aa-cleanprof / delete_duplicates() doesn't check indirect includes

Bug #1399012 reported by Christian Boltz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
AppArmor
New
Undecided
Unassigned

Bug Description

aa-cleanprof / delete_duplicates() checks only files directly included in a profile, but it doesn't check indirect includes.

Shortened example:

usr.sbin.dovecot {
    # include <abstractions/nameservice>
    capability net_bind_service,
}

abstractions/nameservice contains:
    #include <abstractions/nis>

abstractions/nis contains:
    capability net_bind_service,

Expected result: aa-cleanprof should remove net_bind_service from the dovecot profile.

-> delete_duplicates() in aa.py needs to recursively(!) check the includes

Tags: aa-tools
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.