logprof does not properly assign log events when profile is already defined

Bug #837211 reported by John Johansen
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
New
Undecided
Unassigned

Bug Description

When a log contains events for the null-profile and when a profile already exists that contains an exec rule that matches part of the null-profile event stream. The null profile stream of events that belong to the profile specified by the exec rule will not get properly assigned, resulting in logprof re-asking questions about even flow decisions that have already been made.

Note that if the event flow decision was made in the current run of logprof the events get properly assigned it is only when logprof is quit and restarted that the null profile event stream is problematic

Test
1. obtain a log file with null-profile events that must track across an exec.
2. run logprof on the file
3. create transition and new profile that events should be assigned to.
4. save without completing profile so events in log are outstanding
5. restart logprof on log file

logprof won't ask the transition question (which it shouldn't) but starts asking the the child profile events should included in the current (parent) profile.

Revision history for this message
John Johansen (jjohansen) wrote :

Need to test if this is the case on newer logs that track across the fork with pids and the newer null-profile format

Revision history for this message
Christian Boltz (cboltz) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.