<div dir="ltr">Hello, <div class="gmail_extra"> <div class="gmail_quote">On Sat, Dec 26, 2015 at 10:13 PM, Christian Boltz <<a href="mailto:apparmor@cboltz.de" target="_blank">apparmor@cboltz.de</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello, to ensure aa-cleanprof works as expected (and writing the rules works as expected), add some rules for every rule class to the <a href="http://cleanprof.in" rel="noreferrer" target="_blank">cleanprof.in</a> and cleanprof.out test profiles. [ 48-add-more-ruletypes-to-cleanprof-test.diff ] === modified file ./utils/test/<a href="http://cleanprof_test.in" rel="noreferrer" target="_blank">cleanprof_test.in</a> --- utils/test/<a href="http://cleanprof_test.in" rel="noreferrer" target="_blank">cleanprof_test.in</a> 2015-12-12 13:34:40.549997194 +0100 +++ utils/test/<a href="http://cleanprof_test.in" rel="noreferrer" target="_blank">cleanprof_test.in</a> 2015-12-26 17:11:27.034328693 +0100 @@ -4,12 +4,32 @@ /usr/bin/a/simple/cleanprof/test/profile { # Just for the heck of it, this comment wont see the day of light #include <abstractions/base> + + capability sys_admin, + audit capability, + + change_profile -> /bin/foo, + change_profile, + + network inet stream, + network stream, + #Below rule comes from abstractions/base allow /usr/share/X11/locale/** r, allow /home/*/** r, + ptrace tracedby peer=/bin/strace, + ptrace tracedby, unix (receive) type=dgram, + set rlimit nofile <= 256, + set rlimit nofile <= 64, + + signal set=(hup int quit ill trap abrt) + set=(bus,fpe,,,kill,usr1) + set=segv set=usr2 set=pipe set=alrm set=term set=stkflt set=chld, + signal set=(hup int quit), + ^foo { /etc/fstab r, capability dac_override, === modified file ./utils/test/cleanprof_test.out --- utils/test/cleanprof_test.out 2015-12-12 13:34:40.549997194 +0100 +++ utils/test/cleanprof_test.out 2015-12-26 17:14:06.105337830 +0100 @@ -6,11 +6,23 @@ /usr/bin/a/simple/cleanprof/test/profile { #include <abstractions/base> + set rlimit nofile <= 256, + + audit capability, + + network stream, + + signal set=(abrt alrm bus chld fpe hup ill int kill pipe quit segv stkflt term trap usr1 usr2), + + ptrace tracedby, + unix (receive) type=dgram, /home/*/** r, /home/foo/** w, + change_profile, + ^foo { capability dac_override, </blockquote><div>While the two profiles and the test looks good to me, it wouldn't hurt to have a set of more experienced eyes take a look. Acked-by: Kshitij Gupta <<a href="mailto:kgupta8592@gmail.com" target="_blank">kgupta8592@gmail.com</a>> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> Regards, Christian Boltz -- > > of course, now everybody will claim how bad it is to fix bugs which > > people rely on; > No, I wont claim that, in fact I would argue against keeping any bug > on which people relies on (known as "backwards compatibility") I should have excluded you from the list of everybody... [> Cristian Rodríguez and (>>) Dominique Leuenberger in opensuse-factory] -- AppArmor mailing list <a href="mailto:AppArmor@lists.ubuntu.com">AppArmor@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/apparmor" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/apparmor</a> </blockquote></div> -- <div class="gmail_signature"><div dir="ltr"><div>Regards, </div>Kshitij Gupta </div></div> </div></div>