[apparmor] Bug: rcapparmor reload returns "done" even on profile syntax errors

Christian Boltz apparmor at cboltz.de
Mon Mar 26 18:20:20 UTC 2012


Hello,

I just noticed that rcapparmor reload returns a green "done" ($? = 0) 
even if a profile has syntax errors:

# /etc/init.d/boot.apparmor reload x
Restarting AppArmor AppArmor parser error for /etc/apparmor.d/usr.sbin.winbindd in /etc/apparmor.d/usr.sbin.winbindd at line 10: syntax error, unexpected TOK_ID, expecting TOK_MODE

/etc/apparmor.d/usr.sbin.winbindd failed to load                                                                                                      failed
AppArmor parser error for /etc/apparmor.d/usr.sbin.winbindd in /etc/apparmor.d/usr.sbin.winbindd at line 10: syntax error, unexpected TOK_ID, expecting TOK_MODE
                                                                                                                                                      done

I added the "x" after reload to skip the redirect to systemd/systemctl.
With systemctl, only the exitcode is honored and the output hidden -
which means the profile is not loaded, but nobody sees an error message.

Expected result: a red "failed" and $? != 0

(AppArmor 2.7.2 on openSUSE 12.1 - but I'm quite sure trunk shares this 
bug.)


Regards,

Christian Boltz
-- 
> Ich werde gerne als Frau Fischer angesprochen, Herr Fischer macht
> sich da nicht so gut.
Warum denn nicht. Vielleicht kannst Du dann ja mit der
Flugbereitschaft der Bundeswehr auf die Melediven fliegen ;o)
[> Helga Fischer und Thorsten Körner in suse-linux]




More information about the AppArmor mailing list