[apparmor] [patch] let logparser.py parse_event() change disconnected path events to 'ERROR'

[Christian Boltz]

Hello,

Am Samstag, 28. Februar 2015 schrieb Steve Beattie:
> On Mon, Feb 23, 2015 at 10:04:28PM +0100, Christian Boltz wrote:
> > this patch changes logparser.py parse_event() so that it changes
> > disconnected path events to aamode 'ERROR'.
> > 
> > This means that aa-logprof will ignore the event instead of crashing
> > with> 
> >     AppArmorException: 'Unexpected rank input: var/run/nscd/passwd'
> > 
> > Note that I made the check as specific as possible to be sure it
> > doesn't hide other events.
> > 
> > Ideally we should propose to add the attach_disconnected flag to the
> > profile, but implementing that would be a much bigger patch ;-)
> > 
> > References: https://bugzilla.opensuse.org/show_bug.cgi?id=918787
> > 
> > I propose this patch for trunk and 2.9
> 
> Acked-by: Steve Beattie <steve at nxnw.org> for trunk if the following

What about 2.9? Without this patch, aa-logprof crashes if it hits a 
disconnected path event in the log...

> fix is added to test/test-capability.py so that the tests succeed:
> ---
>  utils/test/test-capability.py |    1 +
>  1 file changed, 1 insertion(+)
> 
> Index: b/utils/test/test-capability.py
> ===================================================================
> --- a/utils/test/test-capability.py
> +++ b/utils/test/test-capability.py
> @@ -104,6 +104,7 @@ class CapabilityTest(unittest.TestCase):
>          self.assertEqual(parsed_event, {
>              'request_mask': set(),
>              'denied_mask': set(),
> +            'error_code': 0,
>              'magic_token': 0,
>              'parent': 0,
>              'profile': '/bin/ping',


Good catch, Acked-by: Christian Boltz <apparmor at cboltz.de> and included 
in my commit to trunk.


Regards,

Christian Boltz
-- 
In /etc steht, was Du denkst. In /proc steht, was das OS denkt.
                                           [Thomas Blum in doc]