Hello, collapse_log() creates temporary SignalRule etc. objects which are then checked against the existing profile content.
These temporary objects are based on log events, therefore flag them as such. This will ensure proper handling and escaping by the AARE class. [ 36-collapse-log-set-log_event.diff ] === modified file ./utils/apparmor/aa.py --- utils/apparmor/aa.py 2015-12-08 19:30:43.210864711 +0100 +++ utils/apparmor/aa.py 2015-12-10 12:38:08.008844270 +0100 @@ -2509,26 +2509,26 @@ for cap in prelog[aamode][profile][hat]['capability'].keys(): # If capability not already in profile # XXX remove first check when we have proper profile initialisation - if aa[profile][hat].get('capability', False) and not aa[profile][hat]['capability'].is_covered(CapabilityRule(cap)): + if aa[profile][hat].get('capability', False) and not aa[profile][hat]['capability'].is_covered(CapabilityRule(cap, log_event=True)): log_dict[aamode][profile][hat]['capability'][cap] = True nd = prelog[aamode][profile][hat]['netdomain'] for family in nd.keys(): for sock_type in nd[family].keys(): - if not is_known_rule(aa[profile][hat], 'network', NetworkRule(family, sock_type)): + if not is_known_rule(aa[profile][hat], 'network', NetworkRule(family, sock_type, log_event=True)): log_dict[aamode][profile][hat]['netdomain'][family][sock_type] = True ptrace = prelog[aamode][profile][hat]['ptrace'] for peer in ptrace.keys(): for access in ptrace[peer].keys(): - if not is_known_rule(aa[profile][hat], 'ptrace', PtraceRule(access, peer)): + if not is_known_rule(aa[profile][hat], 'ptrace', PtraceRule(access, peer, log_event=True)): log_dict[aamode][profile][hat]['ptrace'][peer][access] = True sig = prelog[aamode][profile][hat]['signal'] for peer in sig.keys(): for access in sig[peer].keys(): for signal in sig[peer][access].keys(): - if not is_known_rule(aa[profile][hat], 'signal', SignalRule(access, signal, peer)): + if not is_known_rule(aa[profile][hat], 'signal', SignalRule(access, signal, peer, log_event=True)): log_dict[aamode][profile][hat]['signal'][peer][access][signal] = True Regards, Christian Boltz -- Wie meinte doch neulich ein OS/2 oder CygWin-User: PATH=C:\backspace\return;E:\tab\newline;D:\home W:\pakete\mypaket\configure --prefix=F:\fondlinge [Ralf Corsepius in suse-programming] -- AppArmor mailing list AppArmor@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/apparmor