[apparmor] debugging aa_change_profile

[Steve Beattie]

Hi Jeroen,

On Thu, Apr 26, 2012 at 12:25:16PM -0700, Jeroen Ooms wrote:
> If it is helpful, here is some instructions to reproduce the problem.
> I am using Ubuntu 11.10.
> 
> # one time install:
> sudo apt-get install r-base libapparmor-dev
> wget http://www.stat.ucla.edu/~jeroen/files/rApparmor_0.1.tar.gz
> sudo R CMD INSTALL rApparmor_0.1.tar.gz
> 
> # start R:
> R
> 
> # enter these commands in the R console:
> library(rApparmor)
> aa_change_profile("testprofile")

The issue here is a type-mismatch in your wrapper code. From the Writing
R Extensions manual, section 5.2
http://cran.r-project.org/doc/manuals/R-exts.html#Interface-functions-_002eC-and-_002eFortran

  The following table gives the mapping between the modes of R vectors
  and the types of arguments to a C function or FORTRAN subroutine.

   R storage mode C type          FORTRAN type
   [SNIP]
   character      char **         CHARACTER*255

Your wrapper functions don't take this into account:

  void aa_change_profile_wrapper (int *ret, char *profile) {
    *ret = aa_change_profile (profile);
    if(ret != 0){
      *ret = errno;
    }
  }

You need to convert the "char *profile" declaration to "char
**profile" and then evaluate one level of pointer in the
aa_change_profile() call, like so:

  void aa_change_profile_wrapper (int *ret, char **profile) {
    *ret = aa_change_profile (*profile);
    if(ret != 0){
      *ret = errno;
    }
  }

When I do this, I am able to successfully make aa_change_profile calls
from within R:

  $ R
  > library(rApparmor)

(switch to a different shell)

  $ cat /proc/$(pidof R)/attr/current
  unconfined

(back to R)

  > library(rApparmor)
  > aa_change_profile("testprofile")
  Error in aa_change_profile("testprofile") :
    Failed to change profile to: testprofile.
  Error: 2
  > aa_change_profile("/bin/ping")
  >

(and back to the other shell)

  $ cat /proc/$(pidof R)/attr/current
  /bin/ping (enforce)

I didn't look at the aa_change_hat wrapper function, but I suspect a
similar type mis-match there as well.

Thanks for trying this out! I'm really curious how well this
functionality works in R.

-- 
Steve Beattie
<sbeattie at ubuntu.com>
http://NxNW.org/~steve/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20120426/e6a8d8ce/attachment.pgp>