<div dir="ltr">Hello,<br><div class="gmail_extra"><br><div class="gmail_quote">On Sun, Apr 26, 2015 at 12:41 AM, Kshitij Gupta <span dir="ltr"><<a href="mailto:kgupta8592@gmail.com" target="_blank">kgupta8592@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<br><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Wed, Apr 15, 2015 at 12:34 AM, Christian Boltz <span dir="ltr"><<a href="mailto:apparmor@cboltz.de" target="_blank">apparmor@cboltz.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div>Hello,<br> <br> Am Montag, 13. April 2015 schrieb Steve Beattie:<br> > On Tue, Apr 14, 2015 at 12:50:26AM +0200, Christian Boltz wrote:<br> > > Am Montag, 13. April 2015 schrieb Steve Beattie:<br> > > > On Sun, Apr 12, 2015 at 03:32:25AM +0200, Christian Boltz wrote:<br> > > > > CleanProf.remove_duplicate_rules() didn't call<br> > > > ><br> > > > > $profile['capability'].delete_duplicates()<br> > > > ><br> > > > > because aa-cleanprof sets same_file=True.<br> > > > ><br> > > > > Fix this by calling delete_duplicates(None) so that it<br> > > > > only checks the profile against itsself.<br> > > > ><br> > > > > [ 43-cleanprof-do-in-profile-run.diff ]<br> > > > ><br> > > > > === modified file 'utils/apparmor/cleanprofile.py'<br> > > > > --- utils/apparmor/cleanprofile.py 2014-12-16 22:13:25<br> > > > > +0000<br> > > > > +++ utils/apparmor/cleanprofile.py 2015-04-11 22:35:00<br> > > > > +0000<br> > > > > @@ -67,6 +67,8 @@<br> > > > ><br> > > > > #Clean the duplicates of caps in other profile<br> > > > ><br> > > > > if not self.same_file:<br> > > > > deleted +=<br> > > > ><br> > > > >self.other.aa[program][hat]['capability'].delete_duplicates(self.<br> > > > >pro<br> > > > >file.aa[program][hat]['capability'])<br> > > > ><br> > > > > + else:<br> > > > > + deleted +=<br> > > > > self.other.aa[program][hat]['capability'].delete_duplicates(None<br> > > > > )><br> > > ><br> > > > This patch does not seem to do what you claim it does:<br> > > Did you also apply 42-in-profile-deduplication.diff before testing?<br> > > Without that, there's no in-profile deduplication (removing lines<br> > > covered by includes should work without patch 42).<br> ><br> > I didn't initially (nothing in this patch description called out<br> > that it depended on that one. However, when I tried path 42 without<br> > patch 43 applied, the testing that I did showed that it deleted the<br> > in-profile duplicated capability, so I'm still not clear on why this<br> > patch is necessary.<br> <br> </div></div>The strange thing is that it's clearly necessary for me - I just tested<br> without it, and it didn't remove in-profile duplicates.<br> <br></blockquote></div></div><div>Both your test-profile (the one mentioned below) and the one Steve used had their duplicate rules removed by the tool in my bzr branch which had I pulled afresh from upstream (at revision 3018).<br><br></div><div>Note: I'm testing on Kubuntu 14.10 with Python 3.4 if that matters.<br><br></div></div></div></div></blockquote><div>Upon revisiting the profiles(during discussion over IRC) and disabling the includes from both profiles, the duplicate rules were _not_ removed from the profile in both the sample profiles presented.<br><br></div><div>With the above mentioned patch applied the duplicate rules _were_ removed.<br><br></div><div>So, the patch looks fine to me and works for me.<br><br><div>Thanks for the patch.<br> <br></div><div>Acked-by: Kshitij Gupta <<a href="mailto:kgupta8592@gmail.com" target="_blank">kgupta8592@gmail.com</a>>. <br><br></div><div>Regards,<br><br></div>Kshitij Gupta<br><br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div></div><div>Thanks.<br><br></div><div>Regards,<br><br></div><div>Kshitij Gupta<br></div><div><div class="h5"><div><br> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Note that I'm testing with all my pending patches applied [1], however I<br> think only patch 42 is related to cleanprof.<br> <br> My test profile:<br> <br> # cat usr.bin.echo<br> /usr/bin/echo {<br> audit capability chown, # drop (1)<br> capability dac_override, # drop<br> deny capability dac_override,<br> capability dac_override, # drop<br> audit capability chown, # drop (2)<br> deny capability chown, # drop<br> audit deny capability chown,<br> capability, # drop<br> audit capability,<br> }<br> <br> Without patch 43, aa-cleanprof doesn't remove any of those rules.<br> With patch 43, aa-cleanprof shrinks the profile to<br> <br> /usr/bin/echo {<br> audit deny capability chown,<br> deny capability dac_override,<br> <br> audit capability,<br> }<br> <br> <br> Regards,<br> <br> Christian Boltz<br> <br> [1] all pending patches means:<br> 30-logparser-change-mask-only-for-path-events.diff<br> 31-enable-testloops-for-nosetests.diff<br> 33-fix-add-to-variable-and-add-tests.diff<br> 35-fix-serialize_profile_from_old_profiles-variable-add.diff<br> 36-fix-crash-in-serialize_profile_from_old_profiles.diff<br> 39-aatest-maxdiff.diff<br> 41-add-baserule-tests.diff<br> 42-in-profile-deduplication.diff<br> 43-cleanprof-do-in-profile-run.diff<br> <span><font color="#888888"><br> --<br> > > dank meiner Versionitis verwende ich längst die 10.1 ;-)<br> > Das Spielchen habe ich auch mitgemacht - von 6.0 bis 9.3. Nu reichts,<br> > man soll schließlich arbeiten mit dem Ding.<br> Zum Arbeiten braucht es kein unsupportetes Supplementary!<br> [>>Christian Boltz, > Christian Lepper & Marcus Meissner in suse-laptop]<br> </font></span><div><div><br> <br> --<br> AppArmor mailing list<br> <a href="mailto:AppArmor@lists.ubuntu.com" target="_blank">AppArmor@lists.ubuntu.com</a><br> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/apparmor" target="_blank">https://lists.ubuntu.com/mailman/listinfo/apparmor</a><br> </div></div></blockquote></div></div></div><br></div></div> </blockquote></div><br></div></div>