Prepare for AppArmor 3.0.1 release

- update version file

Signed-off-by: John Johansen <john.johansen@canonical.com>

.gitignore

@@ -4,9 +4,6 @@ binutils/aa-enabled
 binutils/aa-enabled.1
 binutils/aa-exec
 binutils/aa-exec.1
-binutils/aa-features-abi
-binutils/aa-features-abi.1
-binutils/aa-load
 binutils/aa-status
 binutils/aa-status.8
 binutils/cJSON.o
@@ -15,7 +12,6 @@ parser/po/*.mo
 parser/af_names.h
 parser/cap_names.h
 parser/generated_cap_names.h
-parser/generated_af_names.h
 parser/tst_lib
 parser/tst_misc
 parser/tst_regex
@@ -40,7 +36,6 @@ parser/libapparmor_re/hfa.o
 parser/libapparmor_re/libapparmor_re.a
 parser/libapparmor_re/parse.o
 parser/mount.o
-parser/mqueue.o
 parser/network.o
 parser/parser_alias.o
 parser/parser_common.o
@@ -60,8 +55,6 @@ parser/profile.o
 parser/ptrace.o
 parser/rule.o
 parser/signal.o
-parser/userns.o
-parser/io_uring.o
 parser/*.7
 parser/*.5
 parser/*.8
@@ -164,7 +157,6 @@ libraries/libapparmor/swig/perl/libapparmor_wrap.c
 libraries/libapparmor/swig/perl/libapparmor_wrap.o
 libraries/libapparmor/swig/perl/pm_to_blib
 libraries/libapparmor/swig/python/LibAppArmor.py
-libraries/libapparmor/swig/python/LibAppArmor.egg-info/
 libraries/libapparmor/swig/python/build/
 libraries/libapparmor/swig/python/libapparmor_wrap.c
 libraries/libapparmor/swig/python/Makefile
@@ -181,7 +173,7 @@ libraries/libapparmor/swig/ruby/LibAppArmor_wrap.c
 libraries/libapparmor/swig/ruby/LibAppArmor_wrap.o
 libraries/libapparmor/swig/ruby/Makefile
 libraries/libapparmor/swig/ruby/Makefile.in
-libraries/libapparmor/swig/ruby/Makefile.bak
+libraries/libapparmor/swig/ruby/Makefile.new
 libraries/libapparmor/swig/ruby/Makefile.ruby
 libraries/libapparmor/swig/ruby/mkmf.log
 libraries/libapparmor/testsuite/.deps
@@ -209,22 +201,14 @@ utils/*.tmp
 utils/po/*.mo
 utils/apparmor/*.pyc
 utils/apparmor/rule/*.pyc
-utils/apparmor.egg-info/
-utils/build/
-utils/htmlcov/
 utils/test/common_test.pyc
 utils/test/.coverage
-utils/test/coverage-report.txt
 utils/test/htmlcov/
 utils/vim/apparmor.vim
 utils/vim/apparmor.vim.5
 utils/vim/apparmor.vim.5.html
 utils/vim/pod2htmd.tmp
-tests/regression/apparmor/*.o
-tests/regression/apparmor/aa_policy_cache
 tests/regression/apparmor/access
-tests/regression/apparmor/at_secure
-tests/regression/apparmor/attach_disconnected
 tests/regression/apparmor/changehat
 tests/regression/apparmor/changehat_fail
 tests/regression/apparmor/changehat_fork
@@ -239,10 +223,6 @@ tests/regression/apparmor/chgrp
 tests/regression/apparmor/chmod
 tests/regression/apparmor/chown
 tests/regression/apparmor/clone
-tests/regression/apparmor/dbus_eavesdrop
-tests/regression/apparmor/dbus_message
-tests/regression/apparmor/dbus_service
-tests/regression/apparmor/dbus_unrequested_reply
 tests/regression/apparmor/deleted
 tests/regression/apparmor/env_check
 tests/regression/apparmor/environ
@@ -253,11 +233,7 @@ tests/regression/apparmor/fchdir
 tests/regression/apparmor/fchgrp
 tests/regression/apparmor/fchmod
 tests/regression/apparmor/fchown
-tests/regression/apparmor/fd_inheritance
-tests/regression/apparmor/fd_inheritor
 tests/regression/apparmor/fork
-tests/regression/apparmor/introspect
-tests/regression/apparmor/io_uring
 tests/regression/apparmor/link
 tests/regression/apparmor/link_subset
 tests/regression/apparmor/mkdir
@@ -268,22 +244,15 @@ tests/regression/apparmor/net_raw
 tests/regression/apparmor/open
 tests/regression/apparmor/openat
 tests/regression/apparmor/pipe
-tests/regression/apparmor/pivot_root
-tests/regression/apparmor/posix_mq_rcv
-tests/regression/apparmor/posix_mq_snd
 tests/regression/apparmor/ptrace
 tests/regression/apparmor/ptrace_helper
 tests/regression/apparmor/pwrite
-tests/regression/apparmor/query_label
 tests/regression/apparmor/readdir
 tests/regression/apparmor/rename
 tests/regression/apparmor/rw
-tests/regression/apparmor/socketpair
 tests/regression/apparmor/swap
 tests/regression/apparmor/symlink
 tests/regression/apparmor/syscall_chroot
-tests/regression/apparmor/syscall_ioperm
-tests/regression/apparmor/syscall_iopl
 tests/regression/apparmor/syscall_mknod
 tests/regression/apparmor/syscall_mlockall
 tests/regression/apparmor/syscall_ptrace
@@ -294,20 +263,11 @@ tests/regression/apparmor/syscall_setpriority
 tests/regression/apparmor/syscall_setscheduler
 tests/regression/apparmor/syscall_sysctl
 tests/regression/apparmor/sysctl_proc
-tests/regression/apparmor/sysv_mq_rcv
-tests/regression/apparmor/sysv_mq_snd
 tests/regression/apparmor/tcp
-tests/regression/apparmor/transition
 tests/regression/apparmor/unix_fd_client
 tests/regression/apparmor/unix_fd_server
-tests/regression/apparmor/unix_socket
-tests/regression/apparmor/unix_socket_client
 tests/regression/apparmor/unlink
-tests/regression/apparmor/userns
-tests/regression/apparmor/userns_setns
-tests/regression/apparmor/uservars.inc
 tests/regression/apparmor/xattrs
-tests/regression/apparmor/xattrs_profile
 tests/regression/apparmor/coredump
 **/__pycache__/
 *.orig

.gitlab-ci.yml

@@ -1,5 +1,9 @@
 ---
 image: ubuntu:latest
+before_script:
+  - export DEBIAN_FRONTEND=noninteractive && apt-get update -qq && apt-get install --no-install-recommends -y build-essential apache2-dev autoconf automake bison dejagnu flex libpam-dev libtool perl liblocale-gettext-perl pkg-config python-all-dev python3-all-dev pyflakes3 ruby-dev swig lsb-release python3-notify2 python3-psutil zlib1g-dev
+  - lsb_release -a
+  - uname -a
 
 # XXX - add a deploy stage to publish man pages, docs, and coverage
 # reports
@@ -8,159 +12,44 @@ stages:
   - build
   - test
 
-.ubuntu-before_script:
-  before_script:
-    - export DEBIAN_FRONTEND=noninteractive
-    - apt-get update -qq
-    - apt-get install --no-install-recommends -y gcc perl liblocale-gettext-perl linux-libc-dev lsb-release make
-    - lsb_release -a
-    - uname -a
-
-.install-c-build-deps: &install-c-build-deps
-  - apt-get install --no-install-recommends -y build-essential apache2-dev autoconf automake bison dejagnu flex libpam-dev libtool pkg-config python3-all-dev python3-setuptools ruby-dev swig zlib1g-dev
-
 build-all:
   stage: build
-  extends:
-    - .ubuntu-before_script
   artifacts:
     name: ${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHA}
     expire_in: 30 days
     untracked: true
     paths:
-      - libraries/libapparmor/
-      - parser/
-      - binutils/
-      - utils/
-      - changehat/mod_apparmor/
-      - changehat/pam_apparmor/
-      - profiles/
+        - libraries/libapparmor/
+        - parser/
+        - binutils/
+        - utils/
+        - changehat/mod_apparmor/
+        - changehat/pam_apparmor/
+        - profiles/
   script:
-    - *install-c-build-deps
-    - cd libraries/libapparmor && ./autogen.sh && ./configure --with-perl --with-python --prefix=/usr && make && cd ../.. || { cat config.log ; exit 1 ; }
-    - make -C parser
-    - make -C binutils
-    - make -C utils
-    - make -C changehat/mod_apparmor
-    - make -C changehat/pam_apparmor
-    - make -C profiles
+      - cd libraries/libapparmor && ./autogen.sh && ./configure --with-perl --with-python --prefix=/usr && make && cd ../.. || { cat config.log ; exit 1 ; }
+      - make -C parser
+      - make -C binutils
+      - make -C utils
+      - make -C changehat/mod_apparmor
+      - make -C changehat/pam_apparmor
+      - make -C profiles
 
-test-libapparmor:
+test-all:
   stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
   script:
-    - *install-c-build-deps
-    - make -C libraries/libapparmor check
-
-test-parser:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
-  script:
-    - *install-c-build-deps
-    - make -C parser check
-
-test-binutils:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
-  script:
-    - make -C binutils check
-
-test-utils:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
-  script:
-    - apt-get install --no-install-recommends -y libc6-dev libjs-jquery libjs-jquery-throttle-debounce libjs-jquery-isonscreen libjs-jquery-tablesorter pyflakes3 python3-coverage python3-notify2 python3-psutil python3-setuptools
-    # See apparmor/apparmor#221
-    - make -C parser/tst gen_dbus
-    - make -C parser/tst gen_xtrans
-    - make -C utils check
-    - make -C utils/test coverage-regression
-  artifacts:
-    paths:
-      - utils/test/htmlcov/
-    when: always
-
-test-mod-apparmor:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
-  script:
-    - make -C changehat/mod_apparmor check
-
-test-profiles:
-  stage: test
-  needs: ["build-all"]
-  extends:
-    - .ubuntu-before_script
-  script:
-    - make -C profiles check-parser
-    - make -C profiles check-abstractions.d
-    - make -C profiles check-extras
-
-shellcheck:
-  stage: test
-  needs: []
-  extends:
-    - .ubuntu-before_script
-  script:
-  - apt-get install --no-install-recommends -y file shellcheck xmlstarlet
-  - shellcheck --version
-  - './tests/bin/shellcheck-tree --format=checkstyle
-       | xmlstarlet tr tests/checkstyle2junit.xslt
-       > shellcheck.xml'
-  artifacts:
-    when: always
-    reports:
-      junit: shellcheck.xml
+      - make -C libraries/libapparmor check
+      - make -C parser check
+      - make -C binutils check
+      - make -C utils check
+      - make -C changehat/mod_apparmor check
+      - make -C profiles check-parser
+      - make -C profiles check-abstractions.d
 
 # Disabled due to aa-logprof dependency on /sbin/apparmor_parser existing
-#   - make -C profiles check-profiles
+#      - make -C profiles check-profiles
 
 # test-pam_apparmor:
 #  - stage: test
 #  - script:
 #    - cd changehat/pam_apparmor && make check
-
-include:
-  - template: SAST.gitlab-ci.yml
-  - template: Secret-Detection.gitlab-ci.yml
-
-variables:
-  SAST_EXCLUDED_ANALYZERS: "eslint,flawfinder,semgrep,spotbugs"
-  SAST_BANDIT_EXCLUDED_PATHS: "*/tst/*, */test/*"
-
-.send-to-coverity: &send-to-coverity
-  - curl https://scan.coverity.com/builds?project=$COVERITY_SCAN_PROJECT_NAME
-    --form token=$COVERITY_SCAN_TOKEN --form email=$GITLAB_USER_EMAIL
-    --form file=@$(ls apparmor-*-cov-int.tar.gz) --form version="$(git describe --tags)"
-    --form description="$(git describe --tags) / $CI_COMMIT_TITLE / $CI_COMMIT_REF_NAME:$CI_PIPELINE_ID"
-
-coverity:
-  stage: .post
-  extends:
-    - .ubuntu-before_script
-  only:
-    refs:
-      - master
-  script:
-      - apt-get install --no-install-recommends -y curl git texlive-latex-recommended
-      - *install-c-build-deps
-      - curl -o /tmp/cov-analysis-linux64.tgz https://scan.coverity.com/download/linux64
-        --form project=$COVERITY_SCAN_PROJECT_NAME --form token=$COVERITY_SCAN_TOKEN
-      - tar xfz /tmp/cov-analysis-linux64.tgz
-      - COV_VERSION=$(ls -dt cov-analysis-linux64-* | head -1)
-      - PATH=$PATH:$(pwd)/$COV_VERSION/bin
-      - make coverity
-      - *send-to-coverity
-  artifacts:
-    paths:
-      - "apparmor-*.tar.gz"

.shellcheckrc

@@ -1,10 +0,0 @@
-# Don't follow source'd scripts
-disable=SC1090
-disable=SC1091
-
-# dash supports 'local'
-disable=SC2039
-disable=SC3043
-
-# dash supports 'echo -n'
-disable=SC3037

binutils/Makefile

@@ -48,10 +48,10 @@ endif
 # Internationalization support. Define a package and a LOCALEDIR
 EXTRA_CFLAGS+=-DPACKAGE=\"${NAME}\" -DLOCALEDIR=\"${LOCALEDIR}\"
 
-SRCS = aa_enabled.c aa_load.c
+SRCS = aa_enabled.c
 HDRS =
 BINTOOLS = aa-enabled aa-exec aa-features-abi
-SBINTOOLS = aa-status aa-load
+SBINTOOLS = aa-status
 
 AALIB = -Wl,-Bstatic -lapparmor  -Wl,-Bdynamic -lpthread
 
@@ -126,9 +126,6 @@ endif
 aa-features-abi: aa_features_abi.c $(LIBAPPARMOR_A)
 	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
 
-aa-load: aa_load.c $(LIBAPPARMOR_A)
-	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB)
-
 aa-enabled: aa_enabled.c $(LIBAPPARMOR_A)
 	$(CC) $(LDFLAGS) $(EXTRA_CFLAGS) -o $@ $< $(LIBS) $(AALIB) 
 

binutils/aa-status.pod

@@ -72,18 +72,11 @@ displays the number of loaded non-enforcing AppArmor policies.
 
 =item --kill
 
-displays the number of loaded enforcing AppArmor policies that will
-kill tasks on policy violations.
-
-=item --prompt
-
-displays the number of loaded enforcing AppArmor policies, with
-fallback to userspace mediation.
+displays the number of loaded enforcing AppArmor policies that will kill tasks on policy violations.
 
 =item --special-unconfined
 
-displays the number of loaded non-enforcing AppArmor policies that are
-in the special unconfined mode.
+displays the number of loaded non-enforcing AppArmor policies that are in the special unconfined mode.
 
 =item --process-mixed
 displays the number of processes confined by profile stacks with
@@ -104,40 +97,6 @@ set in a JSON format, fit for machine consumption.
 same as --json, formatted to be readable by humans as well
 as by machines.
 
-=item --show
-
-what data sets to show information about. Currently I<processes>,
-I<profiles>, I<all> for both processes and profiles. The default is
-I<all>.
-
-=item --count
-
-display only counts for selected information.
-
-=item --filter.mode=filter
-
-Allows specifying a posix regular expression filter that will be
-applied against the displayed processess and profiles apparmor profile
-mode, reducing the output.
-
-=item --filter.profiles=filter
-
-Allows specifying a posix regular expression filter that will be
-applied against the displayed processess and profiles confining
-profile, reducing the output.
-
-=item --filter.pid=filter
-
-Allows specifying a posix regular expression filter that will be
-applied against the displayed processes, so that only processes pids
-matching the expression will be displayed.
-
-=item --filter.exe=filter
-
-Allows specifying a posix regular expression filter that will be
-applied against the displayed processes, so that only processes
-executable name matching the expression will be displayed.
-
 =item --help
 
 displays a short usage statement.
@@ -165,8 +124,7 @@ if apparmor is enabled but no policy is loaded.
 
 =item B<3>
 
-if the apparmor control files aren't available under
-/sys/kernel/security/.
+if the apparmor control files aren't available under /sys/kernel/security/.
 
 =item B<4>
 
@@ -182,9 +140,8 @@ if an internal error occurred.
 =head1 BUGS
 
 B<aa-status> must be run as root to read the state of the loaded
-policy from the apparmor module. It uses the /proc filesystem to
-determine which processes are confined and so is susceptible to race
-conditions.
+policy from the apparmor module. It uses the /proc filesystem to determine
+which processes are confined and so is susceptible to race conditions.
 
 If you find any additional bugs, please report them at
 L<https://gitlab.com/apparmor/apparmor/-/issues>.

binutils/aa_features_abi.c

@@ -124,7 +124,7 @@ static char **parse_args(int argc, char **argv)
 		{"stdout", no_argument, 0, ARG_STDOUT},
 	};
 
-	while ((opt = getopt_long(argc, argv, "+dvhxf:l:w:", long_opts, NULL)) != -1) {
+	while ((opt = getopt_long(argc, argv, "+dvhxl:w:", long_opts, NULL)) != -1) {
 		switch (opt) {
 		case 'd':
 			opt_debug = true;
@@ -181,7 +181,7 @@ int main(int argc, char **argv)
 			error("failed to extract features abi from the kernel");
 	}
 	if (opt_file) {
-		in = open(opt_file, O_RDONLY);
+		int in = open(opt_file, O_RDONLY);
 		if (in == -1)
 			error("failed to open file '%s'", opt_file);
 		rc = aa_features_new_from_file(&features, in);

binutils/aa_load.c

@@ -1,408 +0,0 @@
-/*
- *   Copyright (C) 2020 Canonical Ltd.
- *
- *   This program is free software; you can redistribute it and/or
- *   modify it under the terms of version 2 of the GNU General Public
- *   License published by the Free Software Foundation.
- */
-
-#define _GNU_SOURCE /* for asprintf() */
-#include <stdio.h>
-#include <errno.h>
-#include <getopt.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <stdarg.h>
-#include <stddef.h>
-#include <fcntl.h>
-#include <string.h>
-#include <dirent.h>
-
-#include <sys/types.h>
-#include <sys/stat.h>
-
-#include <sys/apparmor.h>
-
-#include <libintl.h>
-#define _(s) gettext(s)
-
-/* TODO: implement config locations - value can change */
-#define DEFAULT_CONFIG_LOCATIONS "/etc/apparmor/parser.conf"
-#define DEFAULT_POLICY_LOCATIONS "/var/cache/apparmor:/etc/apparmor.d/cache.d:/etc/apparmor.d/cache"
-#define CACHE_FEATURES_FILE ".features"
-
-bool opt_debug = false;
-bool opt_verbose = false;
-bool opt_dryrun = false;
-bool opt_force = false;
-bool opt_config = false;
-
-#define warning(fmt, args...) _error(_("aa-load: WARN: " fmt "\n"), ## args)
-#define error(fmt, args...) _error(_("aa-load: ERROR: " fmt "\n"), ## args)
-static void _error(const char *fmt, ...)
-{
-	va_list args;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-
-#define verbose(fmt, args...) _debug(opt_verbose, _(fmt "\n"), ## args)
-#define debug(fmt, args...) _debug(opt_debug, _("aa-load: DEBUG: " fmt "\n"), ## args)
-static void _debug(bool opt_displayit, const char *fmt, ...)
-{
-	va_list args;
-
-	if (!opt_displayit)
-		return;
-
-	va_start(args, fmt);
-	vfprintf(stderr, fmt, args);
-	va_end(args);
-}
-
-static int have_enough_privilege(const char *command)
-{
-	uid_t uid, euid;
-
-	uid = getuid();
-	euid = geteuid();
-
-	if (uid != 0 && euid != 0) {
-		error("%s: Sorry. You need root privileges to run this program.\n",
-		      command);
-		return EPERM;
-	}
-
-	if (uid != 0 && euid == 0) {
-		error("%s: Aborting! You've set this program setuid root.\n"
-		      "Anybody who can run this program can update "
-		      "your AppArmor profiles.\n", command);
-		exit(EXIT_FAILURE);
-	}
-
-	return 0;
-}
-
-
-static int load_config(const char *file)
-{
-	/* TODO */
-	return ENOENT;
-}
-
-/**
- * load a single policy cache file to the kernel
- */
-static int load_policy_file(const char *file)
-{
-	int rc = 0;
-
-	struct aa_kernel_interface *kernel_interface;
-
-	if (aa_kernel_interface_new(&kernel_interface, NULL, NULL)) {
-		rc = -errno;
-		error("Failed to open kernel interface '%s': %m", file);
-		return rc;
-	}
-	if (!opt_dryrun &&
-	    aa_kernel_interface_replace_policy_from_file(kernel_interface,
-							 AT_FDCWD, file)) {
-		rc = -errno;
-		error("Failed to load policy into kernel '%s': %m", file);
-	}
-	aa_kernel_interface_unref(kernel_interface);
-
-	return rc;
-}
-
-static void validate_features(const char *dir_path)
-{
-	aa_features *kernel_features;
-
-	if (aa_features_new_from_kernel(&kernel_features) == -1) {
-		error("Failed to obtain features: %m");
-		return;
-	}
-
-	if (aa_features_check(AT_FDCWD, dir_path, kernel_features) == -1) {
-		if (errno == ENOENT) {
-			/* features file does not exist
-			 * not an issue when loading cache policies from dir
-			 */
-		}
-		else if (errno == EEXIST) {
-			warning("Overlay features do not match kernel features");
-		}
-	}
-	aa_features_unref(kernel_features);
-}
-
-/**
- * load a directory of policy cache files to the kernel
- * This does not do a subdir search to find the kernel match but
- * tries to load the dir regardless of whether its features match
- *
- * The hierarchy looks like
- *
- * dir/
- *     .features
- *     profile1
- *     ...
- */
-
-static int load_policy_dir(const char *dir_path)
-{
-	DIR *d;
-	struct dirent *dir;
-	int rc = 0;
-	char *file;
-	size_t len;
-
-	validate_features(dir_path);
-
-	d = opendir(dir_path);
-	if (!d) {
-		rc = -errno;
-		error("Failed to open directory '%s': %m", dir_path);
-		return rc;
-	}
-
-	while ((dir = readdir(d)) != NULL) {
-		/* Only check regular files for now */
-		if (dir->d_type == DT_REG) {
-			len = strnlen(dir->d_name, PATH_MAX);
-			/* Ignores .features */
-			if (strncmp(dir->d_name, CACHE_FEATURES_FILE, len) == 0) {
-				continue;
-			}
-			if (asprintf(&file, "%s/%s", dir_path, dir->d_name) == -1) {
-				error("Failure allocating memory");
-				closedir(d);
-				return -1;
-			}
-			load_policy_file(file);
-			free(file);
-			file = NULL;
-		}
-	}
-	closedir(d);
-	return 0;
-}
-
-
-/**
- * load_hashed_policy - find policy hashed dir and load it
- *
- * load/replace all policy from a policy hierarchy directory
- *
- * Returns: 0 on success < -errno
- *
- * It will find the subdir that matches the kernel and load all
- * precompiled policy files from it.
- *
- * The hierarchy looks something like
- *
- * location/
- *          kernel_hash1.0/
- *                         .features
- *                         profile1
- *                         ...
- *          kernel_hash2.0/
- *                        .features
- *                        profile1
- *                        ...
- */
-static int load_policy_by_hash(const char *location)
-{
-	aa_policy_cache *policy_cache = NULL;
-	int rc;
-
-	if ((rc = aa_policy_cache_new(&policy_cache, NULL, AT_FDCWD, location, 0))) {
-		rc = -errno;
-		error("Failed to open policy cache '%s': %m", location);
-		return rc;
-	}
-
-	if (opt_debug) {
-		/* show hash directory under location that matches the
-		 * current kernel
-		 */
-		char *cache_loc = aa_policy_cache_dir_path_preview(NULL, AT_FDCWD, location);
-		if (!cache_loc) {
-			rc = -errno;
-			error("Failed to find cache location '%s': %m", location);
-			goto out;
-		}
-		debug("Loading cache from '%s'\n", cache_loc);
-		free(cache_loc);
-	}
-
-	if (!opt_dryrun) {
-		if ((rc = aa_policy_cache_replace_all(policy_cache, NULL)) < 0) {
-			error("Failed to load policy cache '%s': %m", location);
-		} else {
-			verbose("Success - Loaded policy cache '%s'", location);
-		}
-	}
-
-out:
-	aa_policy_cache_unref(policy_cache);
-
-	return rc;
-}
-
-/**
- * load_arg - calls specific load functions for files and directories
- *
- * load/replace all policy files/dir in arg
- *
- * Returns: 0 on success, 1 on failure.
- *
- * It will load by hash subtree first, and fallback to a cache dir
- * If not a directory, it will try to load it as a cache file
- */
-static int load_arg(char *arg)
-{
-	char **location = NULL;
-	int i, n, rc = 0;
-
-
-	/* arg can specify an overlay of multiple cache locations */
-	if ((n = aa_split_overlay_str(arg, &location, 0, true)) == -1) {
-		error("Failed to parse overlay locations: %m");
-		return 1;
-	}
-
-	for (i = 0; i < n; i++) {
-		struct stat st;
-		debug("Trying to open %s", location[i]);
-		if (stat(location[i], &st) == -1) {
-			error("Failed stat of '%s': %m", location[i]);
-			rc = 1;
-			continue;
-		}
-		if (S_ISDIR(st.st_mode)) {
-			/* try hash dir subtree first */
-			if (load_policy_by_hash(location[i]) < 0) {
-				error("Failed load policy by hash '%s': %m", location[i]);
-				rc = 1;
-			}
-			/* fall back to cache dir */
-			if (load_policy_dir(location[i]) < 0) {
-				error("Failed load policy by directory '%s': %m", location[i]);
-				rc = 1;
-			}
-
-		} else if (load_policy_file(location[i]) < 0) {
-			rc = 1;
-		}
-	}
-
-	for (i = 0; i < n; i++)
-		free(location[i]);
-	free(location);
-	return rc;
-}
-
-static void print_usage(const char *command)
-{
-	printf("Usage: %s [OPTIONS] (cache file|cache dir|cache base dir)]*\n"
-	       "Load Precompiled AppArmor policy from a cache location or \n"
-	       "locations.\n\n"
-	       "Options:\n"
-	       "  -f, --force     load policy even if abi does not match the kernel\n"
-	       "  -d, --debug     display debug messages\n"
-	       "  -v, --verbose   display progress and error messages\n"
-	       "  -n, --dry-run   do everything except actual load\n"
-	       "  -h, --help      this message\n",
-	       command);
-}
-
-static const char *short_options = "c:dfvnh";
-struct option long_options[] = {
-	{"config",	1, 0, 'c'},
-	{"debug",	0, 0, 'd'},
-	{"force",	0, 0, 'f'},
-	{"verbose",	0, 0, 'v'},
-	{"dry-run",	0, 0, 'n'},
-	{"help",	0, 0, 'h'},
-	{NULL, 0, 0, 0},
-};
-
-static int process_args(int argc, char **argv)
-{
-	int c, o;
-
-	opterr = 1;
-	while ((c = getopt_long(argc, argv, short_options, long_options, &o)) != -1) {
-		switch(c) {
-		case 0:
-			error("error in argument processing\n");
-			exit(1);
-			break;
-		case 'd':
-			opt_debug = true;
-			break;
-		case 'f':
-			opt_force = true;
-			break;
-		case 'v':
-			opt_verbose = true;
-			break;
-		case 'n':
-			opt_dryrun = true;
-			break;
-		case 'h':
-			print_usage(argv[0]);
-			exit(0);
-			break;
-		case 'c':
-			/* TODO: reserved config location,
-			 *  act as a bad arg for now, when added update usage
-			 */
-			//opt_config = true; uncomment when implemented
-			/* Fall through */
-		default:
-			error("unknown argument: '%s'\n\n", optarg);
-			print_usage(argv[1]);
-			exit(1);
-			break;
-		}
-	}
-
-	return optind;
-}
-
-int main(int argc, char **argv)
-{
-	int i, rc = 0;
-
-	optind = process_args(argc, argv);
-
-	if (!opt_dryrun && have_enough_privilege(argv[0]))
-		return 1;
-
-	/* if no location use the default one */
-	if (optind == argc) {
-		if (!opt_config && load_config(DEFAULT_CONFIG_LOCATIONS) == 0) {
-			verbose("Loaded policy config");
-		}
-		if ((rc = load_arg(DEFAULT_POLICY_LOCATIONS)))
-			verbose("Loading policy from default location '%s'", DEFAULT_POLICY_LOCATIONS);
-		else
-			debug("No policy specified, and no policy config or policy in default locations");
-	}
-	for (i = optind; i < argc; i++) {
-		/* Try to load all policy locations even if one fails
-		 * but always return an error if any fail
-		 */
-
-		int tmp = load_arg(argv[i]);
-		if (!rc)
-			rc = tmp;
-	}
-
-	return rc;
-}

binutils/po/aa-enabled.pot

@@ -1,66 +0,0 @@
-# Copyright (C) 2015 Canonical Ltd
-# This file is distributed under the same license as the AppArmor package.
-# John Johansen <john.johansen@canonical.com>, 2015.
-#
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: PACKAGE VERSION\n"
-"Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2015-11-28 10:23-0800\n"
-"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: LANGUAGE <LL@li.org>\n"
-"Language: \n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=CHARSET\n"
-"Content-Transfer-Encoding: 8bit\n"
-
-#: ../aa_enabled.c:26
-#, c-format
-msgid ""
-"%s: [options]\n"
-"  options:\n"
-"  -q | --quiet        Don't print out any messages\n"
-"  -h | --help         Print help\n"
-msgstr ""
-
-#: ../aa_enabled.c:45
-#, c-format
-msgid "unknown or incompatible options\n"
-msgstr ""
-
-#: ../aa_enabled.c:55
-#, c-format
-msgid "unknown option '%s'\n"
-msgstr ""
-
-#: ../aa_enabled.c:64
-#, c-format
-msgid "Yes\n"
-msgstr ""
-
-#: ../aa_enabled.c:71
-#, c-format
-msgid "No - not available on this system.\n"
-msgstr ""
-
-#: ../aa_enabled.c:74
-#, c-format
-msgid "No - disabled at boot.\n"
-msgstr ""
-
-#: ../aa_enabled.c:77
-#, c-format
-msgid "Maybe - policy interface not available.\n"
-msgstr ""
-
-#: ../aa_enabled.c:81
-#, c-format
-msgid "Maybe - insufficient permissions to determine availability.\n"
-msgstr ""
-
-#: ../aa_enabled.c:84
-#, c-format
-msgid "Error - '%s'\n"
-msgstr ""

binutils/po/aa_enabled.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2020-10-14 03:52-0700\n"
+"POT-Creation-Date: 2020-10-14 03:58-0700\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -22,7 +22,7 @@ msgstr ""
 msgid ""
 "%s: [options]\n"
 "  options:\n"
-"  -x | --exclusive    Shared interfaces must be available\n"
+"  -x | --exclusive    Shared interfaces must be availabe\n"
 "  -q | --quiet        Don't print out any messages\n"
 "  -h | --help         Print help\n"
 msgstr ""

binutils/po/aa_exec.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2020-10-14 03:52-0700\n"
+"POT-Creation-Date: 2020-10-14 03:58-0700\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

binutils/po/aa_features_abi.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: apparmor@lists.ubuntu.com\n"
-"POT-Creation-Date: 2020-10-14 03:52-0700\n"
+"POT-Creation-Date: 2020-10-14 03:58-0700\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"

changehat/mod_apparmor/mod_apparmor.c

@@ -412,7 +412,7 @@ register_hooks(unused_ apr_pool_t *p)
 
 module AP_MODULE_DECLARE_DATA apparmor_module = {
     STANDARD20_MODULE_STUFF,
-    aa_create_dir_config,        /* dir config creator */
+    aa_create_dir_config,        /* dir config creater */
     NULL,                        /* dir merger --- default is to override */
     /* immunix_merge_dir_config, */        /* dir merger --- default is to override */
     aa_create_srv_config,        /* server config */

changehat/tomcat_apparmor/tomcat_5_0/README.tomcat_apparmor

@@ -66,8 +66,8 @@ under src/jni_src.
   cp dist/libJNIChangeHat.so /usr/lib
 
   [Note: you must ensure that the target directory is passed to tomcat via the
-   java.library.path property. This can be accomplished by setting the JAVA_OPTS
-   environment variable, export JAVA_OPTS=-Djava.library.path, or set via the
+   java.library.path propert. This can be accomplished by setting the JAVA_OPTS
+   enviroment variable, export JAVA_OPTS=-Djava.library.path, or set via the 
    env variable LD_LIBRARY_PATH to include this directory so that tomcat can 
    find this library at startup]
 
@@ -108,13 +108,13 @@ under src/jni_src.
 Once the installation steps above have been started you are ready to begin 
 creating a profile for your application. The profile creation tool genprof will
 guide you through generating a profile and its support for change_hat will 
-prompt you create discrete hats as requested by the changeHatValve during
+prompt you create discrete hats as requested byt the changeHatValve during 
 tomcat execution.
 
   1. Create a basic profile for the tomcat server.
 
      - Run the command "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then stop tomcat
+     - In a seperate window start tomcat and then stop tomcat
      - In the genprof window press "S" to scan for events
      - Answer the questions about the initial profile for tomcat
 
@@ -124,7 +124,7 @@ tomcat execution.
      - Stop the tomcat server
      - Deploy your WAR file or equivalent files under the container. 
      - execute "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then exercise your web application
+     - In a seperate window start tomcat and then exercise your web application
      - In the genprof window press "S" to scan for events
        During the prompting you will be asked questions similar to:
   
@@ -180,7 +180,7 @@ all subsequent resource requests will be mediated in this hew hat (or security
 context).        
 If you choose to use the default hat: genprof will mediate all resource 
 requests in the default hat for the duration of processing this request.
-When the request processing is complete the valve will change_hat back to the
+When the request processng is complete the valve will change_hat back to the 
 parent context.
 
 

changehat/tomcat_apparmor/tomcat_5_5/README.tomcat_apparmor

@@ -66,8 +66,8 @@ under src/jni_src.
   cp dist/libJNIChangeHat.so /usr/lib
 
   [Note: you must ensure that the target directory is passed to tomcat via the
-   java.library.path property. This can be accomplished by setting the JAVA_OPTS
-   environment variable, export JAVA_OPTS=-Djava.library.path, or set via the
+   java.library.path propert. This can be accomplished by setting the JAVA_OPTS
+   enviroment variable, export JAVA_OPTS=-Djava.library.path, or set via the 
    env variable LD_LIBRARY_PATH to include this directory so that tomcat can 
    find this library at startup]
 
@@ -108,13 +108,13 @@ under src/jni_src.
 Once the installation steps above have been started you are ready to begin 
 creating a profile for your application. The profile creation tool genprof will
 guide you through generating a profile and its support for change_hat will 
-prompt you create discrete hats as requested by the changeHatValve during
+prompt you create discrete hats as requested byt the changeHatValve during 
 tomcat execution.
 
   1. Create a basic profile for the tomcat server.
 
      - Run the command "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then stop tomcat
+     - In a seperate window start tomcat and then stop tomcat
      - In the genprof window press "S" to scan for events
      - Answer the questions about the initial profile for tomcat
 
@@ -124,7 +124,7 @@ tomcat execution.
      - Stop the tomcat server
      - Deploy your WAR file or equivalent files under the container. 
      - execute "genprof PATH_TO_CATALINA.SH"
-     - In a separate window start tomcat and then exercise your web application
+     - In a seperate window start tomcat and then exercise your web application
      - In the genprof window press "S" to scan for events
        During the prompting you will be asked questions similar to:
   
@@ -180,7 +180,7 @@ all subsequent resource requests will be mediated in this hew hat (or security
 context).        
 If you choose to use the default hat: genprof will mediate all resource 
 requests in the default hat for the duration of processing this request.
-When the request processing is complete the valve will change_hat back to the
+When the request processng is complete the valve will change_hat back to the 
 parent context.
 
 

common/Make.rules

@@ -42,7 +42,6 @@ endif
 
 define nl
 
-
 endef
 
 REPO_VERSION_CMD=[ -x /usr/bin/git ] && /usr/bin/git describe --tags --long --abbrev=16 --match 'v*' 2> /dev/null || awk '{ print $2 }' common/.stamp_rev

common/Version

@@ -1 +1 @@
-4.0.0~alpha2
+3.0.1

common/list_af_names.sh

@@ -6,7 +6,7 @@
 # the source tree
 # =====================
 
-# It doesn't make sense for AppArmor to mediate PF_UNIX, filter it out. Search
+# It doesn't make sence for AppArmor to mediate PF_UNIX, filter it out. Search
 # for "PF_" constants since that is what is required in bits/socket.h, but
 # rewrite as "AF_".
 

libraries/libapparmor/configure.ac

@@ -58,7 +58,7 @@ if test "$with_perl" = "yes"; then
    AC_PATH_PROG(PERL, perl)
    test -z "$PERL" && AC_MSG_ERROR([perl is required when enabling perl bindings])
    perl_includedir="`$PERL -e 'use Config; print $Config{archlib}'`/CORE"
-   AS_IF([test -e "$perl_includedir/perl.h"], enable_perl=yes, enable_perl=no)
+   AC_CHECK_FILE($perl_includedir/perl.h, enable_perl=yes, enable_perl=no)
 fi
 
 

libraries/libapparmor/doc/aa_find_mountpoint.pod

@@ -70,10 +70,6 @@ AppArmor extensions to the system are not available.
 
 AppArmor is available on the system but has been disabled at boot.
 
-=item B<EBUSY>
-
-AppArmor is available but only via private interfaces.
-
 =item B<ENOENT>
 
 AppArmor is available (and maybe even enforcing policy) but the interface is

libraries/libapparmor/doc/aa_policy_cache.pod

@@ -125,7 +125,7 @@ layer. Binary policy cache files will be located in the directory
 returned by this function.
 
 The aa_policy_cache_dir_levels() function provides access to the number
-of directories that are being overlaid to create the policy cache.
+of directories that are being overlayed to create the policy cache.
 
 
 =head1 RETURN VALUE

libraries/libapparmor/include/aalogparse.h

@@ -159,8 +159,6 @@ typedef struct
 	char *fs_type;
 	char *flags;
 	char *src_name;
-
-	char *class;
 } aa_log_record;
 
 /**

libraries/libapparmor/include/sys/apparmor.h

@@ -157,8 +157,6 @@ extern int aa_features_write_to_file(aa_features *features,
 				     int dirfd, const char *path);
 extern bool aa_features_is_equal(aa_features *features1,
 				 aa_features *features2);
-extern int aa_features_check(int dirfd, const char *path,
-			     aa_features *features);
 extern bool aa_features_supports(aa_features *features, const char *str);
 extern char *aa_features_id(aa_features *features);
 extern char *aa_features_value(aa_features *features, const char *str, size_t *len);
@@ -211,8 +209,6 @@ extern char *aa_policy_cache_filename(aa_policy_cache *policy_cache, const char
 extern char *aa_policy_cache_dir_path_preview(aa_features *kernel_features,
 					      int dirfd, const char *path);
 
-extern int aa_split_overlay_str(char *str, char ***vec, size_t max_size, bool immutable);
-
 #ifdef __cplusplus
 }
 #endif

libraries/libapparmor/m4/ac_python_devel.m4

@@ -13,7 +13,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
            PYTHON_VERSION=""
         fi
 
-        AC_PATH_TOOL([PYTHON_CONFIG],[`basename [$PYTHON]-config`])
+        AC_PATH_PROG([PYTHON_CONFIG],[`basename [$PYTHON]-config`])
         if test -z "$PYTHON_CONFIG"; then
            AC_MSG_ERROR([Cannot find python$PYTHON_VERSION-config in your system path])
         fi
@@ -66,17 +66,17 @@ variable to configure. See ``configure --help'' for reference.
         fi
 
         #
-        # Check if you have setuptools, else fail
+        # Check if you have distutils, else fail
         #
-        AC_MSG_CHECKING([for the setuptools Python package])
-        ac_setuptools_result=`$PYTHON -c "import setuptools" 2>&1`
-        if test -z "$ac_setuptools_result"; then
+        AC_MSG_CHECKING([for the distutils Python package])
+        ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`
+        if test -z "$ac_distutils_result"; then
                 AC_MSG_RESULT([yes])
         else
                 AC_MSG_RESULT([no])
-                AC_MSG_ERROR([cannot import Python module "setuptools".
+                AC_MSG_ERROR([cannot import Python module "distutils".
 Please check your Python installation. The error was:
-$ac_setuptools_result])
+$ac_distutils_result])
                 PYTHON_VERSION=""
         fi
 
@@ -88,8 +88,8 @@ $ac_setuptools_result])
                 PYTHON_CPPFLAGS=`$PYTHON_CONFIG --includes`
         fi
         if test -z "$PYTHON_CPPFLAGS"; then
-                python_path=`$PYTHON -c "import sys; import sysconfig;\
-sys.stdout.write('%s\n' % sysconfig.get_path('include'));"`
+                python_path=`$PYTHON -c "import sys; import distutils.sysconfig;\
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_inc());"`
                 if test -n "${python_path}"; then
                         python_path="-I$python_path"
                 fi
@@ -108,8 +108,8 @@ sys.stdout.write('%s\n' % sysconfig.get_path('include'));"`
         if test -z "$PYTHON_LDFLAGS"; then
                 # (makes two attempts to ensure we've got a version number
                 # from the interpreter)
-                py_version=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('%s\n' % ''.join(sysconfig.get_config_vars('VERSION')))"`
+                py_version=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('%s\n' % ''.join(get_config_vars('VERSION')))"`
                 if test "$py_version" == "[None]"; then
                         if test -n "$PYTHON_VERSION"; then
                                 py_version=$PYTHON_VERSION
@@ -119,8 +119,8 @@ sys.stdout.write("%s\n" % sys.version[[:3]])"`
                         fi
                 fi
 
-                PYTHON_LDFLAGS=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('-L' + sysconfig.get_path('stdlib') + ' -lpython\n')"`$py_version`$PYTHON -c \
+                PYTHON_LDFLAGS=`$PYTHON -c "import sys; from distutils.sysconfig import *; \
+sys.stdout.write('-L' + get_python_lib(0,1) + ' -lpython\n')"`$py_version`$PYTHON -c \
 "import sys; sys.stdout.write('%s' % getattr(sys,'abiflags',''))"`
         fi
         AC_MSG_RESULT([$PYTHON_LDFLAGS])
@@ -131,8 +131,8 @@ sys.stdout.write('-L' + sysconfig.get_path('stdlib') + ' -lpython\n')"`$py_versi
         #
         AC_MSG_CHECKING([for Python site-packages path])
         if test -z "$PYTHON_SITE_PKG"; then
-                PYTHON_SITE_PKG=`$PYTHON -c "import sys; import sysconfig; \
-sys.stdout.write('%s\n' % sysconfig.get_path('purelib'));"`
+                PYTHON_SITE_PKG=`$PYTHON -c "import sys; import distutils.sysconfig; \
+sys.stdout.write('%s\n' % distutils.sysconfig.get_python_lib(0,0));"`
         fi
         AC_MSG_RESULT([$PYTHON_SITE_PKG])
         AC_SUBST([PYTHON_SITE_PKG])
@@ -146,8 +146,8 @@ sys.stdout.write('%s\n' % sysconfig.get_path('purelib'));"`
                         PYTHON_EXTRA_LIBS=''
         fi
         if test -z "$PYTHON_EXTRA_LIBS"; then
-           PYTHON_EXTRA_LIBS=`$PYTHON -c "import sys; import sysconfig; \
-conf = sysconfig.get_config_var; \
+           PYTHON_EXTRA_LIBS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
 sys.stdout.write('%s %s %s\n' % (conf('BLDLIBRARY'), conf('LOCALMODLIBS'), conf('LIBS')))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LIBS])
@@ -162,8 +162,8 @@ sys.stdout.write('%s %s %s\n' % (conf('BLDLIBRARY'), conf('LOCALMODLIBS'), conf(
                         PYTHON_EXTRA_LDFLAGS=''
         fi
         if test -z "$PYTHON_EXTRA_LDFLAGS"; then
-                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import sys; import sysconfig; \
-conf = sysconfig.get_config_var; \
+                PYTHON_EXTRA_LDFLAGS=`$PYTHON -c "import sys; import distutils.sysconfig; \
+conf = distutils.sysconfig.get_config_var; \
 sys.stdout.write('%s\n' % conf('LINKFORSHARED'))"`
         fi
         AC_MSG_RESULT([$PYTHON_EXTRA_LDFLAGS])

libraries/libapparmor/src/Makefile.am

@@ -11,13 +11,9 @@ INCLUDES = $(all_includes)
 # 3. If any interfaces have been added, removed, or changed since the last
 #    update,
 #    - increment AA_LIB_CURRENT
-#      - by 1 if bugfix release
-#      - by 5 on larger releases. This gives room to fix library interface
-#        problems in the unlikely event where an interface has to break.
 #    - set AA_LIB_REVISION to 0.
 # 4. If any interfaces have been added since the last public release, then
-#    - increment AA_LIB_AGE by the same amount that AA_LIB_CURRENT was
-#      incremented.
+#    - increment AA_LIB_AGE.
 # 5. If any interfaces have been removed or changed since the last public
 #    release, then
 #    - set AA_LIB_AGE to 0.
@@ -30,12 +26,9 @@ INCLUDES = $(all_includes)
 # For more information, see:
 # http://www.gnu.org/software/libtool/manual/html_node/Libtool-versioning.html
 #
-# After changing the AA_LIB_* variables, also update EXPECTED_SO_NAME.
-
-AA_LIB_CURRENT = 18
+AA_LIB_CURRENT = 9
 AA_LIB_REVISION = 0
-AA_LIB_AGE = 17
-EXPECTED_SO_NAME = libapparmor.so.1.17.0
+AA_LIB_AGE = 8
 
 SUFFIXES = .pc.in .pc
 
@@ -45,7 +38,7 @@ include $(COMMONDIR)/Make.rules
 BUILT_SOURCES = grammar.h scanner.h af_protos.h
 AM_LFLAGS = -v
 AM_YFLAGS = -d -p aalogparse_
-AM_CFLAGS = -Wall $(EXTRA_WARNINGS) -fPIC -flto-partition=none
+AM_CFLAGS = -Wall $(EXTRA_WARNINGS) -fPIC
 AM_CPPFLAGS = -D_GNU_SOURCE -I$(top_srcdir)/include/
 scanner.h: scanner.l
 	$(LEX) -v $<
@@ -59,7 +52,7 @@ lib_LTLIBRARIES = libapparmor.la
 noinst_HEADERS = grammar.h parser.h scanner.h af_protos.h private.h PMurHash.h
 
 libapparmor_la_SOURCES = grammar.y libaalogparse.c kernel.c scanner.c private.c features.c kernel_interface.c policy_cache.c PMurHash.c
-libapparmor_la_LDFLAGS = -version-info $(AA_LIB_CURRENT):$(AA_LIB_REVISION):$(AA_LIB_AGE) -XCClinker -Bdynamic -pthread \
+libapparmor_la_LDFLAGS = -version-info $(AA_LIB_CURRENT):$(AA_LIB_REVISION):$(AA_LIB_AGE) -XCClinker -dynamic -pthread \
 	-Wl,--version-script=$(top_srcdir)/src/libapparmor.map
 
 pkgconfigdir = $(libdir)/pkgconfig
@@ -84,8 +77,4 @@ tst_kernel_LDFLAGS = -pthread
 check_PROGRAMS = tst_aalogmisc tst_features tst_kernel
 TESTS = $(check_PROGRAMS)
 
-.PHONY: check-local
-check-local:
-	test -f ./.libs/$(EXPECTED_SO_NAME) || { echo '*** unexpected .so name/number for libapparmor (expected $(EXPECTED_SO_NAME), the actual filename is shown below) ***' ; ls -l ./.libs/libapparmor.so.*.* ; exit 1; }
-
 EXTRA_DIST = grammar.y scanner.l libapparmor.map libapparmor.pc

libraries/libapparmor/src/features.c

@@ -35,7 +35,6 @@
 #include "PMurHash.h"
 
 #define FEATURES_FILE "/sys/kernel/security/apparmor/features"
-#define CACHE_FEATURES_FILE ".features"
 
 #define HASH_SIZE (8 + 1) /* 32 bits binary to hex + NUL terminator */
 #define STRING_SIZE 8192
@@ -195,8 +194,6 @@ static int features_dir_cb(int dirfd, const char *name, struct stat *st,
 	if (features_snprintf(fst, "%s {", name) == -1)
 		return -1;
 
-	/* Handle symlink here. See _aa_dirat_for_each in private.c */
-
 	if (S_ISREG(st->st_mode)) {
 		ssize_t len;
 		size_t remaining;
@@ -659,44 +656,6 @@ bool aa_features_is_equal(aa_features *features1, aa_features *features2)
 	       strcmp(features1->string, features2->string) == 0;
 }
 
-/**
- * aa_features_check - check if features from a directory matches an aa_features object
- * @dirfd: a directory file descriptory or AT_FDCWD (see openat(2))
- * @path: the path containing the features
- * @features: features to be matched against
- *
- * Returns: 0 on success, -1 on failure. errno is set to EEXIST when there's not a match
- */
-int aa_features_check(int dirfd, const char *path,
-		      aa_features *features)
-{
-	aa_features *local_features = NULL;
-	autofree char *name = NULL;
-	bool rc;
-	int len;
-
-	len = asprintf(&name, "%s/%s", path, CACHE_FEATURES_FILE);
-	if (len == -1) {
-		errno = ENOMEM;
-		return -1;
-	}
-
-	/* verify that path dir .features matches */
-	if (aa_features_new(&local_features, dirfd, name)) {
-		PDEBUG("could not setup new features object for dirfd '%d' '%s'\n", dirfd, name);
-		return -1;
-	}
-
-	rc = aa_features_is_equal(local_features, features);
-	aa_features_unref(local_features);
-	if (!rc) {
-		errno = EEXIST;
-		return -1;
-	}
-
-	return 0;
-}
-
 static const char *features_lookup(aa_features *features, const char *str)
 {
 	const char *features_string = features->string;
@@ -705,7 +664,7 @@ static const char *features_lookup(aa_features *features, const char *str)
 
 	/* Empty strings are not accepted. Neither are leading '/' chars. */
 	if (!str || str[0] == '/')
-		return NULL;
+		return false;
 
 	/**
 	 * Break @str into an array of components. For example,
@@ -718,7 +677,7 @@ static const char *features_lookup(aa_features *features, const char *str)
 
 	/* At least one valid token is required */
 	if (!num_components)
-		return NULL;
+		return false;
 
 	/* Ensure that all components are valid and found */
 	for (i = 0; i < num_components; i++) {

libraries/libapparmor/src/grammar.y

@@ -38,7 +38,7 @@
 #if (YYDEBUG != 0)
 #define debug_unused_ /* nothing */
 #else
-#define debug_unused_ unused_
+#define no_debug_unused_ unused_
 #endif
 
 aa_log_record *ret_record;
@@ -46,7 +46,7 @@ aa_log_record *ret_record;
 /* Since we're a library, on any errors we don't want to print out any
  * error messages. We should probably add a debug interface that does
  * emit messages when asked for. */
-void aalogparse_error(unused_ void *scanner, debug_unused_ char const *s)
+void aalogparse_error(unused_ void *scanner, no_debug_unused_ char const *s)
 {
 #if (YYDEBUG != 0)
 	printf("ERROR: %s\n", s);
@@ -159,9 +159,7 @@ aa_record_event_type lookup_aa_event(unsigned int type)
 %token TOK_KEY_NAMESPACE
 %token TOK_KEY_ERROR
 %token TOK_KEY_FSUID
-%token TOK_KEY_FSUID_UPPER
 %token TOK_KEY_OUID
-%token TOK_KEY_OUID_UPPER
 %token TOK_KEY_UID
 %token TOK_KEY_AUID
 %token TOK_KEY_SAUID
@@ -187,9 +185,7 @@ aa_record_event_type lookup_aa_event(unsigned int type)
 %token TOK_KEY_FSTYPE
 %token TOK_KEY_FLAGS
 %token TOK_KEY_SRCNAME
-%token TOK_KEY_CLASS
 
-%token TOK_SOCKLOGD_KERNEL
 %token TOK_SYSLOG_KERNEL
 %token TOK_SYSLOG_USER
 
@@ -236,28 +232,24 @@ dmesg_type: TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id key_list
 	{ ret_record->version = AA_RECORD_SYNTAX_V2; free($1); }
 	;
 
-syslog_id: TOK_ID TOK_SYSLOG_KERNEL { free($1); }
-	| TOK_SOCKLOGD_KERNEL { }
-	;
-
 syslog_type:
-	  syslog_date syslog_id audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; }
-	| syslog_date syslog_id key_type audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; }
-	| syslog_date syslog_id TOK_DMESG_STAMP audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($3); }
-	| syslog_date syslog_id TOK_DMESG_STAMP key_type audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($3); }
-	/* needs update: hard newline in handling multiline log messages */
-	| syslog_date syslog_id TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id audit_user_msg_partial_tail
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($3); }
-	| syslog_date syslog_id TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id audit_user_msg_tail
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($3); }
-	| syslog_date syslog_id TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($3); }
-	| syslog_date syslog_id TOK_AUDIT TOK_COLON key_type audit_id key_list
-	  { ret_record->version = AA_RECORD_SYNTAX_V2; }
+	  syslog_date TOK_ID TOK_SYSLOG_KERNEL audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL key_type audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); free($4); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP key_type audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); free($4); }
+	/* needs update: hard newline in handling mutiline log messages */
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id audit_user_msg_partial_tail
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id audit_user_msg_tail
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_DMESG_STAMP TOK_AUDIT TOK_COLON key_type audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); free($4); }
+	| syslog_date TOK_ID TOK_SYSLOG_KERNEL TOK_AUDIT TOK_COLON key_type audit_id key_list
+	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
 	| syslog_date TOK_ID TOK_SYSLOG_USER key_list
 	  { ret_record->version = AA_RECORD_SYNTAX_V2; free($2); }
 	;
@@ -354,10 +346,6 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 	{ ret_record->fsuid = $3;}
 	| TOK_KEY_OUID TOK_EQUALS TOK_DIGITS
 	{ ret_record->ouid = $3;}
-	| TOK_KEY_FSUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
-	{ free($3);} /* Ignore - fsuid username */
-	| TOK_KEY_OUID_UPPER TOK_EQUALS TOK_QUOTED_STRING
-	{ free($3);} /* Ignore - ouid username */
 	| TOK_KEY_SAUID TOK_EQUALS TOK_DIGITS
 	{ /* Ignore - Source audit ID from user AVC messages */ }
 	| TOK_KEY_HOSTNAME TOK_EQUALS safe_string
@@ -385,7 +373,7 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 	| TOK_KEY_CAPABILITY TOK_EQUALS TOK_DIGITS
 	{ /* need to reverse map number to string, need to figure out
 	   * how to get auto generation of reverse mapping table into
-	   * autotools Makefile.  For now just drop assuming capname is
+	   * autotools Makefile.  For now just drop assumming capname is
 	   * present which it should be with current kernels */
 	}
 	| TOK_KEY_CAPNAME TOK_EQUALS TOK_QUOTED_STRING
@@ -393,7 +381,7 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 	  ret_record->name = $3;
 	}
 	| TOK_KEY_OFFSET TOK_EQUALS TOK_DIGITS
-	{ /* offset is used for reporting where an error occurred unpacking
+	{ /* offset is used for reporting where an error occured unpacking
 	   * loaded policy.  We can just drop this currently
 	   */
 	}
@@ -432,8 +420,6 @@ key: TOK_KEY_OPERATION TOK_EQUALS TOK_QUOTED_STRING
 		ret_record->event = AA_RECORD_INVALID;
 		ret_record->info = $1;
 	}
-	| TOK_KEY_CLASS TOK_EQUALS TOK_QUOTED_STRING
-	{ ret_record->class = $3; }
 	;
 
 apparmor_event:

libraries/libapparmor/src/kernel.c

@@ -43,137 +43,10 @@
 		__asm__ (".symver " #real "," #name "@" #version)
 #define default_symbol_version(real, name, version) \
 		__asm__ (".symver " #real "," #name "@@" #version)
-#define DLLEXPORT __attribute__((visibility("default"),externally_visible))
 
 #define UNCONFINED		"unconfined"
 #define UNCONFINED_SIZE		strlen(UNCONFINED)
 
-/*
- * AppArmor kernel interfaces. Potentially used by this code to
- * implement the various library functions.
- *
- *
- * /sys/module/apparmor/parameters/ *
- *
- * Available on all kernels, some options may not be available and policy
- * may block access.
- *     audit                - normal,quiet_denied,quiet,noquiet,all
- *     debug (bool)         - turn on debug messages if enabled during compile
- *     hash_policy (bool)   - provide a hash of loaded policy
- *     logsyscall (bool)    - ignored
- *     paranoid_load (bool) - whether full policy checks are done. Should only
- *                            be disabled for embedded device kernels
- *     audit_header (bool)  - include "apparmor=<mode> in messages"
- *     enabled (bool)       - whether apparmor is enabled. This can be
- *                            different than whether apparmor is available.
- *                            See virtualization and LSM stacking.
- *     lock_policy (bool)   - one way trigger. Once set policy can not be
- *                            loaded, replace, removed.
- *      mode                - global policy namespace control of whether
- *                            apparmor is in "enforce", "complain"
- *      path_max            - maximum path size. Can always be read but
- *                            can only be set on some kernels.
- *
- * securityfs/apparmor - usually mounted at /sys/kernel/security/apparmor/ *
- *     .access    - transactional interface used to query kernel
- *     .ns_level  - RO policy namespace level of current task
- *     .ns_name   - RO current policy namespace of current task
- *     .ns_stacked - RO boolean if stacking is in use with the namespace
- *     .null - special device file used to redirect closed fds to
- *     profiles   - RO virtualized text list of visible loaded profiles
- *     .remove    - WO names of profiles to remove
- *     .replace   - WO binary policy to replace (will load if not present)
- *     .load      - WO binary policy to load (will fail if already present)
- *     revision   - RO unique incrementing revision number for policy
- *     .stacked   - RO boolean if label is currently stacked
- *     features/  - RO feature set supported by kernel
- *     policy/    - RO policy loaded into kernel
- *
- *
- * /proc/<tid>/attr/apparmor/ *
- * New proc attr interface compatible with LSM stacking. Available even
- * when LSM stacking is not in use.
- *     current    - see /proc/<tid>/attr/current
- *     exec       - see /proc/<tid>/attr/exec
- *     prev       - see /proc/<tid>/attr/prev
- *
- * /proc/<tid>/attr/ * Old proc attr interface shared between LSMs goes
- * to first registered LSM that wants the proc interface, but can be
- * virtualized by setting the display LSM. So if LSM stacking is in
- * use this interface may belong to another LSM. Use
- *    /proc/<tid>/attr/apparmor/ *
- * first if possible, and do NOT use if
- *    /sys/module/apparmor/parameters/enabled=N.
- * Note: older version of the library only used this interface and did not
- *       check if it was available. Which could lead to weird failures if
- *       another LSM has claimed it. This version of the library tries to
- *       fix this problem, but unfortunately it is impossible to completely
- *       address, because access to interfaces required to determine
- *       whether apparmor owns the interface may be restricted, either
- *       by existing apparmor policy that has not been updated to use the
- *       new interface or by another LSM.
- *     current    - current confinement
- *     display    - LSM stacking. Which LSM currently owns the interface.
- *     exec       - label to switch to at exec
- *     fscreate   - unused by apparmor
- *     keycreate  - unused by apparmor
- *     prev       - when in HAT set to parent label
- *     sockcreate - unused by apparmor
- *
- *
- * Below /proc/ interface combinations are documented on how the library
- * currently behaves and how it used to behave. This serves to document
- * known failure points as we can not entirely fix this mess.
- * Note: userspace applications using the interface directly have all
- *       the issues/failures of AppArmor 2.x unless they have specifically
- *       been updated to deal with this mess.
- *
- *
- * AppArmor 2.x Lib
- *
- * LSM   AA            sys      sys    proc/   proc/   user
- * Stk | Blt |  LSM  | enabl | avail |  aa/  |   *   | space |
- * ----+-----+-------+-------+-------+-------+-------+-------+--------+
- *  N  |  N  |   -   |   -   |   -   |   -   |   N   | AA2.x |   -    |
- *  N  |  N  | other |   -   |   -   |   -   |   N   | AA2.x |  FAIL  |
- *  N  |  N  | other |denied |   -   |   -   |   N   | AA2.x |  FAIL  |
- *  N  |  Y  |   -   |   N   |   -   |   -   |   N   | AA2.x |   -    |
- *  N  |  Y  | other |   -   |   -   |   -   |   N   | AA2.x |  FAIL  |
- *  N  |  Y  |  AA   |   -   |   -   |   -   |   Y   | AA2.x |  PASS  |
- *  Y  |  N  |   -   |   -   |   -   |   -   |   N   | AA2.x |   -    |
- *  Y  |  N  | other |   -   |   -   |   -   |   N   | AA2.x |  FAIL  |
- *  Y  |  Y  |   -   |   N   |   -   |   -   |   N   | AA2.x |   -    |
- *  Y  |  Y  | other |   -   |   -   |   -   |   N   | AA2.x |  FAIL  |
- *  Y  |  Y  |  AA   |   -   |   -   |   -   |   Y   | AA2.x |  PASS  |
- *  Y  |  Y  | major |   -   |   -   |   -   |   Y   | AA2.x |  PASS  |
- *  Y  |  Y  | minor |   -   |   -   |   -   |   N   | AA2.x |  FAIL  |
- *
- *
- * AppArmor 3.x Lib - adds stacking support.
- *
- * Will FAIL in a few cases because it can not determine if apparmor
- * is enabled and has control of the old interface. Not failing in these
- * cases where AppArmor is available will result in regressions where
- * the library will not work correctly with old kernels. In these
- * cases its better that apparmor userspace is not used.
- *
- * AppArmor 3.x will avoid the failure cases if any of enabled, avail
- * or the new proc interfaces are available to the task. AppArmor 3.x
- * will also automatically add permissions to access the new proc
- * interfaces so change_hat and change_profile won't experience these
- * failures, it will only happen for confined applications hitting the
- * interfaces and not using change_hat or change_profile.
- *
- * LSM   AA            sys      sys    proc/   proc/
- * Stk | Blt |  LSM  | enabl | avail |  aa/  |   *   |
- * ----+-----+-------+-------+-------+-------+-------+-----------------
- * Y/N |  N  | other | denied|   NA  |   NA  |   Y   | old interface avail
- * Y/N |  Y  | other | denied|   NA  |   NA  |   Y   | old interface avail
- *  Y  |  Y  | minor | denied|   NA  |   NA  |   Y   | old interface avail
- *  Y  |  Y  | minor | denied|   NA  | denied|   Y   | old interface avail
- * Y/N |  Y  | minor | denied| denied| denied|   Y   | old interface avail
- */
-
 /**
  * aa_find_mountpoint - find where the apparmor interface filesystem is mounted
  * @mnt: returns buffer with the mountpoint string
@@ -220,34 +93,25 @@ int aa_find_mountpoint(char **mnt)
 	return rc;
 }
 
-/**
- * pararm_check_base - return boolean value for PARAM
- * PARAM: parameter to check
- *
- * Returns: 1 == Y
- *          0 == N
- *         <0 == error
- *
- * done as a macro so we can paste the param
- */
+// done as a macro so we can paste the param
 
 #define param_check_base(PARAM)						\
 ({									\
 	int rc, fd;							\
 	fd = open("/sys/module/apparmor/parameters/" PARAM, O_RDONLY);	\
 	if (fd == -1) {							\
-		rc = -errno;						\
+		rc = errno;						\
 	} else {							\
 		char buffer[2];						\
 		int size = read(fd, &buffer, 2);			\
-		rc = -errno;						\
+		rc = errno;						\
 		close(fd);						\
-		errno = -rc;						\
+		errno = rc;						\
 		if (size > 0) {						\
 			if (buffer[0] == 'Y')				\
-				rc = 1;					\
-			else						\
 				rc = 0;					\
+			else						\
+				rc = ECANCELED;				\
 		}							\
 	}								\
 	(rc);								\
@@ -266,37 +130,31 @@ static void param_check_enabled_init_once(void)
 
 static int param_check_enabled()
 {
-	if (pthread_once(&param_enabled_ctl, param_check_enabled_init_once) == 0 && param_enabled >= 0)
+	if (pthread_once(&param_enabled_ctl, param_check_enabled_init_once) == 0)
 		return param_enabled;
-	/* fallback if not initialized OR we recorded an error when
-	 * initializing.
-	 */
 	return param_check_base("enabled");
 }
 
 static int is_enabled(void)
 {
-	return param_check_enabled() == 1;
+	return !param_check_enabled();
 }
 
 static void param_check_private_enabled_init_once(void)
 {
-	param_private_enabled = param_check_base("available");
+	param_enabled = param_check_base("private_enabled");
 }
 
 static int param_check_private_enabled()
 {
-	if (pthread_once(&param_private_enabled_ctl, param_check_private_enabled_init_once) == 0 && param_private_enabled >= 0)
+	if (pthread_once(&param_private_enabled_ctl, param_check_private_enabled_init_once) == 0)
 		return param_private_enabled;
-	/* fallback if not initialized OR we recorded an error when
-	 * initializing.
-	 */
-	return param_check_base("available");
+	return param_check_base("private_enabled");
 }
 
 static int is_private_enabled(void)
 {
-	return param_check_private_enabled() == 1;
+	return !param_check_private_enabled();
 }
 
 /**
@@ -316,17 +174,15 @@ int aa_is_enabled(void)
 	bool private = false;
 
 	rc = param_check_enabled();
-	if (rc < 1) {
-		if (!is_private_enabled()) {
-			if (rc == 0)
-				errno = ECANCELED;
-			else if (rc == -ENOENT)
-				errno = ENOSYS;
-			else
-				errno = -rc;
+	if (rc) {
+		if (rc == ENOENT)
+			errno = ENOSYS;
+		else
+			errno = rc;
 
+		if (!is_private_enabled())
 			return 0;
-		}
+
 		/* actually available but only on private interfaces */
 		private = true;
 	}
@@ -372,98 +228,45 @@ static inline pid_t aa_gettid(void)
  */
 static pthread_once_t proc_attr_base_ctl = PTHREAD_ONCE_INIT;
 static const char *proc_attr_base_old = "/proc/%d/attr/%s";
-static const char *proc_attr_new_dir = "/proc/%d/attr/apparmor/";
 static const char *proc_attr_base_stacking = "/proc/%d/attr/apparmor/%s";
 static const char *proc_attr_base_unavailable = "/proc/%d/attr/apparmor/unavailable/%s";
-static const char *proc_attr_base = NULL;
-static int proc_stacking_present = -1;	/* unknown */
+static const char *proc_attr_base;
 
 static void proc_attr_base_init_once(void)
 {
 	autofree char *tmp;
 
 	/* if we fail we just fall back to the default value */
-	if (asprintf(&tmp, proc_attr_new_dir, aa_gettid()) > 0) {
-		struct stat sb;
-		if (stat(tmp, &sb) == 0) {
+	if (asprintf(&tmp, "/proc/%d/attr/apparmor/current", aa_gettid())) {
+		autoclose int fd = open(tmp, O_RDONLY);
+		if (fd != -1)
 			proc_attr_base = proc_attr_base_stacking;
-			proc_stacking_present = 1;
-			return;
-		} else if (errno == ENOENT) {
-			/* no stacking - try falling back */
-			proc_stacking_present = 0;
-		} else if (errno == EACCES) {
-			/* the dir exists, but access is denied */
-			proc_stacking_present = 1;
-			proc_attr_base = proc_attr_base_stacking;
-		} /* else
-			   denied by policy, or other error try falling back */
-	} else {
-		/* failed allocation - proc_attr_base stays NULL */
-		return;
-	}
-	/* check for new interface failed, see if we can fallback */
-	if (param_check_enabled() == 0) {
-		/* definate NO (not just an error) on enabled. Do not fall
-		 * back to old shared proc interface
-		 *
-		 * First try an alternate check for private proc interface
-		 */
-		int enabled = param_check_private_enabled();
-		if (enabled == 1) {
-			/* the private interface exists and we can't
-			 * fallback so just keep trying on the new
-			 * interface.
-			 */
-			proc_attr_base = proc_attr_base_stacking;
-		} else if (enabled == 0) {
-			/* definite NO - no interface available */
-			proc_attr_base = proc_attr_base_unavailable;
-		} else {
-			/* error can't determine, proc_attr_base stays NULL */
-		}
-	} else if (param_check_enabled() == 1) {
-		/* apparmor is enabled, we can use the old interface */
-		proc_attr_base = proc_attr_base_old;
-	} else if (errno != EACCES) {
-		/* this shouldn't happen unless apparmor is not builtin
-		 * or proc isn't mounted
+	} else if (!is_enabled() && is_private_enabled()) {
+		/* new stacking interfaces aren't available and apparmor
+		 * is disabled, but available. do not use the
+		 * /proc/<pid>/attr/ * interfaces as they could be
+		 * in use by another LSM
 		 */
 		proc_attr_base = proc_attr_base_unavailable;
-	} /* else
-		   denied by policy - proc_attr_base stays NULL */
-
-	return;
+	} else {
+		proc_attr_base = proc_attr_base_old;
+	}
 }
 
 static char *procattr_path(pid_t pid, const char *attr)
 {
 	char *path = NULL;
-	const char *tmp;
 
-	/* TODO: rework this with futex or userspace RCU so we can update
-	 * the base value instead of continually using the same base
-	 * after we have hit an error
-	 */
 	/* ignore failure, we just fallback to the default value */
 	(void) pthread_once(&proc_attr_base_ctl, proc_attr_base_init_once);
-
-	if (proc_attr_base)
-		tmp = proc_attr_base;
-	else if (proc_stacking_present)
-		/* couldn't determine during init */
-		tmp = proc_attr_base_stacking;
-	else
-		/* couldn't determine during init and no stacking */
-		tmp = proc_attr_base_old;
-	if (asprintf(&path, tmp, pid, attr) > 0)
+	if (asprintf(&path, proc_attr_base, pid, attr) > 0)
 		return path;
 	return NULL;
 }
 
 static int procattr_open(pid_t tid, const char *attr, int flags)
 {
-	autofree char *tmp = NULL;
+	char *tmp;
 	int fd;
 
 	tmp = procattr_path(tid, attr);
@@ -471,9 +274,9 @@ static int procattr_open(pid_t tid, const char *attr, int flags)
 		return -1;
 	}
 	fd = open(tmp, flags);
-
-	/* Test is we can fallback to the old interface (this is ugly).
-	 * If we haven't tried the old interface already
+	free(tmp);
+	/* Test is we can fallback to a different interface this is ugly.
+	 * If only the old interface is available:
 	 *    proc_attr_base == proc_attr_base_old - no fallback
 	 * else if is_enabled()
 	 *    apparmor is available on the old interface
@@ -483,14 +286,11 @@ static int procattr_open(pid_t tid, const char *attr, int flags)
 	 *       old interface where is_enabled() is only successful if
 	 *       the old interface is available to apparmor.
 	 */
-	if (fd == -1 && param_check_enabled() != 0 && strncmp(tmp, proc_attr_base_old, strlen(proc_attr_base_old)) != 0) {
-		free(tmp);
-		if (asprintf(&tmp, proc_attr_base_old, tid, attr) < 0) {
-			/* tmp is undefined, make sure it is null for autofree*/
-			tmp = NULL;
+	if (fd == -1 && errno == EACCES && proc_attr_base != proc_attr_base_old && is_enabled()) {
+		if (asprintf(&tmp, proc_attr_base_old, tid, attr) < 0)
 			return -1;
-		}
 		fd = open(tmp, flags);
+		free(tmp);
 	}
 
 	return fd;
@@ -828,7 +628,7 @@ int aa_change_onexec(const char *profile)
 }
 
 /* create an alias for the old change_hat@IMMUNIX_1.0 symbol */
-DLLEXPORT extern typeof((__change_hat)) __old_change_hat __attribute__((alias ("__change_hat")));
+extern typeof((__change_hat)) __old_change_hat __attribute__((alias ("__change_hat")));
 symbol_version(__old_change_hat, change_hat, IMMUNIX_1.0);
 default_symbol_version(__change_hat, change_hat, APPARMOR_1.0);
 
@@ -1226,7 +1026,7 @@ int query_label(uint32_t mask, char *query, size_t size, int *allowed,
 
 /* export multiple aa_query_label symbols to compensate for downstream
  * releases with differing symbol versions. */
-DLLEXPORT extern typeof((query_label)) __aa_query_label __attribute__((alias ("query_label")));
+extern typeof((query_label)) __aa_query_label __attribute__((alias ("query_label")));
 symbol_version(__aa_query_label, aa_query_label, APPARMOR_1.1);
 default_symbol_version(query_label, aa_query_label, APPARMOR_2.9);
 
@@ -1322,9 +1122,9 @@ int aa_query_link_path_len(const char *label, size_t label_len,
 	query[pos] = 0;
 	query[++pos] = AA_CLASS_FILE;
 	memcpy(query + pos + 1, link, link_len);
-	/* The kernel does the query in two parts; we could simulate this
+	/* The kernel does the query in two parts we could similate this
 	 * doing the following, however as long as policy is compiled
-	 * correctly this isn't required, and it requires an extra round
+	 * correctly this isn't requied, and it requires and extra round
 	 * trip to the kernel and adds a race on policy replacement between
 	 * the two queries.
 	 *
@@ -1358,121 +1158,3 @@ int aa_query_link_path(const char *label, const char *target, const char *link,
 				      strlen(target), link, strlen(link),
 				      allowed, audited);
 }
-
-static int alloc_substring(char ***v, char *s, char *p,
-			   size_t max_size, size_t n, bool immutable)
-{
-	if (max_size) {
-		if (n >= max_size) {
-			errno = E2BIG;
-			return -1;
-		}
-	} else {
-		char ** tmpv;
-		tmpv = (char **) realloc(*v, (n + 1) * sizeof(char *));
-		if (tmpv == NULL) {
-			errno = ENOMEM;
-			return -1;
-		}
-		*v = tmpv;
-	}
-	if (immutable) {
-		char *tmp;
-		tmp = (char *) malloc(p - s + 1);
-		if (tmp == NULL) {
-			errno = ENOMEM;
-			return -1;
-		}
-		memcpy(tmp, s, p - s);
-		tmp[p - s] = 0;
-		(*v)[n] = tmp;
-	} else {
-		(*v)[n] = s;
-		if (*p)
-			*p = 0;
-	}
-
-	return 0;
-}
-
-/**
- * aa_split_overlay_str - split a string into potentially multiple strings
- * @str: the string to split
- * @vec: vector to put string pointers into, IF null will be allocated
- * @max_size: maximum number of ents to put in @vec, IF 0 dynamic
- * @immutable: true if @str should not be modified.
- *
- * Returns: the number of entries in vec on success. -1 on error and errno set.
- *
- * Split a comma or colon separated string into substrings.
- *
- * IF @vec == NULL
- *    the vec will be dynamically allocated
- * ELSE
- *    passed in @vec will be used, and NOT updated/extended
- *
- * IF @max_size == 0 && @vec == NULL
- *    @vec will be dynamically resized
- * ELSE
- *    @vec will be fixed at @max_size
- *
- * IF @immutable is true
- *    the substrings placed in @vec will be allocated copies.
- * ELSE
- *    @str will be updated in place and @vec[x] will point into @str
- */
-int aa_split_overlay_str(char *str, char ***vec, size_t max_size, bool immutable)
-{
-	char *s = str;
-	char *p = str;
-	int rc, n = 0;
-	char **v = *vec;
-
-	if (!*vec) {
-		if (max_size) {
-			v = (char **) malloc(max_size * sizeof(char *));
-			if (v == NULL) {
-				rc = ENOMEM;
-				goto err;
-			}
-		}
-	}
-
-	while (*p) {
-		if (*p == '\\') {
-			if (*(p + 1) != 0)
-				p++;
-		} else if (*p == ',' || *p == ':') {
-			if (p != s) {
-				if (alloc_substring(&v, s, p, max_size, n, immutable) == -1) {
-					rc = errno;
-					goto err;
-				}
-				n++;
-			}
-			p++;
-			s = p;
-		} else
-			p++;
-	}
-	if (p != s) {
-		if (alloc_substring(&v, s, p, max_size, n, immutable) == -1) {
-			rc = errno;
-			goto err;
-		}
-		n++;
-	}
-
-	*vec = v;
-	return n;
-err:
-	if (immutable) {
-		for (int i = 0; i < n; i++) {
-			free(v[i]);
-		}
-	}
-	if (!*vec)
-		free(v);
-	errno = rc;
-	return -1;
-}

libraries/libapparmor/src/kernel_interface.c

@@ -90,7 +90,7 @@ static int write_buffer(int fd, const char *buffer, int size)
 
 /**
  * write_policy_buffer - load compiled policy into the kernel
- * @fd: kernel interface to write to
+ * @fd: kernel iterface to write to
  * @atomic: whether to load all policy in buffer atomically (true)
  * @buffer: buffer of policy to load
  * @size: the size of the data in the buffer
@@ -205,7 +205,7 @@ static int write_policy_file_to_iface(aa_kernel_interface *kernel_interface,
  * @apparmorfs: path to the apparmor directory of the mounted securityfs (can
  *              be NULL and the path will be auto discovered)
  *
- * Returns: 0 on success, -1 on error with errno set and *@kernel_interface
+ * Returns: 0 on success, -1 on error with errnot set and *@kernel_interface
  *          pointing to NULL
  */
 int aa_kernel_interface_new(aa_kernel_interface **kernel_interface,

libraries/libapparmor/src/libaalogparse.c

@@ -103,8 +103,6 @@ void free_record(aa_log_record *record)
 			free(record->flags);
 		if (record->src_name != NULL)
 			free(record->src_name);
-		if (record->class != NULL)
-			free(record->class);
 
 		free(record);
 	}

libraries/libapparmor/src/libapparmor.map

@@ -6,14 +6,14 @@
 
 IMMUNIX_1.0 {
   global:
-        change_hat; __old_change_hat;
+        change_hat;
   local:
         *;
 };
 
 APPARMOR_1.0 {
   global:
-        change_hat; __change_hat;
+        change_hat;
         parse_record;
         free_record;
   local:
@@ -24,7 +24,7 @@ APPARMOR_1.1 {
   global:
         aa_is_enabled;
         aa_find_mountpoint;
-        aa_change_hat; __old_change_hat;
+        aa_change_hat;
         aa_change_hatv;
         aa_change_hat_vargs;
         aa_change_profile;
@@ -37,7 +37,7 @@ APPARMOR_1.1 {
         free_record;
         aa_getprocattr_raw;
         aa_getprocattr;
-        aa_query_label; __aa_query_label;
+        aa_query_label;
 
 	# no more symbols here, please
 
@@ -47,7 +47,7 @@ APPARMOR_1.1 {
 
 APPARMOR_2.9 {
   global:
-	aa_query_label; query_label;
+	aa_query_label;
   local:
 	*;
 } APPARMOR_1.1;
@@ -124,13 +124,6 @@ APPARMOR_3.0 {
 	*;
 } APPARMOR_2.13.1;
 
-APPARMOR_3.1 {
-  global:
-	aa_features_check;
-  local:
-	*;
-} APPARMOR_3.0;
-
 PRIVATE {
 	global:
 		_aa_is_blacklisted;

libraries/libapparmor/src/policy_cache.c

@@ -45,8 +45,6 @@ struct aa_policy_cache {
 static int clear_cache_cb(int dirfd, const char *path, struct stat *st,
 			  void *data unused)
 {
-	/* Handle symlink here. See _aa_dirat_for_each in private.c */
-
 	if (S_ISREG(st->st_mode)) {
 		/* remove regular files */
 		return unlinkat(dirfd, path, 0);
@@ -147,6 +145,36 @@ repeat:
 	return path;
 }
 
+static int cache_check_features(int dirfd, const char *cache_name,
+				aa_features *features)
+{
+	aa_features *local_features = NULL;
+	autofree char *name = NULL;
+	bool rc;
+	int len;
+
+	len = asprintf(&name, "%s/%s", cache_name, CACHE_FEATURES_FILE);
+	if (len == -1) {
+		errno = ENOMEM;
+		return -1;
+	}
+
+	/* verify that cache dir .features matches */
+	if (aa_features_new(&local_features, dirfd, name)) {
+		PDEBUG("could not setup new features object for dirfd '%d' '%s'\n", dirfd, name);
+		return -1;
+	}
+
+	rc = aa_features_is_equal(local_features, features);
+	aa_features_unref(local_features);
+	if (!rc) {
+		errno = EEXIST;
+		return -1;
+	}
+
+	return 0;
+}
+
 static int create_cache(aa_policy_cache *policy_cache, aa_features *features)
 {
 	if (aa_policy_cache_remove(policy_cache->dirfd[0], "."))
@@ -164,8 +192,8 @@ static int create_cache(aa_policy_cache *policy_cache, aa_features *features)
 static int init_cache_features(aa_policy_cache *policy_cache,
 			       aa_features *kernel_features, bool create)
 {
-	if (aa_features_check(policy_cache->dirfd[0], ".",
-			      kernel_features)) {
+	if (cache_check_features(policy_cache->dirfd[0], ".",
+				 kernel_features)) {
 		/* EEXIST must come before ENOENT for short circuit eval */
 		if (!create || errno == EEXIST || errno != ENOENT)
 			return -1;
@@ -201,13 +229,13 @@ static int cache_miss_cb(int dirfd, const struct dirent *ent, void *arg)
 		errno = ENOMEM;
 		return -1;
 	}
-	if (!aa_features_check(dirfd, cache_name, data->features) || errno == ENOENT) {
+	if (!cache_check_features(dirfd, cache_name, data->features) || errno == ENOENT) {
 		/* found cache dir matching pattern */
 		data->cache_name = cache_name;
 		/* return 1 to stop iteration and signal dir found */
 		return 1;
 	}  else if (errno != EEXIST) {
-		PDEBUG("aa_features_check() failed for dirfd '%d' '%s'\n", dirfd, cache_name);
+		PDEBUG("cache_check_features() failed for dirfd '%d' '%s'\n", dirfd, cache_name);
 		free(cache_name);
 		return -1;
 	}
@@ -243,12 +271,12 @@ static int cache_dir_from_path_and_features(char **cache_path,
 	if (len == -1)
 		return -1;
 
-	if (!aa_features_check(dirfd, cache_dir, features) || errno == ENOENT) {
+	if (!cache_check_features(dirfd, cache_dir, features) || errno == ENOENT) {
 		PDEBUG("cache_dir_from_path_and_features() found '%s'\n", cache_dir);
 		*cache_path = cache_dir;
 		return 0;
 	} else if (errno != EEXIST) {
-		PDEBUG("aa_features_check() failed for dirfd '%d' %s\n", dirfd, cache_dir);
+		PDEBUG("cache_check_features() failed for dirfd '%d' %s\n", dirfd, cache_dir);
 		free(cache_dir);
 		return -1;
 	}

libraries/libapparmor/src/private.c

@@ -63,7 +63,7 @@ struct ignored_suffix_t {
 };
 
 static struct ignored_suffix_t ignored_suffixes[] = {
-	/* Debian packaging files, which are in flux during install
+	/* Debian packging files, which are in flux during install
            should be silently ignored. */
 	{ ".dpkg-new", 9, 1 },
 	{ ".dpkg-old", 9, 1 },
@@ -147,7 +147,7 @@ int _aa_is_blacklisted(const char *name)
 	return 0;
 }
 
-/* automatically free allocated variables tagged with autofree on fn exit */
+/* automaticly free allocated variables tagged with autofree on fn exit */
 void _aa_autofree(void *p)
 {
 	void **_p = (void**)p;
@@ -452,8 +452,7 @@ int _aa_overlaydirat_for_each(int dirfd[], int n, void *data,
  *
  * The cb function is called with the DIR in use and the name of the
  * file in that directory.  If the file is to be opened it should
- * use the openat, fstatat, and related fns. If the file is a symlink
- * _aa_dirat_for_each currently tries to traverse it for the caller
+ * use the openat, fstatat, and related fns.
  *
  * Returns: 0 on success, else -1 and errno is set to the error code
  */
@@ -475,7 +474,7 @@ int _aa_dirat_for_each(int dirfd, const char *name, void *data,
 		return -1;
 	}
 
-	num_dirs = readdirfd(cb_dirfd, &namelist, alphasort);
+	num_dirs = readdirfd(cb_dirfd, &namelist, NULL);
 	if (num_dirs == -1) {
 		PDEBUG("scandirat of directory '%s' failed: %m\n", name);
 		return -1;
@@ -486,34 +485,14 @@ int _aa_dirat_for_each(int dirfd, const char *name, void *data,
 		autofree struct dirent *dir = namelist[i];
 		struct stat my_stat;
 
-		if (fstatat(cb_dirfd, dir->d_name, &my_stat, AT_SYMLINK_NOFOLLOW)) {
+		if (rc)
+			continue;
+
+		if (fstatat(cb_dirfd, dir->d_name, &my_stat, 0)) {
 			PDEBUG("stat failed for '%s': %m\n", dir->d_name);
 			rc = -1;
 			continue;
 		}
-		/* currently none of the callers handle symlinks, and this
-		 * same basic code was applied to each. So for this patch
-		 * just drop it here.
-		 *
-		 * Going forward we need to start handling symlinks as
-		 * they have meaning.
-		 * In the case of
-		 * cache: they act as a place holder for files that have been
-		 *        combined into a single binary. This enables the
-		 *        file based cache lookup time find that relation
-		 *        and dedup, so multiple loads aren't done.
-		 * profiles: just a profile in an alternate location, but
-		 *           should do dedup detection when doing dir reads
-		 *           so we don't double process.
-		 */
-		if (S_ISLNK(my_stat.st_mode)) {
-			/* just traverse the symlink */
-			if (fstatat(cb_dirfd, dir->d_name, &my_stat, 0)) {
-				PDEBUG("symlink target stat failed for '%s': %m\n", dir->d_name);
-				rc = -1;
-				continue;
-			}
-		}
 
 		if (cb(cb_dirfd, dir->d_name, &my_stat, data)) {
 			PDEBUG("dir_for_each callback failed for '%s'\n",

libraries/libapparmor/src/scanner.l

@@ -72,7 +72,7 @@ void string_buf_append(unsigned int length, char *text)
 
 %}
 
-ws		[ \t\r\n\x1d]
+ws		[ \t\r\n]
 
 equals		"="
 digit		[[:digit:]]
@@ -121,8 +121,6 @@ key_namespace		"namespace"
 key_mask		"mask"
 key_denied_mask		"denied_mask"
 key_requested_mask	"requested_mask"
-key_denied		"denied"
-key_requested		"requested"
 key_attribute		"attribute"
 key_task		"task"
 key_parent		"parent"
@@ -140,9 +138,7 @@ key_sock_type		"sock_type"
 key_protocol		"protocol"
 key_error		"error"
 key_fsuid		"fsuid"
-key_fsuid_upper		"FSUID"
 key_ouid		"ouid"
-key_ouid_upper		"OUID"
 key_uid			"uid"
 key_auid		"auid"
 key_sauid		"sauid"
@@ -165,21 +161,17 @@ key_dest		"dest"
 key_path		"path"
 key_interface		"interface"
 key_member		"member"
-key_method		"method"
 key_signal		"signal"
 key_peer		"peer"
 key_fstype		"fstype"
 key_flags		"flags"
 key_srcname		"srcname"
-key_class		"class"
-key_tcontext		"tcontext"
 audit			"audit"
 
 /* network addrs */
 ip_addr			[a-f[:digit:].:]{3,}
 
 /* syslog tokens */
-socklogd_kernel		kern.notice{colon}
 syslog_kernel		kernel{colon}
 syslog_user		[[:alnum:]_-]+\[[[:digit:]]+\]{colon}
 syslog_yyyymmdd		{digit}{4}{minus}{digit}{2}{minus}{digit}{2}
@@ -314,8 +306,6 @@ yy_flex_debug = 0;
 {key_mask}		{ return(TOK_KEY_MASK); }
 {key_denied_mask}	{ return(TOK_KEY_DENIED_MASK); }
 {key_requested_mask}	{ return(TOK_KEY_REQUESTED_MASK); }
-{key_denied}		{ return(TOK_KEY_DENIED_MASK); }
-{key_requested}		{ return(TOK_KEY_REQUESTED_MASK); }
 {key_attribute}		{ BEGIN(sub_id); return(TOK_KEY_ATTRIBUTE); }
 {key_task}		{ return(TOK_KEY_TASK); }
 {key_parent}		{ return(TOK_KEY_PARENT); }
@@ -328,15 +318,12 @@ yy_flex_debug = 0;
 {key_peer_profile}	{ BEGIN(safe_string); return(TOK_KEY_PEER_PROFILE); }
 {key_label}		{ BEGIN(safe_string); return(TOK_KEY_LABEL); }
 {key_peer_label}	{ BEGIN(safe_string); return(TOK_KEY_PEER_LABEL); }
-{key_tcontext}		{ BEGIN(safe_string); return(TOK_KEY_PEER_LABEL); }
 {key_family}		{ return(TOK_KEY_FAMILY); }
 {key_sock_type}		{ return(TOK_KEY_SOCK_TYPE); }
 {key_protocol}		{ return(TOK_KEY_PROTOCOL); }
 {key_error}		{ return(TOK_KEY_ERROR); }
 {key_fsuid}		{ return(TOK_KEY_FSUID); }
-{key_fsuid_upper}	{ return(TOK_KEY_FSUID_UPPER); }
 {key_ouid}		{ return(TOK_KEY_OUID); }
-{key_ouid_upper}	{ return(TOK_KEY_OUID_UPPER); }
 {key_uid}		{ return(TOK_KEY_UID); }
 {key_auid}		{ return(TOK_KEY_AUID); }
 {key_sauid}		{ return(TOK_KEY_SAUID); }
@@ -358,15 +345,12 @@ yy_flex_debug = 0;
 {key_path}		{ return(TOK_KEY_PATH); }
 {key_interface}		{ return(TOK_KEY_INTERFACE); }
 {key_member}		{ return(TOK_KEY_MEMBER); }
-{key_method}		{ return(TOK_KEY_MEMBER); }
 {key_signal}		{ BEGIN(sub_id); return(TOK_KEY_SIGNAL); }
 {key_peer}		{ BEGIN(safe_string); return(TOK_KEY_PEER); }
 {key_fstype}		{ return(TOK_KEY_FSTYPE); }
 {key_flags}		{ BEGIN(safe_string); return(TOK_KEY_FLAGS); }
 {key_srcname}		{ BEGIN(safe_string); return(TOK_KEY_SRCNAME); }
-{key_class}		{ BEGIN(safe_string); return(TOK_KEY_CLASS); }
 
-{socklogd_kernel}	{ BEGIN(dmesg_timestamp); return(TOK_SOCKLOGD_KERNEL); }
 {syslog_kernel}		{ BEGIN(dmesg_timestamp); return(TOK_SYSLOG_KERNEL); }
 {syslog_user}		{ return(TOK_SYSLOG_USER); }
 {syslog_month}		{ yylval->t_str = strdup(yytext); return(TOK_DATE_MONTH); }
@@ -381,7 +365,6 @@ yy_flex_debug = 0;
 
 <hostname>{
 	{ws}+		{ /* eat whitespace */ }
-	{socklogd_kernel} { BEGIN(dmesg_timestamp); return(TOK_SOCKLOGD_KERNEL); }
 	{syslog_hostname} { yylval->t_str = strdup(yytext); BEGIN(INITIAL); return(TOK_ID); }
 }
 

libraries/libapparmor/swig/python/Makefile.am

@@ -14,14 +14,14 @@ MOSTLYCLEANFILES=libapparmor_wrap.c LibAppArmor.py
 
 all-local: libapparmor_wrap.c setup.py
 	if test ! -f libapparmor_wrap.c; then cp $(srcdir)/libapparmor_wrap.c . ; fi
-	CC="$(CC)" CFLAGS="$(PYTHON_CPPFLAGS) $(EXTRA_WARNINGS)" LDSHARED="$(CC) -shared" LDFLAGS="$(PYTHON_LDFLAGS) $(LDFLAGS)" $(PYTHON) setup.py build
+	CC="$(CC)" CFLAGS="$(PYTHON_CPPFLAGS) $(EXTRA_WARNINGS)" LDSHARED="$(CC) -shared" LDFLAGS="$(PYTHON_LDFLAGS)" $(PYTHON) setup.py build
 
 install-exec-local:
 	$(PYTHON) setup.py install --root="/$(DESTDIR)" --prefix="$(prefix)"
 
 clean-local:
 	if test -x "$(PYTHON)"; then $(PYTHON) setup.py clean; fi
-	rm -rf build LibAppArmor.egg-info
+	rm -rf build
 	if test $(top_srcdir) != $(top_builddir) ; then rm -f libapparmor_wrap.c ; fi
 
 endif

libraries/libapparmor/swig/python/__init__.py

@@ -1 +1,6 @@
-from LibAppArmor.LibAppArmor import *
+import sys
+
+if sys.version_info[0] >= 3:
+    from LibAppArmor.LibAppArmor import *
+else:
+    from .LibAppArmor import *

libraries/libapparmor/swig/python/setup.py.in

@@ -1,4 +1,4 @@
-from setuptools import setup, Extension
+from distutils.core import setup, Extension
 import string
 
 setup(name          = 'LibAppArmor',

libraries/libapparmor/swig/python/test/Makefile.am

@@ -10,7 +10,8 @@ test_python.py: test_python.py.in $(top_builddir)/config.status
 
 CLEANFILES = test_python.py
 
-PYTHON_DIST_BUILD_PATH = '$(builddir)/../build/$$($(PYTHON) buildpath.py)'
+# bah, how brittle is this?
+PYTHON_DIST_BUILD_PATH = '$(builddir)/../build/$$($(PYTHON) -c "import distutils.util; import platform; print(\"lib.%s-%s\" %(distutils.util.get_platform(), platform.python_version()[:3]))")'
 
 TESTS	= test_python.py
 TESTS_ENVIRONMENT = \

libraries/libapparmor/swig/python/test/buildpath.py

@@ -1,14 +0,0 @@
-#!/usr/bin/python3
-# the build path has changed in setuptools 62.1:
-# https://github.com/pypa/setuptools/commit/1c23f5e1e4b18b50081cbabb2dea22bf345f5894
-import sys
-import sysconfig
-
-import setuptools
-
-
-if tuple(map(int, setuptools.__version__.split("."))) >= (62, 1):
-    identifier = sys.implementation.cache_tag
-else:
-    identifier = "%d.%d" % sys.version_info[:2]
-print("lib.{}-{}".format(sysconfig.get_platform(), identifier))

libraries/libapparmor/swig/python/test/test_python.py.in

@@ -13,7 +13,6 @@
 import ctypes
 import os
 import unittest
-
 import LibAppArmor as libapparmor
 
 TESTDIR = "../../../testsuite/test_multi"
@@ -35,7 +34,6 @@ OUTPUT_MAP = {
     'Local port':       'net_local_port',
     'Foreign port':     'net_foreign_port',
     'Audit subid':      'audit_sub_id',
-    'Class':            '_class',
 }
 
 # FIXME: pull this automatically out of LibAppArmor, but swig
@@ -64,8 +62,8 @@ class AAPythonBindingsTests(unittest.TestCase):
         self.maxDiff = None
 
     def _runtest(self, testname):
-        infile = testname + ".in"
-        outfile = testname + ".out"
+        infile = "%s.in" % (testname)
+        outfile = "%s.out" % (testname)
         # infile *should* only contain one line
         with open(os.path.join(TESTDIR, infile), 'r') as f:
             line = f.read()
@@ -77,11 +75,11 @@ class AAPythonBindingsTests(unittest.TestCase):
 
         expected = self.parse_output_file(outfile)
         self.assertEqual(expected, record,
-                         "expected records did not match\n"
-                         "expected = {}\nactual = {}".format(expected, record))
+                          "expected records did not match\n" +
+                          "expected = %s\nactual = %s" % (expected, record))
 
     def parse_output_file(self, outfile):
-        """parse testcase .out file and return dict"""
+        '''parse testcase .out file and return dict'''
 
         output = dict()
         with open(os.path.join(TESTDIR, outfile), 'r') as f:
@@ -93,7 +91,7 @@ class AAPythonBindingsTests(unittest.TestCase):
             count += 1
             if line == "START":
                 self.assertEqual(count, 1,
-                                 "Unexpected output format in " + outfile)
+                                  "Unexpected output format in %s" % (outfile))
                 continue
             else:
                 key, value = line.split(": ", 1)
@@ -107,10 +105,10 @@ class AAPythonBindingsTests(unittest.TestCase):
         return output
 
     def create_record_dict(self, record):
-        """parse the swig created record and construct a dict from it"""
+        '''parse the swig created record and construct a dict from it'''
 
         new_record = dict()
-        for key in [x for x in dir(record) if not (x.startswith('__') or x == 'this')]:
+        for key in [x for x in dir(record) if not (x.startswith('_') or x == 'this')]:
             value = getattr(record, key)
             if key == "event" and value in EVENT_MAP:
                 new_record[key] = EVENT_MAP[value]
@@ -130,7 +128,7 @@ class AAPythonBindingsTests(unittest.TestCase):
 
 
 def find_testcases(testdir):
-    """dig testcases out of passed directory"""
+    '''dig testcases out of passed directory'''
 
     for f in os.listdir(testdir):
         if f.endswith(".in"):
@@ -141,10 +139,9 @@ def main():
     for f in find_testcases(TESTDIR):
         def stub_test(self, testname=f):
             self._runtest(testname)
-        stub_test.__doc__ = "test " + f
-        setattr(AAPythonBindingsTests, 'test_' + f, stub_test)
+        stub_test.__doc__ = "test %s" % (f)
+        setattr(AAPythonBindingsTests, 'test_%s' % (f), stub_test)
     return unittest.main(verbosity=2)
 
-
 if __name__ == "__main__":
     main()

libraries/libapparmor/swig/ruby/Makefile.am

@@ -9,9 +9,7 @@ LibAppArmor_wrap.c : $(srcdir)/../SWIG/libapparmor.i
 MOSTLYCLEANFILES=LibAppArmor_wrap.c
 
 Makefile.ruby: extconf.rb
-	mv Makefile Makefile.bak
 	PREFIX=$(prefix) $(RUBY) $< --with-LibAppArmor-include=$(top_srcdir)/include
-	mv Makefile.bak Makefile
 
 LibAppArmor.so: LibAppArmor_wrap.c Makefile.ruby
 	$(MAKE) -fMakefile.ruby
@@ -24,7 +22,7 @@ install-exec-local: Makefile.ruby
 
 clean-local:
 	if test -f Makefile.ruby; then $(MAKE) -fMakefile.ruby clean; fi
-	rm -f Makefile.ruby Makefile.bak
+	rm -f Makefile.ruby Makefile.new
 	rm -f *.o *.so *.log
 
 endif

libraries/libapparmor/swig/ruby/extconf.rb

@@ -2,8 +2,16 @@
 
 require 'mkmf'
 
-# hack 1: Before extconf.rb gets called, Makefile gets backed up, and
-#         restored afterwards (see Makefile.am)
+# hack 1: ruby black magic to write a Makefile.new instead of a Makefile
+alias open_orig open
+def open(path, mode=nil, perm=nil)
+  path = 'Makefile.new' if path == 'Makefile'
+  if block_given?
+    open_orig(path, mode, perm) { |io| yield(io) }
+  else
+    open_orig(path, mode, perm)
+  end
+end
 
 if ENV['PREFIX']
   prefix = CONFIG['prefix']
@@ -19,7 +27,7 @@ if find_library('apparmor', 'parse_record', '../../src/.libs') and
 
   # hack 2: strip all rpath references
   open('Makefile.ruby', 'w') do |out|
-    IO.foreach('Makefile') do |line|
+    IO.foreach('Makefile.new') do |line|
       out.puts line.gsub(/-Wl,-R'[^']*'/, '')
     end
   end

libraries/libapparmor/testsuite/libaalogparse.test/multi_test.exp

@@ -1,5 +1,5 @@
-# Runs all tests with the extension "multi" for several times.
-# Each test program <programname>.multi has its own subdirectory
+# Runs all tests with the extention "multi" for several times.
+# Each testprogram <programname>.multi has an own subdirectory
 # <programmname> in which several testcases are defined for this program
 # Each testcase has 3 files:
 #

libraries/libapparmor/testsuite/test_multi.c

@@ -134,8 +134,6 @@ int print_results(aa_log_record *record)
 		print_string("Flags", record->flags);
 		print_string("Src name", record->src_name);
 
-		print_string("Class", record->class);
-
 		print_long("Epoch", record->epoch, 0);
 		print_long("Audit subid", (long) record->audit_sub_id, 0);
 	return(0);

libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.in

@@ -1 +0,0 @@
-type=AVC msg=audit(1661734785.992:270): apparmor="ALLOWED" operation="open" profile="/usr/bin/dolphin" name="/home/otis/.config/kdedefaults/kdeglobals" pid=3483 comm="dolphin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="otis" OUID="root"

libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.out

@@ -1,15 +0,0 @@
-START
-File: 0x1d-uppercase-FSUID-OUID.in
-Event type: AA_RECORD_ALLOWED
-Audit ID: 1661734785.992:270
-Operation: open
-Mask: r
-Denied Mask: r
-fsuid: 1000
-ouid: 0
-Profile: /usr/bin/dolphin
-Name: /home/otis/.config/kdedefaults/kdeglobals
-Command: dolphin
-PID: 3483
-Epoch: 1661734785
-Audit subid: 270

libraries/libapparmor/testsuite/test_multi/0x1d-uppercase-FSUID-OUID.profile

@@ -1,4 +0,0 @@
-/usr/bin/dolphin {
-  /home/otis/.config/kdedefaults/kdeglobals r,
-
-}

libraries/libapparmor/testsuite/test_multi/file_xm.in

@@ -1 +0,0 @@
-type=AVC msg=audit(1676978994.840:1493): apparmor="DENIED" operation="link" profile="cargo" name="/var/tmp/portage/dev-lang/rust-1.67.1/work/rustc-1.67.1-src/build/bootstrap/debug/libbootstrap.rlib" pid=12412 comm="cargo" requested_mask="xm" denied_mask="xm" fsuid=250 ouid=250 target="/var/tmp/portage/dev-lang/rust-1.67.1/work/rustc-1.67.1-src/build/bootstrap/debug/deps/libbootstrap-4542dd99e796257e.rlib"FSUID="portage" OUID="portage"

libraries/libapparmor/testsuite/test_multi/file_xm.out

@@ -1,16 +0,0 @@
-START
-File: file_xm.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1676978994.840:1493
-Operation: link
-Mask: xm
-Denied Mask: xm
-fsuid: 250
-ouid: 250
-Profile: cargo
-Name: /var/tmp/portage/dev-lang/rust-1.67.1/work/rustc-1.67.1-src/build/bootstrap/debug/libbootstrap.rlib
-Command: cargo
-Name2: /var/tmp/portage/dev-lang/rust-1.67.1/work/rustc-1.67.1-src/build/bootstrap/debug/deps/libbootstrap-4542dd99e796257e.rlib
-PID: 12412
-Epoch: 1676978994
-Audit subid: 1493

libraries/libapparmor/testsuite/test_multi/file_xm.profile

@@ -1,4 +0,0 @@
-profile cargo {
-  owner /var/tmp/portage/dev-lang/rust-1.67.1/work/rustc-1.67.1-src/build/bootstrap/debug/libbootstrap.rlib m,
-
-}

libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.in

@@ -1 +0,0 @@
-audit.log:type=AVC msg=audit(1630913351.586:4): apparmor="STATUS" info="AppArmor Filesystem Enabled" pid=1 comm="swapper/0"

libraries/libapparmor/testsuite/test_multi/status-filesystem-enabled.out

@@ -1,3 +0,0 @@
-START
-File: status-filesystem-enabled.in
-Event type: AA_RECORD_INVALID

libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.in

@@ -1 +0,0 @@
-Dec 15 17:32:17 kinetic kernel: [4835959.046111] audit: type=1107 audit(1671125537.724:209): pid=7308 uid=0 auid=4294967295 ses=4294967295 msg='apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" method="Hello" mask="send" label="/tmp/apparmor/tests/regression/apparmor/dbus_message" peer_label="unconfined" exe="/usr/local/bin/dbus-broker" sauid=0 hostname=? addr=? terminal=?'

libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.out

@@ -1,15 +0,0 @@
-START
-File: testcase_dbus_11.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1671125537.724:209
-Operation: dbus_method_call
-Denied Mask: send
-Profile: /tmp/apparmor/tests/regression/apparmor/dbus_message
-Peer profile: unconfined
-Command: /usr/local/bin/dbus-broker
-DBus bus: session
-DBus path: /org/freedesktop/DBus
-DBus interface: org.freedesktop.DBus
-DBus member: Hello
-Epoch: 1671125537
-Audit subid: 209

libraries/libapparmor/testsuite/test_multi/testcase_dbus_11.profile

@@ -1,4 +0,0 @@
-/tmp/apparmor/tests/regression/apparmor/dbus_message {
-  dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=Hello peer=(label=unconfined),
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_01.in

@@ -1 +0,0 @@
-[ 4584.703379] audit: type=1400 audit(1680266735.359:69): apparmor="DENIED" operation="uring_sqpoll" class="io_uring" profile="/root/apparmor/tests/regression/apparmor/io_uring" pid=1320 comm="io_uring" requested="sqpoll" denied="sqpoll"

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_01.out

@@ -1,13 +0,0 @@
-START
-File: testcase_io_uring_01.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1680266735.359:69
-Operation: uring_sqpoll
-Mask: sqpoll
-Denied Mask: sqpoll
-Profile: /root/apparmor/tests/regression/apparmor/io_uring
-Command: io_uring
-PID: 1320
-Class: io_uring
-Epoch: 1680266735
-Audit subid: 69

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_01.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/io_uring {
-  io_uring sqpoll,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_02.in

@@ -1 +0,0 @@
-[ 4584.491076] audit: type=1400 audit(1680266735.147:63): apparmor="DENIED" operation="uring_override" class="io_uring" profile="/root/apparmor/tests/regression/apparmor/io_uring" pid=1193 comm="io_uring" requested="override_creds" denied="override_creds" tcontext="/root/apparmor/tests/regression/apparmor/io_uring"

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_02.out

@@ -1,14 +0,0 @@
-START
-File: testcase_io_uring_02.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1680266735.147:63
-Operation: uring_override
-Mask: override_creds
-Denied Mask: override_creds
-Profile: /root/apparmor/tests/regression/apparmor/io_uring
-Peer profile: /root/apparmor/tests/regression/apparmor/io_uring
-Command: io_uring
-PID: 1193
-Class: io_uring
-Epoch: 1680266735
-Audit subid: 63

libraries/libapparmor/testsuite/test_multi/testcase_io_uring_02.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/io_uring {
-  io_uring override_creds label=/root/apparmor/tests/regression/apparmor/io_uring,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_01.in

@@ -1 +0,0 @@
-Apr 05 19:36:19 ubuntu kernel: audit: type=1400 audit(1649187379.660:255): apparmor="DENIED" operation="create" profile="/root/apparmor/tests/regression/apparmor/posix_mq_rcv" name="/queuename" pid=791 comm="posix_mq_rcv" requested="create" denied="create" class="posix_mqueue" fsuid=0 ouid=0

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_01.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_01.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1649187379.660:255
-Operation: create
-Mask: create
-Denied Mask: create
-fsuid: 0
-ouid: 0
-Profile: /root/apparmor/tests/regression/apparmor/posix_mq_rcv
-Name: /queuename
-Command: posix_mq_rcv
-PID: 791
-Class: posix_mqueue
-Epoch: 1649187379
-Audit subid: 255

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_01.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/posix_mq_rcv {
-  mqueue create type=posix /queuename,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_02.in

@@ -1,2 +0,0 @@
-Apr 05 19:36:29 ubuntu kernel: audit: type=1400 audit(1649187389.828:262): apparmor="DENIED" operation="open" profile="/root/apparmor/tests/regression/apparmor/posix_mq_rcv" name="/queuename" pid=848 comm="posix_mq_rcv" requested="read create" denied="read" class="posix_mqueue" fsuid=0 ouid=0
-

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_02.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_02.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1649187389.828:262
-Operation: open
-Mask: read create
-Denied Mask: read
-fsuid: 0
-ouid: 0
-Profile: /root/apparmor/tests/regression/apparmor/posix_mq_rcv
-Name: /queuename
-Command: posix_mq_rcv
-PID: 848
-Class: posix_mqueue
-Epoch: 1649187389
-Audit subid: 262

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_02.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/posix_mq_rcv {
-  mqueue read type=posix /queuename,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_03.in

@@ -1 +0,0 @@
-Apr 05 19:36:39 ubuntu kernel: audit: type=1400 audit(1649187399.973:265): apparmor="DENIED" operation="unlink" profile="/root/apparmor/tests/regression/apparmor/posix_mq_rcv" name="/queuename" pid=897 comm="posix_mq_rcv" requested="delete" denied="delete" class="posix_mqueue" fsuid=0 ouid=0

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_03.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_03.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1649187399.973:265
-Operation: unlink
-Mask: delete
-Denied Mask: delete
-fsuid: 0
-ouid: 0
-Profile: /root/apparmor/tests/regression/apparmor/posix_mq_rcv
-Name: /queuename
-Command: posix_mq_rcv
-PID: 897
-Class: posix_mqueue
-Epoch: 1649187399
-Audit subid: 265

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_03.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/posix_mq_rcv {
-  mqueue delete type=posix /queuename,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_04.in

@@ -1 +0,0 @@
-Jun 02 16:58:20 ubuntu kernel: audit: type=1400 audit(1654189100.680:1011): apparmor="DENIED" operation="sysv_mqueue" profile="/root/apparmor/tests/regression/apparmor/sysv_mq_rcv" name="123" pid=13574 comm="sysv_mq_rcv" requested="create" denied="create" class="sysv_mqueue" fsuid=0 ouid=0

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_04.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_04.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1654189100.680:1011
-Operation: sysv_mqueue
-Mask: create
-Denied Mask: create
-fsuid: 0
-ouid: 0
-Profile: /root/apparmor/tests/regression/apparmor/sysv_mq_rcv
-Name: 123
-Command: sysv_mq_rcv
-PID: 13574
-Class: sysv_mqueue
-Epoch: 1654189100
-Audit subid: 1011

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_04.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/sysv_mq_rcv {
-  mqueue create type=sysv 123,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_05.in

@@ -1 +0,0 @@
-Jun 02 17:15:45 ubuntu kernel: audit: type=1400 audit(1654190145.439:1135): apparmor="DENIED" operation="sysv_mqueue" profile="/root/apparmor/tests/regression/apparmor/sysv_mq_snd" name="123" pid=15849 comm="sysv_mq_snd" requested="open" denied="open" class="sysv_mqueue"

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_05.out

@@ -1,14 +0,0 @@
-START
-File: testcase_mqueue_05.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1654190145.439:1135
-Operation: sysv_mqueue
-Mask: open
-Denied Mask: open
-Profile: /root/apparmor/tests/regression/apparmor/sysv_mq_snd
-Name: 123
-Command: sysv_mq_snd
-PID: 15849
-Class: sysv_mqueue
-Epoch: 1654190145
-Audit subid: 1135

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_05.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/sysv_mq_snd {
-  mqueue open type=sysv 123,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_06.in

@@ -1 +0,0 @@
-Jun 02 17:15:37 ubuntu kernel: audit: type=1400 audit(1654190137.559:1122): apparmor="DENIED" operation="sysv_mqueue" profile="/root/apparmor/tests/regression/apparmor/sysv_mq_rcv" name="123" pid=15632 comm="sysv_mq_rcv" requested="read" denied="read" class="sysv_mqueue" fsuid=0 ouid=0

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_06.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_06.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1654190137.559:1122
-Operation: sysv_mqueue
-Mask: read
-Denied Mask: read
-fsuid: 0
-ouid: 0
-Profile: /root/apparmor/tests/regression/apparmor/sysv_mq_rcv
-Name: 123
-Command: sysv_mq_rcv
-PID: 15632
-Class: sysv_mqueue
-Epoch: 1654190137
-Audit subid: 1122

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_06.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/sysv_mq_rcv {
-  mqueue read type=sysv 123,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_07.in

@@ -1 +0,0 @@
-Jun 02 17:15:51 ubuntu kernel: audit: type=1400 audit(1654190151.003:1145): apparmor="DENIED" operation="sysv_mqueue" profile="/root/apparmor/tests/regression/apparmor/sysv_mq_rcv" name="123" pid=15973 comm="sysv_mq_rcv" requested="delete" denied="delete" class="sysv_mqueue" fsuid=1001 ouid=1001

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_07.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_07.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1654190151.003:1145
-Operation: sysv_mqueue
-Mask: delete
-Denied Mask: delete
-fsuid: 1001
-ouid: 1001
-Profile: /root/apparmor/tests/regression/apparmor/sysv_mq_rcv
-Name: 123
-Command: sysv_mq_rcv
-PID: 15973
-Class: sysv_mqueue
-Epoch: 1654190151
-Audit subid: 1145

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_07.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/sysv_mq_rcv {
-  mqueue delete type=sysv 123,
-
-}

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_08.in

@@ -1 +0,0 @@
-Jun 02 17:15:55 ubuntu kernel: audit: type=1400 audit(1654190155.699:1155): apparmor="DENIED" operation="sysv_mqueue" profile="/root/apparmor/tests/regression/apparmor/sysv_mq_snd" name="123" pid=16148 comm="sysv_mq_snd" requested="write" denied="write" class="sysv_mqueue" fsuid=1001 ouid=1001

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_08.out

@@ -1,16 +0,0 @@
-START
-File: testcase_mqueue_08.in
-Event type: AA_RECORD_DENIED
-Audit ID: 1654190155.699:1155
-Operation: sysv_mqueue
-Mask: write
-Denied Mask: write
-fsuid: 1001
-ouid: 1001
-Profile: /root/apparmor/tests/regression/apparmor/sysv_mq_snd
-Name: 123
-Command: sysv_mq_snd
-PID: 16148
-Class: sysv_mqueue
-Epoch: 1654190155
-Audit subid: 1155

libraries/libapparmor/testsuite/test_multi/testcase_mqueue_08.profile

@@ -1,4 +0,0 @@
-/root/apparmor/tests/regression/apparmor/sysv_mq_snd {
-  mqueue write type=sysv 123,
-
-}