[apparmor] apparmor.vim - profile format changes since 2.3?

John Johansen john.johansen at canonical.com
Tue Feb 1 17:24:19 UTC 2011


On 02/01/2011 07:01 AM, Christian Boltz wrote:
> Hello,
> 
> Am Dienstag, 1. Februar 2011 schrieb John Johansen:
>>>>>    ^foobar,  # external hat
>>>
>>> You didn't answer that one ;-) - apparmor_parser doesn't like it...
>>
>> hrmm this seems to have been dropped when, some of the hat rule
>> changes were reverted post 2.3 release to fix some problems that we
>> had with policies that had large numbers of hats.
>>
>> This could be added back in, but is essentially a nop now, and since
>> I don't think anyone is using it (they would have to be on a none
>> updated 2.3) I think we will just drop it.
> 
> What does this mean regarding external hats?
> 
Your wish is granted, well sort of.  They don't have to be declared in
the main profile.  You just create the profile and load it and as long
as it has the hat flag it will work.

however it looks like the ability to add the hat flag is missing.  It
would look something like

/some/profile//external_hat (hat) {

}

Its an easy fix to add back in and I'll see if I can't get the patch
out today.




More information about the AppArmor mailing list