[apparmor] [PATCH 20/31] parser: Remove prints and exits from features code

[Tyler Hicks]

On 2015-01-23 19:44:27, Christian Boltz wrote:
> Hello,
> 
> Am Donnerstag, 22. Januar 2015 schrieb Steve Beattie:
> > On Thu, Jan 22, 2015 at 04:23:00PM -0600, Tyler Hicks wrote:
> > > We don't know what a program linking to libapparmor will do with
> > > stdout/stderr so I don't know if debug logging to those streams is
> > > helpful.
> 
> stderr doesn't sound too bad, but might be lost in some situations (like 
> starting a program via its desktop icon)
> 
> > > Maybe in the near future we could add a debug build option to
> > > libapparmor and have it support an env variable that specifies a
> > > file
> > > path to open and log debug messages to?
> > 
> > That would be a very nice improvement indeed.
> 
> Would it also be a secure improvement? ;-)
> 
> Basically that feature would allow to overwrite any file if an attacker 
> is able to inject an environment variable...

Debug builds of programs/libraries aren't intended to be installed on
production systems. Debug output from libapparmor would only be built
and enabled in debug builds of libapparmor.

Tyler
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20150123/c5a7759f/attachment.pgp>