mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-09-05 08:45:22 +00:00
Compare commits
9 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
1fe80c0f85 | ||
|
8043dda3f6 | ||
|
|
e95080e140 | ||
|
|
45125cedd3 | ||
|
969a8f7618 | ||
|
|
770b8f1e88 | ||
|
|
3345250f72 | ||
|
|
51cf0848c7 | ||
|
|
e0c0a6a6a5 |
@@ -1 +1 @@
|
||||
3.1.1
|
||||
3.1.2
|
||||
|
||||
@@ -30,9 +30,12 @@ INCLUDES = $(all_includes)
|
||||
# For more information, see:
|
||||
# http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
|
||||
#
|
||||
# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
|
||||
|
||||
AA_LIB_CURRENT = 13
|
||||
AA_LIB_REVISION = 0
|
||||
AA_LIB_REVISION = 1
|
||||
AA_LIB_AGE = 12
|
||||
EXPECTED_SO_NAME = libapparmor.so.1.12.1
|
||||
|
||||
SUFFIXES = .pc.in .pc
|
||||
|
||||
@@ -81,4 +84,8 @@ tst_kernel_LDFLAGS = -pthread
|
||||
check_PROGRAMS = tst_aalogmisc tst_features tst_kernel
|
||||
TESTS = $(check_PROGRAMS)
|
||||
|
||||
.PHONY: check-local
|
||||
check-local:
|
||||
test -f ./.libs/$(EXPECTED_SO_NAME) || { echo '*** unexpected .so name/number for libapparmor (expected $(EXPECTED_SO_NAME), the actual filename is shown below) ***' ; ls -l ./.libs/libapparmor.so.*.* ; exit 1; }
|
||||
|
||||
EXTRA_DIST = grammar.y scanner.l libapparmor.map libapparmor.pc
|
||||
|
||||
@@ -159,7 +159,9 @@ aa_record_event_type lookup_aa_event(unsigned int type)
|
||||
%token TOK_KEY_NAMESPACE
|
||||
%token TOK_KEY_ERROR
|
||||
%token TOK_KEY_FSUID
|
||||
%token TOK_KEY_FSUID_UPPER
|
||||
%token TOK_KEY_OUID
|
||||
%token TOK_KEY_OUID_UPPER
|
||||
%token TOK_KEY_UID
|
||||
%token TOK_KEY_AUID
|
||||
%token TOK_KEY_SAUID
|
||||
@@ -351,6 +353,10 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
|
||||
{ ret_record->fsuid = $3;}
|
||||
| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
|
||||
{ ret_record->ouid = $3;}
|
||||
| TOK_KEY_FSUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
|
||||
{ free($3);} /* Ignore - fsuid username */
|
||||
| TOK_KEY_OUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
|
||||
{ free($3);} /* Ignore - ouid username */
|
||||
| TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS
|
||||
{ /* Ignore - Source audit ID from user AVC messages */ }
|
||||
| TOK_KEY_HOSTNAME TOK_EQUALS safe_string
|
||||
|
||||
@@ -72,7 +72,7 @@ void string_buf_append(unsigned int length, char *text)
|
||||
|
||||
%}
|
||||
|
||||
ws [ \t\r\n]
|
||||
ws [ \t\r\n\x1d]
|
||||
|
||||
equals "="
|
||||
digit [[:digit:]]
|
||||
@@ -138,7 +138,9 @@ key_sock_type "sock_type"
|
||||
key_protocol "protocol"
|
||||
key_error "error"
|
||||
key_fsuid "fsuid"
|
||||
key_fsuid_upper "FSUID"
|
||||
key_ouid "ouid"
|
||||
key_ouid_upper "OUID"
|
||||
key_uid "uid"
|
||||
key_auid "auid"
|
||||
key_sauid "sauid"
|
||||
@@ -324,7 +326,9 @@ yy_flex_debug = 0;
|
||||
{key_protocol} { return(TOK_KEY_PROTOCOL); }
|
||||
{key_error} { return(TOK_KEY_ERROR); }
|
||||
{key_fsuid} { return(TOK_KEY_FSUID); }
|
||||
{key_fsuid_upper} { return(TOK_KEY_FSUID_UPPER); }
|
||||
{key_ouid} { return(TOK_KEY_OUID); }
|
||||
{key_ouid_upper} { return(TOK_KEY_OUID_UPPER); }
|
||||
{key_uid} { return(TOK_KEY_UID); }
|
||||
{key_auid} { return(TOK_KEY_AUID); }
|
||||
{key_sauid} { return(TOK_KEY_SAUID); }
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
type=AVC msg=audit(1661734785.992:270): apparmor="ALLOWED" operation="open" profile="/usr/bin/dolphin" name="/home/otis/.config/kdedefaults/kdeglobals" pid=3483 comm="dolphin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 FSUID="otis" OUID="root"
|
||||
@@ -0,0 +1,15 @@
|
||||
START
|
||||
File: 0x1d-uppercase-FSUID-OUID.in
|
||||
Event type: AA_RECORD_ALLOWED
|
||||
Audit ID: 1661734785.992:270
|
||||
Operation: open
|
||||
Mask: r
|
||||
Denied Mask: r
|
||||
fsuid: 1000
|
||||
ouid: 0
|
||||
Profile: /usr/bin/dolphin
|
||||
Name: /home/otis/.config/kdedefaults/kdeglobals
|
||||
Command: dolphin
|
||||
PID: 3483
|
||||
Epoch: 1661734785
|
||||
Audit subid: 270
|
||||
@@ -0,0 +1,4 @@
|
||||
/usr/bin/dolphin {
|
||||
/home/otis/.config/kdedefaults/kdeglobals r,
|
||||
|
||||
}
|
||||
@@ -386,11 +386,11 @@ DISTRO=$(shell if [ -f /etc/slackware-version ] ; then \
|
||||
elif [ -f /etc/debian_version ] ; then \
|
||||
echo debian ;\
|
||||
elif which rpm > /dev/null ; then \
|
||||
if [ "$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
|
||||
if [ "$$(rpm --eval '0%{?suse_version}')" != "0" ] ; then \
|
||||
echo suse ;\
|
||||
elif [ "$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
|
||||
elif [ "$$(rpm --eval '%{_host_vendor}')" = redhat ] ; then \
|
||||
echo rhel4 ;\
|
||||
elif [ "$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
|
||||
elif [ "$$(rpm --eval '0%{?fedora}')" != "0" ] ; then \
|
||||
echo rhel4 ;\
|
||||
else \
|
||||
echo unknown ;\
|
||||
|
||||
@@ -41,8 +41,11 @@ owner @{HOME}/.config/Trolltech.conf rwk,
|
||||
owner @{HOME}/.config/baloofilerc r, # indexing options (excludes, etc), used by KFileWidget
|
||||
owner @{HOME}/.config/dolphinrc r, # settings used by KFileWidget
|
||||
owner @{HOME}/.config/kde.org/libphonon.conf r, # for KNotifications::sendEvent()
|
||||
owner @{HOME}/.config/kdedefaults/kdeglobals r, # QPlatformThemeFactory::create() -> KDEPlasmaPlatformTheme.so
|
||||
owner @{HOME}/.config/kdedefaults/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so
|
||||
owner @{HOME}/.config/kdeglobals r, # global settings, used by Breeze style, etc.
|
||||
owner @{HOME}/.config/klanguageoverridesrc r, # per-application languages, for KDEPrivate::initializeLanguages() from libKF5XmlGui.so
|
||||
owner @{HOME}/.config/kwinrc r, # QStyleFactory::create() -> qt5/plugins/styles/breeze.so
|
||||
owner @{HOME}/.config/trashrc r, # Used by KFileWidget
|
||||
|
||||
/usr/share/X11/XKeysymDB r,
|
||||
|
||||
@@ -25,9 +25,9 @@
|
||||
/var/log/samba/cores/** rw,
|
||||
/var/log/samba/* w,
|
||||
@{run}/{,lock/}samba/ w,
|
||||
@{run}/{,lock/}samba/*.tdb rw,
|
||||
@{run}/{,lock/}samba/msg.lock/ rwk,
|
||||
@{run}/{,lock/}samba/msg.lock/[0-9]* rwk,
|
||||
@{run}/{,lock/}samba/*.tdb rwk,
|
||||
@{run}/{,lock/}samba/msg.{lock,sock}/ rwk,
|
||||
@{run}/{,lock/}samba/msg.{lock,sock}/[0-9]* rwk,
|
||||
/var/cache/samba/msg.lock/ rwk,
|
||||
/var/cache/samba/msg.lock/[0-9]* rwk,
|
||||
|
||||
|
||||
@@ -16,7 +16,8 @@ profile samba-bgqd /usr/lib*/samba/{,samba/}samba-bgqd {
|
||||
|
||||
@{run}/samba/samba-bgqd.pid wk,
|
||||
|
||||
/usr/lib*/samba/{,samba/}samba-bgqd m,
|
||||
/usr/lib*/samba/{,samba/}samba-bgqd mr,
|
||||
/var/cache/samba/printing/*.tdb rwk,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/samba-bgqd>
|
||||
|
||||
@@ -18,8 +18,9 @@ profile samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {
|
||||
|
||||
@{run}/samba/samba-dcerpcd.pid wk,
|
||||
|
||||
/usr/lib*/samba/{,samba/}samba-dcerpcd m,
|
||||
/usr/lib*/samba/{,samba/}samba-dcerpcd mr,
|
||||
|
||||
/usr/lib*/samba/ r,
|
||||
/usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} Px -> samba-rpcd,
|
||||
/usr/lib*/samba/{,samba/}rpcd_classic Px -> samba-rpcd-classic,
|
||||
/usr/lib*/samba/{,samba/}rpcd_spoolss Px -> samba-rpcd-spoolss,
|
||||
|
||||
@@ -15,7 +15,10 @@ include <tunables/global>
|
||||
|
||||
profile samba-rpcd /usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} {
|
||||
include <abstractions/samba-rpcd>
|
||||
/usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} m,
|
||||
/usr/lib*/samba/{,samba/}rpcd_{mdssvc,epmapper,rpcecho,fsrvp,lsad,winreg} mr,
|
||||
|
||||
@{run}/samba/ncalrpc/np/winreg wr,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/samba-rpcd>
|
||||
}
|
||||
|
||||
@@ -17,7 +17,7 @@ profile samba-rpcd-classic /usr/lib*/samba/{,samba/}rpcd_classic {
|
||||
include <abstractions/samba-rpcd>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
/usr/lib*/samba/{,samba/}rpcd_classic m,
|
||||
/usr/lib*/samba/{,samba/}rpcd_classic mr,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/samba-rpcd-classic>
|
||||
|
||||
@@ -16,8 +16,16 @@ include <tunables/global>
|
||||
profile samba-rpcd-spoolss /usr/lib*/samba/{,samba/}rpcd_spoolss {
|
||||
include <abstractions/samba-rpcd>
|
||||
|
||||
/usr/lib*/samba/{,samba/}rpcd_spoolss m,
|
||||
/usr/lib*/samba/{,samba/}rpcd_spoolss mr,
|
||||
/usr/lib*/samba/{,samba/}samba-bgqd Px -> samba-bgqd,
|
||||
/var/cache/samba/printing/ w,
|
||||
/var/cache/samba/printing/*.tdb rwk,
|
||||
@{run}/samba/samba-bgqd.pid rk,
|
||||
|
||||
/dev/urandom rw,
|
||||
|
||||
@{run}/samba/ncalrpc/ rw,
|
||||
@{run}/samba/ncalrpc/** rw,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include if exists <local/samba-rpcd-spoolss>
|
||||
|
||||
@@ -61,6 +61,7 @@ profile syslog-ng /{usr/,}{bin,sbin}/syslog-ng {
|
||||
/{var,var/run,run}/log/journal/ r,
|
||||
/{var,var/run,run}/log/journal/*/ r,
|
||||
/{var,var/run,run}/log/journal/*/*.journal r,
|
||||
/{var,var/run,run}/log/journal/*.journal r,
|
||||
@{run}/syslog-ng.ctl a,
|
||||
@{run}/syslog-ng/additional-log-sockets.conf r,
|
||||
|
||||
|
||||
@@ -1119,7 +1119,7 @@ def ask_the_questions(log_dict):
|
||||
else:
|
||||
sev_db.set_variables({})
|
||||
|
||||
if True:
|
||||
if aa.get(profile): # only continue/ask if the parent profile exists
|
||||
if not aa[profile].get(hat, {}).get('file'):
|
||||
if aamode != 'merge':
|
||||
# Ignore log events for a non-existing profile or child profile. Such events can occur
|
||||
|
||||
Reference in New Issue
Block a user