Re: [apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-24 Thread John Johansen
On 03/24/2014 05:59 PM, Jamie Strandboge wrote: > On 03/21/2014 08:34 PM, Seth Arnold wrote: >> On Mon, Mar 17, 2014 at 04:29:30PM -0700, john.johan...@canonical.com wrote: >>> ptrace rules currently take the form of >>> >>> ptrace [] [], >>> ptrace_perm := read|trace|readby|tracedby >>> ptra

Re: [apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-24 Thread Jamie Strandboge
On 03/21/2014 08:34 PM, Seth Arnold wrote: > On Mon, Mar 17, 2014 at 04:29:30PM -0700, john.johan...@canonical.com wrote: >> ptrace rules currently take the form of >> >> ptrace [] [], >> ptrace_perm := read|trace|readby|tracedby >> ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')' >> >> Aft

Re: [apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-24 Thread Jamie Strandboge
On 03/17/2014 06:29 PM, john.johan...@canonical.com wrote: > ptrace rules currently take the form of > > ptrace [] [], > ptrace_perm := read|trace|readby|tracedby > ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')' I just mentioned that signal should use this: signal (send,receive) set=

Re: [apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-21 Thread John Johansen
On 03/21/2014 06:34 PM, Seth Arnold wrote: > On Mon, Mar 17, 2014 at 04:29:30PM -0700, john.johan...@canonical.com wrote: >> ptrace rules currently take the form of >> >> ptrace [] [], >> ptrace_perm := read|trace|readby|tracedby >> ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')' >> >> Aft

Re: [apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-21 Thread Seth Arnold
On Mon, Mar 17, 2014 at 04:29:30PM -0700, john.johan...@canonical.com wrote: > ptrace rules currently take the form of > > ptrace [] [], > ptrace_perm := read|trace|readby|tracedby > ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')' > > After having used the cross check (permission needed

[apparmor] [patch 20/21] Add the ability to specify ptrace rules

2014-03-17 Thread john . johansen
ptrace rules currently take the form of ptrace [] [], ptrace_perm := read|trace|readby|tracedby ptrace_perms := ptrace_perm | '(' ptrace_perm+ ')' After having used the cross check (permission needed in both profiles) I am not sure it is correct for ptrace. Signed-off-by: John Johansen -