mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-22 01:57:43 +00:00
3186b09035
Attached is a patch to make the initscript not fail if /tmp is full by converting the comm(1) usage on temporary files to an embedded awk script. On both Ubuntu and OpenSUSE, a version of awk (mawk in Ubuntu, gawk in OpenSUSE) is either a direct or indirect dependency on the minimal or base package set, and the original reporter also mentioned that an awk-based solution would be palatable in a way that converting to bash, or using perl or python here would not be. In the embedded awk script, I've tried to avoid gawk or mawk specific behaviors or extensions; e.g. this is the reason for the call to sort on the output of the awk script, rather than using gawk's asort(). But please let me know if you see anything that shouldn't be portable across awk implementations. An additional issue that is fixed in both scripts is handling child profiles (e.g. hats) during reload. If child profiles are filtered out (via grep -v '//') of the list to consider, then on reloading a profile where a child profile has been removed or renamed, that child profile will continue to stick around. However, if the profile containing child profiles is removed entirely, if the initscript attempts to unload the child profiles after the parent is removed, this will fail because they were unloaded when the parent was unloaded. Thus I removed any filtering of child profiles out, but do a post-awk reverse sort which guarantees that any child profiles will be removed before their parent is. I also added the LC_COLLATE=C (based on the Ubuntu version) to the sort call to ensure a consistent sort order. To restate, the problem with the existing code is that it creates temporary files in $TMPDIR (by default /tmp) and if that partition is full, problems with the reload action ensue. Alternate solutions include switching the initscript to use bash and its <$() extension or setting TMPDIR to /dev/shm/. The former is unpalatable to some (particularly for an initscript), and for the latter, /dev/shm is only guaranteed to exist on GNU libc based systems (glibc apparently expects /dev/shm to exist for its POSIX shared memory implementation; see shm_overview(7)). So to me, awk (sans GNU extensions) looks to be the least bad option here. Nominated-By: Steve Beattie <sbeattie@ubuntu.com> Acked-By: John Johansen <john.johansen@canonical.com> Bug: https://launchpad.net/bugs/775785
The apparmor_parser allows you to add, replace, and remove AppArmor policy through the use of command line options. The default is to add. `apparmor_parser --help` shows what the command line options are. You can also find more information at <http://forge.novell.com/modules/xfmod/project/?apparmor>. Please send all complaints, bug reports, feature requests, rants about the software, and questions to apparmor-general@forge.novell.com. Security issues should be directed to security@suse.de or secure@novell.com, where we will attempt to conform to the RFP vulnerability disclosure protocol: http://www.wiretrip.net/rfp/policy.html Thanks. -- The AppArmor development team