<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 19, 2015 at 12:41 AM, Kshitij Gupta <span dir="ltr"><<a href="mailto:kgupta8592@gmail.com" target="_blank">kgupta8592@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello,<br><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Sun, Oct 18, 2015 at 8:50 PM, Christian Boltz <span dir="ltr"><<a href="mailto:apparmor@cboltz.de" target="_blank">apparmor@cboltz.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
if a script contains a hashbang like<br>
#! /usr/bin/perl -w<br>
aa-autodep created a profile entry like<br>
"/usr/bin/perl -w" ix,<br>
which is obviously incorrect.<br>
<br>
This patch fixes this (by using only the first part of the hashbang line)<br>
and also adds some tests for it.<br>
<br>
References: <a href="https://bugs.launchpad.net/apparmor/+bug/1505775" rel="noreferrer" target="_blank">https://bugs.launchpad.net/apparmor/+bug/1505775</a><br>
<br>
<br>
[ 95-fix-handling-interpreters-with-parameters.diff ]<br>
<br>
--- utils/apparmor/aa.py 2015-10-18 16:45:00.661993736 +0200<br>
+++ utils/apparmor/aa.py 2015-10-18 17:07:20.459211068 +0200<br>
@@ -416,8 +416,9 @@<br>
if not hashbang.startswith('#!'):<br>
return None, None<br>
<br>
- interpreter = hashbang[2:].strip()<br>
- interpreter_path = get_full_path(interpreter)<br>
+ # get the interpreter (without parameters)<br>
+ interpreter = hashbang[2:].strip().split()<br></blockquote></span><div>I'd like to call it "interpreter_and_flags_and_parameters_stuff" but could settle for "interpreter_and_flags".<br></div><div>Or we can make it:<br>interpreter_path = hashbang[2:].strip().split()[0]<br></div><div><br>Or<br>interpreter_and_flags = hashbang[2:].strip().split()<br>interpreter_path = interpreter_and_flags[0]<br><br></div><div>This way the name is accurate and we don't have to use interpreter variable to represent two different things (the other one being below).<br><br></div><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
+ interpreter_path = get_full_path(interpreter[0])<br>
interpreter = re.sub('^(/usr)?/bin/', '', interpreter_path)<br></blockquote></span><div>How about we inline it to: interpreter = re.sub('^(/usr)?/bin/', '', get_full_path(interpreter_and_flags[0]))<br></div></div></div></div></blockquote><div>scrap this, since we need to return interpreter_path.<br> <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> </div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div> </div><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
if interpreter in ['bash', 'dash', 'sh']:<br>
--- utils/test/test-aa.py 2015-10-18 16:45:00.663993620 +0200<br>
+++ utils/test/test-aa.py 2015-10-18 17:10:34.845932254 +0200<br>
@@ -105,7 +105,9 @@<br>
('#!/bin/dash', ('/bin/dash', 'abstractions/bash')),<br>
('#!/bin/sh', ('/bin/sh', 'abstractions/bash')),<br>
('#! /bin/sh ', ('/bin/sh', 'abstractions/bash')),<br>
+ ('#! /bin/sh -x ', ('/bin/sh', 'abstractions/bash')), # '-x' is not part of the interpreter path<br>
('#!/usr/bin/perl', ('/usr/bin/perl', 'abstractions/perl')),<br>
+ ('#!/usr/bin/perl -w', ('/usr/bin/perl', 'abstractions/perl')), # '-w' is not part of the interpreter path<br>
('#!/usr/bin/python', ('/usr/bin/python', 'abstractions/python')),<br>
('#!/usr/bin/python2', ('/usr/bin/python2', 'abstractions/python')),<br>
('#!/usr/bin/python2.7', ('/usr/bin/python2.7', 'abstractions/python')),<br>
<br></blockquote></span><div>With suggestions considered/incorporated.<br><br>Thanks for the patch.<br><br>Acked-by: Kshitij Gupta <<a href="mailto:kgupta8592@gmail.com" target="_blank">kgupta8592@gmail.com</a>>. <br> </div><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Regards,<br>
<br>
Christian Boltz<br>
<span><font color="#888888">--<br>
We voted and a big majority wanted it this way. So dont blame this on me.<br>
p.s. Although you can share-blame it on me. I was one of the peepz who<br>
voted for it ;) [Henne Vogelsang in opensuse-factory]<br>
<br>
<br>
--<br>
AppArmor mailing list<br>
<a href="mailto:AppArmor@lists.ubuntu.com" target="_blank">AppArmor@lists.ubuntu.com</a><br>
Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/apparmor" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/apparmor</a><br>
</font></span></blockquote></span></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div><div dir="ltr"><div>Regards,<br><br></div>Kshitij Gupta<br></div></div>
</font></span></div></div>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div>Regards,<br><br></div>Kshitij Gupta<br></div></div>
</div></div>