aa-enforce and aa-complain strip all flags instead of manipulating 'complain'

[Jamie Strandboge]

If a profile contains flags other than 'complain', they are stripped out when using aa-enforce and aa-complain. Eg:

If profile has:
/usr/lib/chromium-browser/chromium-browser flags=(complain,attach_disconnected) {...}

After 'sudo aa-enforce /etc/apparmor.d/usr.bin.chromium-browser' it now has:
/usr/lib/chromium-browser/chromium-browser {...}

If profile has:
/usr/lib/chromium-browser/chromium-browser flags=(attach_disconnected) {...}

After 'sudo aa-complain /etc/apparmor.d/usr.bin.chromium-browser' it now has:
/usr/lib/chromium-browser/chromium-browser flags=(complain) {...}

[Jamie Strandboge (jdstrand)]

This is still an issue on 13.04.

[Daniel Richard G. (skunk)]

The aa-* scripts would probably do better to replace "complain" with "enforce" and vice versa, rather than edit the "flags=(...)" bit as a whole.

(Better yet, according to http://wiki.apparmor.net/index.php/AppArmor_Core_Policy_Reference , "the mode flags specify the mode the profile is in and are mutually exclusive. They have been deprecated in favor of external controls in order to better separate policy and state.")

[Steve Beattie (sbeattie)]

This has been fixed upstream with the replacement of the perl tools with the python tools, and was included in Ubuntu trusty with the 2.8.95~2430-0ubuntu1 apparmor upload.

[Steve Beattie (sbeattie)]

Apparmor 2.9.0 has been released; closing.