apparmor fails loading policy with nested profiles inside hats
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
AppArmor |
Triaged
|
Medium
|
Unassigned |
Bug Description
To reproduce:
$ cat ~/tmp/test.profile
profile spork /t {
hat waffle {
/bin/sh Cx -> syrup,
profile syrup {
/bin/sh r,
}
}
}
$ sudo ./apparmor_parser -Kr ~/tmp/test.profile
./apparmor_parser: Unable to replace "syrup". Profile doesn't exist
$ sudo grep syrup /var/log/
type=AVC msg=audit(
This is with kernel Ubuntu 3.13.0-
It also fails similarly if not using a profile name, e.g.:
profile spork /t {
hat waffle {
/bin/sh Cx,
profile /bin/sh {
/bin/sh r,
}
}
}
results in:
type=AVC msg=audit(
Changed in apparmor: | |
importance: | Undecided → Medium |
status: | New → Confirmed |
tags: | added: aa-parser |
Changed in apparmor: | |
status: | Confirmed → Triaged |
Any news on this?