wx/textctrl.h>
#include <wx/textfile.h>
#include <wx/config.h>
#include "ProfileTextCtrl.h"
#include "Preferences.h"
#include "Configuration.h"
BEGIN_EVENT_TABLE(ProfileTextCtrl, wxStyledTextCtrl)
EVT_STC_CHANGE(ID_STYLED_PROFILE_WINDOW, ProfileTextCtrl::OnModified)
END_EVENT_TABLE()
ProfileTextCtrl::ProfileTextCtrl(wxWindow *parent, wxWindowID id,
const wxPoint &pos,
const wxSize &size,
long style)
: wxStyledTextCtrl (parent, id, pos, size, style|wxTE_WORDWRAP|wxTE_MULTILINE|wxTE_PROCESS_ENTER)
{
mpParentWindow = parent;
SetLexer(wxSTC_LEX_APPARMOR);
StyleClearAll();
RefreshColoursAndFonts();
mNeedSaving = false;
mIsNew = false;
}
/**
* Loads a file from disk
* @param filename The file to load
* @return true on success, false on failure
*/
bool ProfileTextCtrl::LoadFile(const wxString& filename)
{
wxTextFile file;
wxString currentLine;
if (!file.Open(filename))
return false;
mIgnoreChanges = true; // Have OnModified ignore the events from loading the file
Clear();
mFilename = filename;
wxStyledTextCtrl::LoadFile(filename);
mIgnoreChanges = false;
mNeedSaving = false;
mIsNew = false;
return true;
}
/**
* Event handler triggered by any change in the window
* @param event
*/
void ProfileTextCtrl::OnModified(wxStyledTextEvent &event)
{
if (!mIgnoreChanges)
{
mNeedSaving = true;
wxPostEvent(mpParentWindow, event);
}
}
/**
* Reloads the syntax colouring and fonts
* @param
*/
void ProfileTextCtrl::RefreshColoursAndFonts(void)
{
wxColour yellowColour(252,253,127);
wxFont defaultFont (10, wxFONTFAMILY_DEFAULT, wxFONTSTYLE_NORMAL, wxFONTWEIGHT_NORMAL);
wxFont commentFont = Configuration::GetCommentFont();
wxFont includeFont = Configuration::GetIncludeFont();
wxFont capabilityFont = Configuration::GetCapabilityFont();
wxFont permFont = Configuration::GetPermFont();
wxFont pathFont = Configuration::GetPathFont();
StyleSetFont (wxSTC_STYLE_DEFAULT, defaultFont);
StyleSetForeground (wxSTC_STYLE_DEFAULT, *wxBLACK);
StyleSetBackground (wxSTC_STYLE_DEFAULT, *wxWHITE);
StyleSetFont (wxSTC_APPARMOR_COMMENT, commentFont);
StyleSetForeground (wxSTC_APPARMOR_COMMENT, Configuration::GetCommentColour());
StyleSetBackground (wxSTC_APPARMOR_COMMENT, *wxWHITE);
StyleSetFont (wxSTC_APPARMOR_INCLUDE, includeFont);
StyleSetForeground (wxSTC_APPARMOR_INCLUDE, Configuration::GetIncludeColour());
StyleSetBackground (wxSTC_APPARMOR_INCLUDE, *wxWHITE);
StyleSetFont (wxSTC_APPARMOR_CAPABILITY, capabilityFont);
StyleSetForeground (wxSTC_APPARMOR_CAPABILITY, Configuration::GetCapColour());
StyleSetBackground (wxSTC_APPARMOR_CAPABILITY, *wxWHITE);
StyleSetFont (wxSTC_APPARMOR_PATH, pathFont);
StyleSetForeground (wxSTC_APPARMOR_PATH, Configuration::GetPathColour());
StyleSetBackground (wxSTC_APPARMOR_PATH, *wxWHITE);
StyleSetFont (wxSTC_APPARMOR_PERMS, permFont);
StyleSetForeground (wxSTC_APPARMOR_PERMS, Configuration::GetPermColour());
StyleSetBackground (wxSTC_APPARMOR_PERMS, *wxWHITE);
StyleSetForeground (wxSTC_STYLE_BRACELIGHT, *wxBLACK);
StyleSetBackground (wxSTC_STYLE_BRACELIGHT, yellowColour);
StyleSetForeground (wxSTC_STYLE_BRACEBAD, *wxBLACK);
StyleSetBackground (wxSTC_STYLE_BRACEBAD, *wxRED);
SetCaretWidth(2);
}

View File

@@ -1,44 +0,0 @@
#ifndef PROFILE_TEXT_CTRL_H
#define PROFILE_TEXT_CTRL_H
#include "wxStyledTextCtrl/stc.h"
#define ID_STYLED_PROFILE_WINDOW 13082
/**
* The syntax highlighting text control
*/
class ProfileTextCtrl : public wxStyledTextCtrl
{
public:
ProfileTextCtrl (wxWindow *parent,
wxWindowID id = wxID_ANY,
const wxPoint &pos = wxDefaultPosition,
const wxSize &size = wxDefaultSize,
long style = wxSUNKEN_BORDER | wxVSCROLL);
bool LoadFile(const wxString &filename);
void ProcessLine(const wxString &currentLine);
void RefreshColoursAndFonts();
void OnModified(wxStyledTextEvent &event);
void OnReturnKey(wxCommandEvent& event);
bool GetNeedSaving() { return mNeedSaving; }
void SetNeedSaving(bool status) { mNeedSaving = status; }
wxString GetFileName() { return mFilename; }
void SetFileName(wxString fileName) { mFilename = fileName; }
void SetIsNew(bool status) { mIsNew = status; }
bool GetIsNew() { return mIsNew; }
void SetIgnoreChanges(bool value) { mIgnoreChanges = value; }
private:
wxWindow *mpParentWindow;
wxString mFilename;
bool mNeedSaving;
bool mIsNew;
bool mIgnoreChanges;
DECLARE_EVENT_TABLE()
};
#endif

View File

@@ -1,179 +0,0 @@
/* AppArmor Profile Editor (C) 2006 Novell, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
*/
#include "wx/wxprec.h"
#ifndef WX_PRECOMP
#include "wx/wx.h"
#endif
#include <wx/dir.h>
#include <wx/ffile.h>
#include <wx/busyinfo.h>
#include <wx/process.h>
#include "SearchAllProfiles.h"
IMPLEMENT_DYNAMIC_CLASS(SearchAllProfilesDialog, wxDialog)
BEGIN_EVENT_TABLE(SearchAllProfilesDialog, wxDialog)
EVT_BUTTON(ID_SEARCH_ALL_PROFILES_BUTTON, SearchAllProfilesDialog::OnSearch)
EVT_LISTBOX_DCLICK(ID_SEARCH_ALL_PROFILES_LIST_BOX, SearchAllProfilesDialog::OnListBoxDClick)
END_EVENT_TABLE()
SearchAllProfilesDialog::SearchAllProfilesDialog( )
{
}
SearchAllProfilesDialog::SearchAllProfilesDialog(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style)
{
Create(parent, id, caption, pos, size, style);
}
bool SearchAllProfilesDialog::Create(wxWindow* parent,
wxWindowID id,
const wxString& caption,
const wxPoint& pos,
const wxSize& size,
long style )
{
mpSearchPhraseSizer = NULL;
mpSearchStaticText = NULL;
mpSearchPhraseTextCtrl = NULL;
mpSearchButton = NULL;
mpSearchResultsListBox = NULL;
mpOKButtonSizer = NULL;
mProfileDirectory = wxEmptyString;
mEditorExecutable = wxEmptyString;
mSearchedPhrase = wxEmptyString;
SetExtraStyle(GetExtraStyle() | wxWS_EX_BLOCK_EVENTS);
wxDialog::Create(parent, id, caption, pos, size, style);
CreateControls();
GetSizer()->Fit(this);
GetSizer()->SetSizeHints(this);
Centre();
return true;
}
void SearchAllProfilesDialog::CreateControls()
{
wxBoxSizer* mainSizer = new wxBoxSizer(wxVERTICAL);
SetSizer(mainSizer);
mpSearchPhraseSizer = new wxFlexGridSizer(1, 3, 0, 0);
mainSizer->Add(mpSearchPhraseSizer, 0, wxGROW|wxALL, 5);
mpSearchStaticText = new wxStaticText(this,
wxID_ANY,
_T("Search phrase:"),
wxDefaultPosition,
wxDefaultSize,
0);
mpSearchPhraseSizer->Add(mpSearchStaticText, 0, wxALIGN_LEFT|wxALIGN_CENTER_VERTICAL|wxALL|wxADJUST_MINSIZE, 5);
mpSearchPhraseTextCtrl = new wxTextCtrl(this,
wxID_ANY,
_T(""),
wxDefaultPosition,
wxSize(300, -1),
0);
mpSearchPhraseSizer->Add(mpSearchPhraseTextCtrl, 0, wxGROW|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpSearchButton = new wxButton(this,
ID_SEARCH_ALL_PROFILES_BUTTON,
_("Search"),
wxDefaultPosition,
wxDefaultSize,
0);
mpSearchPhraseSizer->Add(mpSearchButton, 0, wxALIGN_RIGHT|wxALIGN_CENTER_VERTICAL|wxALL, 5);
mpSearchResultsListBox = new wxListBox(this,
ID_SEARCH_ALL_PROFILES_LIST_BOX,
wxDefaultPosition,
wxSize(-1, 200),
0,
NULL,
wxLB_SINGLE);
mainSizer->Add(mpSearchResultsListBox, 0, wxGROW|wxALL, 5);
mpOKButtonSizer = new wxStdDialogButtonSizer;
mainSizer->Add(mpOKButtonSizer, 0, wxALIGN_CENTER_HORIZONTAL|wxALL, 5);
wxButton* okButton = new wxButton(this,
wxID_CANCEL,
_("&Cancel"),
wxDefaultPosition,
wxDefaultSize, 0);
mpOKButtonSizer->AddButton(okButton);
mpOKButtonSizer->Realize();
}
/**
* Event handler triggered by the Search button
* @param WXUNUSED( event )
*/
void SearchAllProfilesDialog::OnSearch(wxCommandEvent& WXUNUSED(event))
{
mpSearchButton->Disable();
mpSearchResultsListBox->Clear();
mSearchedPhrase = mpSearchPhraseTextCtrl->GetValue();
DoSearch(mSearchedPhrase);
mpSearchButton->Enable();
}
/**
* Calls the directory traverser
* @param searchString
*/
void SearchAllProfilesDialog::DoSearch(const wxString& searchString)
{
if (mProfileDirectory != wxEmptyString)
{
wxBusyInfo wait(_("Searching..."));
wxTheApp->Yield(); // Needed to repaint the busy window
SearchAllProfilesTraverser traverser(searchString, mpSearchResultsListBox);
wxDir dir (mProfileDirectory);
dir.Traverse(traverser,wxEmptyString);
}
}
/**
* A user has double clicked on a search result
* @param event
*/
void SearchAllProfilesDialog::OnListBoxDClick (wxCommandEvent& event)
{
wxString execString = mEditorExecutable;
execString.Append(_T(" "));
execString.Append(event.GetString());
execString.Append(_T(" \""));
execString.Append(mSearchedPhrase);
execString.Append(_T("\""));
wxProcess *proc = wxProcess::Open(execString);
if (proc == NULL)
{
wxMessageDialog *dlg = new wxMessageDialog(this, _("Could not exec!"), _("Error"),
wxOK|wxICON_ERROR);
dlg->ShowModal();
dlg->Destroy();
}
else
{
proc->Detach();
}
}

View File

@@ -1,95 +0,0 @@
#ifndef _SEARCHALLPROFILESDIALOG_H_
#define _SEARCHALLPROFILESDIALOG_H_
class wxFlexGridSizer;
class wxStdDialogButtonSizer;
/**
* A "Search All Profiles" dialog
*/
class SearchAllProfilesDialog: public wxDialog
{
DECLARE_DYNAMIC_CLASS(SearchAllProfilesDialog)
DECLARE_EVENT_TABLE()
public:
SearchAllProfilesDialog();
SearchAllProfilesDialog(wxWindow* parent,
wxWindowID id = wxID_ANY,
const wxString& caption = _("Search All Profiles"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX);
/// Creation
bool Create(wxWindow* parent,
wxWindowID id = wxID_ANY,
const wxString& caption = _("Search All Profiles"),
const wxPoint& pos = wxDefaultPosition,
const wxSize& size = wxSize(400, 300),
long style = wxCAPTION|wxRESIZE_BORDER|wxSYSTEM_MENU|wxCLOSE_BOX );
void CreateControls();
void OnSearch(wxCommandEvent& event);
void OnListBoxDClick (wxCommandEvent& event);
void DoSearch(const wxString& searchString);
void SetProfileDirectory (const wxString& dir) { mProfileDirectory = dir; }
void SetEditorExecutable (const wxString& exec) { mEditorExecutable = exec; }
void SetSearchText (const wxString& searchString) { mpSearchPhraseTextCtrl->SetValue(searchString); }
private:
wxFlexGridSizer* mpSearchPhraseSizer;
wxStaticText* mpSearchStaticText;
wxTextCtrl* mpSearchPhraseTextCtrl;
wxButton* mpSearchButton;
wxListBox* mpSearchResultsListBox;
wxStdDialogButtonSizer* mpOKButtonSizer;
wxString mProfileDirectory;
wxString mEditorExecutable;
wxString mSearchedPhrase;
};
/**
* The "Search All" traverser
*/
class SearchAllProfilesTraverser : public wxDirTraverser
{
public:
SearchAllProfilesTraverser (const wxString& search, wxListBox *rBox)
: searchString(search),
resultsBox(rBox) {}
virtual wxDirTraverseResult OnFile(const wxString& filename)
{
if (!tmpFile.Open(filename))
return wxDIR_CONTINUE;
if (!tmpFile.ReadAll(&tmpString))
return wxDIR_CONTINUE;
if (tmpString.Find(searchString) != -1)
resultsBox->Append(filename);
tmpFile.Close();
return wxDIR_CONTINUE;
}
virtual wxDirTraverseResult OnDir(const wxString& dirname)
{
return wxDIR_CONTINUE;
}
private:
wxString searchString;
wxListBox *resultsBox;
wxString tmpString;
wxFFile tmpFile;
};
enum
{
ID_SEARCH_ALL_PROFILES_BUTTON = 15599,
ID_SEARCH_ALL_PROFILES_LIST_BOX
};
#endif

View File

@@ -1,173 +0,0 @@
/* XPM */
static char * opensuse_logo_xpm[] = {
"223 137 33 1",
" c #FFFFFF",
". c #EBF4E6",
"+ c #E4F0DD",
"@ c #CDE5C1",
"# c #C5E1B7",
"$ c #B5D9A1",
"% c #A3D088",
"& c #7ABF48",
"* c #8FC86C",
"= c #F8FBF7",
"- c #BDDDAC",
"; c #85C35B",
"> c #F2F8EF",
", c #D5E9CB",
"' c #99CC7B",
") c #ACD495",
"! c #DCECD4",
"~ c #EDF1F0",
"{ c #D9E2E1",
"] c #E3EAE9",
"^ c #F6F8F8",
"/ c #A1BAB6",
"( c #357D74",
"_ c #007167",
": c #4F8881",
"< c #759E98",
"[ c #C4D3D1",
"} c #85A7A3",
"| c #93B1AD",
"1 c #64938D",
"2 c #B9CBC8",
"3 c #ADC2BF",
"4 c #CFDBD9",
" ",
" ",
" ",
" ",
" ",
" ",
" .+@#$%%%&&&&&&&&&&&&&&&&&&*%%%%%$##@++= ",
" +@-%;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*%-#+. >+= ",
" .,$'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&')#+= #&&;%$#+> ",
" >,$;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*)#+= #&&&&&&&&;%-,+ ",
" .-'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&'$,> #&&&&&&&&&&&&&&'$@. ",
" .-*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*$,> #&&&&&&&&&&&&&&&&&&&%#!= ",
" >-*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*$!= #&&&&&&&&&&&&&&&&&&&&&&&'-!= ",
" =,'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&%@$&&&&&&&&&&&&&&&&&&&&&&&&&&&'#. ",
" >$;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*$! ",
" +%&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;-. ",
" ,'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&', ",
" ,*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;#= ",
" ,*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*%&&&&&&&&&;! ",
" ,*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*@. =!$&&&&&&&, ",
" +%&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*! =$&&&&&&, ",
" >)&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$= .+= +;&&&&&! ",
" =#&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$ ,%&&&&;$> .;&&&&;= ",
" !*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&% >'&&&&&&&&&# +&&&&&# ",
" =)&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&> .;&&&&&&&&&&&$ -&&&&&> ",
" @;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$ '&&&&&&&&&&&&&@ =&&&&&- ",
" =)&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&. ,&&&&&&$> .)&&;= $&&&&;= ",
" +;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&* %&&&&&$ %&&, ,&&&&&@ ",
" -&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&% &&&&&&- %&&# +&&&&&* ",
" ='&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&% &&&&&&&@ =#&&&) &&&&&&+ ",
" .;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&% &&&&&&&&&%'&&&&&# >&&&&&&$ ",
" ,;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&' '&&&&&&&&&&&&&&&@ +&&&&&&&= ",
" @&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&= @&&&&&&&&&&&&&&&> #&&&&&&&, ",
" $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, =;&&&&&&&&&&&&&- *&&&&&&&) ",
" $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$&&&&&&&&&&&&&* +&&&&&&&&&&&&'= ,&&&&&&&&&= ",
" $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&#.%&&&&&&&&&&&&# !;&&&&&&&&&'= =*&&&&&&&&&, ",
" $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;= ,*&&&&&&&&&&&+ =$;&&&&&*, )&&&&&&&&&&) ",
" $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, #;&&&&&&&&&;! +@#!. $&&&&&&&&&&&; ",
" #&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&* =#;&&&&&&&&&# .'&&&&&&&&&&&&&+ ",
" ,&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, =$;&&&&&&&&*,= .$&&&&&&&&&&&&&&;. ",
" .&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&% =#;&&&&&&&&&%####$*&&&&&&&&&&&&&&&)= ",
" =;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$+ =@*&&&&&&&&&&&&&&&&&&&&&&&&&&&*+ ",
" '&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&%! !)&&&&&&&&&&&&&&&&&&&&&&&*, ",
" #&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*@= =,)&&&&&&&&&&&&&&&&&&', ",
" +&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;$. =!$'&&&&&&&&&&&'-. .> ",
" =*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&',= +,#####@+= +%&# ",
" #&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$! =,'&&&, ",
" >&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;$!= !$;&&&&&= ",
" %&&&&&&&&&&&&&&&&&&&&&&&&;%##!++++##$%;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&%#+ +@)&&&&&&&&) ",
" +&&&&&&&&&&&&&&&&&&&&&&),> >,)&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*%%-%%*&&&&&&&&&&&&+ ",
" %&&&&&&&&&&&&&&&&&&&;#> =,'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$ ",
" !&&&&&&&&&&&&&&&&&&&#= +%&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&- ",
" %&&&&&&&&&&&&&&&&&'. +%&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&%. ",
" +&&&&&&&&&&&&&&&&&$ !*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&$. ",
" $&&&&&&&&&&&&&&&&# =-&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*#= ",
" =&&&&&&&&&&&&&&&&- >,-%%&&;%%-,> !;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;$! ",
" ,&&&&&&&&&&&&&&&$ =@'&&&&&&&&&&&&&'@> >'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&'-! ",
" $&&&&&&&&&&&&&&'= #;&&&&&&&&&&&&&&&&&&$> =$&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*%%&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*%#!= ",
" *&&&&&&&&&&&&&&. >'&&&&&&&&&&&&&&&&&&&&&&#= $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&%,> .+!##%%'&&&&&&&&&&&'%%##!+ ",
" >&&&&&&&&&&&&&&# .;&&&&&&&&&&&&&&&&&&&&&&&&*. $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;! ",
" !&&&&&&&&&&&&&;= .;&&&&&&&&&&&&&&&&&&&&&&&&&&&, $&&&&&&&&&&&&&&&&&&&&&&&&&&&&&'$@+. ++#);&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&+ ",
" #&&&&&&&&&&&&&# =;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, $&&&&&&&&&&&&&&&&&&&&&&&&&&$> !$&&&&&&&&&&&&&&&&&&&&&&&&&&&&$ ",
" )&&&&&&&&&&&&&> )&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, '&&&&&&&&&&&&&&&&&&&&&&&%> =#;&&&&&&&&&&&&&&&&&&&&&&&&&. ",
" %&&&&&&&&&&&&' +&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&! =;&&&&&&&&&&&&&&&&&&&&&@ =-&&&&&&&&&&&&&&&&&&&&&&&; ",
" '&&&&&&&&&&&&- )&&&&&&&&&&&*$@++@-'&&&&&&&&&&&&&&;= +&&&&&&&&&&&&&&&&&&&&, +*&&&&&&&&&&&&&&&&&&&&&% ",
" &&&&&&&&&&&&&@ =&&&&&&&&&&;, >#;&&&&&&&&&&&&) -&&&&&&&&&&&&&&&&&&- =$&&&&&&&&&&&&&&&&&&&&- ",
" &&&&&&&&&&&&&+ !&&&&&&&&&;. >'&&&&&&&&&&&&+ =*&&&&&&&&&&&&&&&&;= @&&&&&&&&&&&&&&&&&&&# ",
" &&&&&&&&&&&&&+ #&&&&&&&&&# $&&&&&&&&&&&% ,&&&&&&&&&&&&&&&&- ,&&&&&&&&&&&&&&&&&&$ ",
" &&&&&&&&&&&&&+ #&&&&&&&&&> )&&&&&&&&&&&+ %&&&&&&&&&&&&&&&. ,&&&&&&&&&&&&&&&&&% ",
" ;&&&&&&&&&&&&+ #&&&&&&&&& =*&&&&&&&&&&$ !&&&&&&&&&&&&&&* ,&&&&&&&&&&&&&&&&; ",
" %&&&&&&&&&&&&@ #&&&&&&&&&! !&&&&&&&&&&; *&&&&&&&&&&&&&) ,&&&&&&&&&&&&&&&&> ",
" %&&&&&&&&&&&&- ,&&&&&&&&&'= %&&&&&&&&&&. #&&&&&&&&&&&&&# ,&&&&&&&&&&&&&&&, ",
" #&&&&&&&&&&&&' .&&&&&&&&&&'+ =,##@> ,&&&&&&&&&&@ >&&&&&&&&&&&&&@ @&&&&&&&&&&&&&&) ",
" ,&&&&&&&&&&&&&> *&&&&&&&&&&&&&&&&&&;, =&&&&&&&&&&$ *&&&&&&&&&&&&+ $&&&&&&&&&&&&&&= ",
" >&&&&&&&&&&&&&@ ,&&&&&&&&&&&&&&&&&&&&> '&&&&&&&&&% -&&&&&&&&&&&&+ $&&&&&&&&&&&&&# ",
" *&&&&&&&&&&&&* *&&&&&&&&&&&&&&&&&&&# %&&&&&&&&&% !&&&&&&&&&&&&+ $&&&&&&&&&&&&* ",
" -&&&&&&&&&&&&&, .&&&&&&&&&&&&&&&&&&&% %&&&&&&&&&% =;&&&&&&&&&&&+ $&&&&&&&&&&&&, ",
" >&&&&&&&&&&&&&* ,&&&&&&&&&&&&&&&&&&$ %&&&&&&&&&% =@*&&&&&&&&&, $&&&&&&&&&&&* ",
" %&&&&&&&&&&&&&# ,&&&&&&&&&&&&&&&&&+ &&&&&&&&&&% ,*&&&&&&&# @;&&&&&&&&&&@ ",
" ,&&&&&&&&&&&&&&. .'&&&&&&&&&&&&&&$ !&&&&&&&&&&) +%&&&&&# ,'&&&&&&&&;= ",
" *&&&&&&&&&&&&&;= ,*&&&&&&&&&&%+ $&&&&&&&&&&# .$&&&% +$&&&&&&&) ",
" +&&&&&&&&&&&&&&'= .#%*&;%$@> >&&&&&&&&&&&+ >-;* >-;&&&&&+ ",
" %&&&&&&&&&&&&&&'. %&&&&&&&&&&; =@ =,*&&&;= ",
" >;&&&&&&&&&&&&&&;! $&&&&&&&&&&&$ +)&&) ",
" @&&&&&&&&&&&&&&&&$= $&&&&&&&&&&&&. >-;, ",
" )&&&&&&&&&&&&&&&&;#= >%&&&&&&&&&&&&% => ",
" ='&&&&&&&&&&&&&&&&&&$!= !$&&&&&&&&&&&&&&+ ",
" >;&&&&&&&&&&&&&&&&&&&&'$#!++++,#%;&&&&&&&&&&&&&&&- ",
" .;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&*= ",
" .'&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;. ",
" ='&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, ",
" -&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&, ",
" +*&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;! ~{{{{{{{{{{{{{{{{ ]{{^ ~{{^ {{{{{{{{{{{{{{{{~ {{{{{{{{{{{{{{{{{{{{{] ",
" =#;&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&'> ~/(_________________:] <___(] /___([ {}__________________| ](______________________1^ 2333{^[ ",
" >$&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&;# [(____________________} 2_____: 4_____(^ ^|_____________________[ :________________________3 3:|<(1< ",
" >#*&&&&&&&&&&&&&&&&&&&&&&&&&;#= [______________________< 3______ 3______{ <______________________3 _________________________< <{31<< ",
" !$;&&&&&&&&&&&&&&&&&&&&',= ~(______________________< 3______ 3______{ 3_______________________2 _________________________| <{33{< ",
" .@)'&&&&&&&&&&&&'$,> |_______________________[ 3______ 3______{ ^(______________________(~ _________________________] ~ ^^ ~ ",
" >++++++++> (______(|33333333333333{ 3______ 3______{ [_______1/33333333333333~ ______:33333333333333333~ ",
" ______:^ 3______ 3______{ 3______/ ______< ",
" ______3 3______ 3______{ 3______{ ______< ",
" ______3 3______ 3______{ 3______{ ______< ",
" ______3 3______ 3______{ 3______{ ______< ",
" ______< 3______ 3______{ 3______2 ______< ",
" >#########,= =#, =,$%%%#> ,#########+ .#+ >@)%%)@= _______}4{{{{{{{{{{{{{^ 3______ 3______{ 2_______3{{{{{{{{{{{{{] ______1{{{{{{{{{{{{{^ ",
" -&&&&&&&&&&&;. )&&-!$;&&&&&&&- .'&&&&&&&&&&&)= >;&&+,%&&&&&&&;! 1______________________<{ 3______ 3______{ ]______________________(|^ ____________________(] ",
" @&&&&&&&&&&&&&;> %&&&&&&&&&&&&&&, =*&&&&&&&&&&&&&) +&&&&&&&&&&&&&&;> [________________________[ 3______ 3______{ <_______________________(] _____________________: ",
" ;&&&%#####-;&&&# %&&&;-#####*&&&' ,&&&;-#####$&&&&> +&&&&%#####-;&&&# 1________________________{ 3______ 3______{ ](_______________________:^ ______________________ ",
" &&&% .&&&% %&&;= =*&&& #&&&+ #&&&+ +&&&% .&&&% ^<_______________________1 3______ 3______{ ](_______________________[ _____________________( ",
" &&&# &&&% %&&% -&&& #&&& +&&&+ +&&&# &&&% [:______________________ 3______ 3______{ ^|(_____________________} _____________________3 ",
" &&&# &&&% %&&% #&&& #&&& +&&&+ +&&&# &&&% ~{{{{{{{{{{{{{[(______{ 3______ 3______{ {{{{{{{{{{{{{{}______< ______:3333333333333{ ",
" &&&# &&&% %&&% #&&& #&&&++++++++@&&&+ +&&&# &&&% /______{ 3______ 3______{ (_____< ______< ",
" &&&# &&&% %&&% #&&& #&&&&&&&&&&&&&&&+ +&&&# &&&% 3______{ 3______ 3______{ <_____< ______< ",
" &&&# &&&% %&&% #&&& #&&&&&&&&&&&&&&&> +&&&# &&&% 3______{ 3______ 3______{ <_____< ______< ",
" &&&# &&&% %&&% #&&& #&&&%%%%%%%%%%%! +&&&# &&&% 3______{ 3______~ /______{ :_____< ______< ",
" &&&# &&&% %&&% #&&& #&&& +&&&# &&&% 1______{ 3______} ](______] ~______< ______< ",
" &&&# &&&% %&&% #&&& #&&& +&&&# &&&% {33333333333333333}_______ [_______:3333333333/(_______ ^[33333333333333333:______} ______:33333333333333333[^ ",
" &&&# &&&% %&&% $&&& #&&& +&&&# &&&% |_________________________1 ~__________________________} ~(_________________________2 _________________________:^ ",
" &&&*= ,&&&) %&&&+ .;&&& #&&&@ +&&&# &&&% ~__________________________2 |_________________________{ 3__________________________~ __________________________2 ",
" '&&&;%%%%%%&&&&@ %&&&&'%%%%%&&&&) +&&&&*%%%%%%. +&&&# &&&% {_________________________1^ ^1_______________________3 3_________________________3 __________________________3 ",
" +&&&&&&&&&&&&&'= %&&&&&&&&&&&&&&+ %&&&&&&&&&&;> +&&&# &&&% ~________________________:] ^1_____________________3 2________________________| :_________________________2 ",
" !;&&&&&&&&&&%= %&&'>,'&&&&&&;! =$&&&&&&&&&)= $&'. ,&;+ 3_____________________(/^ [:_________________}] ^1_____________________:[ [________________________1^ ",
" +@######,. %&&% >,###+ >!######@ @= !. ]{{{{{{{{{{{{{{{{{{{{ ][33333333333334^ {{{{{{{{{{{{{{{{{{{{~ ~{{{{{{{{{{{{{{{{{{{{{{{ ",
" %&&% ",
" %&&% ",
" %&&% ",
" %&&% ",
" %&&% ",
" %&&% ",
" ,&&, ",
" !! ",
" ",
" ",
" ",
" ",
" ",
" "};

File diff suppressed because it is too large Load Diff

View File

@@ -1,136 +0,0 @@
#ifndef _PROFILETOOL_H_
#define _PROFILETOOL_H_
#ifndef HELP_FILE_LOCATION
#define HELP_FILE_LOCATION ""
#endif
/**
* @short AppArmor Profile Tool
* @author Matt Barringer <mbarringer@suse.de>
* @version 1.0
*/
class ProfileToolFrame;
class ProfileTreeData;
/**
* The wxApp class
**/
class AppArmorProfileTool : public wxApp
{
public:
virtual bool OnInit();
virtual int OnExit();
private:
ProfileToolFrame *frame;
};
/**
* The main frame
**/
class ProfileToolFrame : public wxFrame
{
public:
ProfileToolFrame(const wxString& title,
const wxPoint& pos,
const wxSize& size,
const wxString& startingProfile,
const wxString& startingHighlight);
~ProfileToolFrame();
void CreateControls(const wxString &startingProfile,
const wxString &startingHighlight);
void ClearProfile();
bool DeleteProfile(wxString& profile);
void EnableSaveMenu(bool toggle);
int FindTreeNodeAndHighlight(wxTreeItemId startingNode, wxString path);
void LoadProfile(const wxString& profile, const wxString& highlight);
void PopulateControls();
void ProfileHasBeenModified();
int ProfileNeedSaving();
void ReloadProfile(const wxString &filePath);
void ReplaceAll(const wxString searchText,
const wxString replaceText,
int matchCase,
int wholeWord);
void RepopulateControl();
int SaveCurrentProfile();
// Event handlers
void OnQuit(wxCommandEvent& event);
void OnClose(wxCloseEvent &event);
void OnAbout(wxCommandEvent& event);
void OnSave(wxCommandEvent& event);
void OnFind(wxCommandEvent& event);
void OnSearchAllProfiles(wxCommandEvent& event);
void OnReplace(wxCommandEvent& event);
void OnSaveAs(wxCommandEvent& event);
void OnHelp(wxCommandEvent& event );
void OnDeleteProfile(wxCommandEvent &event);
void OnReloadProfile(wxCommandEvent &event);
void OnCheckSyntax(wxCommandEvent &event);
void OnEditMenu(wxCommandEvent& event);
void OnPreferences(wxCommandEvent& event);
void OnNewProfile(wxCommandEvent& event);
void OnProfileModified(wxStyledTextEvent &event);
void OnTreeSelection(wxTreeEvent& event);
void OnTreeContextMenu(wxTreeEvent& event);
void OnOpenInclude(wxCommandEvent &event);
void OnInsertInclude(wxCommandEvent &event);
void OnUpdateUI(wxStyledTextEvent &event);
void OnSize(wxSizeEvent& event);
void OnFindButton(wxFindDialogEvent& event);
void OnEndOfProfileReload(wxProcessEvent &event);
private:
wxTreeCtrl *mpProfileTree;
wxFindReplaceDialog *mpFindDialog, *mpReplaceDialog;
wxHtmlHelpController *mpHelpController;
ProfileTextCtrl *mpProfileView;
wxMenuBar *mpMenuBar;
wxFindReplaceData mFindData, mReplaceData;
wxTreeItemId mRootNode;
wxTreeItemId mCurrentNode;
wxSplitterWindow *mpSplitterWindow;
DECLARE_EVENT_TABLE()
};
/**
* This class is used to keep track of what path goes with
* what profile entry in the tree.
*/
class ProfileTreeData : public wxTreeItemData
{
public:
ProfileTreeData(const wxString& path) : mPath(path) {}
wxString GetPath(void) { return mPath; }
private:
wxString mPath;
};
enum
{
ID_MENU_FILE_NEW=1048,
ID_MENU_FILE_PREFERENCES,
ID_MENU_FILE_SAVE,
ID_MENU_FILE_SAVE_AS,
ID_MENU_HELP_ABOUT,
ID_MENU_HELP_PROFILES,
ID_MENU_EDIT_COPY,
ID_MENU_EDIT_CUT,
ID_MENU_EDIT_PASTE,
ID_MENU_EDIT_UNDO,
ID_MENU_EDIT_REDO,
ID_MENU_EDIT_FIND,
ID_MENU_EDIT_REPLACE,
ID_MENU_EDIT_FIND_NEXT,
ID_MENU_EDIT_SEARCH_ALL_PROFILES,
ID_PREFERENCES_DIALOG,
ID_TREE_CONTEXT_DELETE,
ID_TREE_CONTEXT_RELOAD,
ID_RELOAD_PROFILE_PROCESS,
ID_PROFILE_TREE
};
#endif // _PROFILETOOL_H_

View File

@@ -1,78 +0,0 @@
// Scintilla source code edit control
/** @file Accessor.h
** Rapid easy access to contents of a Scintilla.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
enum { wsSpace = 1, wsTab = 2, wsSpaceTab = 4, wsInconsistent=8};
class Accessor;
typedef bool (*PFNIsCommentLeader)(Accessor &styler, int pos, int len);
/**
* Interface to data in a Scintilla.
*/
class Accessor {
protected:
enum {extremePosition=0x7FFFFFFF};
/** @a bufferSize is a trade off between time taken to copy the characters
* and retrieval overhead.
* @a slopSize positions the buffer before the desired position
* in case there is some backtracking. */
enum {bufferSize=4000, slopSize=bufferSize/8};
char buf[bufferSize+1];
int startPos;
int endPos;
int codePage;
virtual bool InternalIsLeadByte(char ch)=0;
virtual void Fill(int position)=0;
public:
Accessor() : startPos(extremePosition), endPos(0), codePage(0) {}
virtual ~Accessor() {}
char operator[](int position) {
if (position < startPos || position >= endPos) {
Fill(position);
}
return buf[position - startPos];
}
/** Safe version of operator[], returning a defined value for invalid position. */
char SafeGetCharAt(int position, char chDefault=' ') {
if (position < startPos || position >= endPos) {
Fill(position);
if (position < startPos || position >= endPos) {
// Position is outside range of document
return chDefault;
}
}
return buf[position - startPos];
}
bool IsLeadByte(char ch) {
return codePage && InternalIsLeadByte(ch);
}
void SetCodePage(int codePage_) { codePage = codePage_; }
virtual bool Match(int pos, const char *s)=0;
virtual char StyleAt(int position)=0;
virtual int GetLine(int position)=0;
virtual int LineStart(int line)=0;
virtual int LevelAt(int line)=0;
virtual int Length()=0;
virtual void Flush()=0;
virtual int GetLineState(int line)=0;
virtual int SetLineState(int line, int state)=0;
virtual int GetPropertyInt(const char *key, int defaultValue=0)=0;
virtual char *GetProperties()=0;
// Style setting
virtual void StartAt(unsigned int start, char chMask=31)=0;
virtual void SetFlags(char chFlags_, char chWhile_)=0;
virtual unsigned int GetStartSegment()=0;
virtual void StartSegment(unsigned int pos)=0;
virtual void ColourTo(unsigned int pos, int chAttr)=0;
virtual void SetLevel(int line, int level)=0;
virtual int IndentAmount(int line, int *flags, PFNIsCommentLeader pfnIsCommentLeader = 0)=0;
};

View File

@@ -1,174 +0,0 @@
// Scintilla source code edit control
/** @file AutoComplete.cxx
** Defines the auto completion list box.
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include "Platform.h"
#include "PropSet.h"
#include "AutoComplete.h"
AutoComplete::AutoComplete() :
active(false),
separator(' '),
typesep('?'),
ignoreCase(false),
chooseSingle(false),
lb(0),
posStart(0),
startLen(0),
cancelAtStartPos(true),
autoHide(true),
dropRestOfWord(false) {
lb = ListBox::Allocate();
stopChars[0] = '\0';
fillUpChars[0] = '\0';
}
AutoComplete::~AutoComplete() {
if (lb) {
lb->Destroy();
delete lb;
lb = 0;
}
}
bool AutoComplete::Active() {
return active;
}
void AutoComplete::Start(Window &parent, int ctrlID,
int position, Point location, int startLen_,
int lineHeight, bool unicodeMode) {
if (active) {
Cancel();
}
lb->Create(parent, ctrlID, location, lineHeight, unicodeMode);
lb->Clear();
active = true;
startLen = startLen_;
posStart = position;
}
void AutoComplete::SetStopChars(const char *stopChars_) {
strncpy(stopChars, stopChars_, sizeof(stopChars));
stopChars[sizeof(stopChars) - 1] = '\0';
}
bool AutoComplete::IsStopChar(char ch) {
return ch && strchr(stopChars, ch);
}
void AutoComplete::SetFillUpChars(const char *fillUpChars_) {
strncpy(fillUpChars, fillUpChars_, sizeof(fillUpChars));
fillUpChars[sizeof(fillUpChars) - 1] = '\0';
}
bool AutoComplete::IsFillUpChar(char ch) {
return ch && strchr(fillUpChars, ch);
}
void AutoComplete::SetSeparator(char separator_) {
separator = separator_;
}
char AutoComplete::GetSeparator() {
return separator;
}
void AutoComplete::SetTypesep(char separator_) {
typesep = separator_;
}
char AutoComplete::GetTypesep() {
return typesep;
}
void AutoComplete::SetList(const char *list) {
lb->SetList(list, separator, typesep);
}
void AutoComplete::Show(bool show) {
lb->Show(show);
if (show)
lb->Select(0);
}
void AutoComplete::Cancel() {
if (lb->Created()) {
lb->Clear();
lb->Destroy();
active = false;
}
}
void AutoComplete::Move(int delta) {
int count = lb->Length();
int current = lb->GetSelection();
current += delta;
if (current >= count)
current = count - 1;
if (current < 0)
current = 0;
lb->Select(current);
}
void AutoComplete::Select(const char *word) {
size_t lenWord = strlen(word);
int location = -1;
const int maxItemLen=1000;
char item[maxItemLen];
int start = 0; // lower bound of the api array block to search
int end = lb->Length() - 1; // upper bound of the api array block to search
while ((start <= end) && (location == -1)) { // Binary searching loop
int pivot = (start + end) / 2;
lb->GetValue(pivot, item, maxItemLen);
int cond;
if (ignoreCase)
cond = CompareNCaseInsensitive(word, item, lenWord);
else
cond = strncmp(word, item, lenWord);
if (!cond) {
// Find first match
while (pivot > start) {
lb->GetValue(pivot-1, item, maxItemLen);
if (ignoreCase)
cond = CompareNCaseInsensitive(word, item, lenWord);
else
cond = strncmp(word, item, lenWord);
if (0 != cond)
break;
--pivot;
}
location = pivot;
if (ignoreCase) {
// Check for exact-case match
for (; pivot <= end; pivot++) {
lb->GetValue(pivot, item, maxItemLen);
if (!strncmp(word, item, lenWord)) {
location = pivot;
break;
}
if (CompareNCaseInsensitive(word, item, lenWord))
break;
}
}
} else if (cond < 0) {
end = pivot - 1;
} else if (cond > 0) {
start = pivot + 1;
}
}
if (location == -1 && autoHide)
Cancel();
else
lb->Select(location);
}

View File

@@ -1,70 +0,0 @@
// Scintilla source code edit control
/** @file AutoComplete.h
** Defines the auto completion list box.
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef AUTOCOMPLETE_H
#define AUTOCOMPLETE_H
/**
*/
class AutoComplete {
bool active;
char stopChars[256];
char fillUpChars[256];
char separator;
char typesep; // Type seperator
public:
bool ignoreCase;
bool chooseSingle;
ListBox *lb;
int posStart;
int startLen;
/// Should autocompletion be canceled if editor's currentPos <= startPos?
bool cancelAtStartPos;
bool autoHide;
bool dropRestOfWord;
AutoComplete();
~AutoComplete();
/// Is the auto completion list displayed?
bool Active();
/// Display the auto completion list positioned to be near a character position
void Start(Window &parent, int ctrlID, int position, Point location,
int startLen_, int lineHeight, bool unicodeMode);
/// The stop chars are characters which, when typed, cause the auto completion list to disappear
void SetStopChars(const char *stopChars_);
bool IsStopChar(char ch);
/// The fillup chars are characters which, when typed, fill up the selected word
void SetFillUpChars(const char *fillUpChars_);
bool IsFillUpChar(char ch);
/// The separator character is used when interpreting the list in SetList
void SetSeparator(char separator_);
char GetSeparator();
/// The typesep character is used for seperating the word from the type
void SetTypesep(char separator_);
char GetTypesep();
/// The list string contains a sequence of words separated by the separator character
void SetList(const char *list);
void Show(bool show);
void Cancel();
/// Move the current list element by delta, scrolling appropriately
void Move(int delta);
/// Select a list element that starts with word as the current element
void Select(const char *word);
};
#endif

View File

@@ -1,270 +0,0 @@
// Scintilla source code edit control
/** @file CallTip.cxx
** Code for displaying call tips.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <string.h>
#include "Platform.h"
#include "Scintilla.h"
#include "CallTip.h"
CallTip::CallTip() {
wCallTip = 0;
inCallTipMode = false;
posStartCallTip = 0;
val = 0;
rectUp = PRectangle(0,0,0,0);
rectDown = PRectangle(0,0,0,0);
lineHeight = 1;
startHighlight = 0;
endHighlight = 0;
colourBG.desired = ColourDesired(0xff, 0xff, 0xff);
colourUnSel.desired = ColourDesired(0x80, 0x80, 0x80);
colourSel.desired = ColourDesired(0, 0, 0x80);
colourShade.desired = ColourDesired(0, 0, 0);
colourLight.desired = ColourDesired(0xc0, 0xc0, 0xc0);
}
CallTip::~CallTip() {
font.Release();
wCallTip.Destroy();
delete []val;
val = 0;
}
const int widthArrow = 14;
void CallTip::RefreshColourPalette(Palette &pal, bool want) {
pal.WantFind(colourBG, want);
pal.WantFind(colourUnSel, want);
pal.WantFind(colourSel, want);
pal.WantFind(colourShade, want);
pal.WantFind(colourLight, want);
}
static bool IsArrowCharacter(char ch) {
return (ch == 0) || (ch == '\001') || (ch == '\002');
}
void CallTip::DrawChunk(Surface *surface, int &x, const char *s,
int posStart, int posEnd, int ytext, PRectangle rcClient,
bool highlight, bool draw) {
s += posStart;
int len = posEnd - posStart;
int maxEnd = 0;
int ends[10];
for (int i=0;i<len;i++) {
if (IsArrowCharacter(s[i])) {
if (i > 0)
ends[maxEnd++] = i;
ends[maxEnd++] = i+1;
}
}
ends[maxEnd++] = len;
int startSeg = 0;
int xEnd;
for (int seg = 0; seg<maxEnd; seg++) {
int endSeg = ends[seg];
if (endSeg > startSeg) {
if (IsArrowCharacter(s[startSeg])) {
xEnd = x + widthArrow;
offsetMain = xEnd;
rcClient.left = x;
rcClient.right = xEnd;
if (draw) {
const int halfWidth = widthArrow / 2 - 3;
const int centreX = x + widthArrow / 2 - 1;
const int centreY = (rcClient.top + rcClient.bottom) / 2;
surface->FillRectangle(rcClient, colourBG.allocated);
PRectangle rcClientInner(rcClient.left+1, rcClient.top+1, rcClient.right-2, rcClient.bottom-1);
surface->FillRectangle(rcClientInner, colourUnSel.allocated);
if (s[startSeg] == '\001') {
// Up arrow
Point pts[] = {
Point(centreX - halfWidth, centreY + halfWidth / 2),
Point(centreX + halfWidth, centreY + halfWidth / 2),
Point(centreX, centreY - halfWidth + halfWidth / 2),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
colourBG.allocated, colourBG.allocated);
} else {
// Down arrow
Point pts[] = {
Point(centreX - halfWidth, centreY - halfWidth / 2),
Point(centreX + halfWidth, centreY - halfWidth / 2),
Point(centreX, centreY + halfWidth - halfWidth / 2),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
colourBG.allocated, colourBG.allocated);
}
}
if (s[startSeg] == '\001') {
rectUp = rcClient;
} else if (s[startSeg] == '\002') {
rectDown = rcClient;
}
} else {
xEnd = x + surface->WidthText(font, s+startSeg, endSeg - startSeg);
if (draw) {
rcClient.left = x;
rcClient.right = xEnd;
surface->DrawTextNoClip(rcClient, font, ytext,
s+startSeg, endSeg - startSeg,
highlight ? colourSel.allocated : colourUnSel.allocated,
colourBG.allocated);
}
}
x = xEnd;
startSeg = endSeg;
}
}
}
int CallTip::PaintContents(Surface *surfaceWindow, bool draw) {
PRectangle rcClientPos = wCallTip.GetClientPosition();
PRectangle rcClientSize(0, 0, rcClientPos.right - rcClientPos.left,
rcClientPos.bottom - rcClientPos.top);
PRectangle rcClient(1, 1, rcClientSize.right - 1, rcClientSize.bottom - 1);
// To make a nice small call tip window, it is only sized to fit most normal characters without accents
int ascent = surfaceWindow->Ascent(font) - surfaceWindow->InternalLeading(font);
// For each line...
// Draw the definition in three parts: before highlight, highlighted, after highlight
int ytext = rcClient.top + ascent + 1;
rcClient.bottom = ytext + surfaceWindow->Descent(font) + 1;
char *chunkVal = val;
bool moreChunks = true;
int maxWidth = 0;
while (moreChunks) {
char *chunkEnd = strchr(chunkVal, '\n');
if (chunkEnd == NULL) {
chunkEnd = chunkVal + strlen(chunkVal);
moreChunks = false;
}
int chunkOffset = chunkVal - val;
int chunkLength = chunkEnd - chunkVal;
int chunkEndOffset = chunkOffset + chunkLength;
int thisStartHighlight = Platform::Maximum(startHighlight, chunkOffset);
thisStartHighlight = Platform::Minimum(thisStartHighlight, chunkEndOffset);
thisStartHighlight -= chunkOffset;
int thisEndHighlight = Platform::Maximum(endHighlight, chunkOffset);
thisEndHighlight = Platform::Minimum(thisEndHighlight, chunkEndOffset);
thisEndHighlight -= chunkOffset;
rcClient.top = ytext - ascent - 1;
int x = 5;
DrawChunk(surfaceWindow, x, chunkVal, 0, thisStartHighlight,
ytext, rcClient, false, draw);
DrawChunk(surfaceWindow, x, chunkVal, thisStartHighlight, thisEndHighlight,
ytext, rcClient, true, draw);
DrawChunk(surfaceWindow, x, chunkVal, thisEndHighlight, chunkLength,
ytext, rcClient, false, draw);
chunkVal = chunkEnd + 1;
ytext += lineHeight;
rcClient.bottom += lineHeight;
maxWidth = Platform::Maximum(maxWidth, x);
}
return maxWidth;
}
void CallTip::PaintCT(Surface *surfaceWindow) {
if (!val)
return;
PRectangle rcClientPos = wCallTip.GetClientPosition();
PRectangle rcClientSize(0, 0, rcClientPos.right - rcClientPos.left,
rcClientPos.bottom - rcClientPos.top);
PRectangle rcClient(1, 1, rcClientSize.right - 1, rcClientSize.bottom - 1);
surfaceWindow->FillRectangle(rcClient, colourBG.allocated);
offsetMain = 5;
PaintContents(surfaceWindow, true);
// Draw a raised border around the edges of the window
surfaceWindow->MoveTo(0, rcClientSize.bottom - 1);
surfaceWindow->PenColour(colourShade.allocated);
surfaceWindow->LineTo(rcClientSize.right - 1, rcClientSize.bottom - 1);
surfaceWindow->LineTo(rcClientSize.right - 1, 0);
surfaceWindow->PenColour(colourLight.allocated);
surfaceWindow->LineTo(0, 0);
surfaceWindow->LineTo(0, rcClientSize.bottom - 1);
}
void CallTip::MouseClick(Point pt) {
clickPlace = 0;
if (rectUp.Contains(pt))
clickPlace = 1;
if (rectDown.Contains(pt))
clickPlace = 2;
}
PRectangle CallTip::CallTipStart(int pos, Point pt, const char *defn,
const char *faceName, int size,
int codePage_, int characterSet, Window &wParent) {
clickPlace = 0;
if (val)
delete []val;
val = new char[strlen(defn) + 1];
if (!val)
return PRectangle();
strcpy(val, defn);
codePage = codePage_;
Surface *surfaceMeasure = Surface::Allocate();
if (!surfaceMeasure)
return PRectangle();
surfaceMeasure->Init(wParent.GetID());
surfaceMeasure->SetUnicodeMode(SC_CP_UTF8 == codePage);
surfaceMeasure->SetDBCSMode(codePage);
startHighlight = 0;
endHighlight = 0;
inCallTipMode = true;
posStartCallTip = pos;
int deviceHeight = surfaceMeasure->DeviceHeightFont(size);
font.Create(faceName, characterSet, deviceHeight, false, false);
// Look for multiple lines in the text
// Only support \n here - simply means container must avoid \r!
int numLines = 1;
const char *newline;
const char *look = val;
rectUp = PRectangle(0,0,0,0);
rectDown = PRectangle(0,0,0,0);
offsetMain = 5;
int width = PaintContents(surfaceMeasure, false) + 5;
while ((newline = strchr(look, '\n')) != NULL) {
look = newline + 1;
numLines++;
}
lineHeight = surfaceMeasure->Height(font);
// Extra line for border and an empty line at top and bottom
int height = lineHeight * numLines - surfaceMeasure->InternalLeading(font) + 2 + 2;
delete surfaceMeasure;
return PRectangle(pt.x - offsetMain, pt.y + 1, pt.x + width - offsetMain, pt.y + 1 + height);
}
void CallTip::CallTipCancel() {
inCallTipMode = false;
if (wCallTip.Created()) {
wCallTip.Destroy();
}
}
void CallTip::SetHighlight(int start, int end) {
// Avoid flashing by checking something has really changed
if ((start != startHighlight) || (end != endHighlight)) {
startHighlight = start;
endHighlight = end;
if (wCallTip.Created()) {
wCallTip.InvalidateAll();
}
}
}

View File

@@ -1,65 +0,0 @@
// Scintilla source code edit control
/** @file CallTip.h
** Interface to the call tip control.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef CALLTIP_H
#define CALLTIP_H
/**
*/
class CallTip {
int startHighlight;
int endHighlight;
char *val;
Font font;
PRectangle rectUp;
PRectangle rectDown;
int lineHeight;
int offsetMain;
// Private so CallTip objects can not be copied
CallTip(const CallTip &) {}
CallTip &operator=(const CallTip &) { return *this; }
void DrawChunk(Surface *surface, int &x, const char *s,
int posStart, int posEnd, int ytext, PRectangle rcClient,
bool highlight, bool draw);
int PaintContents(Surface *surfaceWindow, bool draw);
public:
Window wCallTip;
Window wDraw;
bool inCallTipMode;
int posStartCallTip;
ColourPair colourBG;
ColourPair colourUnSel;
ColourPair colourSel;
ColourPair colourShade;
ColourPair colourLight;
int codePage;
int clickPlace;
CallTip();
~CallTip();
/// Claim or accept palette entries for the colours required to paint a calltip.
void RefreshColourPalette(Palette &pal, bool want);
void PaintCT(Surface *surfaceWindow);
void MouseClick(Point pt);
/// Setup the calltip and return a rectangle of the area required.
PRectangle CallTipStart(int pos, Point pt, const char *defn,
const char *faceName, int size, int codePage_,
int characterSet, Window &wParent);
void CallTipCancel();
/// Set a range of characters to be displayed in a highlight style.
/// Commonly used to highlight the current parameter.
void SetHighlight(int start, int end);
};
#endif

View File

@@ -1,250 +0,0 @@
// Scintilla source code edit control
/** @file CellBuffer.h
** Manages the text of the document.
**/
// Copyright 1998-2004 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef CELLBUFFER_H
#define CELLBUFFER_H
/**
* This holds the marker identifier and the marker type to display.
* MarkerHandleNumbers are members of lists.
*/
struct MarkerHandleNumber {
int handle;
int number;
MarkerHandleNumber *next;
};
/**
* A marker handle set contains any number of MarkerHandleNumbers.
*/
class MarkerHandleSet {
MarkerHandleNumber *root;
public:
MarkerHandleSet();
~MarkerHandleSet();
int Length();
int NumberFromHandle(int handle);
int MarkValue(); ///< Bit set of marker numbers.
bool Contains(int handle);
bool InsertHandle(int handle, int markerNum);
void RemoveHandle(int handle);
bool RemoveNumber(int markerNum);
void CombineWith(MarkerHandleSet *other);
};
/**
* Each line stores the starting position of the first character of the line in the cell buffer
* and potentially a marker handle set. Often a line will not have any attached markers.
*/
struct LineData {
int startPosition;
MarkerHandleSet *handleSet;
LineData() : startPosition(0), handleSet(0) {
}
};
/**
* The line vector contains information about each of the lines in a cell buffer.
*/
class LineVector {
public:
int growSize;
int lines;
LineData *linesData;
int size;
int *levels;
int sizeLevels;
/// Handles are allocated sequentially and should never have to be reused as 32 bit ints are very big.
int handleCurrent;
LineVector();
~LineVector();
void Init();
void Expand(int sizeNew);
void ExpandLevels(int sizeNew=-1);
void ClearLevels();
void InsertValue(int pos, int value);
void SetValue(int pos, int value);
void Remove(int pos);
int LineFromPosition(int pos);
int AddMark(int line, int marker);
void MergeMarkers(int pos);
void DeleteMark(int line, int markerNum, bool all);
void DeleteMarkFromHandle(int markerHandle);
int LineFromHandle(int markerHandle);
};
enum actionType { insertAction, removeAction, startAction };
/**
* Actions are used to store all the information required to perform one undo/redo step.
*/
class Action {
public:
actionType at;
int position;
char *data;
int lenData;
bool mayCoalesce;
Action();
~Action();
void Create(actionType at_, int position_=0, char *data_=0, int lenData_=0, bool mayCoalesce_=true);
void Destroy();
void Grab(Action *source);
};
/**
*
*/
class UndoHistory {
Action *actions;
int lenActions;
int maxAction;
int currentAction;
int undoSequenceDepth;
int savePoint;
void EnsureUndoRoom();
public:
UndoHistory();
~UndoHistory();
void AppendAction(actionType at, int position, char *data, int length);
void BeginUndoAction();
void EndUndoAction();
void DropUndoSequence();
void DeleteUndoHistory();
/// The save point is a marker in the undo stack where the container has stated that
/// the buffer was saved. Undo and redo can move over the save point.
void SetSavePoint();
bool IsSavePoint() const;
/// To perform an undo, StartUndo is called to retrieve the number of steps, then UndoStep is
/// called that many times. Similarly for redo.
bool CanUndo() const;
int StartUndo();
const Action &GetUndoStep() const;
void CompletedUndoStep();
bool CanRedo() const;
int StartRedo();
const Action &GetRedoStep() const;
void CompletedRedoStep();
};
/**
* Holder for an expandable array of characters that supports undo and line markers.
* Based on article "Data Structures in a Bit-Mapped Text Editor"
* by Wilfred J. Hansen, Byte January 1987, page 183.
*/
class CellBuffer {
private:
char *body; ///< The cell buffer itself.
int size; ///< Allocated size of the buffer.
int length; ///< Total length of the data.
int part1len; ///< Length of the first part.
int gaplen; ///< Length of the gap between the two parts.
char *part2body; ///< The second part of the cell buffer.
///< Doesn't point after the gap but set so that
///< part2body[position] is consistent with body[position].
bool readOnly;
int growSize;
bool collectingUndo;
UndoHistory uh;
LineVector lv;
SVector lineStates;
void GapTo(int position);
void RoomFor(int insertionLength);
inline char ByteAt(int position);
void SetByteAt(int position, char ch);
public:
CellBuffer(int initialLength = 4000);
~CellBuffer();
/// Retrieving positions outside the range of the buffer works and returns 0
char CharAt(int position);
void GetCharRange(char *buffer, int position, int lengthRetrieve);
char StyleAt(int position);
int ByteLength();
int Length();
void Allocate(int newSize);
int Lines();
int LineStart(int line);
int LineFromPosition(int pos) { return lv.LineFromPosition(pos); }
const char *InsertString(int position, char *s, int insertLength);
/// Setting styles for positions outside the range of the buffer is safe and has no effect.
/// @return true if the style of a character is changed.
bool SetStyleAt(int position, char style, char mask='\377');
bool SetStyleFor(int position, int length, char style, char mask);
const char *DeleteChars(int position, int deleteLength);
bool IsReadOnly();
void SetReadOnly(bool set);
/// The save point is a marker in the undo stack where the container has stated that
/// the buffer was saved. Undo and redo can move over the save point.
void SetSavePoint();
bool IsSavePoint();
/// Line marker functions
int AddMark(int line, int markerNum);
void DeleteMark(int line, int markerNum);
void DeleteMarkFromHandle(int markerHandle);
int GetMark(int line);
void DeleteAllMarks(int markerNum);
int LineFromHandle(int markerHandle);
/// Actions without undo
void BasicInsertString(int position, char *s, int insertLength);
void BasicDeleteChars(int position, int deleteLength);
bool SetUndoCollection(bool collectUndo);
bool IsCollectingUndo();
void BeginUndoAction();
void EndUndoAction();
void DeleteUndoHistory();
/// To perform an undo, StartUndo is called to retrieve the number of steps, then UndoStep is
/// called that many times. Similarly for redo.
bool CanUndo();
int StartUndo();
const Action &GetUndoStep() const;
void PerformUndoStep();
bool CanRedo();
int StartRedo();
const Action &GetRedoStep() const;
void PerformRedoStep();
int SetLineState(int line, int state);
int GetLineState(int line);
int GetMaxLineState();
int SetLevel(int line, int level);
int GetLevel(int line);
void ClearLevels();
};
#define CELL_SIZE 2
#endif

View File

@@ -1,283 +0,0 @@
// Scintilla source code edit control
/** @file ContractionState.cxx
** Manages visibility of lines for folding.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include "Platform.h"
#include "ContractionState.h"
OneLine::OneLine() {
displayLine = 0;
//docLine = 0;
visible = true;
height = 1;
expanded = true;
}
ContractionState::ContractionState() {
lines = 0;
size = 0;
linesInDoc = 1;
linesInDisplay = 1;
valid = false;
docLines = 0;
sizeDocLines = 0;
}
ContractionState::~ContractionState() {
Clear();
}
void ContractionState::MakeValid() const {
if (!valid) {
// Could be cleverer by keeping the index of the last still valid entry
// rather than invalidating all.
linesInDisplay = 0;
for (int lineInDoc=0; lineInDoc<linesInDoc; lineInDoc++) {
lines[lineInDoc].displayLine = linesInDisplay;
if (lines[lineInDoc].visible) {
linesInDisplay += lines[lineInDoc].height;
}
}
if (sizeDocLines < linesInDisplay) {
delete []docLines;
int *docLinesNew = new int[linesInDisplay + growSize];
if (!docLinesNew) {
docLines = 0;
sizeDocLines = 0;
return;
}
docLines = docLinesNew;
sizeDocLines = linesInDisplay + growSize;
}
int lineInDisplay=0;
for (int line=0; line<linesInDoc; line++) {
if (lines[line].visible) {
for (int linePiece=0; linePiece<lines[line].height; linePiece++) {
docLines[lineInDisplay] = line;
lineInDisplay++;
}
}
}
valid = true;
}
}
void ContractionState::Clear() {
delete []lines;
lines = 0;
size = 0;
linesInDoc = 1;
linesInDisplay = 1;
delete []docLines;
docLines = 0;
sizeDocLines = 0;
}
int ContractionState::LinesInDoc() const {
return linesInDoc;
}
int ContractionState::LinesDisplayed() const {
if (size != 0) {
MakeValid();
}
return linesInDisplay;
}
int ContractionState::DisplayFromDoc(int lineDoc) const {
if (size == 0) {
return lineDoc;
}
MakeValid();
if ((lineDoc >= 0) && (lineDoc < linesInDoc)) {
return lines[lineDoc].displayLine;
}
return -1;
}
int ContractionState::DocFromDisplay(int lineDisplay) const {
if (lineDisplay <= 0)
return 0;
if (lineDisplay >= linesInDisplay)
return linesInDoc;
if (size == 0)
return lineDisplay;
MakeValid();
if (docLines) { // Valid allocation
return docLines[lineDisplay];
} else {
return 0;
}
}
void ContractionState::Grow(int sizeNew) {
OneLine *linesNew = new OneLine[sizeNew];
if (linesNew) {
int i = 0;
for (; i < size; i++) {
linesNew[i] = lines[i];
}
for (; i < sizeNew; i++) {
linesNew[i].displayLine = i;
}
delete []lines;
lines = linesNew;
size = sizeNew;
valid = false;
} else {
Platform::DebugPrintf("No memory available\n");
// TODO: Blow up
}
}
void ContractionState::InsertLines(int lineDoc, int lineCount) {
if (size == 0) {
linesInDoc += lineCount;
linesInDisplay += lineCount;
return;
}
//Platform::DebugPrintf("InsertLine[%d] = %d\n", lineDoc);
if ((linesInDoc + lineCount + 2) >= size) {
Grow(linesInDoc + lineCount + growSize);
}
linesInDoc += lineCount;
for (int i = linesInDoc; i >= lineDoc + lineCount; i--) {
lines[i].visible = lines[i - lineCount].visible;
lines[i].height = lines[i - lineCount].height;
linesInDisplay += lines[i].height;
lines[i].expanded = lines[i - lineCount].expanded;
}
for (int d=0;d<lineCount;d++) {
lines[lineDoc+d].visible = true; // Should inherit visibility from context ?
lines[lineDoc+d].height = 1;
lines[lineDoc+d].expanded = true;
}
valid = false;
}
void ContractionState::DeleteLines(int lineDoc, int lineCount) {
if (size == 0) {
linesInDoc -= lineCount;
linesInDisplay -= lineCount;
return;
}
int deltaDisplayed = 0;
for (int d=0;d<lineCount;d++) {
if (lines[lineDoc+d].visible)
deltaDisplayed -= lines[lineDoc+d].height;
}
for (int i = lineDoc; i < linesInDoc-lineCount; i++) {
if (i != 0) // Line zero is always visible
lines[i].visible = lines[i + lineCount].visible;
lines[i].expanded = lines[i + lineCount].expanded;
lines[i].height = lines[i + lineCount].height;
}
linesInDoc -= lineCount;
linesInDisplay += deltaDisplayed;
valid = false;
}
bool ContractionState::GetVisible(int lineDoc) const {
if (size == 0)
return true;
if ((lineDoc >= 0) && (lineDoc < linesInDoc)) {
return lines[lineDoc].visible;
} else {
return false;
}
}
bool ContractionState::SetVisible(int lineDocStart, int lineDocEnd, bool visible) {
if (lineDocStart == 0)
lineDocStart++;
if (lineDocStart > lineDocEnd)
return false;
if (size == 0) {
Grow(linesInDoc + growSize);
}
// TODO: modify docLine members to mirror displayLine
int delta = 0;
// Change lineDocs
if ((lineDocStart <= lineDocEnd) && (lineDocStart >= 0) && (lineDocEnd < linesInDoc)) {
for (int line=lineDocStart; line <= lineDocEnd; line++) {
if (lines[line].visible != visible) {
delta += visible ? lines[line].height : -lines[line].height;
lines[line].visible = visible;
}
}
}
linesInDisplay += delta;
valid = false;
return delta != 0;
}
bool ContractionState::GetExpanded(int lineDoc) const {
if (size == 0)
return true;
if ((lineDoc >= 0) && (lineDoc < linesInDoc)) {
return lines[lineDoc].expanded;
} else {
return false;
}
}
bool ContractionState::SetExpanded(int lineDoc, bool expanded) {
if (size == 0) {
if (expanded) {
// If in completely expanded state then setting
// one line to expanded has no effect.
return false;
}
Grow(linesInDoc + growSize);
}
if ((lineDoc >= 0) && (lineDoc < linesInDoc)) {
if (lines[lineDoc].expanded != expanded) {
lines[lineDoc].expanded = expanded;
return true;
}
}
return false;
}
int ContractionState::GetHeight(int lineDoc) const {
if (size == 0)
return 1;
if ((lineDoc >= 0) && (lineDoc < linesInDoc)) {
return lines[lineDoc].height;
} else {
return 1;
}
}
// Set the number of display lines needed for this line.
// Return true if this is a change.
bool ContractionState::SetHeight(int lineDoc, int height) {
if (lineDoc > linesInDoc)
return false;
if (size == 0) {
if (height == 1) {
// If in completely expanded state then all lines
// assumed to have height of one so no effect here.
return false;
}
Grow(linesInDoc + growSize);
}
if (lines[lineDoc].height != height) {
lines[lineDoc].height = height;
valid = false;
return true;
} else {
return false;
}
}
void ContractionState::ShowAll() {
delete []lines;
lines = 0;
size = 0;
}

View File

@@ -1,65 +0,0 @@
// Scintilla source code edit control
/** @file ContractionState.h
** Manages visibility of lines for folding.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef CONTRACTIONSTATE_H
#define CONTRACTIONSTATE_H
/**
*/
class OneLine {
public:
int displayLine; ///< Position within set of visible lines
//int docLine; ///< Inverse of @a displayLine
int height; ///< Number of display lines needed to show all of the line
bool visible;
bool expanded;
OneLine();
virtual ~OneLine() {}
};
/**
*/
class ContractionState {
void Grow(int sizeNew);
enum { growSize = 4000 };
int linesInDoc;
mutable int linesInDisplay;
mutable OneLine *lines;
int size;
mutable int *docLines;
mutable int sizeDocLines;
mutable bool valid;
void MakeValid() const;
public:
ContractionState();
virtual ~ContractionState();
void Clear();
int LinesInDoc() const;
int LinesDisplayed() const;
int DisplayFromDoc(int lineDoc) const;
int DocFromDisplay(int lineDisplay) const;
void InsertLines(int lineDoc, int lineCount);
void DeleteLines(int lineDoc, int lineCount);
bool GetVisible(int lineDoc) const;
bool SetVisible(int lineDocStart, int lineDocEnd, bool visible);
bool GetExpanded(int lineDoc) const;
bool SetExpanded(int lineDoc, bool expanded);
int GetHeight(int lineDoc) const;
bool SetHeight(int lineDoc, int height);
void ShowAll();
};
#endif

View File

@@ -1,305 +0,0 @@
// Scintilla source code edit control
/** @file Document.h
** Text document that handles notifications, DBCS, styling, words and end of line.
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef DOCUMENT_H
#define DOCUMENT_H
/**
* A Position is a position within a document between two characters or at the beginning or end.
* Sometimes used as a character index where it identifies the character after the position.
*/
typedef int Position;
const Position invalidPosition = -1;
/**
* The range class represents a range of text in a document.
* The two values are not sorted as one end may be more significant than the other
* as is the case for the selection where the end position is the position of the caret.
* If either position is invalidPosition then the range is invalid and most operations will fail.
*/
class Range {
public:
Position start;
Position end;
Range(Position pos=0) :
start(pos), end(pos) {
};
Range(Position start_, Position end_) :
start(start_), end(end_) {
};
bool Valid() const {
return (start != invalidPosition) && (end != invalidPosition);
}
// Is the position within the range?
bool Contains(Position pos) const {
if (start < end) {
return (pos >= start && pos <= end);
} else {
return (pos <= start && pos >= end);
}
}
// Is the character after pos within the range?
bool ContainsCharacter(Position pos) const {
if (start < end) {
return (pos >= start && pos < end);
} else {
return (pos < start && pos >= end);
}
}
bool Contains(Range other) const {
return Contains(other.start) && Contains(other.end);
}
bool Overlaps(Range other) const {
return
Contains(other.start) ||
Contains(other.end) ||
other.Contains(start) ||
other.Contains(end);
}
};
class DocWatcher;
class DocModification;
class RESearch;
/**
*/
class Document {
public:
/** Used to pair watcher pointer with user data. */
class WatcherWithUserData {
public:
DocWatcher *watcher;
void *userData;
WatcherWithUserData() {
watcher = 0;
userData = 0;
}
};
enum charClassification { ccSpace, ccNewLine, ccWord, ccPunctuation };
private:
int refCount;
CellBuffer cb;
charClassification charClass[256];
char stylingMask;
int endStyled;
int styleClock;
int enteredCount;
int enteredReadOnlyCount;
WatcherWithUserData *watchers;
int lenWatchers;
bool matchesValid;
RESearch *pre;
char *substituted;
public:
int stylingBits;
int stylingBitsMask;
int eolMode;
/// Can also be SC_CP_UTF8 to enable UTF-8 mode
int dbcsCodePage;
int tabInChars;
int indentInChars;
int actualIndentInChars;
bool useTabs;
bool tabIndents;
bool backspaceUnindents;
Document();
virtual ~Document();
int AddRef();
int Release();
int LineFromPosition(int pos);
int ClampPositionIntoDocument(int pos);
bool IsCrLf(int pos);
int LenChar(int pos);
int MovePositionOutsideChar(int pos, int moveDir, bool checkLineEnd=true);
// Gateways to modifying document
void ModifiedAt(int pos);
bool DeleteChars(int pos, int len);
bool InsertStyledString(int position, char *s, int insertLength);
int Undo();
int Redo();
bool CanUndo() { return cb.CanUndo(); }
bool CanRedo() { return cb.CanRedo(); }
void DeleteUndoHistory() { cb.DeleteUndoHistory(); }
bool SetUndoCollection(bool collectUndo) {
return cb.SetUndoCollection(collectUndo);
}
bool IsCollectingUndo() { return cb.IsCollectingUndo(); }
void BeginUndoAction() { cb.BeginUndoAction(); }
void EndUndoAction() { cb.EndUndoAction(); }
void SetSavePoint();
bool IsSavePoint() { return cb.IsSavePoint(); }
int GetLineIndentation(int line);
void SetLineIndentation(int line, int indent);
int GetLineIndentPosition(int line);
int GetColumn(int position);
int FindColumn(int line, int column);
void Indent(bool forwards, int lineBottom, int lineTop);
static char *TransformLineEnds(int *pLenOut, const char *s, size_t len, int eolMode);
void ConvertLineEnds(int eolModeSet);
void SetReadOnly(bool set) { cb.SetReadOnly(set); }
bool IsReadOnly() { return cb.IsReadOnly(); }
bool InsertChar(int pos, char ch);
bool InsertString(int position, const char *s);
bool InsertString(int position, const char *s, size_t insertLength);
void ChangeChar(int pos, char ch);
void DelChar(int pos);
void DelCharBack(int pos);
char CharAt(int position) { return cb.CharAt(position); }
void GetCharRange(char *buffer, int position, int lengthRetrieve) {
cb.GetCharRange(buffer, position, lengthRetrieve);
}
char StyleAt(int position) { return cb.StyleAt(position); }
int GetMark(int line) { return cb.GetMark(line); }
int AddMark(int line, int markerNum);
void AddMarkSet(int line, int valueSet);
void DeleteMark(int line, int markerNum);
void DeleteMarkFromHandle(int markerHandle);
void DeleteAllMarks(int markerNum);
int LineFromHandle(int markerHandle) { return cb.LineFromHandle(markerHandle); }
int LineStart(int line);
int LineEnd(int line);
int LineEndPosition(int position);
int VCHomePosition(int position);
int SetLevel(int line, int level);
int GetLevel(int line) { return cb.GetLevel(line); }
void ClearLevels() { cb.ClearLevels(); }
int GetLastChild(int lineParent, int level=-1);
int GetFoldParent(int line);
void Indent(bool forwards);
int ExtendWordSelect(int pos, int delta, bool onlyWordCharacters=false);
int NextWordStart(int pos, int delta);
int NextWordEnd(int pos, int delta);
int Length() { return cb.Length(); }
void Allocate(int newSize) { cb.Allocate(newSize*2); }
long FindText(int minPos, int maxPos, const char *s,
bool caseSensitive, bool word, bool wordStart, bool regExp, bool posix, int *length);
long FindText(int iMessage, unsigned long wParam, long lParam);
const char *SubstituteByPosition(const char *text, int *length);
int LinesTotal();
void ChangeCase(Range r, bool makeUpperCase);
void SetDefaultCharClasses(bool includeWordClass);
void SetCharClasses(const unsigned char *chars, charClassification newCharClass);
void SetStylingBits(int bits);
void StartStyling(int position, char mask);
bool SetStyleFor(int length, char style);
bool SetStyles(int length, char *styles);
int GetEndStyled() { return endStyled; }
bool EnsureStyledTo(int pos);
int GetStyleClock() { return styleClock; }
void IncrementStyleClock();
int SetLineState(int line, int state) { return cb.SetLineState(line, state); }
int GetLineState(int line) { return cb.GetLineState(line); }
int GetMaxLineState() { return cb.GetMaxLineState(); }
bool AddWatcher(DocWatcher *watcher, void *userData);
bool RemoveWatcher(DocWatcher *watcher, void *userData);
const WatcherWithUserData *GetWatchers() const { return watchers; }
int GetLenWatchers() const { return lenWatchers; }
bool IsWordPartSeparator(char ch);
int WordPartLeft(int pos);
int WordPartRight(int pos);
int ExtendStyleRange(int pos, int delta, bool singleLine = false);
bool IsWhiteLine(int line);
int ParaUp(int pos);
int ParaDown(int pos);
int IndentSize() { return actualIndentInChars; }
int BraceMatch(int position, int maxReStyle);
private:
void CheckReadOnly();
charClassification WordCharClass(unsigned char ch);
bool IsWordStartAt(int pos);
bool IsWordEndAt(int pos);
bool IsWordAt(int start, int end);
void NotifyModifyAttempt();
void NotifySavePoint(bool atSavePoint);
void NotifyModified(DocModification mh);
};
/**
* To optimise processing of document modifications by DocWatchers, a hint is passed indicating the
* scope of the change.
* If the DocWatcher is a document view then this can be used to optimise screen updating.
*/
class DocModification {
public:
int modificationType;
int position;
int length;
int linesAdded; /**< Negative if lines deleted. */
const char *text; /**< Only valid for changes to text, not for changes to style. */
int line;
int foldLevelNow;
int foldLevelPrev;
DocModification(int modificationType_, int position_=0, int length_=0,
int linesAdded_=0, const char *text_=0, int line_=0) :
modificationType(modificationType_),
position(position_),
length(length_),
linesAdded(linesAdded_),
text(text_),
line(line_),
foldLevelNow(0),
foldLevelPrev(0) {}
DocModification(int modificationType_, const Action &act, int linesAdded_=0) :
modificationType(modificationType_),
position(act.position),
length(act.lenData),
linesAdded(linesAdded_),
text(act.data),
line(0),
foldLevelNow(0),
foldLevelPrev(0) {}
};
/**
* A class that wants to receive notifications from a Document must be derived from DocWatcher
* and implement the notification methods. It can then be added to the watcher list with AddWatcher.
*/
class DocWatcher {
public:
virtual ~DocWatcher() {}
virtual void NotifyModifyAttempt(Document *doc, void *userData) = 0;
virtual void NotifySavePoint(Document *doc, void *userData, bool atSavePoint) = 0;
virtual void NotifyModified(Document *doc, DocModification mh, void *userData) = 0;
virtual void NotifyDeleted(Document *doc, void *userData) = 0;
virtual void NotifyStyleNeeded(Document *doc, void *userData, int endPos) = 0;
};
#endif

View File

@@ -1,186 +0,0 @@
// Scintilla source code edit control
/** @file DocumentAccessor.cxx
** Rapid easy access to contents of a Scintilla.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <stdio.h>
#include "Platform.h"
#include "PropSet.h"
#include "SVector.h"
#include "Accessor.h"
#include "DocumentAccessor.h"
#include "CellBuffer.h"
#include "Scintilla.h"
#include "Document.h"
DocumentAccessor::~DocumentAccessor() {
}
bool DocumentAccessor::InternalIsLeadByte(char ch) {
if (SC_CP_UTF8 == codePage)
// For lexing, all characters >= 0x80 are treated the
// same so none is considered a lead byte.
return false;
else
return Platform::IsDBCSLeadByte(codePage, ch);
}
void DocumentAccessor::Fill(int position) {
if (lenDoc == -1)
lenDoc = pdoc->Length();
startPos = position - slopSize;
if (startPos + bufferSize > lenDoc)
startPos = lenDoc - bufferSize;
if (startPos < 0)
startPos = 0;
endPos = startPos + bufferSize;
if (endPos > lenDoc)
endPos = lenDoc;
pdoc->GetCharRange(buf, startPos, endPos-startPos);
buf[endPos-startPos] = '\0';
}
bool DocumentAccessor::Match(int pos, const char *s) {
for (int i=0; *s; i++) {
if (*s != SafeGetCharAt(pos+i))
return false;
s++;
}
return true;
}
char DocumentAccessor::StyleAt(int position) {
// Mask off all bits which aren't in the 'mask'.
return static_cast<char>(pdoc->StyleAt(position) & mask);
}
int DocumentAccessor::GetLine(int position) {
return pdoc->LineFromPosition(position);
}
int DocumentAccessor::LineStart(int line) {
return pdoc->LineStart(line);
}
int DocumentAccessor::LevelAt(int line) {
return pdoc->GetLevel(line);
}
int DocumentAccessor::Length() {
if (lenDoc == -1)
lenDoc = pdoc->Length();
return lenDoc;
}
int DocumentAccessor::GetLineState(int line) {
return pdoc->GetLineState(line);
}
int DocumentAccessor::SetLineState(int line, int state) {
return pdoc->SetLineState(line, state);
}
void DocumentAccessor::StartAt(unsigned int start, char chMask) {
// Store the mask specified for use with StyleAt.
mask = chMask;
pdoc->StartStyling(start, chMask);
startPosStyling = start;
}
void DocumentAccessor::StartSegment(unsigned int pos) {
startSeg = pos;
}
void DocumentAccessor::ColourTo(unsigned int pos, int chAttr) {
// Only perform styling if non empty range
if (pos != startSeg - 1) {
if (pos < startSeg) {
Platform::DebugPrintf("Bad colour positions %d - %d\n", startSeg, pos);
}
if (validLen + (pos - startSeg + 1) >= bufferSize)
Flush();
if (validLen + (pos - startSeg + 1) >= bufferSize) {
// Too big for buffer so send directly
pdoc->SetStyleFor(pos - startSeg + 1, static_cast<char>(chAttr));
} else {
if (chAttr != chWhile)
chFlags = 0;
chAttr |= chFlags;
for (unsigned int i = startSeg; i <= pos; i++) {
PLATFORM_ASSERT((startPosStyling + validLen) < Length());
styleBuf[validLen++] = static_cast<char>(chAttr);
}
}
}
startSeg = pos+1;
}
void DocumentAccessor::SetLevel(int line, int level) {
pdoc->SetLevel(line, level);
}
void DocumentAccessor::Flush() {
startPos = extremePosition;
lenDoc = -1;
if (validLen > 0) {
pdoc->SetStyles(validLen, styleBuf);
startPosStyling += validLen;
validLen = 0;
}
}
int DocumentAccessor::IndentAmount(int line, int *flags, PFNIsCommentLeader pfnIsCommentLeader) {
int end = Length();
int spaceFlags = 0;
// Determines the indentation level of the current line and also checks for consistent
// indentation compared to the previous line.
// Indentation is judged consistent when the indentation whitespace of each line lines
// the same or the indentation of one line is a prefix of the other.
int pos = LineStart(line);
char ch = (*this)[pos];
int indent = 0;
bool inPrevPrefix = line > 0;
int posPrev = inPrevPrefix ? LineStart(line-1) : 0;
while ((ch == ' ' || ch == '\t') && (pos < end)) {
if (inPrevPrefix) {
char chPrev = (*this)[posPrev++];
if (chPrev == ' ' || chPrev == '\t') {
if (chPrev != ch)
spaceFlags |= wsInconsistent;
} else {
inPrevPrefix = false;
}
}
if (ch == ' ') {
spaceFlags |= wsSpace;
indent++;
} else { // Tab
spaceFlags |= wsTab;
if (spaceFlags & wsSpace)
spaceFlags |= wsSpaceTab;
indent = (indent / 8 + 1) * 8;
}
ch = (*this)[++pos];
}
*flags = spaceFlags;
indent += SC_FOLDLEVELBASE;
// if completely empty line or the start of a comment...
if ((ch == ' ' || ch == '\t' || ch == '\n' || ch == '\r') ||
(pfnIsCommentLeader && (*pfnIsCommentLeader)(*this, pos, end-pos)) )
return indent | SC_FOLDLEVELWHITEFLAG;
else
return indent;
}

View File

@@ -1,67 +0,0 @@
// Scintilla source code edit control
/** @file DocumentAccessor.h
** Implementation of BufferAccess and StylingAccess on a Scintilla
** rapid easy access to contents of a Scintilla.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
class Document;
/**
*/
class DocumentAccessor : public Accessor {
// Private so DocumentAccessor objects can not be copied
DocumentAccessor(const DocumentAccessor &source) : Accessor(), props(source.props) {}
DocumentAccessor &operator=(const DocumentAccessor &) { return *this; }
protected:
Document *pdoc;
PropSet &props;
WindowID id;
int lenDoc;
char styleBuf[bufferSize];
int validLen;
char chFlags;
char chWhile;
unsigned int startSeg;
int startPosStyling;
int mask;
bool InternalIsLeadByte(char ch);
void Fill(int position);
public:
DocumentAccessor(Document *pdoc_, PropSet &props_, WindowID id_=0) :
Accessor(), pdoc(pdoc_), props(props_), id(id_),
lenDoc(-1), validLen(0), chFlags(0), chWhile(0),
startSeg(0), startPosStyling(0),
mask(127) { // Initialize the mask to be big enough for any lexer.
}
~DocumentAccessor();
bool Match(int pos, const char *s);
char StyleAt(int position);
int GetLine(int position);
int LineStart(int line);
int LevelAt(int line);
int Length();
void Flush();
int GetLineState(int line);
int SetLineState(int line, int state);
int GetPropertyInt(const char *key, int defaultValue=0) {
return props.GetInt(key, defaultValue);
}
char *GetProperties() {
return props.ToString();
}
WindowID GetWindow() { return id; }
void StartAt(unsigned int start, char chMask=31);
void SetFlags(char chFlags_, char chWhile_) {chFlags = chFlags_; chWhile = chWhile_; };
unsigned int GetStartSegment() { return startSeg; }
void StartSegment(unsigned int pos);
void ColourTo(unsigned int pos, int chAttr);
void SetLevel(int line, int level);
int IndentAmount(int line, int *flags, PFNIsCommentLeader pfnIsCommentLeader = 0);
};

View File

@@ -1,581 +0,0 @@
// Scintilla source code edit control
/** @file Editor.h
** Defines the main editor class.
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef EDITOR_H
#define EDITOR_H
/**
*/
class Caret {
public:
bool active;
bool on;
int period;
Caret();
};
/**
*/
class Timer {
public:
bool ticking;
int ticksToWait;
enum {tickSize = 100};
TickerID tickerID;
Timer();
};
/**
*/
class Idler {
public:
bool state;
IdlerID idlerID;
Idler();
};
/**
*/
class LineLayout {
private:
friend class LineLayoutCache;
int *lineStarts;
int lenLineStarts;
/// Drawing is only performed for @a maxLineLength characters on each line.
int lineNumber;
bool inCache;
public:
enum { wrapWidthInfinite = 0x7ffffff };
int maxLineLength;
int numCharsInLine;
enum validLevel { llInvalid, llCheckTextAndStyle, llPositions, llLines } validity;
int xHighlightGuide;
bool highlightColumn;
int selStart;
int selEnd;
bool containsCaret;
int edgeColumn;
char *chars;
unsigned char *styles;
int styleBitsSet;
char *indicators;
int *positions;
char bracePreviousStyles[2];
// Hotspot support
int hsStart;
int hsEnd;
// Wrapped line support
int widthLine;
int lines;
LineLayout(int maxLineLength_);
virtual ~LineLayout();
void Resize(int maxLineLength_);
void Free();
void Invalidate(validLevel validity_);
int LineStart(int line) {
if (line <= 0) {
return 0;
} else if ((line >= lines) || !lineStarts) {
return numCharsInLine;
} else {
return lineStarts[line];
}
}
void SetLineStart(int line, int start);
void SetBracesHighlight(Range rangeLine, Position braces[],
char bracesMatchStyle, int xHighlight);
void RestoreBracesHighlight(Range rangeLine, Position braces[]);
};
/**
*/
class LineLayoutCache {
int level;
int length;
int size;
LineLayout **cache;
bool allInvalidated;
int styleClock;
int useCount;
void Allocate(int length_);
void AllocateForLevel(int linesOnScreen, int linesInDoc);
public:
LineLayoutCache();
virtual ~LineLayoutCache();
void Deallocate();
enum {
llcNone=SC_CACHE_NONE,
llcCaret=SC_CACHE_CARET,
llcPage=SC_CACHE_PAGE,
llcDocument=SC_CACHE_DOCUMENT
};
void Invalidate(LineLayout::validLevel validity_);
void SetLevel(int level_);
int GetLevel() { return level; }
LineLayout *Retrieve(int lineNumber, int lineCaret, int maxChars, int styleClock_,
int linesOnScreen, int linesInDoc);
void Dispose(LineLayout *ll);
};
/**
* Hold a piece of text selected for copying or dragging.
* The text is expected to hold a terminating "\0" and this is counted in len.
*/
class SelectionText {
public:
char *s;
int len;
bool rectangular;
int codePage;
int characterSet;
SelectionText() : s(0), len(0), rectangular(false), codePage(0), characterSet(0) {}
~SelectionText() {
Free();
}
void Free() {
Set(0, 0, 0, 0, false);
}
void Set(char *s_, int len_, int codePage_, int characterSet_, bool rectangular_) {
delete []s;
s = s_;
if (s)
len = len_;
else
len = 0;
codePage = codePage_;
characterSet = characterSet_;
rectangular = rectangular_;
}
void Copy(const char *s_, int len_, int codePage_, int characterSet_, bool rectangular_) {
delete []s;
s = new char[len_];
if (s) {
len = len_;
for (int i = 0; i < len_; i++) {
s[i] = s_[i];
}
} else {
len = 0;
}
codePage = codePage_;
characterSet = characterSet_;
rectangular = rectangular_;
}
void Copy(const SelectionText &other) {
Copy(other.s, other.len, other.codePage, other.characterSet, other.rectangular);
}
};
/**
*/
class Editor : public DocWatcher {
// Private so Editor objects can not be copied
Editor(const Editor &) : DocWatcher() {}
Editor &operator=(const Editor &) { return *this; }
protected: // ScintillaBase subclass needs access to much of Editor
/** On GTK+, Scintilla is a container widget holding two scroll bars
* whereas on Windows there is just one window with both scroll bars turned on. */
Window wMain; ///< The Scintilla parent window
/** Style resources may be expensive to allocate so are cached between uses.
* When a style attribute is changed, this cache is flushed. */
bool stylesValid;
ViewStyle vs;
Palette palette;
int printMagnification;
int printColourMode;
int printWrapState;
int cursorMode;
int controlCharSymbol;
bool hasFocus;
bool hideSelection;
bool inOverstrike;
int errorStatus;
bool mouseDownCaptures;
/** In bufferedDraw mode, graphics operations are drawn to a pixmap and then copied to
* the screen. This avoids flashing but is about 30% slower. */
bool bufferedDraw;
/** In twoPhaseDraw mode, drawing is performed in two phases, first the background
* and then the foreground. This avoids chopping off characters that overlap the next run. */
bool twoPhaseDraw;
int xOffset; ///< Horizontal scrolled amount in pixels
int xCaretMargin; ///< Ensure this many pixels visible on both sides of caret
bool horizontalScrollBarVisible;
int scrollWidth;
bool verticalScrollBarVisible;
bool endAtLastLine;
bool caretSticky;
Surface *pixmapLine;
Surface *pixmapSelMargin;
Surface *pixmapSelPattern;
Surface *pixmapIndentGuide;
Surface *pixmapIndentGuideHighlight;
LineLayoutCache llc;
KeyMap kmap;
Caret caret;
Timer timer;
Timer autoScrollTimer;
enum { autoScrollDelay = 200 };
Idler idler;
Point lastClick;
unsigned int lastClickTime;
int dwellDelay;
int ticksToDwell;
bool dwelling;
enum { selChar, selWord, selLine } selectionType;
Point ptMouseLast;
bool inDragDrop;
bool dropWentOutside;
int posDrag;
int posDrop;
int lastXChosen;
int lineAnchor;
int originalAnchorPos;
int currentPos;
int anchor;
int targetStart;
int targetEnd;
int searchFlags;
int topLine;
int posTopLine;
int lengthForEncode;
bool needUpdateUI;
Position braces[2];
int bracesMatchStyle;
int highlightGuideColumn;
int theEdge;
enum { notPainting, painting, paintAbandoned } paintState;
PRectangle rcPaint;
bool paintingAllText;
int modEventMask;
SelectionText drag;
enum selTypes { noSel, selStream, selRectangle, selLines };
selTypes selType;
bool moveExtendsSelection;
int xStartSelect; ///< x position of start of rectangular selection
int xEndSelect; ///< x position of end of rectangular selection
bool primarySelection;
int caretXPolicy;
int caretXSlop; ///< Ensure this many pixels visible on both sides of caret
int caretYPolicy;
int caretYSlop; ///< Ensure this many lines visible on both sides of caret
int visiblePolicy;
int visibleSlop;
int searchAnchor;
bool recordingMacro;
int foldFlags;
ContractionState cs;
// Hotspot support
int hsStart;
int hsEnd;
// Wrapping support
enum { eWrapNone, eWrapWord, eWrapChar } wrapState;
bool backgroundWrapEnabled;
int wrapWidth;
int docLineLastWrapped;
int docLastLineToWrap;
int wrapVisualFlags;
int wrapVisualFlagsLocation;
int wrapVisualStartIndent;
int actualWrapVisualStartIndent;
bool convertPastes;
Document *pdoc;
Editor();
virtual ~Editor();
virtual void Initialise() = 0;
virtual void Finalise();
void InvalidateStyleData();
void InvalidateStyleRedraw();
virtual void RefreshColourPalette(Palette &pal, bool want);
void RefreshStyleData();
void DropGraphics();
virtual PRectangle GetClientRectangle();
PRectangle GetTextRectangle();
int LinesOnScreen();
int LinesToScroll();
int MaxScrollPos();
Point LocationFromPosition(int pos);
int XFromPosition(int pos);
int PositionFromLocation(Point pt);
int PositionFromLocationClose(Point pt);
int PositionFromLineX(int line, int x);
int LineFromLocation(Point pt);
void SetTopLine(int topLineNew);
bool AbandonPaint();
void RedrawRect(PRectangle rc);
void Redraw();
void RedrawSelMargin(int line=-1);
PRectangle RectangleFromRange(int start, int end);
void InvalidateRange(int start, int end);
int CurrentPosition();
bool SelectionEmpty();
int SelectionStart();
int SelectionEnd();
void SetRectangularRange();
void InvalidateSelection(int currentPos_, int anchor_);
void SetSelection(int currentPos_, int anchor_);
void SetSelection(int currentPos_);
void SetEmptySelection(int currentPos_);
bool RangeContainsProtected(int start, int end) const;
bool SelectionContainsProtected();
int MovePositionOutsideChar(int pos, int moveDir, bool checkLineEnd=true);
int MovePositionTo(int newPos, selTypes sel=noSel, bool ensureVisible=true);
int MovePositionSoVisible(int pos, int moveDir);
void SetLastXChosen();
void ScrollTo(int line, bool moveThumb=true);
virtual void ScrollText(int linesToMove);
void HorizontalScrollTo(int xPos);
void MoveCaretInsideView(bool ensureVisible=true);
int DisplayFromPosition(int pos);
void EnsureCaretVisible(bool useMargin=true, bool vert=true, bool horiz=true);
void ShowCaretAtCurrentPosition();
void DropCaret();
void InvalidateCaret();
virtual void UpdateSystemCaret();
void NeedWrapping(int docLineStartWrapping = 0, int docLineEndWrapping = 0x7ffffff);
bool WrapLines(bool fullWrap, int priorityWrapLineStart);
void LinesJoin();
void LinesSplit(int pixelWidth);
int SubstituteMarkerIfEmpty(int markerCheck, int markerDefault);
void PaintSelMargin(Surface *surface, PRectangle &rc);
LineLayout *RetrieveLineLayout(int lineNumber);
void LayoutLine(int line, Surface *surface, ViewStyle &vstyle, LineLayout *ll,
int width=LineLayout::wrapWidthInfinite);
ColourAllocated TextBackground(ViewStyle &vsDraw, bool overrideBackground, ColourAllocated background, bool inSelection, bool inHotspot, int styleMain, int i, LineLayout *ll);
void DrawIndentGuide(Surface *surface, int lineVisible, int lineHeight, int start, PRectangle rcSegment, bool highlight);
void DrawWrapMarker(Surface *surface, PRectangle rcPlace, bool isEndMarker, ColourAllocated wrapColour);
void DrawEOL(Surface *surface, ViewStyle &vsDraw, PRectangle rcLine, LineLayout *ll,
int line, int lineEnd, int xStart, int subLine, int subLineStart,
bool overrideBackground, ColourAllocated background,
bool drawWrapMark, ColourAllocated wrapColour);
void DrawLine(Surface *surface, ViewStyle &vsDraw, int line, int lineVisible, int xStart,
PRectangle rcLine, LineLayout *ll, int subLine=0);
void RefreshPixMaps(Surface *surfaceWindow);
void Paint(Surface *surfaceWindow, PRectangle rcArea);
long FormatRange(bool draw, RangeToFormat *pfr);
int TextWidth(int style, const char *text);
virtual void SetVerticalScrollPos() = 0;
virtual void SetHorizontalScrollPos() = 0;
virtual bool ModifyScrollBars(int nMax, int nPage) = 0;
virtual void ReconfigureScrollBars();
void SetScrollBars();
void ChangeSize();
void AddChar(char ch);
virtual void AddCharUTF(char *s, unsigned int len, bool treatAsDBCS=false);
void ClearSelection();
void ClearAll();
void ClearDocumentStyle();
void Cut();
void PasteRectangular(int pos, const char *ptr, int len);
virtual void Copy() = 0;
virtual bool CanPaste();
virtual void Paste() = 0;
void OpenAppArmorInclude();
void Clear();
void SelectAll();
void Undo();
void Redo();
void DelChar();
void DelCharBack(bool allowLineStartDeletion);
virtual void ClaimSelection() = 0;
virtual void NotifyChange() = 0;
virtual void NotifyFocus(bool focus);
virtual int GetCtrlID() { return ctrlID; }
virtual void NotifyParent(SCNotification scn) = 0;
virtual void NotifyStyleToNeeded(int endStyleNeeded);
void NotifyChar(int ch);
void NotifyMove(int position);
void NotifySavePoint(bool isSavePoint);
void NotifyModifyAttempt();
virtual void NotifyDoubleClick(Point pt, bool shift);
void NotifyHotSpotClicked(int position, bool shift, bool ctrl, bool alt);
void NotifyHotSpotDoubleClicked(int position, bool shift, bool ctrl, bool alt);
void NotifyUpdateUI();
void NotifyPainted();
bool NotifyMarginClick(Point pt, bool shift, bool ctrl, bool alt);
void NotifyNeedShown(int pos, int len);
void NotifyDwelling(Point pt, bool state);
void NotifyZoom();
void NotifyModifyAttempt(Document *document, void *userData);
void NotifySavePoint(Document *document, void *userData, bool atSavePoint);
void CheckModificationForWrap(DocModification mh);
void NotifyModified(Document *document, DocModification mh, void *userData);
void NotifyDeleted(Document *document, void *userData);
void NotifyStyleNeeded(Document *doc, void *userData, int endPos);
void NotifyMacroRecord(unsigned int iMessage, uptr_t wParam, sptr_t lParam);
void PageMove(int direction, selTypes sel=noSel, bool stuttered = false);
void ChangeCaseOfSelection(bool makeUpperCase);
void LineTranspose();
void Duplicate(bool forLine);
virtual void CancelModes();
void NewLine();
void CursorUpOrDown(int direction, selTypes sel=noSel);
void ParaUpOrDown(int direction, selTypes sel=noSel);
int StartEndDisplayLine(int pos, bool start);
virtual int KeyCommand(unsigned int iMessage);
virtual int KeyDefault(int /* key */, int /*modifiers*/);
int KeyDown(int key, bool shift, bool ctrl, bool alt, bool *consumed=0);
int GetWhitespaceVisible();
void SetWhitespaceVisible(int view);
void Indent(bool forwards);
long FindText(uptr_t wParam, sptr_t lParam);
void SearchAnchor();
long SearchText(unsigned int iMessage, uptr_t wParam, sptr_t lParam);
long SearchInTarget(const char *text, int length);
void GoToLine(int lineNo);
virtual void CopyToClipboard(const SelectionText &selectedText) = 0;
char *CopyRange(int start, int end);
void CopySelectionFromRange(SelectionText *ss, int start, int end);
void CopySelectionRange(SelectionText *ss);
void CopyRangeToClipboard(int start, int end);
void CopyText(int length, const char *text);
void SetDragPosition(int newPos);
virtual void DisplayCursor(Window::Cursor c);
virtual void StartDrag();
void DropAt(int position, const char *value, bool moving, bool rectangular);
/** PositionInSelection returns 0 if position in selection, -1 if position before selection, and 1 if after.
* Before means either before any line of selection or before selection on its line, with a similar meaning to after. */
int PositionInSelection(int pos);
bool PointInSelection(Point pt);
bool PointInSelMargin(Point pt);
void LineSelection(int lineCurrent_, int lineAnchor_);
void DwellEnd(bool mouseMoved);
virtual void ButtonDown(Point pt, unsigned int curTime, bool shift, bool ctrl, bool alt);
void ButtonMove(Point pt);
void ButtonUp(Point pt, unsigned int curTime, bool ctrl);
void Tick();
bool Idle();
virtual void SetTicking(bool on) = 0;
virtual bool SetIdle(bool) { return false; }
virtual void SetMouseCapture(bool on) = 0;
virtual bool HaveMouseCapture() = 0;
void SetFocusState(bool focusState);
virtual bool PaintContains(PRectangle rc);
bool PaintContainsMargin();
void CheckForChangeOutsidePaint(Range r);
void SetBraceHighlight(Position pos0, Position pos1, int matchStyle);
void SetDocPointer(Document *document);
void Expand(int &line, bool doExpand);
void ToggleContraction(int line);
void EnsureLineVisible(int lineDoc, bool enforcePolicy);
int ReplaceTarget(bool replacePatterns, const char *text, int length=-1);
bool PositionIsHotspot(int position);
bool PointIsHotspot(Point pt);
void SetHotSpotRange(Point *pt);
void GetHotSpotRange(int& hsStart, int& hsEnd);
int CodePage() const;
int WrapCount(int line);
virtual sptr_t DefWndProc(unsigned int iMessage, uptr_t wParam, sptr_t lParam) = 0;
public:
// Public so the COM thunks can access it.
bool IsUnicodeMode() const;
// Public so scintilla_send_message can use it.
virtual sptr_t WndProc(unsigned int iMessage, uptr_t wParam, sptr_t lParam);
// Public so scintilla_set_id can use it.
int ctrlID;
friend class AutoSurface;
friend class SelectionLineIterator;
};
/**
* A smart pointer class to ensure Surfaces are set up and deleted correctly.
*/
class AutoSurface {
private:
Surface *surf;
public:
AutoSurface(Editor *ed) : surf(0) {
if (ed->wMain.GetID()) {
surf = Surface::Allocate();
if (surf) {
surf->Init(ed->wMain.GetID());
surf->SetUnicodeMode(SC_CP_UTF8 == ed->CodePage());
surf->SetDBCSMode(ed->CodePage());
}
}
}
AutoSurface(SurfaceID sid, Editor *ed) : surf(0) {
if (ed->wMain.GetID()) {
surf = Surface::Allocate();
if (surf) {
surf->Init(sid, ed->wMain.GetID());
surf->SetUnicodeMode(SC_CP_UTF8 == ed->CodePage());
surf->SetDBCSMode(ed->CodePage());
}
}
}
~AutoSurface() {
delete surf;
}
Surface *operator->() const {
return surf;
}
operator Surface *() const {
return surf;
}
};
#endif

View File

@@ -1,257 +0,0 @@
// Scintilla source code edit control
/** @file ExternalLexer.cxx
** Support external lexers in DLLs.
**/
// Copyright 2001 Simon Steele <ss@pnotepad.org>, portions copyright Neil Hodgson.
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include "Platform.h"
#include "SciLexer.h"
#include "PropSet.h"
#include "Accessor.h"
#include "DocumentAccessor.h"
#include "KeyWords.h"
#include "ExternalLexer.h"
LexerManager *LexerManager::theInstance = NULL;
//------------------------------------------
//
// ExternalLexerModule
//
//------------------------------------------
char **WordListsToStrings(WordList *val[]) {
int dim = 0;
while (val[dim])
dim++;
char **wls = new char * [dim + 1];
for (int i = 0;i < dim;i++) {
SString words;
words = "";
for (int n = 0; n < val[i]->len; n++) {
words += val[i]->words[n];
if (n != val[i]->len - 1)
words += " ";
}
wls[i] = new char[words.length() + 1];
strcpy(wls[i], words.c_str());
}
wls[dim] = 0;
return wls;
}
void DeleteWLStrings(char *strs[]) {
int dim = 0;
while (strs[dim]) {
delete strs[dim];
dim++;
}
delete [] strs;
}
void ExternalLexerModule::Lex(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const {
if (!fneLexer)
return ;
char **kwds = WordListsToStrings(keywordlists);
char *ps = styler.GetProperties();
// The accessor passed in is always a DocumentAccessor so this cast and the subsequent
// access will work. Can not use the stricter dynamic_cast as that requires RTTI.
DocumentAccessor &da = static_cast<DocumentAccessor &>(styler);
WindowID wID = da.GetWindow();
fneLexer(externalLanguage, startPos, lengthDoc, initStyle, kwds, wID, ps);
delete ps;
DeleteWLStrings(kwds);
}
void ExternalLexerModule::Fold(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const {
if (!fneFolder)
return ;
char **kwds = WordListsToStrings(keywordlists);
char *ps = styler.GetProperties();
// The accessor passed in is always a DocumentAccessor so this cast and the subsequent
// access will work. Can not use the stricter dynamic_cast as that requires RTTI.
DocumentAccessor &da = static_cast<DocumentAccessor &>(styler);
WindowID wID = da.GetWindow();
fneFolder(externalLanguage, startPos, lengthDoc, initStyle, kwds, wID, ps);
delete ps;
DeleteWLStrings(kwds);
}
void ExternalLexerModule::SetExternal(ExtLexerFunction fLexer, ExtFoldFunction fFolder, int index) {
fneLexer = fLexer;
fneFolder = fFolder;
externalLanguage = index;
}
//------------------------------------------
//
// LexerLibrary
//
//------------------------------------------
LexerLibrary::LexerLibrary(const char* ModuleName) {
// Initialise some members...
first = NULL;
last = NULL;
// Load the DLL
lib = DynamicLibrary::Load(ModuleName);
if (lib->IsValid()) {
m_sModuleName = ModuleName;
//Cannot use reinterpret_cast because: ANSI C++ forbids casting between pointers to functions and objects
GetLexerCountFn GetLexerCount = (GetLexerCountFn)lib->FindFunction("GetLexerCount");
if (GetLexerCount) {
ExternalLexerModule *lex;
LexerMinder *lm;
// Find functions in the DLL
GetLexerNameFn GetLexerName = (GetLexerNameFn)lib->FindFunction("GetLexerName");
ExtLexerFunction Lexer = (ExtLexerFunction)lib->FindFunction("Lex");
ExtFoldFunction Folder = (ExtFoldFunction)lib->FindFunction("Fold");
// Assign a buffer for the lexer name.
char lexname[100];
strcpy(lexname, "");
int nl = GetLexerCount();
for (int i = 0; i < nl; i++) {
GetLexerName(i, lexname, 100);
lex = new ExternalLexerModule(SCLEX_AUTOMATIC, NULL, lexname, NULL);
// Create a LexerMinder so we don't leak the ExternalLexerModule...
lm = new LexerMinder;
lm->self = lex;
lm->next = NULL;
if (first != NULL) {
last->next = lm;
last = lm;
} else {
first = lm;
last = lm;
}
// The external lexer needs to know how to call into its DLL to
// do its lexing and folding, we tell it here. Folder may be null.
lex->SetExternal(Lexer, Folder, i);
}
}
}
next = NULL;
}
LexerLibrary::~LexerLibrary() {
Release();
delete lib;
}
void LexerLibrary::Release() {
//TODO maintain a list of lexers created, and delete them!
LexerMinder *lm;
LexerMinder *next;
lm = first;
while (NULL != lm) {
next = lm->next;
delete lm->self;
delete lm;
lm = next;
}
first = NULL;
last = NULL;
}
//------------------------------------------
//
// LexerManager
//
//------------------------------------------
/// Return the single LexerManager instance...
LexerManager *LexerManager::GetInstance() {
if(!theInstance)
theInstance = new LexerManager;
return theInstance;
}
/// Delete any LexerManager instance...
void LexerManager::DeleteInstance()
{
if(theInstance) {
delete theInstance;
theInstance = NULL;
}
}
/// protected constructor - this is a singleton...
LexerManager::LexerManager() {
first = NULL;
last = NULL;
}
LexerManager::~LexerManager() {
Clear();
}
void LexerManager::Load(const char* path)
{
LoadLexerLibrary(path);
}
void LexerManager::LoadLexerLibrary(const char* module)
{
LexerLibrary *lib = new LexerLibrary(module);
if (NULL != first) {
last->next = lib;
last = lib;
} else {
first = lib;
last = lib;
}
}
void LexerManager::Clear()
{
if (NULL != first) {
LexerLibrary *cur = first;
LexerLibrary *next;
while (cur) {
next = cur->next;
delete cur;
cur = next;
}
first = NULL;
last = NULL;
}
}
//------------------------------------------
//
// LexerManager
//
//------------------------------------------
LMMinder::~LMMinder()
{
LexerManager::DeleteInstance();
}
LMMinder minder;

View File

@@ -1,91 +0,0 @@
// Scintilla source code edit control
/** @file ExternalLexer.h
** Support external lexers in DLLs.
**/
// Copyright 2001 Simon Steele <ss@pnotepad.org>, portions copyright Neil Hodgson.
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef EXTERNALLEXER_H
#define EXTERNALLEXER_H
#define EXT_LEXER_DECL
// External Lexer function definitions...
typedef void (EXT_LEXER_DECL *ExtLexerFunction)(unsigned int lexer, unsigned int startPos, int length, int initStyle,
char *words[], WindowID window, char *props);
typedef void (EXT_LEXER_DECL *ExtFoldFunction)(unsigned int lexer, unsigned int startPos, int length, int initStyle,
char *words[], WindowID window, char *props);
typedef void* (EXT_LEXER_DECL *GetLexerFunction)(unsigned int Index);
typedef int (EXT_LEXER_DECL *GetLexerCountFn)();
typedef void (EXT_LEXER_DECL *GetLexerNameFn)(unsigned int Index, char *name, int buflength);
//class DynamicLibrary;
/// Sub-class of LexerModule to use an external lexer.
class ExternalLexerModule : protected LexerModule {
protected:
ExtLexerFunction fneLexer;
ExtFoldFunction fneFolder;
int externalLanguage;
char name[100];
public:
ExternalLexerModule(int language_, LexerFunction fnLexer_,
const char *languageName_=0, LexerFunction fnFolder_=0) : LexerModule(language_, fnLexer_, 0, fnFolder_){
strncpy(name, languageName_, sizeof(name));
languageName = name;
};
virtual void Lex(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const;
virtual void Fold(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const;
virtual void SetExternal(ExtLexerFunction fLexer, ExtFoldFunction fFolder, int index);
};
/// LexerMinder points to an ExternalLexerModule - so we don't leak them.
class LexerMinder {
public:
ExternalLexerModule *self;
LexerMinder *next;
};
/// LexerLibrary exists for every External Lexer DLL, contains LexerMinders.
class LexerLibrary {
DynamicLibrary *lib;
LexerMinder *first;
LexerMinder *last;
public:
LexerLibrary(const char* ModuleName);
~LexerLibrary();
void Release();
LexerLibrary *next;
SString m_sModuleName;
};
/// LexerManager manages external lexers, contains LexerLibrarys.
class LexerManager {
public:
~LexerManager();
static LexerManager *GetInstance();
static void DeleteInstance();
void Load(const char* path);
void Clear();
private:
LexerManager();
static LexerManager *theInstance;
void LoadLexerLibrary(const char* module);
LexerLibrary *first;
LexerLibrary *last;
};
class LMMinder {
public:
~LMMinder();
};
#endif

View File

@@ -1,71 +0,0 @@
// Scintilla source code edit control
/** @file Indicator.cxx
** Defines the style of indicators which are text decorations such as underlining.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include "Platform.h"
#include "Scintilla.h"
#include "Indicator.h"
void Indicator::Draw(Surface *surface, const PRectangle &rc, const PRectangle &rcLine) {
surface->PenColour(fore.allocated);
int ymid = (rc.bottom + rc.top) / 2;
if (style == INDIC_SQUIGGLE) {
surface->MoveTo(rc.left, rc.top);
int x = rc.left + 2;
int y = 2;
while (x < rc.right) {
surface->LineTo(x, rc.top + y);
x += 2;
y = 2 - y;
}
surface->LineTo(rc.right, rc.top + y); // Finish the line
} else if (style == INDIC_TT) {
surface->MoveTo(rc.left, ymid);
int x = rc.left + 5;
while (x < rc.right) {
surface->LineTo(x, ymid);
surface->MoveTo(x-3, ymid);
surface->LineTo(x-3, ymid+2);
x++;
surface->MoveTo(x, ymid);
x += 5;
}
surface->LineTo(rc.right, ymid); // Finish the line
if (x - 3 <= rc.right) {
surface->MoveTo(x-3, ymid);
surface->LineTo(x-3, ymid+2);
}
} else if (style == INDIC_DIAGONAL) {
int x = rc.left;
while (x < rc.right) {
surface->MoveTo(x, rc.top+2);
int endX = x+3;
int endY = rc.top - 1;
if (endX > rc.right) {
endY += endX - rc.right;
endX = rc.right;
}
surface->LineTo(endX, endY);
x += 4;
}
} else if (style == INDIC_STRIKE) {
surface->MoveTo(rc.left, rc.top - 4);
surface->LineTo(rc.right, rc.top - 4);
} else if (style == INDIC_HIDDEN) {
// Draw nothing
} else if (style == INDIC_BOX) {
surface->MoveTo(rc.left, ymid+1);
surface->LineTo(rc.right, ymid+1);
surface->LineTo(rc.right, rcLine.top+1);
surface->LineTo(rc.left, rcLine.top+1);
surface->LineTo(rc.left, ymid+1);
} else { // Either INDIC_PLAIN or unknown
surface->MoveTo(rc.left, ymid);
surface->LineTo(rc.right, ymid);
}
}

View File

@@ -1,22 +0,0 @@
// Scintilla source code edit control
/** @file Indicator.h
** Defines the style of indicators which are text decorations such as underlining.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef INDICATOR_H
#define INDICATOR_H
/**
*/
class Indicator {
public:
int style;
ColourPair fore;
Indicator() : style(INDIC_PLAIN), fore(ColourDesired(0,0,0)) {
}
void Draw(Surface *surface, const PRectangle &rc, const PRectangle &rcLine);
};
#endif

View File

@@ -1,148 +0,0 @@
// Scintilla source code edit control
/** @file KeyMap.cxx
** Defines a mapping between keystrokes and commands.
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include "Platform.h"
#include "Scintilla.h"
#include "KeyMap.h"
KeyMap::KeyMap() : kmap(0), len(0), alloc(0) {
for (int i = 0; MapDefault[i].key; i++) {
AssignCmdKey(MapDefault[i].key,
MapDefault[i].modifiers,
MapDefault[i].msg);
}
}
KeyMap::~KeyMap() {
Clear();
}
void KeyMap::Clear() {
delete []kmap;
kmap = 0;
len = 0;
alloc = 0;
}
void KeyMap::AssignCmdKey(int key, int modifiers, unsigned int msg) {
if ((len+1) >= alloc) {
KeyToCommand *ktcNew = new KeyToCommand[alloc + 5];
if (!ktcNew)
return;
for (int k = 0; k < len; k++)
ktcNew[k] = kmap[k];
alloc += 5;
delete []kmap;
kmap = ktcNew;
}
for (int keyIndex = 0; keyIndex < len; keyIndex++) {
if ((key == kmap[keyIndex].key) && (modifiers == kmap[keyIndex].modifiers)) {
kmap[keyIndex].msg = msg;
return;
}
}
kmap[len].key = key;
kmap[len].modifiers = modifiers;
kmap[len].msg = msg;
len++;
}
unsigned int KeyMap::Find(int key, int modifiers) {
for (int i = 0; i < len; i++) {
if ((key == kmap[i].key) && (modifiers == kmap[i].modifiers)) {
return kmap[i].msg;
}
}
return 0;
}
const KeyToCommand KeyMap::MapDefault[] = {
{SCK_DOWN, SCI_NORM, SCI_LINEDOWN},
{SCK_DOWN, SCI_SHIFT, SCI_LINEDOWNEXTEND},
{SCK_DOWN, SCI_CTRL, SCI_LINESCROLLDOWN},
{SCK_DOWN, SCI_ASHIFT, SCI_LINEDOWNRECTEXTEND},
{SCK_UP, SCI_NORM, SCI_LINEUP},
{SCK_UP, SCI_SHIFT, SCI_LINEUPEXTEND},
{SCK_UP, SCI_CTRL, SCI_LINESCROLLUP},
{SCK_UP, SCI_ASHIFT, SCI_LINEUPRECTEXTEND},
{'[', SCI_CTRL, SCI_PARAUP},
{'[', SCI_CSHIFT, SCI_PARAUPEXTEND},
{']', SCI_CTRL, SCI_PARADOWN},
{']', SCI_CSHIFT, SCI_PARADOWNEXTEND},
{SCK_LEFT, SCI_NORM, SCI_CHARLEFT},
{SCK_LEFT, SCI_SHIFT, SCI_CHARLEFTEXTEND},
{SCK_LEFT, SCI_CTRL, SCI_WORDLEFT},
{SCK_LEFT, SCI_CSHIFT, SCI_WORDLEFTEXTEND},
{SCK_LEFT, SCI_ASHIFT, SCI_CHARLEFTRECTEXTEND},
{SCK_RIGHT, SCI_NORM, SCI_CHARRIGHT},
{SCK_RIGHT, SCI_SHIFT, SCI_CHARRIGHTEXTEND},
{SCK_RIGHT, SCI_CTRL, SCI_WORDRIGHT},
{SCK_RIGHT, SCI_CSHIFT, SCI_WORDRIGHTEXTEND},
{SCK_RIGHT, SCI_ASHIFT, SCI_CHARRIGHTRECTEXTEND},
{'/', SCI_CTRL, SCI_WORDPARTLEFT},
{'/', SCI_CSHIFT, SCI_WORDPARTLEFTEXTEND},
{'\\', SCI_CTRL, SCI_WORDPARTRIGHT},
{'\\', SCI_CSHIFT, SCI_WORDPARTRIGHTEXTEND},
{SCK_HOME, SCI_NORM, SCI_VCHOME},
{SCK_HOME, SCI_SHIFT, SCI_VCHOMEEXTEND},
{SCK_HOME, SCI_CTRL, SCI_DOCUMENTSTART},
{SCK_HOME, SCI_CSHIFT, SCI_DOCUMENTSTARTEXTEND},
{SCK_HOME, SCI_ALT, SCI_HOMEDISPLAY},
// {SCK_HOME, SCI_ASHIFT, SCI_HOMEDISPLAYEXTEND},
{SCK_HOME, SCI_ASHIFT, SCI_VCHOMERECTEXTEND},
{SCK_END, SCI_NORM, SCI_LINEEND},
{SCK_END, SCI_SHIFT, SCI_LINEENDEXTEND},
{SCK_END, SCI_CTRL, SCI_DOCUMENTEND},
{SCK_END, SCI_CSHIFT, SCI_DOCUMENTENDEXTEND},
{SCK_END, SCI_ALT, SCI_LINEENDDISPLAY},
// {SCK_END, SCI_ASHIFT, SCI_LINEENDDISPLAYEXTEND},
{SCK_END, SCI_ASHIFT, SCI_LINEENDRECTEXTEND},
{SCK_PRIOR, SCI_NORM, SCI_PAGEUP},
{SCK_PRIOR, SCI_SHIFT, SCI_PAGEUPEXTEND},
{SCK_PRIOR, SCI_ASHIFT, SCI_PAGEUPRECTEXTEND},
{SCK_NEXT, SCI_NORM, SCI_PAGEDOWN},
{SCK_NEXT, SCI_SHIFT, SCI_PAGEDOWNEXTEND},
{SCK_NEXT, SCI_ASHIFT, SCI_PAGEDOWNRECTEXTEND},
{SCK_DELETE, SCI_NORM, SCI_CLEAR},
{SCK_DELETE, SCI_SHIFT, SCI_CUT},
{SCK_DELETE, SCI_CTRL, SCI_DELWORDRIGHT},
{SCK_DELETE, SCI_CSHIFT, SCI_DELLINERIGHT},
{SCK_INSERT, SCI_NORM, SCI_EDITTOGGLEOVERTYPE},
{SCK_INSERT, SCI_SHIFT, SCI_PASTE},
{SCK_INSERT, SCI_CTRL, SCI_COPY},
{SCK_ESCAPE, SCI_NORM, SCI_CANCEL},
{SCK_BACK, SCI_NORM, SCI_DELETEBACK},
{SCK_BACK, SCI_SHIFT, SCI_DELETEBACK},
{SCK_BACK, SCI_CTRL, SCI_DELWORDLEFT},
{SCK_BACK, SCI_ALT, SCI_UNDO},
{SCK_BACK, SCI_CSHIFT, SCI_DELLINELEFT},
{'Z', SCI_CTRL, SCI_UNDO},
{'Y', SCI_CTRL, SCI_REDO},
{'X', SCI_CTRL, SCI_CUT},
{'C', SCI_CTRL, SCI_COPY},
{'V', SCI_CTRL, SCI_PASTE},
{'A', SCI_CTRL, SCI_SELECTALL},
{SCK_TAB, SCI_NORM, SCI_TAB},
{SCK_TAB, SCI_SHIFT, SCI_BACKTAB},
{SCK_RETURN, SCI_NORM, SCI_NEWLINE},
{SCK_RETURN, SCI_SHIFT, SCI_NEWLINE},
{SCK_ADD, SCI_CTRL, SCI_ZOOMIN},
{SCK_SUBTRACT, SCI_CTRL, SCI_ZOOMOUT},
{SCK_DIVIDE, SCI_CTRL, SCI_SETZOOM},
//'L', SCI_CTRL, SCI_FORMFEED,
{'L', SCI_CTRL, SCI_LINECUT},
{'L', SCI_CSHIFT, SCI_LINEDELETE},
{'T', SCI_CSHIFT, SCI_LINECOPY},
{'T', SCI_CTRL, SCI_LINETRANSPOSE},
{'D', SCI_CTRL, SCI_SELECTIONDUPLICATE},
{'U', SCI_CTRL, SCI_LOWERCASE},
{'U', SCI_CSHIFT, SCI_UPPERCASE},
{0,0,0},
};

View File

@@ -1,43 +0,0 @@
// Scintilla source code edit control
/** @file KeyMap.h
** Defines a mapping between keystrokes and commands.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef KEYTOCOMMAND_H
#define KEYTOCOMMAND_H
#define SCI_NORM 0
#define SCI_SHIFT SCMOD_SHIFT
#define SCI_CTRL SCMOD_CTRL
#define SCI_ALT SCMOD_ALT
#define SCI_CSHIFT (SCI_CTRL | SCI_SHIFT)
#define SCI_ASHIFT (SCI_ALT | SCI_SHIFT)
/**
*/
class KeyToCommand {
public:
int key;
int modifiers;
unsigned int msg;
};
/**
*/
class KeyMap {
KeyToCommand *kmap;
int len;
int alloc;
static const KeyToCommand MapDefault[];
public:
KeyMap();
~KeyMap();
void Clear();
void AssignCmdKey(int key, int modifiers, unsigned int msg);
unsigned int Find(int key, int modifiers); // 0 returned on failure
};
#endif

View File

@@ -1,142 +0,0 @@
// Scintilla source code edit control
/** @file KeyWords.cxx
** Colourise for particular languages.
**/
// Copyright 1998-2002 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <stdio.h>
#include <stdarg.h>
#include "Platform.h"
#include "PropSet.h"
#include "Accessor.h"
#include "KeyWords.h"
#include "Scintilla.h"
#include "SciLexer.h"
const LexerModule *LexerModule::base = 0;
int LexerModule::nextLanguage = SCLEX_AUTOMATIC+1;
LexerModule::LexerModule(int language_,
LexerFunction fnLexer_,
const char *languageName_,
LexerFunction fnFolder_,
const char * const wordListDescriptions_[],
int styleBits_) :
language(language_),
fnLexer(fnLexer_),
fnFolder(fnFolder_),
wordListDescriptions(wordListDescriptions_),
styleBits(styleBits_),
languageName(languageName_) {
next = base;
base = this;
if (language == SCLEX_AUTOMATIC) {
language = nextLanguage;
nextLanguage++;
}
}
int LexerModule::GetNumWordLists() const {
if (wordListDescriptions == NULL) {
return -1;
} else {
int numWordLists = 0;
while (wordListDescriptions[numWordLists]) {
++numWordLists;
}
return numWordLists;
}
}
const char *LexerModule::GetWordListDescription(int index) const {
static const char *emptyStr = "";
PLATFORM_ASSERT(index < GetNumWordLists());
if (index >= GetNumWordLists()) {
return emptyStr;
} else {
return wordListDescriptions[index];
}
}
int LexerModule::GetStyleBitsNeeded() const {
return styleBits;
}
const LexerModule *LexerModule::Find(int language) {
const LexerModule *lm = base;
while (lm) {
if (lm->language == language) {
return lm;
}
lm = lm->next;
}
return 0;
}
const LexerModule *LexerModule::Find(const char *languageName) {
if (languageName) {
const LexerModule *lm = base;
while (lm) {
if (lm->languageName && 0 == strcmp(lm->languageName, languageName)) {
return lm;
}
lm = lm->next;
}
}
return 0;
}
void LexerModule::Lex(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const {
if (fnLexer)
fnLexer(startPos, lengthDoc, initStyle, keywordlists, styler);
}
void LexerModule::Fold(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const {
if (fnFolder) {
int lineCurrent = styler.GetLine(startPos);
// Move back one line in case deletion wrecked current line fold state
if (lineCurrent > 0) {
lineCurrent--;
int newStartPos = styler.LineStart(lineCurrent);
lengthDoc += startPos - newStartPos;
startPos = newStartPos;
initStyle = 0;
if (startPos > 0) {
initStyle = styler.StyleAt(startPos - 1);
}
}
fnFolder(startPos, lengthDoc, initStyle, keywordlists, styler);
}
}
// Alternative historical name for Scintilla_LinkLexers
int wxForceScintillaLexers(void) {
return Scintilla_LinkLexers();
}
// To add or remove a lexer, add or remove its file and run LexGen.py.
// Force a reference to all of the Scintilla lexers so that the linker will
// not remove the code of the lexers.
int Scintilla_LinkLexers() {
static int forcer = 0;
// Shorten the code that declares a lexer and ensures it is linked in by calling a method.
#define LINK_LEXER(lexer) extern LexerModule lexer; forcer += lexer.GetLanguage();
//++Autogenerated -- run src/LexGen.py to regenerate
//**\(\tLINK_LEXER(\*);\n\)
LINK_LEXER(lmAppArmor);
return 1;
}

View File

@@ -1,82 +0,0 @@
// Scintilla source code edit control
/** @file KeyWords.h
** Colourise for particular languages.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
typedef void (*LexerFunction)(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler);
/**
* A LexerModule is responsible for lexing and folding a particular language.
* The class maintains a list of LexerModules which can be searched to find a
* module appropriate to a particular language.
*/
class LexerModule {
protected:
const LexerModule *next;
int language;
LexerFunction fnLexer;
LexerFunction fnFolder;
const char * const * wordListDescriptions;
int styleBits;
static const LexerModule *base;
static int nextLanguage;
public:
const char *languageName;
LexerModule(int language_,
LexerFunction fnLexer_,
const char *languageName_=0,
LexerFunction fnFolder_=0,
const char * const wordListDescriptions_[] = NULL,
int styleBits_=5);
virtual ~LexerModule() {
}
int GetLanguage() const { return language; }
// -1 is returned if no WordList information is available
int GetNumWordLists() const;
const char *GetWordListDescription(int index) const;
int GetStyleBitsNeeded() const;
virtual void Lex(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const;
virtual void Fold(unsigned int startPos, int lengthDoc, int initStyle,
WordList *keywordlists[], Accessor &styler) const;
static const LexerModule *Find(int language);
static const LexerModule *Find(const char *languageName);
};
/**
* Check if a character is a space.
* This is ASCII specific but is safe with chars >= 0x80.
*/
inline bool isspacechar(unsigned char ch) {
return (ch == ' ') || ((ch >= 0x09) && (ch <= 0x0d));
}
inline bool iswordchar(char ch) {
return isascii(ch) && (isalnum(ch) || ch == '.' || ch == '_');
}
inline bool iswordstart(char ch) {
return isascii(ch) && (isalnum(ch) || ch == '_');
}
inline bool isoperator(char ch) {
if (isascii(ch) && isalnum(ch))
return false;
// '.' left out as it is used to make up numbers
if (ch == '%' || ch == '^' || ch == '&' || ch == '*' ||
ch == '(' || ch == ')' || ch == '-' || ch == '+' ||
ch == '=' || ch == '|' || ch == '{' || ch == '}' ||
ch == '[' || ch == ']' || ch == ':' || ch == ';' ||
ch == '<' || ch == '>' || ch == ',' || ch == '/' ||
ch == '?' || ch == '!' || ch == '.' || ch == '~')
return true;
return false;
}

View File

@@ -1,189 +0,0 @@
// Scintilla source code edit control
/** @file LexOthers.cxx
** Lexers for batch files, diff results, properties files, make files and error lists.
** Also lexer for LaTeX documents.
**/
// Copyright 1998-2001 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <stdio.h>
#include <stdarg.h>
#include "Platform.h"
#include "PropSet.h"
#include "Accessor.h"
#include "KeyWords.h"
#include "Scintilla.h"
#include "SciLexer.h"
#include "StyleContext.h"
static inline bool IsAWordStart(const int ch) {
return (ch < 0x80) && (isalnum(ch) || ch == '_');
}
static inline bool IsAWordChar(const int ch) {
return (ch < 0x80) && (isalnum(ch) || ch == '.' || ch == '_');
}
static void ColouriseAppArmorDoc(
unsigned int startPos,
int length,
int initStyle,
WordList *keywordlists[],
Accessor &styler)
{
initStyle = SCE_APPARMOR_DEFAULT;
int stateHash = 19;
int stateCap = 20;
int pathSpaceAllowed = 0;
int pathQuoteCount = 0;
int chPrevNonWhite = ' ';
StyleContext sc(startPos, length, initStyle, styler);
for (; sc.More(); sc.Forward()) {
// Handle line continuation
if (sc.ch == '\\') {
if (sc.chNext == '\n' || sc.chNext == '\r') {
sc.Forward();
if (sc.ch == '\r' && sc.chNext == '\n') {
sc.Forward();
}
continue;
}
}
// Reset the states if we need to
if (sc.state == SCE_APPARMOR_PATH) {
if (sc.ch == '\"') {
if (pathQuoteCount == 1) {
// This is the end of a quote
pathQuoteCount = 0;
sc.ForwardSetState(SCE_APPARMOR_DEFAULT);
} else {
pathQuoteCount = 1;
sc.Forward();
sc.SetState(SCE_APPARMOR_PATH);
}
} else if ((sc.ch == ' ') || (sc.ch == '\t')) {
if (pathSpaceAllowed == 1) {
pathSpaceAllowed = 0;
sc.ForwardSetState(SCE_APPARMOR_PATH);
} else if (pathQuoteCount == 1) {
pathSpaceAllowed = 0;
sc.ForwardSetState(SCE_APPARMOR_PATH);
} else {
sc.SetState(SCE_APPARMOR_PATH_TRANSITION);
}
} else if (sc.ch == '\\') {
pathSpaceAllowed = 1;
sc.SetState(SCE_APPARMOR_PATH);
}
}
else if (sc.state == stateHash) {
if (!IsAWordChar(sc.ch)) {
char s[100];
sc.GetCurrentLowered(s, sizeof(s));
if (strcmp(s, "#include") == 0) {
sc.ChangeState(SCE_APPARMOR_INCLUDE);
} else {
sc.ChangeState(SCE_APPARMOR_COMMENT);
}
}
} else if (sc.state == stateCap) {
if (!IsAWordChar(sc.ch)) {
char t[100];
sc.GetCurrentLowered(t, sizeof(t));
if (strcmp(t, "capability") == 0) {
sc.ChangeState(SCE_APPARMOR_CAPABILITY);
}
sc.SetState(SCE_APPARMOR_DEFAULT);
}
} else if (sc.state == SCE_APPARMOR_INCLUDE) {
if (sc.ch == '\r' || sc.ch == '\n') {
sc.ForwardSetState(SCE_APPARMOR_DEFAULT);
}
} else if (sc.state == SCE_APPARMOR_COMMENT) {
if (sc.ch == '\r' || sc.ch == '\n') {
sc.ForwardSetState(SCE_APPARMOR_DEFAULT);
} else if (sc.atLineStart) {
sc.SetState(SCE_APPARMOR_DEFAULT);
} else {
sc.ForwardSetState(SCE_APPARMOR_COMMENT);
}
} else if (sc.state == SCE_APPARMOR_PATH_TRANSITION) {
if (sc.ch == 'r'
|| sc.ch == 'w'
|| sc.ch == 'l'
|| sc.ch == 'x'
|| sc.ch == 'p'
|| sc.ch == 'u'
|| sc.ch == 'i'
|| sc.ch == 'm'
|| sc.ch == 'W'
|| sc.ch == 'R'
|| sc.ch == 'X'
|| sc.ch == 'L'
|| sc.ch == 'M'
|| sc.ch == 'P'
|| sc.ch == 'U'
|| sc.ch == 'I'
|| sc.ch == ',') {
sc.SetState(SCE_APPARMOR_PERMS);
} else if (sc.ch == ' ' || sc.ch == '\t') {
sc.SetState(SCE_APPARMOR_PATH_TRANSITION);
} else {
sc.SetState (SCE_APPARMOR_DEFAULT);
}
} else if (sc.state == SCE_APPARMOR_PERMS) {
if (sc.ch == '\r' || sc.ch == '\n' || sc.ch == '{') {
sc.SetState(SCE_APPARMOR_DEFAULT);
}
}
// See if we need to enter a new state
if (sc.state == SCE_APPARMOR_DEFAULT) {
if (sc.ch == '#') {
if (sc.chNext == ' ') {
// This'll have to be a comment
sc.SetState(SCE_APPARMOR_COMMENT);
} else {
sc.SetState(stateHash);
}
} else if (sc.ch == '/') {
sc.SetState(SCE_APPARMOR_PATH);
} else if (IsAWordStart(sc.ch)) {
sc.SetState(stateCap);
} else if (sc.ch == '\"') {
if (sc.chNext == '/') {
pathQuoteCount = 1;
sc.SetState(SCE_APPARMOR_PATH);
}
}
}
if (sc.atLineEnd) {
chPrevNonWhite = ' ';
}
if (!IsASpace(sc.ch)) {
chPrevNonWhite = sc.ch;
}
}
sc.Complete();
}
static const char * const appArmorWordListDesc[] = {
"Keywords",
0
};
LexerModule lmAppArmor(SCLEX_APPARMOR, ColouriseAppArmorDoc, "apparmor", 0, appArmorWordListDesc);

View File

@@ -1,301 +0,0 @@
// Scintilla source code edit control
/** @file LineMarker.cxx
** Defines the look of a line marker in the margin .
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#include <string.h>
#include "Platform.h"
#include "Scintilla.h"
#include "XPM.h"
#include "LineMarker.h"
void LineMarker::RefreshColourPalette(Palette &pal, bool want) {
pal.WantFind(fore, want);
pal.WantFind(back, want);
if (pxpm) {
pxpm->RefreshColourPalette(pal, want);
}
}
void LineMarker::SetXPM(const char *textForm) {
delete pxpm;
pxpm = new XPM(textForm);
markType = SC_MARK_PIXMAP;
}
void LineMarker::SetXPM(const char * const *linesForm) {
delete pxpm;
pxpm = new XPM(linesForm);
markType = SC_MARK_PIXMAP;
}
static void DrawBox(Surface *surface, int centreX, int centreY, int armSize, ColourAllocated fore, ColourAllocated back) {
PRectangle rc;
rc.left = centreX - armSize;
rc.top = centreY - armSize;
rc.right = centreX + armSize + 1;
rc.bottom = centreY + armSize + 1;
surface->RectangleDraw(rc, back, fore);
}
static void DrawCircle(Surface *surface, int centreX, int centreY, int armSize, ColourAllocated fore, ColourAllocated back) {
PRectangle rcCircle;
rcCircle.left = centreX - armSize;
rcCircle.top = centreY - armSize;
rcCircle.right = centreX + armSize + 1;
rcCircle.bottom = centreY + armSize + 1;
surface->Ellipse(rcCircle, back, fore);
}
static void DrawPlus(Surface *surface, int centreX, int centreY, int armSize, ColourAllocated fore) {
PRectangle rcV(centreX, centreY - armSize + 2, centreX + 1, centreY + armSize - 2 + 1);
surface->FillRectangle(rcV, fore);
PRectangle rcH(centreX - armSize + 2, centreY, centreX + armSize - 2 + 1, centreY+1);
surface->FillRectangle(rcH, fore);
}
static void DrawMinus(Surface *surface, int centreX, int centreY, int armSize, ColourAllocated fore) {
PRectangle rcH(centreX - armSize + 2, centreY, centreX + armSize - 2 + 1, centreY+1);
surface->FillRectangle(rcH, fore);
}
void LineMarker::Draw(Surface *surface, PRectangle &rcWhole, Font &fontForCharacter) {
if ((markType == SC_MARK_PIXMAP) && (pxpm)) {
pxpm->Draw(surface, rcWhole);
return;
}
// Restrict most shapes a bit
PRectangle rc = rcWhole;
rc.top++;
rc.bottom--;
int minDim = Platform::Minimum(rc.Width(), rc.Height());
minDim--; // Ensure does not go beyond edge
int centreX = (rc.right + rc.left) / 2;
int centreY = (rc.bottom + rc.top) / 2;
int dimOn2 = minDim / 2;
int dimOn4 = minDim / 4;
int blobSize = dimOn2-1;
int armSize = dimOn2-2;
if (rc.Width() > (rc.Height() * 2)) {
// Wide column is line number so move to left to try to avoid overlapping number
centreX = rc.left + dimOn2 + 1;
}
if (markType == SC_MARK_ROUNDRECT) {
PRectangle rcRounded = rc;
rcRounded.left = rc.left + 1;
rcRounded.right = rc.right - 1;
surface->RoundedRectangle(rcRounded, fore.allocated, back.allocated);
} else if (markType == SC_MARK_CIRCLE) {
PRectangle rcCircle;
rcCircle.left = centreX - dimOn2;
rcCircle.top = centreY - dimOn2;
rcCircle.right = centreX + dimOn2;
rcCircle.bottom = centreY + dimOn2;
surface->Ellipse(rcCircle, fore.allocated, back.allocated);
} else if (markType == SC_MARK_ARROW) {
Point pts[] = {
Point(centreX - dimOn4, centreY - dimOn2),
Point(centreX - dimOn4, centreY + dimOn2),
Point(centreX + dimOn2 - dimOn4, centreY),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
fore.allocated, back.allocated);
} else if (markType == SC_MARK_ARROWDOWN) {
Point pts[] = {
Point(centreX - dimOn2, centreY - dimOn4),
Point(centreX + dimOn2, centreY - dimOn4),
Point(centreX, centreY + dimOn2 - dimOn4),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
fore.allocated, back.allocated);
} else if (markType == SC_MARK_PLUS) {
Point pts[] = {
Point(centreX - armSize, centreY - 1),
Point(centreX - 1, centreY - 1),
Point(centreX - 1, centreY - armSize),
Point(centreX + 1, centreY - armSize),
Point(centreX + 1, centreY - 1),
Point(centreX + armSize, centreY -1),
Point(centreX + armSize, centreY +1),
Point(centreX + 1, centreY + 1),
Point(centreX + 1, centreY + armSize),
Point(centreX - 1, centreY + armSize),
Point(centreX - 1, centreY + 1),
Point(centreX - armSize, centreY + 1),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
fore.allocated, back.allocated);
} else if (markType == SC_MARK_MINUS) {
Point pts[] = {
Point(centreX - armSize, centreY - 1),
Point(centreX + armSize, centreY -1),
Point(centreX + armSize, centreY +1),
Point(centreX - armSize, centreY + 1),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
fore.allocated, back.allocated);
} else if (markType == SC_MARK_SMALLRECT) {
PRectangle rcSmall;
rcSmall.left = rc.left + 1;
rcSmall.top = rc.top + 2;
rcSmall.right = rc.right - 1;
rcSmall.bottom = rc.bottom - 2;
surface->RectangleDraw(rcSmall, fore.allocated, back.allocated);
} else if (markType == SC_MARK_EMPTY || markType == SC_MARK_BACKGROUND) {
// An invisible marker so don't draw anything
} else if (markType == SC_MARK_VLINE) {
surface->PenColour(back.allocated);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, rcWhole.bottom);
} else if (markType == SC_MARK_LCORNER) {
surface->PenColour(back.allocated);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, rc.top + dimOn2);
surface->LineTo(rc.right - 2, rc.top + dimOn2);
} else if (markType == SC_MARK_TCORNER) {
surface->PenColour(back.allocated);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rc.top + dimOn2);
surface->LineTo(rc.right - 2, rc.top + dimOn2);
} else if (markType == SC_MARK_LCORNERCURVE) {
surface->PenColour(back.allocated);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, rc.top + dimOn2-3);
surface->LineTo(centreX+3, rc.top + dimOn2);
surface->LineTo(rc.right - 1, rc.top + dimOn2);
} else if (markType == SC_MARK_TCORNERCURVE) {
surface->PenColour(back.allocated);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rc.top + dimOn2-3);
surface->LineTo(centreX+3, rc.top + dimOn2);
surface->LineTo(rc.right - 1, rc.top + dimOn2);
} else if (markType == SC_MARK_BOXPLUS) {
surface->PenColour(back.allocated);
DrawBox(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
DrawPlus(surface, centreX, centreY, blobSize, back.allocated);
} else if (markType == SC_MARK_BOXPLUSCONNECTED) {
surface->PenColour(back.allocated);
DrawBox(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
DrawPlus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, centreY - blobSize);
} else if (markType == SC_MARK_BOXMINUS) {
surface->PenColour(back.allocated);
DrawBox(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
DrawMinus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
} else if (markType == SC_MARK_BOXMINUSCONNECTED) {
surface->PenColour(back.allocated);
DrawBox(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
DrawMinus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, centreY - blobSize);
} else if (markType == SC_MARK_CIRCLEPLUS) {
DrawCircle(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
surface->PenColour(back.allocated);
DrawPlus(surface, centreX, centreY, blobSize, back.allocated);
} else if (markType == SC_MARK_CIRCLEPLUSCONNECTED) {
DrawCircle(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
surface->PenColour(back.allocated);
DrawPlus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, centreY - blobSize);
} else if (markType == SC_MARK_CIRCLEMINUS) {
DrawCircle(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
surface->PenColour(back.allocated);
DrawMinus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
} else if (markType == SC_MARK_CIRCLEMINUSCONNECTED) {
DrawCircle(surface, centreX, centreY, blobSize, fore.allocated, back.allocated);
surface->PenColour(back.allocated);
DrawMinus(surface, centreX, centreY, blobSize, back.allocated);
surface->MoveTo(centreX, centreY + blobSize);
surface->LineTo(centreX, rcWhole.bottom);
surface->MoveTo(centreX, rcWhole.top);
surface->LineTo(centreX, centreY - blobSize);
} else if (markType >= SC_MARK_CHARACTER) {
char character[1];
character[0] = static_cast<char>(markType - SC_MARK_CHARACTER);
int width = surface->WidthText(fontForCharacter, character, 1);
rc.left += (rc.Width() - width) / 2;
rc.right = rc.left + width;
surface->DrawTextClipped(rc, fontForCharacter, rc.bottom - 2,
character, 1, fore.allocated, back.allocated);
} else if (markType == SC_MARK_DOTDOTDOT) {
int right = centreX - 6;
for (int b=0; b<3; b++) {
PRectangle rcBlob(right, rc.bottom - 4, right + 2, rc.bottom-2);
surface->FillRectangle(rcBlob, fore.allocated);
right += 5;
}
} else if (markType == SC_MARK_ARROWS) {
surface->PenColour(fore.allocated);
int right = centreX - 2;
for (int b=0; b<3; b++) {
surface->MoveTo(right - 4, centreY - 4);
surface->LineTo(right, centreY);
surface->LineTo(right - 5, centreY + 5);
right += 4;
}
} else if (markType == SC_MARK_SHORTARROW) {
Point pts[] = {
Point(centreX, centreY + dimOn2),
Point(centreX + dimOn2, centreY),
Point(centreX, centreY - dimOn2),
Point(centreX, centreY - dimOn4),
Point(centreX - dimOn4, centreY - dimOn4),
Point(centreX - dimOn4, centreY + dimOn4),
Point(centreX, centreY + dimOn4),
Point(centreX, centreY + dimOn2),
};
surface->Polygon(pts, sizeof(pts) / sizeof(pts[0]),
fore.allocated, back.allocated);
} else { // SC_MARK_FULLRECT
surface->FillRectangle(rcWhole, back.allocated);
}
}

View File

@@ -1,50 +0,0 @@
// Scintilla source code edit control
/** @file LineMarker.h
** Defines the look of a line marker in the margin .
**/
// Copyright 1998-2003 by Neil Hodgson <neilh@scintilla.org>
// The License.txt file describes the conditions under which this software may be distributed.
#ifndef LINEMARKER_H
#define LINEMARKER_H
/**
*/
class LineMarker {
public:
int markType;
ColourPair fore;
ColourPair back;
XPM *pxpm;
LineMarker() {
markType = SC_MARK_CIRCLE;
fore = ColourDesired(0,0,0);
back = ColourDesired(0xff,0xff,0xff);
pxpm = NULL;
}
LineMarker(const LineMarker &) {
// Defined to avoid pxpm being blindly copied, not as real copy constructor
markType = SC_MARK_CIRCLE;
fore = ColourDesired(0,0,0);
back = ColourDesired(0xff,0xff,0xff);
pxpm = NULL;
}
~LineMarker() {
delete pxpm;
}
LineMarker &operator=(const LineMarker &) {
// Defined to avoid pxpm being blindly copied, not as real assignment operator
markType = SC_MARK_CIRCLE;
fore = ColourDesired(0,0,0);
back = ColourDesired(0xff,0xff,0xff);
delete pxpm;
pxpm = NULL;
return *this;
}
void RefreshColourPalette(Palette &pal, bool want);
void SetXPM(const char *textForm);
void SetXPM(const char * const *linesForm);
void Draw(Surface *surface, PRectangle &rc, Font &fontForCharacter);
};
#endif

View File

@@ -1,19 +0,0 @@
METASOURCES = AUTO
noinst_LIBRARIES = libAppArmorStyledTextCtrl.a
libAppArmorStyledTextCtrl_a_SOURCES = AutoComplete.cxx CallTip.cxx \
CellBuffer.cxx ContractionState.cxx DocumentAccessor.cxx Document.cxx Editor.cxx \
ExternalLexer.cxx Indicator.cxx KeyMap.cxx KeyWords.cxx LineMarker.cxx PlatWX.cpp \
PropSet.cxx RESearch.cxx ScintillaBase.cxx ScintillaWX.cpp stc.cpp StyleContext.cxx \
Style.cxx UniConversion.cxx ViewStyle.cxx WindowAccessor.cxx XPM.cxx \
LexAppArmor.cxx
noinst_HEADERS = Accessor.h AutoComplete.h CallTip.h CellBuffer.h \
ContractionState.h DocumentAccessor.h Document.h Editor.h ExternalLexer.h Indicator.h \
KeyMap.h KeyWords.h LineMarker.h Platform.h PlatWX.h PropSet.h RESearch.h \
SciLexer.h ScintillaBase.h Scintilla.h ScintillaWidget.h ScintillaWX.h SString.h \
stc_cwc_d.h stc_cwc.h stc_cw_d.h stc_cw.h stc.h StyleContext.h Style.h SVector.h \
UniConversion.h ViewStyle.h WindowAccessor.h XPM.h
AM_CFLAGS = -DSCI_LEXER -DLINK_LEXERS -fPIC -DPIC -DWX_PRECOMP -DNO_GCC_PRAGMA \
-D__WXGTK__ -D__WX__
AM_CXXFLAGS = -DSCI_LEXER -DLINK_LEXERS -fPIC -DPIC -DWX_PRECOMP -DNO_GCC_PRAGMA

Some files were not shown because too many files have changed in this diff Show More