Hello,
another patch with more fixes:
- change --help for files - "Profile(s) to merge" instead of "base profile"
- display the profile to save when asking to save it
- disable searching for existing network rules in abstractions because
it crashes. This doesn't hurt too much, see the comment in the patch.
(I'm not sure if I should include the full comment with backtrace etc.
in the commit - opinions? If someone wants to fix this crash, even
better ;-)
The patch applies on top of my previous patches.
Regards,
Christian Boltz
--
So... Hm... ich bin etwas aufgeschmissen.
How to troubleshoot without trouble?
[Ratti in fontlinge-devel]
--- aa-mergeprof__MERGED+fixes+fix-include 2014-10-15 23:14:21.334612572 +0200
+++ aa-mergeprof 2014-10-16 13:41:51.412243374 +0200
@@ -27,7 +27,7 @@ from apparmor.translations import init_t
_ = init_translation()
parser = argparse.ArgumentParser(description=_('Merge the given profiles into /etc/apparmor.d/ (or the directory specified with -d)'))
-parser.add_argument('files', nargs='+', type=str, help=_('base profile'))
+parser.add_argument('files', nargs='+', type=str, help=_('Profile(s) to merge'))
#parser.add_argument('other', nargs='?', type=str, help=_('other profile'))
parser.add_argument('-d', '--dir', type=str, help=_('path to profiles'))
#parser.add_argument('-a', '--auto', action='store_true', help=_('Automatically merge profiles, exits incase of *x conflicts'))
@@ -154,7 +154,7 @@ def act(files, merge_mode, merging_profi
q.explanation = _('The following local profiles were changed. Would you like to save them?')
q.functions = ['CMD_SAVE_CHANGES', 'CMD_VIEW_CHANGES', 'CMD_ABORT', 'CMD_IGNORE_ENTRY']
q.default = 'CMD_VIEW_CHANGES'
- q.options = []
+ q.options = [merging_profile]
q.selected = 0
ans = ''
@@ -724,8 +724,31 @@ class Merge(object):
# severity handling for net toggles goes here
for sock_type in sorted(other.aa[profile][hat][allow]['netdomain']['rule'][family].keys()):
- if apparmor.aa.profile_known_network(self.user.aa[profile][hat], family, sock_type):
- continue
+ #if apparmor.aa.profile_known_network(self.user.aa[profile][hat], family, sock_type):
+ # continue
+ # disabled for now because of
+# python3 ~/apparmor/HEAD-CLEAN/utils/aa-mergeprof -d ../../INSTALL/ usr.sbin.couriertls # [cb: da2 profiles]
+#
+# Merging profile for /usr/sbin/couriertls
+# Traceback (most recent call last):
+# File "/home/cb/apparmor/HEAD-CLEAN/utils/aa-mergeprof", line 809, in <module>
+# main()
+# File "/home/cb/apparmor/HEAD-CLEAN/utils/aa-mergeprof", line 113, in main
+# act([user_file, base_file, None], 2, profile_name)
+# File "/home/cb/apparmor/HEAD-CLEAN/utils/aa-mergeprof", line 150, in act
+# mergeprofiles.ask_the_questions('base', merging_profile)
+# File "/home/cb/apparmor/HEAD-CLEAN/utils/aa-mergeprof", line 727, in ask_the_questions
+# if apparmor.aa.profile_known_network(self.user.aa[profile][hat], family, sock_type):
+# File "/home/cb/apparmor/HEAD-CLEAN/utils/apparmor/aa.py", line 4444, in profile_known_network
+# if netrules_access_check(include[incname][incname]['deny']['netdomain'], family, sock_type):
+# KeyError: 'abstractions/base'
+
+# REASON: profile_known_network() in aa.py expects the global variable 'include' to be filled
+
+
+# By disabling the above check, aa-mergeprof asks for network rules that are in the "new" profile, but already covered by an abstraction
+# This doesn't hurt much because the cleanprof run at the end removes them again ;-)
+
default_option = 1
options = []
newincludes = apparmor.aa.match_net_includes(self.user.aa[profile][hat], family, sock_type)
--
AppArmor mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
