Hello,
if a script contains a hashbang like
#! /usr/bin/perl -w
aa-autodep created a profile entry like
"/usr/bin/perl -w" ix,
which is obviously incorrect.
This patch fixes this (by using only the first part of the hashbang line)
and also adds some tests for it.
References: https://bugs.launchpad.net/apparmor/+bug/1505775
[ 95-fix-handling-interpreters-with-parameters.diff ]
--- utils/apparmor/aa.py 2015-10-18 16:45:00.661993736 +0200
+++ utils/apparmor/aa.py 2015-10-18 17:07:20.459211068 +0200
@@ -416,8 +416,9 @@
if not hashbang.startswith('#!'):
return None, None
- interpreter = hashbang[2:].strip()
- interpreter_path = get_full_path(interpreter)
+ # get the interpreter (without parameters)
+ interpreter = hashbang[2:].strip().split()
+ interpreter_path = get_full_path(interpreter[0])
interpreter = re.sub('^(/usr)?/bin/', '', interpreter_path)
if interpreter in ['bash', 'dash', 'sh']:
--- utils/test/test-aa.py 2015-10-18 16:45:00.663993620 +0200
+++ utils/test/test-aa.py 2015-10-18 17:10:34.845932254 +0200
@@ -105,7 +105,9 @@
('#!/bin/dash', ('/bin/dash',
'abstractions/bash')),
('#!/bin/sh', ('/bin/sh',
'abstractions/bash')),
('#! /bin/sh ', ('/bin/sh',
'abstractions/bash')),
+ ('#! /bin/sh -x ', ('/bin/sh',
'abstractions/bash')), # '-x' is not part of the interpreter path
('#!/usr/bin/perl', ('/usr/bin/perl',
'abstractions/perl')),
+ ('#!/usr/bin/perl -w', ('/usr/bin/perl',
'abstractions/perl')), # '-w' is not part of the interpreter path
('#!/usr/bin/python', ('/usr/bin/python',
'abstractions/python')),
('#!/usr/bin/python2', ('/usr/bin/python2',
'abstractions/python')),
('#!/usr/bin/python2.7', ('/usr/bin/python2.7',
'abstractions/python')),
Regards,
Christian Boltz
--
We voted and a big majority wanted it this way. So dont blame this on me.
p.s. Although you can share-blame it on me. I was one of the peepz who
voted for it ;) [Henne Vogelsang in opensuse-factory]
--
AppArmor mailing list
AppArmor@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/apparmor
