logprof and genprof don't detect socket events

[Jeff Mahoney]

The version of AppArmor that was accepted upstream initially had network mediation but it was removed. There's a compatibility patch floating around that (at least) openSUSE and Ubuntu have applied to their kernel trees to re-add support for socket operations.

This works to allow the profiles to be honored in the kernel, but one step was overlooked. Somewhere during the upstream acceptance phase, the naming of the socket event operations was changed to drop the socket_ prefix. This doesn't have any effect on network mediation or security but does mean that logprof and genprof stopped recognizing networking events and could not suggest them during their runs.

The attached patch adds an operation type hash that can be used to replace the simple /socket_/ checks that were used previously to identify a a network operation. My testing shows that it is properly detecting networking events again.

[Jeff Mahoney (jeffm-jeffreymahoney)]

This issue was initially reported at https://bugzilla.novell.com/show_bug.cgi?id=665483

[Steve Beattie (sbeattie)]

Jeff, thanks for the patch. I've reproduced the issue, confirmed the fix, and committed it to both the lp:apparmor and lp:apparmor/2.5 branches.

[Steve Beattie (sbeattie)]

Closing, apparmor 2.5.2 was released.