[apparmor] [patch] Fix available buttons after switching audit flag in aa-logprof

[Steve Beattie]

On Tue, May 26, 2015 at 01:53:45PM +0530, Kshitij Gupta wrote:
> On Mon, May 25, 2015 at 5:20 AM, Christian Boltz <apparmor at cboltz.de> wrote:
> 
> > Hello,
> >
> > when switching the audit flag for network events in aa-logprof
> > (technically, it happens in aa.py ask_the_question()), the "(I)gnore"
> > button gets "lost".
> >
> > This patch fixes the list of available buttons.
> >
> >
> > I propose this patch for trunk and 2.9.
> >
> >
> > [ 26-logprof-fix-buttons-after-audit.diff ]
> >
> > === modified file utils/apparmor/aa.py
> > --- utils/apparmor/aa.py        2015-05-25 00:47:50.323591893 +0200
> > +++ utils/apparmor/aa.py        2015-05-25 01:45:28.597491886 +0200
> > @@ -2009,10 +2009,10 @@
> >                                  audit = ''
> >                                  if audit_toggle:
> >                                      audit = 'audit'
> > -                                    q.functions = ['CMD_ALLOW',
> > 'CMD_DENY', 'CMD_AUDIT_OFF',
> > +                                    q.functions = ['CMD_ALLOW',
> > 'CMD_DENY', 'CMD_IGNORE_ENTRY', 'CMD_AUDIT_OFF',
> >                                                        'CMD_ABORT',
> > 'CMD_FINISHED']
> >                                  else:
> > -                                    q.functions = ['CMD_ALLOW',
> > 'CMD_DENY', 'CMD_AUDIT_NEW',
> > +                                    q.functions = ['CMD_ALLOW',
> > 'CMD_DENY', 'CMD_IGNORE_ENTRY', 'CMD_AUDIT_NEW',
> >                                                        'CMD_ABORT',
> > 'CMD_FINISHED']
> >                                  q.headers = [_('Profile'),
> > combine_name(profile, hat)]
> >                                  q.headers += [_('Network Family'), audit
> > + family]
> >
> Not sure if why it happens in other cases(if it does), here a possible
> reasoning would be "if user selected Audit button, they dont wish to ignore
> it".

Oddly enough, on trunk with all patches up to this one applied,
I'm not getting offered the audit option for file permissions; e.g.:

  Profile:  /usr/lib/chromium-browser/chromium-browser
  Path:     /proc/4092/task/4115
  Mode:     r
  Severity: 6

    1 - /proc/4092/task/4115
   [2 - /proc/*/task/4115]
  [(A)llow] / (D)eny / (I)gnore / (G)lob / Glob with (E)xtension / (N)ew / Abo(r)t / (F)inish / (M)ore

(More doesn't offer more options, it's not really clear what it does/is
supposed to do.)

> That said giving more options to user doesn't seem like a bad idea.

Well, there's the issue of offering too many options to the user and
potentially overwhelming them.

> Thanks for the patch.
> 
> Acked-by: Kshitij Gupta <kgupta8592 at gmail.com>.

Yeah, Acked-by: Steve Beattie <steve at nxnw.org> for trunk and 2.9.

-- 
Steve Beattie
<sbeattie at ubuntu.com>
http://NxNW.org/~steve/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20150601/f4f84d8f/attachment.pgp>