On Sun, May 24, 2015 at 06:53:35PM +0200, Christian Boltz wrote: > Note: the != '--' check in aa-mergeprof is superfluous for > capabilities, but will become useful once this code block is used > for other rule types. > > > [ 21-read-severity-from-capability-rule.diff ]
Again, I like everything here except for the magic value '--' that
is yet another representation of 'unknown value'
> === modified file utils/aa-mergeprof
> --- utils/aa-mergeprof 2015-05-24 18:48:10.454327370 +0200
> +++ utils/aa-mergeprof 2015-05-24 18:26:44.337170095 +0200
> @@ -317,13 +317,9 @@
> continue
>
> if rule_obj.all_caps:
> - severity = 10
> cap_txt = 'ALL'
> else:
> cap_txt = ' '.join(rule_obj.capability)
> - severity = 0
> - for cap in rule_obj.capability:
> - severity = max(severity, sev_db.rank('CAP_%s' %
> cap))
>
> if rule_obj.deny:
> cap_txt = 'deny %s' % cap_txt
> @@ -345,7 +341,10 @@
>
> q.headers = [_('Profile'),
> apparmor.aa.combine_name(profile, hat)]
> q.headers += [_('Capability'), cap_txt]
> - q.headers += [_('Severity'), severity]
> +
> + severity = rule_obj.severity(sev_db)
> + if severity != '--':
> + q.headers += [_('Severity'), severity]
>
> audit_toggle = 0
>
> === modified file utils/apparmor/aa.py
> --- utils/apparmor/aa.py 2015-05-17 23:18:49.560093509 +0200
> +++ utils/apparmor/aa.py 2015-05-24 18:48:48.857062323 +0200
> @@ -1569,8 +1569,8 @@
> capability_obj = CapabilityRule(capability)
> if is_known_rule(aa[profile][hat], 'capability',
> capability_obj):
> continue
> - # Load variables? Don't think so.
> - severity = sev_db.rank('CAP_%s' % capability)
> + # Load variables into sev_db? Not needed/used for
> capabilities.
> + severity = capability_obj.severity(sev_db)
> default_option = 1
> options = []
> newincludes = match_includes(aa[profile][hat],
> 'capability', capability_obj)
--
Steve Beattie
<sbeat...@ubuntu.com>
http://NxNW.org/~steve/
signature.asc
Description: Digital signature
-- AppArmor mailing list AppArmor@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor
