Bugzilla – Bug 520013
apparmor reports wrong line numbers on error.
Last modified: 2016-04-15 09:43:03 UTC
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.11) Gecko/2009060200 SUSE/3.0.11-0.1.1 Firefox/3.0.11 ---- Wed Jul 08, 03:55:57 , /etc/apparmor.d acer15 # cat -n usr.bin.skype | tail -n 3 56 audit deny /home/olli/bin* mrwkx, 57 58 } ---- Wed Jul 08, 03:57:22 , /etc/apparmor.d acer15 # service boot.apparmor restart Reloading AppArmor profiles AppArmor parser error in /etc/apparmor.d/usr.bin.skype at line 491: syntax error, unexpected TOK_AUDIT, expecting TOK_MODE Profile /etc/apparmor.d/usr.bin.skype failed to load failed ---- Wed Jul 08, 03:57:29 , /etc/apparmor.d acer15 # Reproducible: Always Steps to Reproduce: 1. make a bug in a profile 2. service boot.apparmor restart 3. the bug is displayed w/ buggy file name, but line number is invalid. Actual Results: in my case displays line number far after the last line of a file. Expected Results: should show right line number.
Ok, this is because it pulls in all the includes and then parses the result. I'm working on implementing #line support in the postprocessed output and will have test packages soon.
I've posted test packages at http://ftp.suse.com/pub/people/jeffm/suse/testpkgs/520013 It may take a few moments to sync out.
After installing packages from http://ftp.suse.com/pub/people/jeffm/suse/testpkgs/520013 the buggy string is reported correctly. Though there arrives another sort of 'something wrong' sitation - many profiles that loaded OK before now fail to load. What should I do w/ that? Some details follow: ---- Sun Oct 18, 22:57:29 , /etc/apparmor.d acer15 # service boot.apparmor restart 2>&1| grep "Profile doesn't conform to protocol" | wc -l 25 ---- Sun Oct 18, 22:57:44 , /etc/apparmor.d acer15 # ls /etc/apparmor.d/ -1 | wc -l 33 ---- Sun Oct 18, 22:57:49 , /etc/apparmor.d acer15 # service boot.apparmor restart | head /sbin/apparmor_parser: Unable to replace "/bin/ping". Profile doesn't conform to protocol Reloading AppArmor profiles Profile /etc/apparmor.d/bin.ping failed to load /sbin/apparmor_parser: Unable to replace "/sbin/klogd". Profile doesn't conform to protocol Profile /etc/apparmor.d/sbin.klogd failed to load /sbin/apparmor_parser: Unable to replace "/sbin/rpc.statd". Profile doesn't conform to protocol Profile /etc/apparmor.d/sbin.rpc.statd failed to load /sbin/apparmor_parser: Unable to replace "/sbin/syslog-ng". Profile doesn't conform to protocol Profile /etc/apparmor.d/sbin.syslog-ng failed to load /sbin/apparmor_parser: Unable to replace "/sbin/syslogd". Profile doesn't conform to protocol Profile /etc/apparmor.d/sbin.syslogd failed to load /sbin/apparmor_parser: Unable to replace "/usr/bin/gaim". Profile doesn't conform to protocol Profile /etc/apparmor.d/usr.bin.gaim failed to load /sbin/apparmor_parser: Unable to replace "/usr/bin/opera". Profile doesn't conform to protocol Profile /etc/apparmor.d/usr.bin.opera failed to load /sbin/apparmor_parser: Unable to replace "/usr/bin/psi". Profile doesn't conform to protocol Profile /etc/apparmor.d/usr.bin.psi failed to load /sbin/apparmor_parser: Unable to replace "/usr/bin/skype". Profile doesn't conform to protocol Profile /etc/apparmor.d/usr.bin.skype failed to load /sbin/apparmor_parser: Unable to replace "/usr/bin/xchat". Profile doesn't conform to protocol Profile /etc/apparmor.d/usr.bin.xchat failed to load /sbin/apparmor_parser: Unable to replace "/usr/sbin/avahi-daemon". Profile doesn't conform to protocol ---- Sun Oct 18, 22:58:14 , /etc/apparmor.d acer15 # rpm -qa | grep apparmor yast2-apparmor-2.17.4-1.5 libapparmor-devel-2.3-50.18 apparmor-profiles-2.3-42.5 apparmor-utils-2.3.1-5.5 opensuse-apparmor-quick_en-pdf-11.1-29.5.1 apparmor-docs-2.3.1-11 apparmor-profile-editor-0.9.1-268.14 perl-libapparmor-2.3-50.18 apache2-mod_apparmor-2.0.2-168.15 apparmor-parser-2.3.1-11 libapparmor1-2.3-50.18 pam_apparmor-2.3-2.69 ---- Sun Oct 18, 22:58:41 , /etc/apparmor.d acer15 #
Hrm. I'm not sure what to make of that. I'll take a look.
I've committed the line number changes to the security:apparmor:factory project. I'll get the fix backported the various products tonight.
I've committed this fix to openSUSE 11.2 and SLE11 SP1. 11.2 is out of scope. Anja, I have three fixes queued up for apparmor-parser. SR 34867
ok, we so kind and submit a patchinfo for 11.2; swampID: 32010
The SWAMPID for this issue is 32010. Please submit the patch and patchinfo file using this ID. (https://swamp.suse.de/webswamp/wf/32010)
Update released for: apparmor-parser, apparmor-parser-debuginfo, apparmor-parser-debugsource, apparmor-utils Products: openSUSE 11.2 (debug, i586, x86_64)
Closing as fixed.
This is an autogenerated message for OBS integration: This bug (520013) was mentioned in https://build.opensuse.org/request/show/34867 11.2:Test / apparmor-parser