aa-autodep crashes when called with multiple parameters if profile already exists in active _and_ extra directory

Bug #1426372 reported by Christian Boltz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
New
Low
Unassigned

Bug Description

After fixing bug 1378095, aa-autodep can still crash in rare cases

aa-autodep crashes if
- you call it with multiple parameters AND
- a profile (for example for sshd) exists in both /etc/apparmor.d/ AND the extra-profiles directory AND
- that profile contains hats

Reproducer:
- copy the sshd profile from the "inactive" dir to /etc/apparmor.d/
  (important: the profile has to contain hats!)
- run aa-autodep with multiple parameters:
      aa-autodep /bin/true /bin/false

This crash is caused by read_inactive_profiles() running multiple times, once for each parameter.

Proof-of-concept patch- fixes the problem, but I'm not sure if I want it as final solution:

=== modified file 'utils/apparmor/aa.py'
--- utils/apparmor/aa.py 2015-02-20 20:36:55 +0000
+++ utils/apparmor/aa.py 2015-02-20 22:48:43 +0000
@@ -2593,7 +2593,15 @@
             else:
                 read_profile(profile_dir + '/' + file, True)

+inactive_profiles_already_read = False
+
 def read_inactive_profiles():
+ global inactive_profiles_already_read
+ if inactive_profiles_already_read:
+ print("read_inactive_profiles called a second time, IGNORING")
+ return
+ inactive_profiles_already_read = True
+
     if not os.path.exists(extra_profile_dir):
         return None
     try:

Tags: aa-tools
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.