AppArmor

file_inherit log events crash aa-logprof

Bug #1509030 reported by Christian Boltz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
Fix Released
Undecided
Christian Boltz
AppArmor 2.10.1
2.9
Fix Released
Undecided
Christian Boltz
AppArmor 2.9.3

Bug Description

This file_inherit log event crashes aa-logprof:

Oct 22 15:57:38 NR021AA kernel: [ 69.827705] audit: type=1400 audit(1445522258.769:1054): apparmor="DENIED" operation="file_inherit" profile="/usr/lib/NetworkManager/nm-dhcp-client.action" pid=2407 comm="nm-dhcp-client." lport=10580 family="inet6" sock_type="dgram" protocol=17

...
  File "/home/cb/apparmor/HEAD-clean/utils/apparmor/logparser.py", line 200, in add_event_to_tree
    e = self.parse_event_for_tree(e)
  File "/home/cb/apparmor/HEAD-clean/utils/apparmor/logparser.py", line 296, in parse_event_for_tree
    rmask = rmask.replace('c', 'a')
AttributeError: 'NoneType' object has no attribute 'replace'

found by goroman on IRC.

Tags: aa-tools
Revision history for this message
Christian Boltz (cboltz) wrote :

Patch sent to the mailinglist.

Changed in apparmor:
status: New → Incomplete
status: Incomplete → In Progress
assignee: nobody → Christian Boltz (cboltz)
milestone: none → 2.10.1
milestone: 2.10.1 → 2.9.3
milestone: 2.9.3 → 2.10.1
Revision history for this message
Christian Boltz (cboltz) wrote :

Fix commited to bzr trunk r3266 and 2.9 branch r2961.

I accidently used a wrong bug number when commiting (bug 1466812, which is the file_perm "twin" of this bug) - I'll add a comment there to avoid confusion.

Changed in apparmor:
status: In Progress → Fix Committed
John Johansen (jjohansen)
Changed in apparmor:
status: Fix Committed → Fix Released
Revision history for this message
Christian Boltz (cboltz) wrote :

"Real fix" (which decides about file vs. network instead of ignoring these events) implemented in bzr trunk r3594 (will be in 2.11) and 2.10 branch r3369 (will be in 2.10.2).

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.