[apparmor] [patch] Ignore file events with a request mask of 'send' or 'receive'

[Seth Arnold]

On Sat, May 21, 2016 at 12:39:12AM +0200, Christian Boltz wrote:
> Hello,
> 
> $subject.
> 
> Those events are actually network events, so ideally we should map them
> as such. Unfortunately this requires bigger changes, so here is a hotfix
> that ignores those events and thus avoids crashing aa-logprof.
> 
> References: https://bugs.launchpad.net/apparmor/+bug/1577051
>             https://bugs.launchpad.net/apparmor/+bug/1582374
> 
> 
> I propose this patch for trunk, 2.10 and 2.9

Acked for all three, thanks.

Acked-by: Seth Arnold <seth.arnold at canonical.com>

> 
> 
> [ 81-ignore-request-mask-send-receive.diff ]
> 
> --- utils/apparmor/logparser.py 2016-05-13 21:59:57.919133776 +0200
> +++ utils/apparmor/logparser.py 2016-05-21 00:28:10.020062373 +0200
> @@ -307,6 +307,13 @@
>                  self.debug_logger.debug('UNHANDLED (missing request_mask): %s' % e)
>                  return None
>  
> +            # sometimes network events come with an e['operation'] that matches the list of file operations
> +            # see https://bugs.launchpad.net/apparmor/+bug/1577051 and https://bugs.launchpad.net/apparmor/+bug/1582374
> +            # XXX these events are network events, so we should map them as such
> +            if e['request_mask'] in ('send', 'receive'):
> +                self.debug_logger.debug('UNHANDLED (request_mask is send or receive): %s' % e)
> +                return None
> +
>              # Map c (create) and d (delete) to w (logging is more detailed than the profile language)
>              rmask = e['request_mask']
>              rmask = rmask.replace('c', 'w')
> 
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20160520/c62abde6/attachment.pgp>