apparmor fails loading policy with nested profiles inside hats

Bug #1334455 reported by Steve Beattie
14
This bug affects 3 people
Affects Status Importance Assigned to Milestone
AppArmor
Triaged
Medium
Unassigned

Bug Description

To reproduce:

$ cat ~/tmp/test.profile
profile spork /t {
  hat waffle {
    /bin/sh Cx -> syrup,

    profile syrup {
      /bin/sh r,
    }
  }
}
$ sudo ./apparmor_parser -Kr ~/tmp/test.profile
./apparmor_parser: Unable to replace "syrup". Profile doesn't exist
$ sudo grep syrup /var/log/audit/audit.log
type=AVC msg=audit(1403737842.880:42591): apparmor="STATUS" operation="profile_replace" info="parent does not exist" error=-2 profile="unconfined" name="waffle//syrup" pid=874 comm="apparmor_parser"

This is with kernel Ubuntu 3.13.0-24.47-generic 3.13.9 (amd64)

It also fails similarly if not using a profile name, e.g.:

profile spork /t {
  hat waffle {
    /bin/sh Cx,

    profile /bin/sh {
      /bin/sh r,
    }
  }
}

results in:

type=AVC msg=audit(1403738004.360:42598): apparmor="STATUS" operation="profile_replace" info="parent does not exist" error=-2 profile="unconfined" name="waffle///bin/sh" pid=1807 comm="apparmor_parser"

Tags: aa-parser
Revision history for this message
azurit (azurit) wrote :

Any news on this?

Changed in apparmor:
importance: Undecided → Medium
status: New → Confirmed
tags: added: aa-parser
Changed in apparmor:
status: Confirmed → Triaged
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.