[apparmor] [PATCH 2/5] Remove the restriction that unattached profiles must be started with the profile keyword. It is not required for parsing and there doesn't seem to be an good reason to require it.
John Johansen
john.johansen at canonical.com
Tue Nov 30 05:23:07 GMT 2010
On 11/29/2010 12:29 PM, Steve Beattie wrote:
> On Tue, Nov 23, 2010 at 01:18:52AM -0800, John Johansen wrote:
>> Remove the restriction that unattached profiles must be started with
>> the profile keyword. It is not required for parsing and there doesn't
>> seem to be an good reason to require it.
>
> It looks like the restriction got added in (bzr) commit 939 with the
> basic addition of namespaces, but there's no explanation as to why.
>
>> Signed-off-by: John Johansen <john.johansen at canonical.com>
> Acked-By: Steve Beattie <sbeattie at ubuntu.com>
I have thought about this some more and I am going to NAK my own patch.
Basically what I came to, was that while it isn't technically required
it makes adding new keywords difficult. The keywords get processed
first so what ever doesn't get claimed as a keyword can be a name.
So if we add a new keyword that takes away from the space of names
potentially breaking an existing policy. Requiring the leading profile
keyword avoids this problem.
More information about the AppArmor
mailing list