More Robust aa-status Output Parser #35

shundhammer · 2019-01-23T17:27:31Z

Trello

https://trello.com/c/3d3oJxcu/612-1121274-build-20190105-internal-error-when-trying-to-edit-settings-in-yast-apparrmor-module

Bugzilla

https://bugzilla.suse.com/show_bug.cgi?id=1121274

Problem

AppArmor profiles can also have a short name, not just the full path of the binary that is confined in AppArmor.

There was a recent change in Tumbleweed that appears to use that more heavily, and the old parser of this YaST AppArmor module was not quite robust enough to handle that; it would not find the correct profile anymore, and it tried to access a nonexistent hash key in the hash of all profiles, resulting in a nil:NilClass (NoMethodError) exception.

Sample JSON output

sudo aa-status --pretty-json

{
    "version": "1",
    "profiles": {
        "/usr/bin/lessopen.sh": "enforce",
        "/usr/lib/apache2/mpm-prefork/apache2": "enforce",
        "/usr/lib/apache2/mpm-prefork/apache2//DEFAULT_URI": "enforce",
        "/usr/lib/apache2/mpm-prefork/apache2//HANDLING_UNTRUSTED_INPUT": "enforce",
        "/usr/lib/apache2/mpm-prefork/apache2//phpsysinfo": "enforce",
        "/usr/lib/colord": "enforce",
        "/usr/lib/dovecot/anvil": "enforce",
        "/usr/lib/dovecot/auth": "enforce",
        "/usr/lib/dovecot/config": "enforce",
        "/usr/lib/dovecot/deliver": "enforce",
        "/usr/lib/dovecot/dict": "enforce",
        "/usr/lib/dovecot/dovecot-auth": "enforce",
        "/usr/lib/dovecot/dovecot-lda": "enforce",
        "/usr/lib/dovecot/dovecot-lda//sendmail": "enforce",
        "/usr/lib/dovecot/imap": "enforce",
        "/usr/lib/dovecot/imap-login": "enforce",
        "/usr/lib/dovecot/lmtp": "enforce",
        "/usr/lib/dovecot/log": "enforce",
        "/usr/lib/dovecot/managesieve": "enforce",
        "/usr/lib/dovecot/managesieve-login": "enforce",
        "/usr/lib/dovecot/pop3": "enforce",
        "/usr/lib/dovecot/pop3-login": "enforce",
        "/usr/lib/dovecot/ssl-params": "enforce",
        "/usr/lib/dovecot/stats": "enforce",
        "/usr/{bin,sbin}/dnsmasq": "enforce",
        "/usr/{bin,sbin}/dnsmasq//libvirt_leaseshelper": "enforce",
        "apache2": "enforce",
        "apache2//DEFAULT_URI": "enforce",
        "apache2//HANDLING_UNTRUSTED_INPUT": "enforce",
        "apache2//phpsysinfo": "enforce",
        "avahi-daemon": "enforce",
        "dovecot": "enforce",
        "identd": "enforce",
        "klogd": "enforce",
        "mdnsd": "enforce",
        "nmbd": "enforce",
        "nscd": "enforce",
        "ntpd": "enforce",
        "nvidia_modprobe": "enforce",
        "nvidia_modprobe//kmod": "enforce",
        "ping": "enforce",
        "smbd": "enforce",
        "smbldap-useradd": "enforce",
        "smbldap-useradd///etc/init.d/nscd": "enforce",
        "syslog-ng": "enforce",
        "syslogd": "enforce",
        "traceroute": "enforce",
        "winbindd": "enforce"
    },
    "processes": {
        "/usr/sbin/nscd": [
            {
                "profile": "nscd",
                "pid": "805",
                "status": "enforce"
            }
        ],
        "/usr/sbin/avahi-daemon": [
            {
                "profile": "avahi-daemon",
                "pid": "806",
                "status": "enforce"
            }
        ],
        "/usr/lib/colord": [
            {
                "profile": "/usr/lib/colord",
                "pid": "1790",
                "status": "enforce"
            }
        ]
    }
}

Notice the entries for nscd:

{
    "profiles": {
        ...
        "nscd": "enforce",
        ...
    },
    "processes": {
        "/usr/sbin/nscd": [
            {
                "profile": "nscd",
                "pid": "805",
                "status": "enforce"
            }
        ],
        ...
   }
}

In profiles the name is just nscd. In processes there is an entry for the /usr/sbin/nscd executable, but the corresponding profile name is in profile in the hash in the list of processes.

The profile /etc/apparmor.d/usr.sbin.nscd looks like this:

#include <tunables/global>
profile nscd /usr/{bin,sbin}/nscd {
  ...
}

I.e. there is the (optional!) name nscd and a shell glob pattern for the binaries that are to be confined in AppArmor.

Fix

Extended the parser accordingly
Modularized the parser
Changed the output format from --json to --pretty-json so it is actually human-readable, not only machine-readable
Added logging for easier future debugging

Test

On a fresh installation of the most recent Tumbleweed (from 2091-01-21), the problem was easy to reproduce.

With the fix, it's now working fine.

shundhammer · 2019-01-24T12:47:46Z

@goldwynr: Care to take a look at this?

goldwynr · 2019-01-24T13:21:59Z

This change does not seem to be backward compatible with Leap 15.0 apparmor. The reason I requested for a apparmor JSON version update.

shundhammer · 2019-01-24T14:24:48Z

@goldwynr: Thank you for checking this.

I tried to find out with what version of AppArmor that change was released, but I can't make sense of that repo; I see the commit and the merge, but I don't see any tags or a change log.

I would have added a "Requires: apparmor-utils > xy" to the spec file of this YaST module, but I'd need a version number for that.

shundhammer · 2019-01-24T14:42:14Z

https://build.opensuse.org/request/show/598829

Do Apr 19 2018 suse-beta@cboltz.de

update to AppArmor 2.13

add support for multiple cache directories and cache overlays
(boo#1069906, boo#1074429)

add support for conditional includes in policy

remove group restrictions from aa-notify (boo#1058787)

aa-complain etc.: set flags for profiles represented by a glob

aa-status: split profile from exec name

several profile and abstraction updates

see https://gitlab.com/apparmor/apparmor/wikis/Release_Notes_2.13
for the detailed upstream changelog

So we need to require apparmor-utils >= 2.13.

shundhammer · 2019-01-24T14:56:50Z

Rather than requiring apparmor-utils >= 2.13, it is more conservative to conflict with apparmor-utils < 2.13; otherwise the package will always drag in apparmor-utils and apparmor and whatnot. This might not be desirable since yast2-apparmor might be part of a some "yast stuff" sub-pattern.

goldwynr · 2019-01-24T15:10:04Z

Honestly, I would like apparmor to update the version number conveyed in JSON format, namely in apparmor/utils/apparmor/ui.py where set_json_mode is called. This would allow us to be compatible with both. This is the first communication message we send across when apparmor gets a json output, namely {'dialog': 'apparmor-json-version', 'data': '2.12'}

I agree this would take longer pushing apparmor guys to put a change, but it would make "inter-operability" better.

Let me push that change.

shundhammer · 2019-01-24T15:11:19Z

Sure, that would be the desirable solution. But we need a bugfix now. While this is not quite as elegant, it is the pragmatic approach.

wfeldt

lgtm

lslezak

Would it be possible to add an unit test for this? If you already have a sample JSON output it would be nice use it in some tests...

lslezak · 2019-01-24T15:17:09Z

src/lib/apparmor/profiles.rb

+          pid = pidmap["pid"]
+          if @prof.key?(profile_name)
+            msg = "Active process #{pid} #{executable_name}"
+            msg += " profile name #{profile_name}" if executable_name != profile_name


np: you can use the << operator:

Suggested change

msg += " profile name #{profile_name}" if executable_name != profile_name

msg << " profile name #{profile_name}" if executable_name != profile_name

yast-bot · 2019-01-24T15:31:08Z

✔️ Public Jenkins job #10 successfully finished
✔️ Created OBS submit request #668378

yast-bot · 2019-01-24T15:31:43Z

✔️ Internal Jenkins job #11 successfully finished
✔️ Created IBS submit request #182578

shundhammer · 2019-01-28T13:41:05Z

BTW follow-up problem: https://bugzilla.suse.com/show_bug.cgi?id=1123258

Fix: PR #36

I.e. the new parser is robust enough to also understand the old JSON format.

More robust aa-status output parser

8f25ff5

shundhammer changed the title ~~WIP: More robust aa-status output parser~~ WIP: More Robust aa-status Output Parser Jan 23, 2019

shundhammer changed the title ~~WIP: More Robust aa-status Output Parser~~ More Robust aa-status Output Parser Jan 24, 2019

Version bump and change log

779387d

Conflict with incompatible aa-utils pkg

396db4e

wfeldt approved these changes Jan 24, 2019

View reviewed changes

lslezak reviewed Jan 24, 2019

View reviewed changes

shundhammer merged commit aadeecf into yast:master Jan 24, 2019

shundhammer deleted the huha-profile-names branch January 28, 2019 13:49

wfeldt mentioned this pull request Nov 7, 2019

More Robust aa-status Output Parser (bsc#1132418) #46

Merged

dgdavid mentioned this pull request Nov 7, 2019

[SLE-15-GA] Backports #44

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

More Robust aa-status Output Parser #35

More Robust aa-status Output Parser #35

shundhammer commented Jan 23, 2019 •

edited

shundhammer commented Jan 24, 2019

goldwynr commented Jan 24, 2019

shundhammer commented Jan 24, 2019

shundhammer commented Jan 24, 2019

shundhammer commented Jan 24, 2019

goldwynr commented Jan 24, 2019

shundhammer commented Jan 24, 2019

wfeldt left a comment

lslezak left a comment

lslezak Jan 24, 2019

yast-bot commented Jan 24, 2019

yast-bot commented Jan 24, 2019

shundhammer commented Jan 28, 2019 •

edited

	msg += " profile name #{profile_name}" if executable_name != profile_name
	msg << " profile name #{profile_name}" if executable_name != profile_name

More Robust aa-status Output Parser #35

More Robust aa-status Output Parser #35

Conversation

shundhammer commented Jan 23, 2019 • edited

Trello

Bugzilla

Problem

Sample JSON output

Fix

Test

shundhammer commented Jan 24, 2019

goldwynr commented Jan 24, 2019

shundhammer commented Jan 24, 2019

shundhammer commented Jan 24, 2019

shundhammer commented Jan 24, 2019

goldwynr commented Jan 24, 2019

shundhammer commented Jan 24, 2019

wfeldt left a comment

Choose a reason for hiding this comment

lslezak left a comment

Choose a reason for hiding this comment

lslezak Jan 24, 2019

Choose a reason for hiding this comment

yast-bot commented Jan 24, 2019

yast-bot commented Jan 24, 2019

shundhammer commented Jan 28, 2019 • edited

shundhammer commented Jan 23, 2019 •

edited

shundhammer commented Jan 28, 2019 •

edited