Tyler Hicks has proposed merging lp:~apparmor-dev/apparmor/aa-fixes into
lp:~apparmor-dev/apparmor/apparmor-ubuntu-citrain.
Requested reviews:
Jamie Strandboge (jdstrand)
For more details, see:
https://code.launchpad.net/~apparmor-dev/apparmor/aa-fixes/+merge/213170
Is your branch in sync with latest trunk? Yes
Is debian/changelog properly formatted in the MP? Yes
Did you build your software in a clean sbuild/pbuilder chroot or ppa? Yes
(security-proposed PPA)
Did you build your software in a clean sbuild/pbuilder chroot or ppa on armhf?
Yes (security-proposed PPA)
Has your component TestPlan been executed successfully on emulator/armhf Touch
build (eg, one of N4, N10, N7 (either), Galaxy Nexus) and clean Ubuntu Desktop
VM? I've done an abbreviated version of the TestPlan, at jdstrand's request:
- Ran QRT's test-apparmor.py (to test the changes to the regression suite and
aa.py)
- Created an LXC container, started it, and verified that it was confined (for
LP: #1296459)
- Manually tested the Python utils (for LP: #1294825 and LP: #1294819)
+ Note that they still backtrace on the LXC abstractions due to LP: #1295346
and LP: #1298678)
- Launched apps and verified their confinement on Touch
- Did exploratory testing on Touch and Desktop
Has a 5 minute exploratory testing run been executed on an armhf Touch build?
Yes (N7)
If you changed the packaging (debian/), did you subscribe a core-dev to this
MP? N/A
What components might get impacted by your changes?
- The apparmor/aa.py Python module and the utils shipped in apparmor-utils
- apparmor_parser
- The in-tree regression tests (they don't get installed but are used for
testing)
Have you requested review by the teams of these owning components? Yes,
upstream AppArmor has acked all changes and jdstrand is the reviewer of this
merge
--
https://code.launchpad.net/~apparmor-dev/apparmor/aa-fixes/+merge/213170
Your team AppArmor Developers is subscribed to branch
lp:~apparmor-dev/apparmor/apparmor-ubuntu-citrain.
=== modified file 'debian/changelog'
--- debian/changelog 2014-03-26 16:15:34 +0000
+++ debian/changelog 2014-03-28 00:01:01 +0000
@@ -1,5 +1,6 @@
-apparmor (2.8.95~2430-0ubuntu3) UNRELEASED; urgency=medium
+apparmor (2.8.95~2430-0ubuntu3) trusty; urgency=medium
+ [ Jamie Strandboge ]
* debian/lib/apparmor/functions: properly calculate number of profiles in
/var/lib/apparmor/profiles (LP: #1295816)
* autostart aa-notify via /etc/xdg/autostart instead of /etc/X11/Xsession.d
@@ -11,7 +12,30 @@
* debian/notify/notify.conf: use_group should be set to "sudo" instead of
"admin" (LP: #1009666)
- -- Jamie Strandboge <[email protected]> Wed, 26 Mar 2014 10:34:34 -0500
+ [ Tyler Hicks ]
+ * debian/patches/initialize-mount-flags.patch: Initialize the variables
+ containing mount rule flags to zero. Otherwise, the parser may set
+ unexpected bits in the mount flags field for rules that do not specify
+ mount flags. The uninitialized mount flag variables may have caused
+ unexpected AppArmor denials during mount mediation. (LP: #1296459)
+ * debian/patches/fix-typo-in-dbus_write.patch: Fix a bug in the
+ apparmor/aa.py module that caused the utilities in the apparmor-utils
+ package to write out network rules instead of dbus rules
+ * debian/patches/limited-mount-rule-support.patch: Fix a bug in the
+ apparmor/aa.py module that caused the utilities in the apparmor-utils
+ package to traceback when encountering a mount rule (LP: #1294825)
+ * debian/patches/bare-capability-rule-support.patch: Fix a bug in the
+ apparmor/aa.py module that caused the utilities in the apparmor-utils
+ package to traceback when encountering a bare capability rule
+ (LP: #1294819)
+ * debian/patches/check-config-for-sysctl.patch,
+ debian/patches/increase-swap-size.patch: Fix bugs in the regression test
+ suite that caused errors when running on ppc64el
+ * debian/patches/test-v6-policy.patch,
+ debian/patches/test-mount-mediation.patch: Improve the regression tests
+ by increasing the mount rule test coverage
+
+ -- Tyler Hicks <[email protected]> Thu, 27 Mar 2014 14:12:29 -0500
apparmor (2.8.95~2430-0ubuntu2) trusty; urgency=medium
=== added file 'debian/patches/bare-capability-rule-support.patch'
--- debian/patches/bare-capability-rule-support.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/bare-capability-rule-support.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,89 @@
+Description: utils: Basic support for bare capability rules
+ .
+ Bug: https://bugs.launchpad.net/bugs/1294819
+ .
+ This patch as minimal support for bare capability rules ("capability,").
+ It prevents aa.py from emitting a traceback when encountering such a
+ rule.
+ .
+ It only adds the ability to parse and write the bare rule. It doesn't
+ attempt to be clever when deleting duplicate rules, such as realizing
+ that "capability audit_control," can be deleted if "capability," is also
+ present.
+ .
+ Signed-off-by: Tyler Hicks <[email protected]>
+ Acked-by: Steve Beattie <[email protected]>
+ Acked-by: Christian Boltz <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: Tyler Hicks <[email protected]>
+Bug: https://launchpad.net/bugs/1294819
+Last-Update: 2014-03-20
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'utils/apparmor/aa.py'
+--- old/utils/apparmor/aa.py 2014-03-20 19:25:42 +0000
++++ new/utils/apparmor/aa.py 2014-03-20 19:27:24 +0000
+@@ -78,6 +78,9 @@
+ # To store the globs entered by users so they can be provided again
+ user_globs = []
+
++# The key for representing bare rules such as "capability," or "file,"
++ALL = '_ALL'
++
+ ## Variables used under logprof
+ ### Were our
+ t = hasher() # dict()
+@@ -2104,6 +2107,9 @@
+ deleted = []
+ if profilecaps and inccaps:
+ for capname in profilecaps.keys():
++ # XXX The presence of a bare capability rule ("capability,") should
++ # cause more specific capability rules
++ # ("capability audit_control,") to be deleted
+ if inccaps[capname].get('set', False) == 1:
+ deleted.append(capname)
+ for capname in deleted:
+@@ -2599,7 +2605,7 @@
+ ## Profile parsing regex
+ RE_PROFILE_START = re.compile('^\s*(("??/.+?"??)|(profile\s+("??.+?"??)))\s+((flags=)?\((.+)\)\s+)?\{\s*(#.*)?$')
+ RE_PROFILE_END = re.compile('^\s*\}\s*(#.*)?$')
+-RE_PROFILE_CAP = re.compile('^\s*(audit\s+)?(allow\s+|deny\s+)?capability\s+(\S+)\s*,\s*(#.*)?$')
++RE_PROFILE_CAP = re.compile('^\s*(audit\s+)?(allow\s+|deny\s+)?capability(\s+\S+)?\s*,\s*(#.*)?$')
+ RE_PROFILE_LINK = re.compile('^\s*(audit\s+)?(allow\s+|deny\s+)?link\s+(((subset)|(<=))\s+)?([\"\@\/].*?"??)\s+->\s*([\"\@\/].*?"??)\s*,\s*(#.*)?$')
+ RE_PROFILE_CHANGE_PROFILE = re.compile('^\s*change_profile\s+->\s*("??.+?"??),(#.*)?$')
+ RE_PROFILE_ALIAS = re.compile('^\s*alias\s+("??.+?"??)\s+->\s*("??.+?"??)\s*,(#.*)?$')
+@@ -2733,7 +2739,9 @@
+ if matches[1] and matches[1].strip() == 'deny':
+ allow = 'deny'
+
+- capability = matches[2]
++ capability = ALL
++ if matches[2]:
++ capability = matches[2].strip()
+
+ profile_data[profile][hat][allow]['capability'][capability]['set'] = True
+ profile_data[profile][hat][allow]['capability'][capability]['audit'] = audit
+@@ -3236,7 +3244,10 @@
+ if prof_data[allow]['capability'][cap].get('audit', False):
+ audit = 'audit '
+ if prof_data[allow]['capability'][cap].get('set', False):
+- data.append('%s%s%scapability %s,' % (pre, audit, allowstr, cap))
++ if cap == ALL:
++ data.append('%s%s%scapability,' % (pre, audit, allowstr))
++ else:
++ data.append('%s%s%scapability %s,' % (pre, audit, allowstr, cap))
+ data.append('')
+
+ return data
+@@ -3698,7 +3709,9 @@
+ if matches[1] and matches[1].strip() == 'deny':
+ allow = 'deny'
+
+- capability = matches[2]
++ capability = ALL
++ if matches[2]:
++ capability = matches[2].strip()
+
+ if not write_prof_data[hat][allow]['capability'][capability].get('set', False):
+ correct = False
+
=== added file 'debian/patches/check-config-for-sysctl.patch'
--- debian/patches/check-config-for-sysctl.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/check-config-for-sysctl.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,274 @@
+Description: regression sysctl: skip if sysctl not available
+ .
+ Some kernels have CONFIG_SYSCALL_SYSCTL disabled, which is something to
+ be encouraged. This patch separates out the two different kind of sysctl
+ tests (syscall based and /proc/sys based) into separate shell functions,
+ and then checks to see that the test environment supports each before
+ invoking each shell function, issuing a warning (but not failing the
+ tests) if not available.
+ .
+ Signed-off-by: Steve Beattie <[email protected]>
+ Acked-by: John Johansen <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: Steve Beattie <[email protected]>
+Last-Update: 2014-03-20
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'tests/regression/apparmor/syscall_sysctl.sh'
+--- old/tests/regression/apparmor/syscall_sysctl.sh 2010-12-20 20:29:10 +0000
++++ new/tests/regression/apparmor/syscall_sysctl.sh 2014-03-20 18:23:10 +0000
+@@ -25,119 +25,140 @@
+ ##
+ ## C. SYSCTL
+ ##
++
++test_syscall_sysctl()
++{
++ settest syscall_sysctl
++
++ runchecktest "SYSCTL (no confinement read only)" pass ro
++
++ runchecktest "SYSCTL (no confinement rw)" pass
++
++ genprofile $sysctlgood:r
++ runchecktest "SYSCTL (confinement/good r w/ r perm)" pass ro
++
++ genprofile $sysctlgood:r
++ runchecktest "SYSCTL (confinement/good rw w/ r perm)" fail
++
++ genprofile $sysctlgood:w
++ runchecktest "SYSCTL (confinement/good r w/ w perm)" fail ro
++
++ genprofile $sysctlgood:w
++ runchecktest "SYSCTL (confinement/good rw w/ w perm)" fail
++
++ genprofile $sysctlgood:rw
++ runchecktest "SYSCTL (confinement/good r w/ rw perm)" pass ro
++
++ genprofile $sysctlgood:rw
++ runchecktest "SYSCTL (confinement/good rw w/ rw perm)" pass
++
++ genprofile $sysctlbad:r
++ runchecktest "SYSCTL (confinement/bad r w/ r perm)" fail ro
++
++ genprofile $sysctlbad:r
++ runchecktest "SYSCTL (confinement/bad rw w/ r perm)" fail ro
++
++ genprofile $sysctlbad:w
++ runchecktest "SYSCTL (confinement/bad r w/ w perm)" fail ro
++
++ genprofile $sysctlbad:w
++ runchecktest "SYSCTL (confinement/bad rw w/ w perm)" fail
++
++ genprofile $sysctlbad:rw
++ runchecktest "SYSCTL (confinement/bad r w/ rw perm)" fail ro
++
++ genprofile $sysctlbad:rw
++ runchecktest "SYSCTL (confinement/bad rw w/ rw perm)" fail
++}
++
++test_sysctl_proc()
++{
++ settest sysctl_proc
++
++ #unconfined
++ runchecktest "SYSCTL /proc (read no confinement)" pass $sysctlgood r
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (write no confinement)" pass $sysctlgood w $value
++ runchecktest "SYSCTL /proc (rw no confinement)" pass $sysctlgood rw
++
++ #test with profile giving access to sysctlgood
++ genprofile $sysctlgood:r
++ runchecktest "SYSCTL /proc (confinement/good r w/ r perm)" pass $sysctlgood r
++
++ genprofile $sysctlgood:w
++ runchecktest "SYSCTL /proc (confinement/good r w/ w perm)" fail $sysctlgood r
++
++ genprofile $sysctlgood:rw
++ runchecktest "SYSCTL /proc (confinement/good r w/ rw perm)" pass $sysctlgood r
++
++ genprofile $sysctlgood:r
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/good w w/ r perm)" fail $sysctlgood w $value
++
++ genprofile $sysctlgood:w
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/good w w/ w perm)" pass $sysctlgood w $value
++
++ genprofile $sysctlgood:rw
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/good w w/ rw perm)" pass $sysctlgood w $value
++
++ genprofile $sysctlgood:r
++ runchecktest "SYSCTL /proc (confinement/good rw w/ r perm)" fail $sysctlgood rw
++
++ genprofile $sysctlgood:w
++ runchecktest "SYSCTL /proc (confinement/good rw w/ w perm)" fail $sysctlgood rw
++
++ genprofile $sysctlgood:rw
++ runchecktest "SYSCTL /proc (confinement/good rw w/ rw perm)" pass $sysctlgood rw
++
++ #test with profile giving access to sysctlbad but access to sysctlgood
++ genprofile $sysctlbad:r
++ runchecktest "SYSCTL /proc (confinement/bad r w/ r perm)" fail $sysctlgood r
++
++ genprofile $sysctlbad:w
++ runchecktest "SYSCTL /proc (confinement/bad r w/ w perm)" fail $sysctlgood r
++
++ genprofile $sysctlbad:rw
++ runchecktest "SYSCTL /proc (confinement/bad r w/ rw perm)" fail $sysctlgood r
++
++ genprofile $sysctlbad:r
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/bad w w/ r perm)" fail $sysctlgood w $value
++
++ genprofile $sysctlbad:w
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/bad w w/ w perm)" fail $sysctlgood w $value
++
++ genprofile $sysctlbad:rw
++ value=`cat $sysctlgood`
++ runchecktest "SYSCTL /proc (confinement/bad w w/ rw perm)" fail $sysctlgood w $value
++
++ genprofile $sysctlbad:r
++ runchecktest "SYSCTL /proc (confinement/bad rw w/ r perm)" fail $sysctlgood rw
++
++ genprofile $sysctlbad:w
++ runchecktest "SYSCTL /proc (confinement/bad rw w/ w perm)" fail $sysctlgood rw
++
++ genprofile $sysctlbad:rw
++ runchecktest "SYSCTL /proc (confinement/bad rw w/ rw perm)" fail $sysctlgood rw
++}
++
++
++# check if the kernel supports CONFIG_SYSCTL_SYSCALL
++# generally we want to encourage kernels to disable it, but if it's
++# enabled we want to test against it
+ settest syscall_sysctl
+-
+-runchecktest "SYSCTL (no confinement read only)" pass ro
+-
+-runchecktest "SYSCTL (no confinement rw)" pass
+-
+-genprofile $sysctlgood:r
+-runchecktest "SYSCTL (confinement/good r w/ r perm)" pass ro
+-
+-genprofile $sysctlgood:r
+-runchecktest "SYSCTL (confinement/good rw w/ r perm)" fail
+-
+-genprofile $sysctlgood:w
+-runchecktest "SYSCTL (confinement/good r w/ w perm)" fail ro
+-
+-genprofile $sysctlgood:w
+-runchecktest "SYSCTL (confinement/good rw w/ w perm)" fail
+-
+-genprofile $sysctlgood:rw
+-runchecktest "SYSCTL (confinement/good r w/ rw perm)" pass ro
+-
+-genprofile $sysctlgood:rw
+-runchecktest "SYSCTL (confinement/good rw w/ rw perm)" pass
+-
+-genprofile $sysctlbad:r
+-runchecktest "SYSCTL (confinement/bad r w/ r perm)" fail ro
+-
+-genprofile $sysctlbad:r
+-runchecktest "SYSCTL (confinement/bad rw w/ r perm)" fail ro
+-
+-genprofile $sysctlbad:w
+-runchecktest "SYSCTL (confinement/bad r w/ w perm)" fail ro
+-
+-genprofile $sysctlbad:w
+-runchecktest "SYSCTL (confinement/bad rw w/ w perm)" fail
+-
+-genprofile $sysctlbad:rw
+-runchecktest "SYSCTL (confinement/bad r w/ rw perm)" fail ro
+-
+-genprofile $sysctlbad:rw
+-runchecktest "SYSCTL (confinement/bad rw w/ rw perm)" fail
++res=$(${test} ro)
++if [ $? -ne 0 -a $res == "FAIL: sysctl read failed - Function not implemented" ] ; then
++ echo " WARNING: syscall sysctl not implemented, skipping tests ..."
++else
++ test_syscall_sysctl
++fi
+
+ # now test /proc/sys/ paths
+-
+-settest sysctl_proc
+-
+-#unconfined
+-runchecktest "SYSCTL /proc (read no confinement)" pass $sysctlgood r
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (write no confinement)" pass $sysctlgood w $value
+-runchecktest "SYSCTL /proc (rw no confinement)" pass $sysctlgood rw
+-
+-#test with profile giving access to sysctlgood
+-genprofile $sysctlgood:r
+-runchecktest "SYSCTL /proc (confinement/good r w/ r perm)" pass $sysctlgood r
+-
+-genprofile $sysctlgood:w
+-runchecktest "SYSCTL /proc (confinement/good r w/ w perm)" fail $sysctlgood r
+-
+-genprofile $sysctlgood:rw
+-runchecktest "SYSCTL /proc (confinement/good r w/ rw perm)" pass $sysctlgood r
+-
+-genprofile $sysctlgood:r
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/good w w/ r perm)" fail $sysctlgood w $value
+-
+-genprofile $sysctlgood:w
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/good w w/ w perm)" pass $sysctlgood w $value
+-
+-genprofile $sysctlgood:rw
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/good w w/ rw perm)" pass $sysctlgood w $value
+-
+-genprofile $sysctlgood:r
+-runchecktest "SYSCTL /proc (confinement/good rw w/ r perm)" fail $sysctlgood rw
+-
+-genprofile $sysctlgood:w
+-runchecktest "SYSCTL /proc (confinement/good rw w/ w perm)" fail $sysctlgood rw
+-
+-genprofile $sysctlgood:rw
+-runchecktest "SYSCTL /proc (confinement/good rw w/ rw perm)" pass $sysctlgood rw
+-
+-#test with profile giving access to sysctlbad but access to sysctlgood
+-genprofile $sysctlbad:r
+-runchecktest "SYSCTL /proc (confinement/bad r w/ r perm)" fail $sysctlgood r
+-
+-genprofile $sysctlbad:w
+-runchecktest "SYSCTL /proc (confinement/bad r w/ w perm)" fail $sysctlgood r
+-
+-genprofile $sysctlbad:rw
+-runchecktest "SYSCTL /proc (confinement/bad r w/ rw perm)" fail $sysctlgood r
+-
+-genprofile $sysctlbad:r
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/bad w w/ r perm)" fail $sysctlgood w $value
+-
+-genprofile $sysctlbad:w
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/bad w w/ w perm)" fail $sysctlgood w $value
+-
+-genprofile $sysctlbad:rw
+-value=`cat $sysctlgood`
+-runchecktest "SYSCTL /proc (confinement/bad w w/ rw perm)" fail $sysctlgood w $value
+-
+-genprofile $sysctlbad:r
+-runchecktest "SYSCTL /proc (confinement/bad rw w/ r perm)" fail $sysctlgood rw
+-
+-genprofile $sysctlbad:w
+-runchecktest "SYSCTL /proc (confinement/bad rw w/ w perm)" fail $sysctlgood rw
+-
+-genprofile $sysctlbad:rw
+-runchecktest "SYSCTL /proc (confinement/bad rw w/ rw perm)" fail $sysctlgood rw
+-
+-
+-
++if [ ! -f "${sysctlgood}" ] ; then
++ echo " WARNING: proc sysctl path not found, /proc not mounted? Skipping tests ..."
++else
++ test_sysctl_proc
++fi
+
=== added file 'debian/patches/fix-typo-in-dbus_write.patch'
--- debian/patches/fix-typo-in-dbus_write.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/fix-typo-in-dbus_write.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,22 @@
+Description: utils: Fix typo in write_dbus()
+ .
+ Signed-off-by: Tyler Hicks <[email protected]>
+ Acked-by: Steve Beattie <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: Tyler Hicks <[email protected]>
+Last-Update: 2014-03-20
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'utils/apparmor/aa.py'
+--- old/utils/apparmor/aa.py 2014-03-16 15:06:42 +0000
++++ new/utils/apparmor/aa.py 2014-03-20 19:19:40 +0000
+@@ -3265,7 +3265,7 @@
+
+ def write_dbus(prof_data, depth):
+ data = write_dbus_rules(prof_data, depth, 'deny')
+- data += write_net_rules(prof_data, depth, 'allow')
++ data += write_dbus_rules(prof_data, depth, 'allow')
+ return data
+
+ def write_link_rules(prof_data, depth, allow):
+
=== added file 'debian/patches/increase-swap-size.patch'
--- debian/patches/increase-swap-size.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/increase-swap-size.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,30 @@
+Description: regression swap test: 640 KiB not enough swap for everyone
+ .
+ On ppc64el platforms, the minimum swapfile size is 640KiB. Our swap
+ test aborts there because it creates a swapfile of size 512KiB. This
+ patch adjusts the size to 768KiB, to satisfy ppc64el and to try
+ to keep the size down for embedded and otherwise limited platforms
+ (e.g. phones).
+ .
+ Signed-off-by: Steve Beattie <[email protected]>
+ Acked-by: John Johansen <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: Steve Beattie <[email protected]>
+Last-Update: 2014-03-20
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'tests/regression/apparmor/swap.sh'
+--- old/tests/regression/apparmor/swap.sh 2014-03-19 18:53:26 +0000
++++ new/tests/regression/apparmor/swap.sh 2014-03-20 18:28:51 +0000
+@@ -29,7 +29,9 @@
+
+ swap_file=$tmpdir/swapfile
+
+-dd if=/dev/zero of=${swap_file} bs=1024 count=512 2> /dev/null
++# ppc64el wants this to be larger than 640KiB
++# arm/small machines want this as small as possible
++dd if=/dev/zero of=${swap_file} bs=1024 count=768 2> /dev/null
+ /sbin/mkswap -f ${swap_file} > /dev/null
+
+ # TEST 1. Make sure can enable and disable swap unconfined
+
=== added file 'debian/patches/initialize-mount-flags.patch'
--- debian/patches/initialize-mount-flags.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/initialize-mount-flags.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,17 @@
+Subject: Initialize mount flag variables
+Author: Steve Beattie <[email protected]>
+Origin: https://lists.ubuntu.com/archives/apparmor/2014-March/005498.html
+
+Index: apparmor-2.8.95~2430/parser/mount.c
+===================================================================
+--- apparmor-2.8.95~2430.orig/parser/mount.c 2014-03-25 15:20:57.018085658 -0500
++++ apparmor-2.8.95~2430/parser/mount.c 2014-03-25 15:20:57.010085658 -0500
+@@ -389,7 +389,7 @@ mnt_rule::mnt_rule(struct cond_entry *sr
+ struct cond_entry *dst_conds __unused, char *mnt_point_p,
+ int allow_p):
+ mnt_point(mnt_point_p), device(device_p), trans(NULL), opts(NULL),
+- audit(0), deny(0)
++ flags(0), inv_flags(0), audit(0), deny(0)
+ {
+ /* FIXME: dst_conds are ignored atm */
+ aa_class = AA_CLASS_MOUNT;
=== added file 'debian/patches/limited-mount-rule-support.patch'
--- debian/patches/limited-mount-rule-support.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/limited-mount-rule-support.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,222 @@
+Description: utils: Add very limited support for mount rules
+ .
+ Bug: https://bugs.launchpad.net/bugs/1294825
+ .
+ This patch is inspired by sbeattie's patch to add limited dbus rule
+ support. It adds does very dumb parsing of mount rules. Basically, it
+ stores mount, remount, and umount rules as raw strings wrapped in a
+ class.
+ .
+ Signed-off-by: Tyler Hicks <[email protected]>
+ Acked-by: Steve Beattie <[email protected]>
+ Acked-by: Christian Boltz <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: Tyler Hicks <[email protected]>
+Bug: https://launchpad.net/bugs/1294825
+Last-Update: 2014-03-20
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'utils/apparmor/aa.py'
+--- old/utils/apparmor/aa.py 2014-03-20 19:19:40 +0000
++++ new/utils/apparmor/aa.py 2014-03-20 19:25:42 +0000
+@@ -2616,6 +2616,7 @@
+ RE_NETWORK_FAMILY_TYPE = re.compile('\s+(\S+)\s+(\S+)\s*,$')
+ RE_NETWORK_FAMILY = re.compile('\s+(\S+)\s*,$')
+ RE_PROFILE_DBUS = re.compile('^\s*(audit\s+)?(allow\s+|deny\s+)?(dbus[^#]*\s*,)\s*(#.*)?$')
++RE_PROFILE_MOUNT = re.compile('^\s*(audit\s+)?(allow\s+|deny\s+)?((mount|remount|umount)[^#]*\s*,)\s*(#.*)?$')
+
+ # match anything that's not " or #, or matching quotes with anything except quotes inside
+ __re_no_or_quoted_hash = '([^#"]|"[^"]*")*'
+@@ -2693,6 +2694,7 @@
+ profile_data[profile][hat]['allow']['netdomain'] = hasher()
+ profile_data[profile][hat]['allow']['path'] = hasher()
+ profile_data[profile][hat]['allow']['dbus'] = list()
++ profile_data[profile][hat]['allow']['mount'] = list()
+ # Save the initial comment
+ if initial_comment:
+ profile_data[profile][hat]['initial_comment'] = initial_comment
+@@ -2966,6 +2968,28 @@
+ dbus_rules.append(dbus_rule)
+ profile_data[profile][hat][allow]['dbus'] = dbus_rules
+
++ elif RE_PROFILE_MOUNT.search(line):
++ matches = RE_PROFILE_MOUNT.search(line).groups()
++
++ if not profile:
++ raise AppArmorException(_('Syntax Error: Unexpected mount entry found in file: %s line: %s') % (file, lineno + 1))
++
++ audit = False
++ if matches[0]:
++ audit = True
++ allow = 'allow'
++ if matches[1] and matches[1].strip() == 'deny':
++ allow = 'deny'
++ mount = matches[2]
++
++ mount_rule = parse_mount_rule(mount)
++ mount_rule.audit = audit
++ mount_rule.deny = (allow == 'deny')
++
++ mount_rules = profile_data[profile][hat][allow].get('mount', list())
++ mount_rules.append(mount_rule)
++ profile_data[profile][hat][allow]['mount'] = mount_rules
++
+ elif RE_PROFILE_CHANGE_HAT.search(line):
+ matches = RE_PROFILE_CHANGE_HAT.search(line).groups()
+
+@@ -3060,6 +3084,10 @@
+ # return aarules.DBUS_Rule()
+ #print(line)
+
++def parse_mount_rule(line):
++ # XXX Do real parsing here
++ return aarules.Raw_Mount_Rule(line)
++
+ def separate_vars(vs):
+ """Returns a list of all the values for a variable"""
+ data = []
+@@ -3268,6 +3296,24 @@
+ data += write_dbus_rules(prof_data, depth, 'allow')
+ return data
+
++def write_mount_rules(prof_data, depth, allow):
++ pre = ' ' * depth
++ data = []
++
++ # no mount rules, so return
++ if not prof_data[allow].get('mount', False):
++ return data
++
++ for mount_rule in prof_data[allow]['mount']:
++ data.append('%s%s' % (pre, mount_rule.serialize()))
++ data.append('')
++ return data
++
++def write_mount(prof_data, depth):
++ data = write_mount_rules(prof_data, depth, 'deny')
++ data += write_mount_rules(prof_data, depth, 'allow')
++ return data
++
+ def write_link_rules(prof_data, depth, allow):
+ pre = ' ' * depth
+ data = []
+@@ -3361,6 +3407,7 @@
+ data += write_capabilities(prof_data, depth)
+ data += write_netdomain(prof_data, depth)
+ data += write_dbus(prof_data, depth)
++ data += write_mount(prof_data, depth)
+ data += write_links(prof_data, depth)
+ data += write_paths(prof_data, depth)
+ data += write_change_profile(prof_data, depth)
+@@ -3509,6 +3556,7 @@
+ 'capability': write_capabilities,
+ 'netdomain': write_netdomain,
+ 'dbus': write_dbus,
++ 'mount': write_mount,
+ 'link': write_links,
+ 'path': write_paths,
+ 'change_profile': write_change_profile,
+@@ -3600,6 +3648,7 @@
+ data += write_capabilities(write_prof_data[name], depth)
+ data += write_netdomain(write_prof_data[name], depth)
+ data += write_dbus(write_prof_data[name], depth)
++ data += write_mount(write_prof_data[name], depth)
+ data += write_links(write_prof_data[name], depth)
+ data += write_paths(write_prof_data[name], depth)
+ data += write_change_profile(write_prof_data[name], depth)
+
+=== modified file 'utils/apparmor/rules.py'
+--- old/utils/apparmor/rules.py 2014-03-07 17:58:54 +0000
++++ new/utils/apparmor/rules.py 2014-03-20 19:25:42 +0000
+@@ -55,3 +55,15 @@
+ return "%s%s%s" % ('audit ' if self.audit else '',
+ 'deny ' if self.deny else '',
+ self.rule)
++
++class Raw_Mount_Rule(object):
++ audit = False
++ deny = False
++
++ def __init__(self, rule):
++ self.rule = rule
++
++ def serialize(self):
++ return "%s%s%s" % ('audit ' if self.audit else '',
++ 'deny ' if self.deny else '',
++ self.rule)
+
+=== added file 'utils/test/test-mount_parse.py'
+--- old/utils/test/test-mount_parse.py 1970-01-01 00:00:00 +0000
++++ new/utils/test/test-mount_parse.py 2014-03-20 19:25:42 +0000
+@@ -0,0 +1,70 @@
++#! /usr/bin/env python
++# ------------------------------------------------------------------
++#
++# Copyright (C) 2014 Canonical Ltd.
++#
++# This program is free software; you can redistribute it and/or
++# modify it under the terms of version 2 of the GNU General Public
++# License published by the Free Software Foundation.
++#
++# ------------------------------------------------------------------
++
++import apparmor.aa as aa
++import unittest
++
++class AAParseMountTest(unittest.TestCase):
++
++ def test_parse_plain_mount_rule(self):
++ rule = 'mount,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++ def test_parse_ro_mount(self):
++ rule = 'mount -o ro,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++ def test_parse_rw_mount_with_mount_points(self):
++ rule = 'mount -o rw /dev/sdb1 -> /mnt/external,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++class AAParseRemountTest(unittest.TestCase):
++
++ def test_parse_plain_remount_rule(self):
++ rule = 'remount,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++ def test_parse_ro_remount(self):
++ rule = 'remount -o ro,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++ def test_parse_ro_remount_with_mount_point(self):
++ rule = 'remount -o ro /,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++class AAParseUmountTest(unittest.TestCase):
++
++ def test_parse_plain_umount_rule(self):
++ rule = 'umount,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++ def test_parse_umount_with_mount_point(self):
++ rule = 'umount /mnt/external,'
++ mount = aa.parse_mount_rule(rule)
++ self.assertEqual(rule, mount.serialize(),
++ 'mount object returned "%s", expected "%s"' % (mount.serialize(), rule))
++
++if __name__ == '__main__':
++ unittest.main()
+
=== modified file 'debian/patches/series'
--- debian/patches/series 2014-03-20 03:36:23 +0000
+++ debian/patches/series 2014-03-28 00:01:01 +0000
@@ -24,3 +24,11 @@
fix-ppc-endian-ftbfs.patch
opt_arg.patch
tests-cond-dbus.patch
+initialize-mount-flags.patch
+fix-typo-in-dbus_write.patch
+limited-mount-rule-support.patch
+bare-capability-rule-support.patch
+check-config-for-sysctl.patch
+increase-swap-size.patch
+test-v6-policy.patch
+test-mount-mediation.patch
=== added file 'debian/patches/test-mount-mediation.patch'
--- debian/patches/test-mount-mediation.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/test-mount-mediation.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,266 @@
+Description: tests: Improve mount rule tests
+ .
+ The mount.sh regression test script was not testing with actual AppArmor
+ mount rules. This patch improves mkprofile.pl by adding the ability to
+ generate mount rules and adds tests to mount.sh that verify mount
+ mediation is working properly.
+ .
+ Signed-off-by: John Johansen <[email protected]>
+ [tyhicks: Fixed a couple typos and added fstype tests]
+ Signed-off-by: Tyler Hicks <[email protected]>
+ Acked-by: Steve Beattie <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: John Johansen <[email protected]>
+Last-Update: 2014-03-27
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'tests/regression/apparmor/mkprofile.pl'
+--- old/tests/regression/apparmor/mkprofile.pl 2013-09-20 13:48:56 +0000
++++ new/tests/regression/apparmor/mkprofile.pl 2014-03-27 02:10:04 +0000
+@@ -174,6 +174,78 @@
+ }
+ }
+
++sub gen_mount($) {
++ my $rule = shift;
++ my @rules = split (/:/, $rule);
++ if (@rules == 2) {
++ if ($rules[1] =~ /^ALL$/) {
++ push (@{$output_rules{$hat}}, " mount,\n");
++ } else {
++ push (@{$output_rules{$hat}}, " mount $rules[1],\n");
++ }
++ } elsif (@rules == 3) {
++ push (@{$output_rules{$hat}}, " mount $rules[1] $rules[2],\n");
++ } elsif (@rules == 4) {
++ push (@{$output_rules{$hat}}, " mount $rules[1] $rules[2] $rules[3],\n");
++ } elsif (@rules == 5) {
++ push (@{$output_rules{$hat}}, " mount $rules[1] $rules[2] $rules[3] $rules[4],\n");
++ } elsif (@rules == 6) {
++ push (@{$output_rules{$hat}}, " mount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5],\n");
++ } elsif (@rules == 7) {
++ push (@{$output_rules{$hat}}, " mount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5] $rules[6],\n");
++ } else {
++ (!$nowarn) && print STDERR "Warning: invalid mount description '$rule', ignored\n";
++ }
++}
++
++sub gen_remount($) {
++ my $rule = shift;
++ my @rules = split (/:/, $rule);
++ if (@rules == 2) {
++ if ($rules[1] =~ /^ALL$/) {
++ push (@{$output_rules{$hat}}, " remount,\n");
++ } else {
++ push (@{$output_rules{$hat}}, " remount $rules[1],\n");
++ }
++ } elsif (@rules == 3) {
++ push (@{$output_rules{$hat}}, " remount $rules[1] $rules[2],\n");
++ } elsif (@rules == 4) {
++ push (@{$output_rules{$hat}}, " remount $rules[1] $rules[2] $rules[3],\n");
++ } elsif (@rules == 5) {
++ push (@{$output_rules{$hat}}, " remount $rules[1] $rules[2] $rules[3] $rules[4],\n");
++ } elsif (@rules == 6) {
++ push (@{$output_rules{$hat}}, " remount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5],\n");
++ } elsif (@rules == 7) {
++ push (@{$output_rules{$hat}}, " remount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5] $rules[6],\n");
++ } else {
++ (!$nowarn) && print STDERR "Warning: invalid remount description '$rule', ignored\n";
++ }
++}
++
++sub gen_umount($) {
++ my $rule = shift;
++ my @rules = split (/:/, $rule);
++ if (@rules == 2) {
++ if ($rules[1] =~ /^ALL$/) {
++ push (@{$output_rules{$hat}}, " umount,\n");
++ } else {
++ push (@{$output_rules{$hat}}, " umount $rules[1],\n");
++ }
++ } elsif (@rules == 3) {
++ push (@{$output_rules{$hat}}, " umount $rules[1] $rules[2],\n");
++ } elsif (@rules == 4) {
++ push (@{$output_rules{$hat}}, " umount $rules[1] $rules[2] $rules[3],\n");
++ } elsif (@rules == 5) {
++ push (@{$output_rules{$hat}}, " umount $rules[1] $rules[2] $rules[3] $rules[4],\n");
++ } elsif (@rules == 6) {
++ push (@{$output_rules{$hat}}, " umount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5],\n");
++ } elsif (@rules == 7) {
++ push (@{$output_rules{$hat}}, " umount $rules[1] $rules[2] $rules[3] $rules[4] $rules[5] $rules[6],\n");
++ } else {
++ (!$nowarn) && print STDERR "Warning: invalid umount description '$rule', ignored\n";
++ }
++}
++
+ sub gen_file($) {
+ my $rule = shift;
+ my @rules = split (/:/, $rule);
+@@ -260,6 +332,12 @@
+ gen_network($rule);
+ } elsif ($rule =~ /^cap:/) {
+ gen_cap($rule);
++ } elsif ($rule =~ /^mount:/) {
++ gen_mount($rule);
++ } elsif ($rule =~ /^remount:/) {
++ gen_remount($rule);
++ } elsif ($rule =~ /^umount:/) {
++ gen_umount($rule);
+ } elsif ($rule =~ /^flag:/) {
+ gen_flag($rule);
+ } elsif ($rule =~ /^hat:/) {
+
+=== modified file 'tests/regression/apparmor/mount.sh'
+--- old/tests/regression/apparmor/mount.sh 2012-02-24 12:29:08 +0000
++++ new/tests/regression/apparmor/mount.sh 2014-03-27 02:10:04 +0000
+@@ -28,11 +28,29 @@
+
+ mount_file=$tmpdir/mountfile
+ mount_point=$tmpdir/mountpoint
++mount_bad=$tmpdir/mountbad
+ loop_device="unset"
++fstype="ext2"
++
++setup_mnt() {
++ /bin/mount -t${fstype} ${loop_device} ${mount_point}
++# /bin/mount -t${fstype} ${loop_device} ${mount_bad}
++}
++remove_mnt() {
++ mountpoint -q "${mount_point}"
++ if [ $? -eq 0 ] ; then
++ /bin/umount -t${fstype} ${mount_point}
++ fi
++ mountpoint -q "${mount_bad}"
++ if [ $? -eq 0 ] ; then
++ /bin/umount -t${fstype} ${mount_bad}
++ fi
++}
+
+ dd if=/dev/zero of=${mount_file} bs=1024 count=512 2> /dev/null
+-/sbin/mkfs -text2 -F ${mount_file} > /dev/null 2> /dev/null
++/sbin/mkfs -t${fstype} -F ${mount_file} > /dev/null 2> /dev/null
+ /bin/mkdir ${mount_point}
++/bin/mkdir ${mount_bad}
+
+ # in a modular udev world, the devices won't exist until the loopback
+ # module is loaded.
+@@ -56,32 +74,95 @@
+ fatalerror 'Unable to find a free loop device'
+ fi
+
++
+ # TEST 1. Make sure can mount and umount unconfined
+-
+ runchecktest "MOUNT (unconfined)" pass mount ${loop_device} ${mount_point}
++remove_mnt
++
++setup_mnt
+ runchecktest "UMOUNT (unconfined)" pass umount ${loop_device} ${mount_point}
+-
+-# TEST A2. confine MOUNT
+-
+-genprofile
+-runchecktest "MOUNT (confined)" fail mount ${loop_device} ${mount_point}
+-
+-# TEST A3. confine MOUNT - cap sys_admin is not sufficient to mount
+-genprofile capability:sys_admin
+-runchecktest "MOUNT (confined)" fail mount ${loop_device} ${mount_point}
+-
+-/bin/umount -text2 ${mount_point}
+-
+-# TEST A4. confine UMOUNT
+-
+-/bin/mount -text2 ${loop_device} ${mount_point}
+-
+-genprofile
+-runchecktest "UMOUNT (confined)" fail umount ${loop_device} ${mount_point}
+-
+-# TEST A4. confine UMOUNT - cap sys_admin allows unmount
+-genprofile capability:sys_admin
+-runchecktest "UMOUNT (confined)" pass umount ${loop_device} ${mount_point}
++remove_mnt
++
++# TEST A2. confine MOUNT no perms
++genprofile
++runchecktest "MOUNT (confined no perm)" fail mount ${loop_device} ${mount_point}
++remove_mnt
++
++setup_mnt
++runchecktest "UMOUNT (confined no perm)" fail umount ${loop_device} ${mount_point}
++remove_mnt
++
++
++if [ "$(have_features mount)" != "true" ] ; then
++ genprofile capability:sys_admin
++ runchecktest "MOUNT (confined cap)" pass mount ${loop_device} ${mount_point}
++ remove_mnt
++
++ setup_mnt
++ runchecktest "UMOUNT (confined cap)" pass umount ${loop_device} ${mount_point}
++ remove_mnt
++else
++ echo " using mount rules ..."
++
++ genprofile capability:sys_admin
++ runchecktest "MOUNT (confined cap)" fail mount ${loop_device} ${mount_point}
++ remove_mnt
++
++ setup_mnt
++ runchecktest "UMOUNT (confined cap)" fail umount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile mount:ALL
++ runchecktest "MOUNT (confined mount:ALL)" fail mount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile "mount:-> ${mount_point}/"
++ runchecktest "MOUNT (confined bad mntpnt mount -> mntpnt)" fail mount ${loop_device} ${mount_bad}
++ remove_mnt
++
++ runchecktest "MOUNT (confined mount -> mntpnt)" fail mount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++
++ genprofile umount:ALL
++ setup_mnt
++ runchecktest "UMOUNT (confined umount:ALL)" fail umount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile mount:ALL cap:sys_admin
++ runchecktest "MOUNT (confined cap mount:ALL)" pass mount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile cap:sys_admin "mount:-> ${mount_point}/"
++ runchecktest "MOUNT (confined bad mntpnt cap mount -> mntpnt)" fail mount ${loop_device} ${mount_bad}
++ remove_mnt
++
++ runchecktest "MOUNT (confined cap mount -> mntpnt)" pass mount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile cap:sys_admin "mount:fstype=${fstype}XXX"
++ runchecktest "MOUNT (confined cap mount bad fstype)" fail mount ${loop_device} ${mount_point}
++ remove_mnt
++
++ genprofile cap:sys_admin "mount:fstype=${fstype}"
++ runchecktest "MOUNT (confined cap mount fstype)" pass mount ${loop_device} ${mount_point}
++ remove_mnt
++
++
++ genprofile cap:sys_admin umount:ALL
++ setup_mnt
++ runchecktest "UMOUNT (confined cap umount:ALL)" pass umount ${loop_device} ${mount_point}
++ remove_mnt
++
++fi
++
++#need tests for move mount, remount, bind mount, pivot root, chroot
+
+ # cleanup, umount file
+ /bin/umount ${loop_device} > /dev/null 2> /dev/null || /sbin/losetup -d ${loop_device} > /dev/null 2> /dev/null
+
=== added file 'debian/patches/test-v6-policy.patch'
--- debian/patches/test-v6-policy.patch 1970-01-01 00:00:00 +0000
+++ debian/patches/test-v6-policy.patch 2014-03-28 00:01:01 +0000
@@ -0,0 +1,147 @@
+Description: tests: Update the regression tests for v6 policy
+ .
+ This updates the regression tests for v6 policy. It refactors the
+ required_features test into a have_features fn, and a new
+ requires_features fn (renamed to catch all instances make sure they
+ where right)
+ .
+ The have_features fn is then applied to several test to make them
+ conditionally apply based off of availability of the feature
+ and policy version.
+ .
+ Signed-off-by: John Johansen <[email protected]>
+ Acked-by: Tyler Hicks <[email protected]>
+Origin: commit, revision id: [email protected]
+Author: John Johansen <[email protected]>
+Last-Update: 2014-03-27
+X-Bzr-Revision-Id: [email protected]
+
+=== modified file 'tests/regression/apparmor/dbus_eavesdrop.sh'
+--- old/tests/regression/apparmor/dbus_eavesdrop.sh 2013-12-06 19:19:33 +0000
++++ new/tests/regression/apparmor/dbus_eavesdrop.sh 2014-03-27 02:08:59 +0000
+@@ -18,7 +18,7 @@
+ bin=$pwd
+
+ . $bin/prologue.inc
+-required_features dbus
++requires_features dbus
+ . $bin/dbus.inc
+
+ args="--session"
+
+=== modified file 'tests/regression/apparmor/dbus_message.sh'
+--- old/tests/regression/apparmor/dbus_message.sh 2013-08-29 19:34:13 +0000
++++ new/tests/regression/apparmor/dbus_message.sh 2014-03-27 02:08:59 +0000
+@@ -18,7 +18,7 @@
+ bin=$pwd
+
+ . $bin/prologue.inc
+-required_features dbus
++requires_features dbus
+ . $bin/dbus.inc
+
+ listnames="--type=method_call --session --name=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames"
+
+=== modified file 'tests/regression/apparmor/dbus_service.sh'
+--- old/tests/regression/apparmor/dbus_service.sh 2013-08-20 19:14:03 +0000
++++ new/tests/regression/apparmor/dbus_service.sh 2014-03-27 02:08:59 +0000
+@@ -17,7 +17,7 @@
+ bin=$pwd
+
+ . $bin/prologue.inc
+-required_features dbus
++requires_features dbus
+ . $bin/dbus.inc
+
+ service="--$bus --name=$dest $path $iface"
+
+=== modified file 'tests/regression/apparmor/prologue.inc'
+--- old/tests/regression/apparmor/prologue.inc 2013-09-28 00:33:09 +0000
++++ new/tests/regression/apparmor/prologue.inc 2014-03-27 02:08:59 +0000
+@@ -21,19 +21,32 @@
+ #
+ # For this file, functions are first, entry point code is at end, see "MAIN"
+
+-required_features()
++#use $() to retreive the failure message or "true" if success
++have_features()
+ {
+ if [ ! -e "/sys/kernel/security/apparmor/features/" ] ; then
+- echo "Kernel feature masks not supported. Skipping tests ..."
+- exit 0
++ echo "Kernel feature masks not supported."
++ return 1;
+ fi
+
+ for f in $@ ; do
+ if [ ! -e "/sys/kernel/security/apparmor/features/$f" ] ; then
+- echo "Required feature $f not available. Skipping tests ..."
+- exit 0
++ echo "Required feature '$f' not available."
++ return 2;
+ fi
+ done
++
++ echo "true"
++ return 0;
++}
++
++requires_features()
++{
++ local res=$(have_features $@)
++ if [ "$res" != "true" ] ; then
++ echo "$res. Skipping tests ..."
++ exit 0
++ fi
+ }
+
+ requires_query_interface()
+
+=== modified file 'tests/regression/apparmor/tcp.sh'
+--- old/tests/regression/apparmor/tcp.sh 2011-03-02 13:02:45 +0000
++++ new/tests/regression/apparmor/tcp.sh 2014-03-27 02:08:59 +0000
+@@ -15,6 +15,7 @@
+ bin=$pwd
+
+ . $bin/prologue.inc
++requires_features network
+
+ port=34567
+ ip="127.0.0.1"
+
+=== modified file 'tests/regression/apparmor/unix_fd_server.sh'
+--- old/tests/regression/apparmor/unix_fd_server.sh 2013-10-29 17:35:51 +0000
++++ new/tests/regression/apparmor/unix_fd_server.sh 2014-03-27 02:08:59 +0000
+@@ -132,10 +132,12 @@
+ sleep 1
+ rm -f ${socket}
+
+-# FAIL - confined client, no access to the socket file
+-
+-genprofile $file:$okperm $socket:rw $fd_client:px -- image=$fd_client $file:$okperm
+-runchecktest "fd passing; confined client w/o socket access" fail $file $socket $fd_client
+-
+-sleep 1
+-rm -f ${socket}
++if [ "$(have_features policy/versions/v6)" == "true" ] ; then
++ # FAIL - confined client, no access to the socket file
++
++ genprofile $file:$okperm $socket:rw $fd_client:px -- image=$fd_client $file:$okperm
++ runchecktest "fd passing; confined client w/o socket access" fail $file $socket $fd_client
++
++ sleep 1
++ rm -f ${socket}
++fi
+
+=== modified file 'tests/regression/apparmor/unix_socket_file.sh'
+--- old/tests/regression/apparmor/unix_socket_file.sh 2013-10-29 17:35:51 +0000
++++ new/tests/regression/apparmor/unix_socket_file.sh 2014-03-27 02:08:59 +0000
+@@ -27,6 +27,7 @@
+ bin=$pwd
+
+ . $bin/prologue.inc
++requires_features policy/versions/v6
+
+ client=$bin/unix_socket_file_client
+ socket=${tmpdir}/unix_socket_file.sock
+
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
