[apparmor] [patch] Ignore file events with a request mask of 'send' or 'receive'

[Christian Boltz]

Hello,

$subject.

Those events are actually network events, so ideally we should map them
as such. Unfortunately this requires bigger changes, so here is a hotfix
that ignores those events and thus avoids crashing aa-logprof.

References: https://bugs.launchpad.net/apparmor/+bug/1577051
            https://bugs.launchpad.net/apparmor/+bug/1582374


I propose this patch for trunk, 2.10 and 2.9


[ 81-ignore-request-mask-send-receive.diff ]

--- utils/apparmor/logparser.py 2016-05-13 21:59:57.919133776 +0200
+++ utils/apparmor/logparser.py 2016-05-21 00:28:10.020062373 +0200
@@ -307,6 +307,13 @@
                 self.debug_logger.debug('UNHANDLED (missing request_mask): %s' % e)
                 return None
 
+            # sometimes network events come with an e['operation'] that matches the list of file operations
+            # see https://bugs.launchpad.net/apparmor/+bug/1577051 and https://bugs.launchpad.net/apparmor/+bug/1582374
+            # XXX these events are network events, so we should map them as such
+            if e['request_mask'] in ('send', 'receive'):
+                self.debug_logger.debug('UNHANDLED (request_mask is send or receive): %s' % e)
+                return None
+
             # Map c (create) and d (delete) to w (logging is more detailed than the profile language)
             rmask = e['request_mask']
             rmask = rmask.replace('c', 'w')



Regards,

Christian Boltz
-- 
<Ohmmmmm> Heiliger St.Tux öffne mir die Augen, welche durch jahrelangen
Missbrauch von KleinSoftFenster 3.1 - XP mit Fehlermeldungen zuge-
pflastert wurden, damit ich sehend werde für die Wunder des Reiches
das da heißt LINUX.</Ohmmmmm> (Heike Hautz in dcoulm)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20160521/568d76a0/attachment.pgp>