~intrigeri/apparmor/nameservice-support-libnss-gw-name : changes

~intrigeri/apparmor/nameservice-support-libnss-gw-name » Changes from revision 3366

From Revision 3366 to 3347

Rev	Summary	Authors	Date
3366	abstractions/nameservice: support systems that use libnl-3-2... abstractions/nameservice: support systems that use libnl-3-200 via libnss-gw-name. Patch initially proposed by Simon McVittie <smcv@debian.org>. Closes: Debian#810888	intrigeri at boum	8 years ago
3365	Drop unused suggest_incs_for_path() in aa.py Drop unused suggest_incs_for_path() in aa.py Acked-by: Seth Arnold <seth.arnold@canonical.com>	Christian Boltz	8 years ago
3364	pam_apparmor: Don't leak /dev/urandom fd pam_apparmor: Don't leak /dev/urandom fd If reading /dev/urandom failed, the corresponding file descriptor was leaked through the error path. Coverity CID #56012 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3363	libapparmor: Fix -Wunused-but-set-variable GCC warning libapparmor: Fix -Wunused-but-set-variable GCC warning Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Tyler Hicks	8 years ago
3362	libapparmor: Fix -Wunused-variable GCC warning libapparmor: Fix -Wunused-variable GCC warning The variable was only referenced by commented section of code so move the declaration into the comment. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3361	README: Document Coverity support README: Document Coverity support Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3360	Makefile: Add coverity target Makefile: Add coverity target Add a target that uses cov-build, which must be found in $PATH, to generate an intermediate Coverity directory called cov-int. The intermediate Coverity directory will be based on a clean snapshot of the last commit in the bzr tree. Finally, the intermediate directory is converted to a compressed tarball, stored in apparmor-<SNAPSHOT_VERSION>-cov-int.tar.gz, and is suitable for uploading to scan.coverity.com. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3359	Makefile: Convert shell variables into reusable make variabl... Makefile: Convert shell variables into reusable make variables Turn REPO_VERSION and SNAPSHOT_DIR into make variables that may be reused by future targets that specify the snapshot target as a prerequisite. This prevents us from having to repeatedly call out to potentially slow commands on bound bzr branches, such as the bzr version-info command stored in the REPO_VERSION_CMD make variable. The new REPO_VERSION make variable is turned into a "simply expanded" variable as to not require a callout to bzr each time it is expanded. The SNAPSHOT_DIR shell variable is renamed to SNAPSHOT_NAME as a make variable. The new name may be slightly more descriptive in the future as the variable will be reused in other ways besides a simple directory name. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3358	common: Simplify REPO_VERSION_CMD in Make.rules common: Simplify REPO_VERSION_CMD in Make.rules bzr version-info supports directly printing the bare revno to stdout so we should use that instead of parsing the default verbose output. This change simplifies the shell snippet used to assign the REPO_VERSION_CMD make variable. It was also tested to work with the bzr present in Ubuntu 12.04. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de> Acked-by: Steve Beattie <steve@nxnw.org>	Tyler Hicks	8 years ago
3357	Makefile: Reorder DIRS variable according to build order Makefile: Reorder DIRS variable according to build order Order the DIRS variable according to build order. This allows the DIRS variable to be iterated over to build libapparmor, binutils, parser, utils, etc., without having to reorder the list. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Acked-by: Steve Beattie <steve@nxnw.org> Acked-by: Christian Boltz <apparmor@cboltz.de>	Tyler Hicks	8 years ago
3356	libapparmor: Correct meaning of EPERM in aa_change_profile m... libapparmor: Correct meaning of EPERM in aa_change_profile man page I suspect that the incorrect description of EPERM was copied from the aa_change_hat man page, where it is possible to see EPERM if the application is not confined by AppArmor. This patch corrects the description by documenting that the only possible way to see EPERM is if a confined application has the no_new_privs bit set. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reported-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com>	Tyler Hicks	8 years ago
3355	libapparmor: Open fds may be revalidated after aa_change_pro... libapparmor: Open fds may be revalidated after aa_change_profile() It is possible that file descriptors will be revalidated after an aa_change_profile() but there is a lot of complexity involved that doesn't need to be spelled out in the man page. Instead, mention that revalidation is possible but the only way to ensure that file descriptors are not passed on is to close them. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reported-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: John Johansen <john.johansen@canonical.com>	Tyler Hicks	8 years ago
3354	libapparmor: Remove incorrect statement in aa_change_profile... libapparmor: Remove incorrect statement in aa_change_profile man page The statement was meant to convey the difference between aa_change_hat() and aa_change_profile(). Unfortunately, it read as if there was something preventing a program from using aa_change_profile() twice to move from profile A to profile B and back to profile A, even if profiles A and B contained the necessary rules. Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reported-by: Seth Arnold <seth.arnold@canonical.com> Acked-by: Christian Boltz <apparmor@cboltz.de>	Tyler Hicks	8 years ago
3353	utils: handle versioned ruby interpreters utils: handle versioned ruby interpreters On Debian and Ubuntu it's possible to have multiple ruby interpreters installed, and the default to use is handled by the ruby-defaults package, which includes a symlink from /usr/bin/ruby to the versioned ruby interpreter. This patch makes aa.py:get_interpreter_and_abstraction() take that into account by using a regex to match possible versions of ruby. Testcases are included. (I noticed this lack of support because on Ubuntu the ruby test was failing because get_interpreter_and_abstraction() would get the complete path, which on my 16.04 laptop would get /usr/bin/ruby2.2.) Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Seth Arnold <seth.arnold@canonical.com>	Steve Beattie	8 years ago
3352	parser: fix memory leaks in variable failure cases parser: fix memory leaks in variable failure cases This patch frees some leaked memory that occur when errors are detected while adding variables to the parser's symbol table. While not a significant issue currently due to the parser exiting on failures, as the process of library-ifying the parser continues, these need to be addressed. It also makes it easier to use tools like Address Sanitizer on the parser against our test suite. Signed-off-by: Steve Beattie <steve@nxnw.org> Acked-by: Tyler Hicks <tyhicks@canonical.com>	Steve Beattie	8 years ago
3351	utils/test/Makefile: print test filenames in 'make check' an... utils/test/Makefile: print test filenames in 'make check' and 'make coverage' This makes it easier to find the file that contains a failing test. Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.	Christian Boltz	8 years ago
3350	Split off logprof_value_or_all() Split off logprof_value_or_all() The rule classes have lots of if self.all_foo: foo_txt = _('ALL') else: foo_txt = self.foo in logprof_header_localvars(). To avoid repeating this over and over, split it off to a logprof_value_or_all() function. This function can handle - str (will be returned unmodified - AARE (.regex will be used) - sets/lists/tuples (will be ' '.join()ed and sorted) Other types are returned unmodified. Acked-by: Steve Beattie <steve@nxnw.org>	Christian Boltz	8 years ago
3349	Better error message on unknown profile lines Better error message on unknown profile lines When hitting an unknown line while parsing a profile, it's a good idea to include that line in the error message ;-) Note: 2.9 would print a literal \n because it doesn't have apparmor.fail, so it will get a slightly different patch with spaces instead of \n. Acked-by: Steve Beattie <steve@nxnw.org> for trunk, 2.10 and 2.9.	Christian Boltz	8 years ago
3348	split off _is_equal_aare() split off _is_equal_aare() Checking if two AARE objects are equal is not hard, but also not a one-liner. Since we need to do this more than once (and even more often in other outstanding rule classes), split that code into an _is_equal_aare() function and change PtraceRule and SignalRule to use it. To make things even more easier, the parameters to use match the _is_covered_aare() syntax. Acked-by: Steve Beattie <steve@nxnw.org>	Christian Boltz	8 years ago
3347	Improve __repr__() for Ruleset Improve __repr__() for Ruleset If a *Ruleset is empty, let __repr__() print/return <FooRuleset (empty) /> instead of <FooRuleset> </FooRuleset> Acked-by: Steve Beattie <steve@nxnw.org> for trunk and 2.10.	Christian Boltz	8 years ago

Older »