Import upstream version 2.8.96~2541

Makefile

@@ -27,12 +27,16 @@ __SETUP_DIR?=.
 # embedded in ${VERSION}
 TAG_VERSION=$(subst ~,-,${VERSION})
 
+# Add exclusion entries arguments for tar here, of the form:
+#   --exclude dir_to_exclude --exclude other_dir
+TAR_EXCLUSIONS=
+
 .PHONY: tarball
 tarball: clean
 	REPO_VERSION=`$(value REPO_VERSION_CMD)` ; \
 	make export_dir __EXPORT_DIR=${RELEASE_DIR} __REPO_VERSION=$${REPO_VERSION} ; \
 	make setup __SETUP_DIR=${RELEASE_DIR} ; \
-	tar --exclude deprecated -cvzf ${RELEASE_DIR}.tar.gz ${RELEASE_DIR}
+	tar ${TAR_EXCLUSIONS} -cvzf ${RELEASE_DIR}.tar.gz ${RELEASE_DIR}
 
 .PHONY: snapshot
 snapshot: clean
@@ -40,7 +44,7 @@ snapshot: clean
 	SNAPSHOT_DIR=apparmor-${VERSION}~$${REPO_VERSION} ;\
 	make export_dir __EXPORT_DIR=$${SNAPSHOT_DIR} __REPO_VERSION=$${REPO_VERSION} ; \
 	make setup __SETUP_DIR=$${SNAPSHOT_DIR} ; \
-	tar --exclude deprecated -cvzf $${SNAPSHOT_DIR}.tar.gz $${SNAPSHOT_DIR} ;
+	tar ${TAR_EXCLUSIONS} -cvzf $${SNAPSHOT_DIR}.tar.gz $${SNAPSHOT_DIR} ;
 
 
 .PHONY: export_dir

common/.stamp_rev

-https://code.launchpad.net/~apparmor-dev/apparmor/master 2430

common/Version

-2.8.95
+2.8.96

deprecated/utils/Immunix/Config.pm

+# ----------------------------------------------------------------------
+#    Copyright (c) 2006 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+package Immunix::Config;
+
+use strict;
+use warnings;
+
+use Carp;
+use Cwd qw(cwd realpath);
+use File::Basename;
+use File::Temp qw/ tempfile tempdir /;
+use Data::Dumper;
+use Locale::gettext;
+use POSIX;
+
+require Exporter;
+our @ISA    = qw(Exporter);
+our @EXPORT = qw(
+    read_config
+    write_config
+    find_first_file
+    find_first_dir
+);
+
+our $confdir = "/etc/apparmor";
+
+# config vars
+our $cfg;
+our $repo_cfg;
+
+sub read_config {
+    my $filename = shift;
+    my $config;
+
+    if (open(CONF, "$confdir/$filename")) {
+        my $which;
+        while (<CONF>) {
+            chomp;
+            # ignore comments
+            next if /^\s*#/;
+            if (m/^\[(\S+)\]/) {
+                $which = $1;
+            } elsif (m/^\s*(\S+)\s*=\s*(.*)\s*$/) {
+                my ($key, $value) = ($1, $2);
+                $config->{$which}{$key} = $value;
+            }
+        }
+        close(CONF);
+    }
+
+    # LP: #692406
+    # Explicitly disable the repository until there is an alternative, since
+    # the OpenSUSE site went away
+    if ($filename eq "repository.conf") {
+        $config->{repository}{enabled} = "no";
+    }
+
+    return $config;
+}
+
+sub write_config {
+    my ($filename, $config) = @_;
+    if (open(my $CONF, ">$confdir/$filename")) {
+        for my $section (sort keys %$config) {
+            print $CONF "[$section]\n";
+
+            for my $key (sort keys %{$config->{$section}}) {
+                print $CONF "  $key = $config->{$section}{$key}\n"
+                    if ($config->{$section}{$key});
+            }
+        }
+        chmod(0600, $CONF);
+        close($CONF);
+    } else {
+        die "Can't write config file $filename: $!";
+    }
+}
+
+sub find_first_file {
+    my $list = shift;
+    return if ( not defined $list );
+    my $filename;
+    for my $f (split(/\s+/, $list)) {
+        if (-f $f) {
+            $filename = $f;
+            last;
+        }
+    }
+
+    return $filename;
+}
+
+sub find_first_dir {
+    my $list = shift;
+    return if ( not defined $list );
+    my $dirname;
+    for my $f (split(/\s+/, $list)) {
+        if (-d $f) {
+            $dirname = $f;
+            last;
+        }
+    }
+
+    return $dirname;
+}
+
+1;

deprecated/utils/Immunix/Repository.pm

+# ----------------------------------------------------------------------
+#    Copyright (c) 2008 Dominic Reynolds
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#
+# ----------------------------------------------------------------------
+
+package Immunix::Repository;
+
+use strict;
+use warnings;
+
+use Carp;
+use Cwd qw(cwd realpath);
+use Data::Dumper;
+use File::Basename;
+use File::Temp qw/ tempfile tempdir /;
+use Immunix::Config;
+use Locale::gettext;
+use POSIX;
+use RPC::XML;
+use RPC::XML::Client;
+
+
+require Exporter;
+our @ISA    = qw(Exporter);
+our @EXPORT = qw(
+    get_repo_client
+    did_result_succeed
+    get_result_error
+    user_login
+    user_register
+    upload_profile
+    fetch_profile_by_id
+    fetch_profiles_by_user
+    fetch_profiles_by_name
+    fetch_profiles_by_name_and_user
+    fetch_newer_profile
+    get_repo_config
+    set_repo_config
+);
+
+our %clients;
+our %uid2login;
+our $DEBUGGING = 0;
+our $repo_cfg;
+our $aa_cfg;
+
+sub get_repo_client ($) {
+    my $repo_url = shift;
+    unless ( $clients{$repo_url} ) {
+        $clients{$repo_url} = new RPC::XML::Client $repo_url;
+    }
+    return $clients{$repo_url};
+}
+
+sub did_result_succeed {
+    my $result = shift;
+
+    my $ref = ref $result;
+    return ($ref && $ref ne "RPC::XML::fault") ? 1 : 0;
+}
+
+sub get_result_error {
+    my $result = shift;
+
+    if (ref $result) {
+        if (ref $result eq "RPC::XML::fault") {
+            $result = $result->string;
+        } else {
+            $result = $$result;
+        }
+    }
+    return $result;
+}
+
+sub user_login ($$$) {
+    my ($repo_url,$user,$pass) = @_;
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    if ( $repo_client ) {
+        my $res = $repo_client->send_request('LoginConfirm', $user, $pass);
+        if (did_result_succeed($res)) {
+            $status = 1;
+            $detail = "";
+        } else {
+            $status = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+
+sub user_register ($$$$) {
+    my ($repo_url,$user,$pass,$email) = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my ($status,$detail);
+    if ( $repo_client ) {
+        my $res = $repo_client->send_request('Signup', $user, $pass, $email);
+        if (did_result_succeed($res)) {
+            $status = 1;
+            $detail = "";
+        } else {
+            $status  = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+sub upload_profile ($$$$$$$) {
+    my ($repo_url,$user,$pass,$distro,$pname,$profile,$changelog) = @_;
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    my $res = $repo_client->send_request( 'Create', $user, $pass, $distro,
+                                          $pname, $profile, $changelog);
+    if (did_result_succeed($res)) {
+       $detail = $res->value;
+       $status  = 1;
+    } else {
+       $detail = get_result_error($res);
+       $status  = 0;
+    }
+    return $status,$detail;
+}
+
+sub fetch_profile_by_id ($$) {
+    my ($repo_url,$id) = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my $repo_profile;
+    my ($status,$detail);
+    my $res = $repo_client->send_request('Show', $id);
+    if (did_result_succeed($res)) {
+        $status = 1;
+        $detail = $res->value();
+    } else {
+        $status  = 0;
+        $detail = get_result_error($res);
+    }
+
+    return $status, $detail;
+}
+
+
+sub fetch_profiles ($$$$) {
+    my ($repo_url,$distro,$username,$fqdn) = @_;
+    my $p_hash = {};
+    my ($status,$detail);
+    my $repo_client = get_repo_client( $repo_url );
+    my $res =
+      $repo_client->send_request('FindProfiles', $distro, $fqdn, $username);
+    if (did_result_succeed($res)) {
+        $status = 1;
+        for my $p ( @$res ) {
+            my $p_repo = $p->{profile}->value();
+            $p_repo =~ s/flags=\(complain\)// if ( $p_repo );  #strip complain flag
+            $p->{profile}             = $p_repo;
+            $p->{user_id}             = $p->{user_id}->value();
+            $p->{id}                  = $p->{id}->value();
+            $p->{name}                = $p->{name}->value();
+            $p->{created_at}          = $p->{created_at}->value();
+            $p->{downloaded_count}    = $p->{downloaded_count}->value();
+        }
+        $detail = $res;
+    } else {
+        $status = 0;
+        $detail = get_result_error($res);
+    }
+    return $status,$detail;
+}
+
+sub fetch_profiles_by_user ($$$) {
+    my ($repo_url,$distro,$username) = @_;
+    my $p_hash = {};
+    my ($status,$detail) = fetch_profiles( $repo_url, $distro, $username, "" );
+    if ( $status ) {
+        for my $p ( @$detail ) {
+            my $p_repo = $p->{profile};
+            if ($p_repo ne "") {
+                $p->{username} = $username;
+                $p_hash->{$p->{name}} = $p;
+            }
+        }
+    } else {
+        return ($status,$detail);
+    }
+    return($status,$p_hash);
+}
+
+
+sub fetch_profiles_by_name_and_user ($$$$) {
+    my ($repo_url,$distro,$fqdbin, $username) = @_;
+    my $p_hash = {};
+    my ($status,$detail) = fetch_profiles( $repo_url, $distro, $username, $fqdbin );
+    if ( $status ) {
+        for my $p ( @$detail ) {
+            my $p_repo = $p->{profile}?$p->{profile}:"";
+            $p_hash->{$p->{name}} = $p if ($p_repo ne "");
+        }
+    } else {
+        return ($status,$detail);
+    }
+    return($status,$p_hash);
+}
+
+
+sub fetch_profiles_by_name ($$$) {
+    my ($repo_url,$distro,$fqdbin) = @_;
+    my ($status,$detail,$data);
+    $detail = {};
+    ($status,$data) = fetch_profiles( $repo_url, $distro, "", $fqdbin);
+    if ($status) {
+        my @uids;
+        for my $p (@$data) {
+            push @uids, $p->{user_id};
+        }
+        my ($status_unames,$unames) = fetch_usernames_from_uids($repo_url, @uids);
+        if ( $status_unames ) {
+            for my $p (@$data) {
+                if ( $unames->{$p->{user_id}} ) {
+                    $p->{username} = $unames->{$p->{user_id}};
+                } else {
+                    $p->{username} = "unkown-" . $p->{user_id};
+                }
+            }
+
+        } else {
+            print STDOUT "ERROR UID\n";
+        }
+        for my $p (@$data) {
+            $p->{profile_type} = "REPOSITORY";
+            $detail->{$p->{username}} = $p;
+        }
+    } else {
+        $detail = $data;
+    }
+    return $status,$detail;
+}
+
+
+sub fetch_newer_profile ($$$$$) {
+    my ($repo_url,$distro,$user,$id,$profile)  = @_;
+    my $repo_client = get_repo_client( $repo_url );
+    my $p;
+    my ($status,$detail);
+
+    if ($repo_client) {
+        my $res =
+          $repo_client->send_request('FindProfiles', $distro, $profile, $user);
+        if (did_result_succeed($res)) {
+            my @profiles;
+            my @profile_list = @{$res->value};
+            $status = 1;
+
+            if (@profile_list) {
+                if ($profile_list[0]->{id} > $id) {
+                    $p = $profile_list[0];
+                }
+            }
+            $detail = $p;
+        } else {
+            $status = 0;
+            $detail = get_result_error($res);
+        }
+    }
+    return $status,$detail;
+}
+
+sub fetch_usernames_from_uids ($) {
+    my ($repo_url,@searchuids) = @_;
+    my ($status,$result) = (1,{});
+    my @uids;
+
+    for my $uid ( @searchuids ) {
+        if ( $uid2login{$uid} ) {
+            $result->{$uid} = $uid2login{$uid};
+        } else {
+            push @uids, $uid;
+        }
+    }
+    if (@uids) {
+        my $repo_client = get_repo_client( $repo_url );
+	#RPC::XML will serialize the array into XML with the is_utf8 flag set
+	#which causes, HTTP:Message to fail.  Looping on the array elements
+	#stops this from happening, and since these are all numbers it
+	#will not cause problems.
+	for my $foo (@uids) {
+	    Encode::_utf8_off($foo);
+	}
+        my $res = $repo_client->send_request('LoginNamesFromUserIds', [@uids]);
+        if (did_result_succeed($res)) {
+            my @usernames = @{ $res->value };
+            for my $uid (@uids) {
+                my $username = shift @usernames;
+                $uid2login{$uid} = $username;
+                $result->{$uid} = $uid2login{$uid};
+            }
+        } else {
+            $status = 0;
+            $result = get_result_error($res);
+        }
+    }
+    return $status,$result;
+}
+
+sub get_repo_config {
+    unless ( $repo_cfg ) {
+       $repo_cfg = Immunix::Config::read_config("repository.conf");
+    }
+    unless ( $aa_cfg ) {
+       $aa_cfg = Immunix::Config::read_config("logprof.conf");
+    }
+    return {
+              "url"      => $aa_cfg->{repository}{url},
+              "distro"   => $aa_cfg->{repository}{distro},
+              "enabled"  => $repo_cfg->{repository}{enabled},
+              "upload"   => $repo_cfg->{repository}{upload},
+              "user"     => $repo_cfg->{repository}{user},
+              "password" => $repo_cfg->{repository}{pass},
+              "email"    => $repo_cfg->{repository}{email}
+            };
+}
+
+sub set_repo_config ($) {
+    my $cfg = shift;
+    my ($url,$distro,$enabled,$upload,$user,$pass);
+    unless ( $repo_cfg ) {
+       $repo_cfg = Immunix::Config::read_config("repository.conf");
+    }
+    unless ( $aa_cfg ) {
+       $aa_cfg = Immunix::Config::read_config("logprof.conf");
+    }
+    $repo_cfg->{repository}{enabled} = $cfg->{enabled} if ( $cfg->{enabled} );
+    $repo_cfg->{repository}{upload}  = $cfg->{upload}  if ( $cfg->{upload} );
+    $repo_cfg->{repository}{user}    = $cfg->{user}    if ( $cfg->{user} );
+    $repo_cfg->{repository}{pass}    = $cfg->{password}if ( $cfg->{password} );
+    $repo_cfg->{repository}{email}   = $cfg->{email}   if ( $cfg->{email} );
+    $aa_cfg->{repository}{distro}    = $cfg->{distro}  if ( $cfg->{distro} );
+    $aa_cfg->{repository}{url}       = $cfg->{url}     if ( $cfg->{url} );
+    write_config("repository.conf", $repo_cfg);
+    write_config("logprof.conf", $aa_cfg);
+}
+
+
+1;

deprecated/utils/Immunix/Severity.pm

+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2005-2006 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+package Immunix::Severity;
+use strict;
+use Data::Dumper;
+
+my ($debug) = 0;
+
+sub debug {
+    print @_ if $debug;
+}
+
+sub new {
+    my $self = {};
+    $self->{DATABASENAME} = undef;
+    $self->{CAPABILITIES} = {};
+    $self->{FILES}        = {};
+    $self->{REGEXPS}      = {};
+    $self->{DEFAULT_RANK} = 10;
+    bless($self);
+    shift;
+    $self->init(@_) if @_;
+    return $self;
+}
+
+sub init ($;$) {
+    my ($self, $resource, $read, $write, $execute, $severity);
+    $self = shift;
+    $self->{DATABASENAME} = shift;
+    $self->{DEFAULT_RANK} = shift if defined $_[0];
+    open(DATABASE, $self->{DATABASENAME})
+      or die "Could not open severity db $self->{DATABASENAME}: $!\n";
+    while (<DATABASE>) {
+        chomp();
+        next if m/^\s*#/;
+        next if m/^\s*$/;
+
+        # leading whitespace is fine; maybe it shouldn't be?
+        if (/^\s*\/(\S+)\s+(\d+)\s+(\d+)\s+(\d+)\s*$/) {
+            my ($path, $read, $write, $execute) = ($1, $2, $3, $4);
+
+            if (index($path, "*") == -1) {
+
+                $self->{FILES}{$path} = {
+                    r => $read,
+                    w => $write,
+                    x => $execute
+                };
+
+            } else {
+
+                my $ptr = $self->{REGEXPS};
+                my @pieces = split(/\//, $path);
+
+                while (my $piece = shift @pieces) {
+                    if (index($piece, "*") != -1) {
+                        my $path = join("/", $piece, @pieces);
+                        my $regexp = convert_regexp($path);
+                        $ptr->{$regexp}{SD_RANK} = {
+                            r => $read,
+                            w => $write,
+                            x => $execute
+                        };
+                        last;
+                    } else {
+                        $ptr->{$piece} = {} unless exists $ptr->{$piece};
+                        $ptr = $ptr->{$piece};
+                    }
+                }
+            }
+        } elsif (m|^\s*CAP|) {
+            ($resource, $severity) = split;
+            $self->{CAPABILITIES}{$resource} = $severity;
+        } else {
+            print "unexpected database line: $_\n";
+        }
+    }
+    close(DATABASE);
+    debug Dumper($self);
+    return $self;
+}
+
+#rank:
+# handle capability
+# handle file
+#
+# handle capability
+#   if the name is in the database, return it
+#   otherwise, send a diagnostic message to stderr and return the default
+#
+# handle file
+#   initialize the current return value to 0
+#   loop over each entry in the database;
+#     find the max() value for each mode that matches and set a 'found' flag
+#   if the found flag has not been set, return the default;
+#   otherwise, return the maximum from the database
+
+sub handle_capability ($) {
+    my ($self, $resource) = @_;
+
+    my $ret = $self->{CAPABILITIES}{$resource};
+    if (!defined($ret)) {
+        return "unexpected capability rank input: $resource\n";
+    }
+    return $ret;
+}
+
+sub check_subtree {
+    my ($tree, $mode, $sev, $first, @rest) = @_;
+
+    # reassemble the remaining path from this directory level
+    my $path = join("/", $first, @rest);
+
+    # first check if we have a literal directory match to descend into
+    if ($tree->{$first}) {
+        $sev = check_subtree($tree->{$first}, $mode, $sev, @rest);
+    }
+
+    # if we didn't get a severity already, check for matching globs
+    unless ($sev) {
+
+        # check each glob at this directory level
+        for my $chunk (grep { index($_, "*") != -1 } keys %{$tree}) {
+
+            # does it match the rest of our path?
+            if ($path =~ /^$chunk$/) {
+
+                # if we've got a ranking, check if it's higher than
+                # current one, if any
+                if ($tree->{$chunk}->{SD_RANK}) {
+                    for my $m (split(//, $mode)) {
+                        if ((!defined $sev)
+                            || $tree->{$chunk}->{SD_RANK}->{$m} > $sev)
+                        {
+                            $sev = $tree->{$chunk}->{SD_RANK}->{$m};
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    return $sev;
+}
+
+sub handle_file ($$) {
+    my ($self, $resource, $mode) = @_;
+
+    # strip off the initial / from the path we're checking
+    $resource = substr($resource, 1);
+
+    # break the path into directory-level chunks
+    my @pieces = split(/\//, $resource);
+
+    my $sev;
+
+    # if there's a exact match for this path in the db, use that instead of
+    # checking the globs
+    if ($self->{FILES}{$resource}) {
+
+        # check each piece of the passed mode against the db entry
+        for my $m (split(//, $mode)) {
+            if ((!defined $sev) || $self->{FILES}{$resource}{$m} > $sev) {
+                $sev = $self->{FILES}{$resource}{$m};
+            }
+        }
+
+    } else {
+
+        # descend into the regexp tree looking for matches
+        $sev = check_subtree($self->{REGEXPS}, $mode, $sev, @pieces);
+
+    }
+
+    return (defined $sev) ? $sev : $self->{DEFAULT_RANK};
+}
+
+sub rank ($;$) {
+    my ($self, $resource, $mode) = @_;
+
+    if (substr($resource, 0, 1) eq "/") {
+        return $self->handle_file($resource, $mode);
+    } elsif (substr($resource, 0, 3) eq "CAP") {
+        return $self->handle_capability($resource);
+    } else {
+        return "unexpected rank input: $resource\n";
+    }
+}
+
+sub convert_regexp ($) {
+    my ($input) = shift;
+
+    # we need to convert subdomain regexps to perl regexps
+    my $regexp = $input;
+
+    # escape + . [ and ] characters
+    $regexp =~ s/(\+|\.|\[|\])/\\$1/g;
+
+    # convert ** globs to match anything
+    $regexp =~ s/\*\*/.SDPROF_INTERNAL_GLOB/g;
+
+    # convert * globs to match anything at current path level
+    $regexp =~ s/\*/[^\/]SDPROF_INTERNAL_GLOB/g;
+
+    # convert {foo,baz} to (foo|baz)
+    $regexp =~ y/\{\}\,/\(\)\|/ if $regexp =~ /\{.*\,.*\}/;
+
+    # twiddle the escaped * chars back
+    $regexp =~ s/SDPROF_INTERNAL_GLOB/\*/g;
+    return $regexp;
+}
+
+1;    # so the require or use succeeds

deprecated/utils/Makefile

+# ----------------------------------------------------------------------
+#    Copyright (c) 1999, 2004-2009 NOVELL (All rights reserved)
+#    Copyright (c) 2010-2011, 2014 Canonical Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+# ----------------------------------------------------------------------
+
+# NOTE: this Makefile has been adjusted from the original to assist in
+# the installation of the Immunix perl modules, if they're still needed
+# by users. Because the utilities conflict with their replacments, make
+# install *will* *not* install them.
+
+NAME 		= apparmor-utils
+all:
+COMMONDIR=../../common/
+
+include common/Make.rules
+
+COMMONDIR_EXISTS=$(strip $(shell [ -d ${COMMONDIR} ] && echo true))
+ifeq ($(COMMONDIR_EXISTS), true)
+common/Make.rules: $(COMMONDIR)/Make.rules
+	ln -sf $(COMMONDIR) .
+endif
+
+MODDIR = Immunix
+PERLTOOLS = aa-genprof aa-logprof aa-autodep aa-audit aa-complain aa-enforce \
+	aa-unconfined aa-disable
+MODULES = ${MODDIR}/AppArmor.pm ${MODDIR}/Repository.pm \
+	${MODDIR}/Config.pm ${MODDIR}/Severity.pm
+
+all:
+
+# need some better way of determining this
+DESTDIR=/
+BINDIR=${DESTDIR}/usr/sbin
+CONFDIR=${DESTDIR}/etc/apparmor
+VENDOR_PERL=$(shell perl -e 'use Config; print $$Config{"vendorlib"};')
+PERLDIR=${DESTDIR}${VENDOR_PERL}/${MODDIR}
+
+.PHONY: install
+install:
+	install -d ${PERLDIR}
+	install -m 644 ${MODULES} ${PERLDIR}
+
+.PHONY: clean
+ifndef VERBOSE
+.SILENT: clean
+endif
+clean: _clean
+	rm -f core core.* *.o *.s *.a *~
+	rm -f Make.rules
+	rm -rf staging/ build/
+
+.PHONY: check
+.SILENT: check
+check:
+	for i in ${MODULES} ${PERLTOOLS} ; do \
+		perl -c $$i || exit 1; \
+	done

deprecated/utils/aa-audit

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString("Please enter the program to switch to audit mode: ", ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to audit mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "audit");
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to audit mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-autodep

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help  = '';
+my $force = undef;
+
+GetOptions(
+    'force'   => \$force,
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+my $sd_mountpoint = check_for_subdomain();
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important(sprintf(gettext('Can\'t find AppArmor profiles in %s.'), $profiledir));
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to create a profile for: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+            my $which = which($profiling);
+            if ($which) {
+                $fqdbin = get_full_path($which);
+            }
+        }
+    }
+
+    # make sure that the app they're requesting to profile is not marked as
+    # not allowed to have it's own profile
+    if ($qualifiers{$fqdbin}) {
+        unless ($qualifiers{$fqdbin} =~ /p/) {
+            UI_Info(sprintf(gettext('%s is currently marked as a program that should not have it\'s own profile.  Usually, programs are marked this way if creating a profile for them is likely to break the rest of the system.  If you know what you\'re doing and are certain you want to create a profile for this program, edit the corresponding entry in the [qualifiers] section in /etc/apparmor/logprof.conf.'), $fqdbin));
+            exit 1;
+        }
+    }
+
+    if (-e $fqdbin) {
+        if (-e getprofilefilename($fqdbin) && !$force) {
+            UI_Info(sprintf(gettext('Profile for %s already exists - skipping.'), $fqdbin));
+        } else {
+            autodep($fqdbin);
+            reload($fqdbin) if $sd_mountpoint;
+        }
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info("usage: $0 [ --force ] [ -d /path/to/profiles ]");
+    exit 0;
+}
+

deprecated/utils/aa-complain

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to switch to complain mode: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to complain mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "complain");
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to complain mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-disable

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005-2010 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Canonical, Inc.
+#
+#    To contact Canonical about this file by physical or electronic mail,
+#    you may find current contact information at www.canonical.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+use File::Basename;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+my $disabledir = "$profiledir/disable";
+unless (-d $disabledir) {
+    UI_Important("Can't find AppArmor disable directory '$disabledir'.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program whose profile should be disabled: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+	            my $which = which($profiling);
+        	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	}
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip package manager backup files
+        next if isSkippableFile($filename);
+
+        my ($bname, $dname, $suffix) = File::Basename::fileparse($filename);
+        if ($bname eq "") {
+            UI_Info(sprintf(gettext('Could not find basename for %s.'), $filename));
+            exit 1;
+        }
+
+        printf(gettext('Disabling %s.'), $fqdbin);
+        print "\n";
+
+        my $link = "$disabledir/$bname";
+        if (! -e $link) {
+            if (symlink($filename, $link) != 1) {
+                UI_Info(sprintf(gettext('Could not create %s symlink.'), $link));
+                exit 1;
+            }
+        }
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -R 2>&1 1>/dev/null);
+        if ($? != 0) {
+            UI_Info($cmd_info);
+            exit $?;
+        }
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to have profile disabled ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-enforce

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#    Copyright (c) 2011 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use FindBin;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+$UI_Mode = "text";
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'dir|d=s' => \$profiledir,
+    'help|h'  => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    UI_Important("Can't find AppArmor profiles in $profiledir.");
+    exit 1;
+}
+
+# what are we profiling?
+my @profiling = @ARGV;
+
+unless (@profiling) {
+    @profiling = (UI_GetString(gettext("Please enter the program to switch to enforce mode: "), ""));
+}
+
+for my $profiling (@profiling) {
+
+    next unless $profiling;
+
+    my $fqdbin;
+    if (-e $profiling) {
+        $fqdbin = get_full_path($profiling);
+        chomp($fqdbin);
+    } else {
+        if ($profiling !~ /\//) {
+	    opendir(DIR,$profiledir);
+	    my @tmp_fqdbin = grep ( /$profiling/, readdir(DIR));
+	    closedir(DIR);
+	    if (scalar @tmp_fqdbin eq 1) {
+		    $fqdbin = "$profiledir/$tmp_fqdbin[0]";
+	    } else {
+            	    my $which = which($profiling);
+            	    if ($which) {
+                	$fqdbin = get_full_path($which);
+            	    }
+	    }
+        }
+    }
+
+    if (-e $fqdbin) {
+        my $filename;
+        if ($fqdbin =~ /^$profiledir\//) {
+            $filename = $fqdbin;
+        } else {
+            $filename = getprofilefilename($fqdbin);
+        }
+
+        # argh, skip directories
+        next unless -f $filename;
+
+        # skip rpm backup files
+        next if isSkippableFile($filename);
+
+        printf(gettext('Setting %s to enforce mode.'), $fqdbin);
+        print "\n";
+        setprofileflags($filename, "");
+
+        # remove symlink in $profiledir/force-complain as well
+        my $complainlink = $filename;
+        $complainlink =~ s/^$profiledir/$profiledir\/force-complain/;
+        -e $complainlink and unlink($complainlink);
+
+        # remove symlink in $profiledir/disable as well
+        my $disablelink = $filename;
+        $disablelink =~ s/^$profiledir/$profiledir\/disable/;
+        -e $disablelink and unlink($disablelink);
+
+        my $cmd_info = qx(cat $filename | $parser -I$profiledir -r 2>&1 1>/dev/null);
+	if ($? != 0) {
+	    UI_Info($cmd_info);
+	    exit $?;
+	}
+
+
+#          if check_for_subdomain();
+    } else {
+        if ($profiling =~ /^[^\/]+$/) {
+            UI_Info(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' as a user with the correct PATH environment set up in order to find the fully-qualified path.'), $profiling, $profiling));
+            exit 1;
+        } else {
+            UI_Info(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+            exit 1;
+        }
+    }
+}
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ program to switch to enforce mode ]"), $0));
+    exit 0;
+}
+

deprecated/utils/aa-genprof

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use Getopt::Long;
+
+use Immunix::AppArmor;
+
+use Data::Dumper;
+
+use Locale::gettext;
+use POSIX;
+
+sub sysctl_read($) {
+    my $path = shift;
+    my $value = undef;
+    if (open(SYSCTL, "<$path")) {
+        $value = int(<SYSCTL>);
+    }
+    close(SYSCTL);
+    return $value;
+}
+
+sub sysctl_write($$) {
+    my $path = shift;
+    my $value = shift;
+    return if (!defined($value));
+    if (open(SYSCTL, ">$path")) {
+        print SYSCTL $value;
+        close(SYSCTl);
+    }
+}
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+# options variables
+my $help = '';
+
+GetOptions(
+    'file|f=s' => \$filename,
+    'dir|d=s'  => \$profiledir,
+    'help|h'   => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+my $sd_mountpoint = check_for_subdomain();
+unless ($sd_mountpoint) {
+    fatal_error(gettext("AppArmor does not appear to be started. Please enable AppArmor and try again."));
+}
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    fatal_error "Can't find AppArmor profiles in $profiledir.";
+}
+
+# what are we profiling?
+my $profiling = shift;
+
+unless ($profiling) {
+    $profiling = UI_GetString(gettext("Please enter the program to profile: "), "")
+      || exit 0;
+}
+
+my $fqdbin;
+if (-e $profiling) {
+    $fqdbin = get_full_path($profiling);
+    chomp($fqdbin);
+} else {
+    if ($profiling !~ /\//) {
+        my $which = which($profiling);
+        if ($which) {
+            $fqdbin = get_full_path($which);
+        }
+    }
+}
+
+unless ($fqdbin && -e $fqdbin) {
+    if ($profiling =~ /^[^\/]+$/) {
+        fatal_error(sprintf(gettext('Can\'t find %s in the system path list.  If the name of the application is correct, please run \'which %s\' in the other window in order to find the fully-qualified path.'), $profiling, $profiling));
+    } else {
+        fatal_error(sprintf(gettext('%s does not exist, please double-check the path.'), $profiling));
+    }
+}
+
+
+# make sure that the app they're requesting to profile is not marked as
+# not allowed to have it's own profile
+check_qualifiers($fqdbin);
+
+# load all the include files
+loadincludes();
+
+my $profilefilename = getprofilefilename($fqdbin);
+if (-e $profilefilename) {
+    $helpers{$fqdbin} = getprofileflags($profilefilename) || "enforce";
+} else {
+    autodep($fqdbin);
+    $helpers{$fqdbin} = "enforce";
+}
+
+if ($helpers{$fqdbin} eq "enforce") {
+    complain($fqdbin);
+    reload($fqdbin);
+}
+
+# When reading from syslog, it is possible to hit the default kernel
+# printk ratelimit. This will result in audit entries getting skipped,
+# making profile generation inaccurate. When using genprof, disable
+# the printk ratelimit, and restore it on exit.
+my $ratelimit_sysctl = "/proc/sys/kernel/printk_ratelimit";
+my $ratelimit_saved = sysctl_read($ratelimit_sysctl);
+END { sysctl_write($ratelimit_sysctl, $ratelimit_saved); }
+sysctl_write($ratelimit_sysctl, 0);
+
+UI_Info(gettext("\nBefore you begin, you may wish to check if a\nprofile already exists for the application you\nwish to confine. See the following wiki page for\nmore information:\nhttp://wiki.apparmor.net/index.php/Profiles"));
+
+UI_Important(gettext("Please start the application to be profiled in \nanother window and exercise its functionality now.\n\nOnce completed, select the \"Scan\" button below in \norder to scan the system logs for AppArmor events.  \n\nFor each AppArmor event, you will be given the  \nopportunity to choose whether the access should be  \nallowed or denied."));
+
+my $syslog         = 1;
+my $logmark        = "";
+my $done_profiling = 0;
+
+$syslog = 0 if (-e "/var/log/audit/audit.log");
+
+while (not $done_profiling) {
+    if ($syslog) {
+        $logmark = `date | md5sum`;
+        chomp $logmark;
+        $logmark = $1 if $logmark =~ /^([0-9a-f]+)/;
+        system("$logger -p kern.warn 'GenProf: $logmark'");
+    } else {
+        $logmark = last_audit_entry_time();
+    }
+    eval {
+
+        my $q = {};
+        $q->{headers} = [ gettext("Profiling"), $fqdbin ];
+        $q->{functions} = [ "CMD_SCAN", "CMD_FINISHED" ];
+        $q->{default} = "CMD_SCAN";
+
+        my ($ans, $arg) = UI_PromptUser($q);
+
+        if ($ans eq "CMD_SCAN") {
+
+            my $lp_ret = do_logprof_pass($logmark);
+
+            $done_profiling = 1 if $lp_ret eq "FINISHED";
+
+        } else {
+
+            $done_profiling = 1;
+
+        }
+    };
+    if ($@) {
+        if ($@ =~ /FINISHING/) {
+            $done_profiling = 1;
+        } else {
+            die $@;
+        }
+    }
+}
+
+for my $p (sort keys %helpers) {
+    if ($helpers{$p} eq "enforce") {
+        enforce($p);
+        reload($p);
+    }
+}
+
+UI_Info(gettext("Reloaded AppArmor profiles in enforce mode."));
+UI_Info(gettext("\nPlease consider contributing your new profile! See\nthe following wiki page for more information:\nhttp://wiki.apparmor.net/index.php/Profiles\n"));
+UI_Info(sprintf(gettext('Finished generating profile for %s.'), $fqdbin));
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ -f /path/to/logfile ] [ program to profile ]"), $0));
+    exit 0;
+}
+
+sub last_audit_entry_time {
+    local $_ = `tail -1 /var/log/audit/audit.log`;
+    my $logmark;
+    if (/^*msg\=audit\((\d+\.\d+\:\d+).*\).*$/) {
+        $logmark = $1;
+    } else {
+        $logmark = "";
+    }
+    return $logmark;
+}

deprecated/utils/aa-logprof

+#!/usr/bin/perl
+# ----------------------------------------------------------------------
+#    Copyright (c) 2005 Novell, Inc. All Rights Reserved.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+#
+#    To contact Novell about this file by physical or electronic mail,
+#    you may find current contact information at www.novell.com.
+# ----------------------------------------------------------------------
+
+use strict;
+use Data::Dumper;
+use Getopt::Long;
+use Locale::gettext;
+use POSIX;
+
+use Immunix::AppArmor;
+
+# force $PATH to be sane
+$ENV{PATH} = "/bin:/sbin:/usr/bin:/usr/sbin";
+
+# initialize the local poo
+setlocale(LC_MESSAGES, "");
+textdomain("apparmor-utils");
+
+setup_yast();
+
+# options variables
+my $help = '';
+my $logmark;
+
+GetOptions(
+    'file|f=s'    => \$filename,
+    'dir|d=s'     => \$profiledir,
+    'logmark|m=s' => \$logmark,
+    'help|h'      => \$help,
+);
+
+# tell 'em how to use it...
+&usage && exit if $help;
+
+# let's convert it to full path...
+$profiledir = get_full_path($profiledir);
+
+unless (-d $profiledir) {
+    fatal_error "Can't find AppArmor profiles in $profiledir.";
+}
+
+# load all the include files
+loadincludes();
+
+do_logprof_pass($logmark);
+
+shutdown_yast();
+
+exit 0;
+
+sub usage {
+    UI_Info(sprintf(gettext("usage: \%s [ -d /path/to/profiles ] [ -f /path/to/logfile ] [ -m \"mark in log to start processing after\""), $0));
+    exit 0;
+}
+

deprecated/utils/aa-status

+#!/usr/bin/perl -w
+# ------------------------------------------------------------------
+#
+#    Copyright (C) 2005-2006 Novell/SUSE
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+# ------------------------------------------------------------------
+
+
+use strict;
+use Getopt::Long;
+use Cwd 'abs_path';
+
+my $confdir = "/etc/apparmor";
+my $sd_mountpoint;
+my $check_enabled = 0;
+my $count_enforced = 0;
+my $count_profiled = 0;
+my $count_complain = 0;
+my $verbose = 0;
+my $help;
+
+GetOptions(
+  'complaining'		=> \$count_complain,
+  'enabled'		=> \$check_enabled,
+  'enforced'		=> \$count_enforced,
+  'profiled'		=> \$count_profiled,
+  'verbose|v'		=> \$verbose,
+  'help|h'		=> \$help,
+) or usage();
+
+sub usage {
+  print "Usage: $0 [OPTIONS]\n";
+  print "Displays various information about the currently loaded AppArmor policy.\n";
+  print "OPTIONS (one only):\n";
+  print "  --enabled       returns error code if subdomain not enabled\n";
+  print "  --profiled      prints the number of loaded policies\n";
+  print "  --enforced      prints the number of loaded enforcing policies\n";
+  print "  --complaining   prints the number of loaded non-enforcing policies\n";
+  print "  --verbose       (default) displays multiple data points about loaded policy set\n";
+  print "  --help          this message\n";
+  exit;
+}
+
+$verbose = 1 if ($count_complain + $check_enabled + $count_enforced + $count_profiled == 0);
+usage() if $help or ($count_complain + $check_enabled + $count_enforced + $count_profiled + $verbose > 1);
+
+sub is_subdomain_loaded() {
+  return 1 if (-d "/sys/module/apparmor");
+  if(open(MODULES, "/proc/modules")) {
+    while(<MODULES>) {
+      return 1 if m/^(subdomain|apparmor)\s+/;
+    }
+  }
+
+  return 0;
+}
+
+sub find_subdomainfs() {
+
+  my $sd_mountpoint;
+  if(open(MOUNTS, "/proc/mounts")) {
+    while(<MOUNTS>) {
+      $sd_mountpoint = "$1/apparmor" if m/^\S+\s+(\S+)\s+securityfs\s/ && -e "$1/apparmor";
+      $sd_mountpoint = "$1/subdomain" if m/^\S+\s+(\S+)\s+securityfs\s/ && -e "$1/subdomain";
+      $sd_mountpoint = $1 if m/^\S+\s+(\S+)\s+subdomainfs\s/ && -e "$1";
+    }
+    close(MOUNTS);
+  }
+
+  return $sd_mountpoint;
+}
+
+sub get_profiles {
+  my $mountpoint = shift;
+  my %profiles = ();
+
+  if (open(PROFILES, "$mountpoint/profiles")) {
+    while(<PROFILES>) {
+      $profiles{$1} = $2 if m/^([^\(]+)\s+\((\w+)\)$/;
+    }
+    close(PROFILES);
+  }
+  return (%profiles);
+}
+
+sub get_processes {
+  my %profiles = @_;
+  my %processes = ();
+  if (opendir(PROC, "/proc")) {
+    my $file;
+    while (defined($file = readdir(PROC))) {
+      if ($file =~ m/^\d+/) {
+        if (open(CURRENT, "/proc/$file/attr/current")) {
+          while (<CURRENT>) {
+            if (m/^([^\(]+)\s+\((\w+)\)$/) {
+              $processes{$file}{'profile'} = $1;
+              $processes{$file}{'mode'} = $2;
+            } elsif (grep(abs_path("/proc/$file/exe") eq $_ , keys(%profiles))) {
+              # keep only unconfined processes that have a profile defined
+              $processes{$file}{'profile'} = abs_path("/proc/$file/exe");
+              $processes{$file}{'mode'} = 'unconfined';
+            }
+          }
+          close(CURRENT);
+        }
+      }
+    }
+    closedir(PROC);
+  }
+  return (%processes);
+}
+
+my $is_loaded = is_subdomain_loaded();
+
+if (!$is_loaded) {
+  print STDERR "apparmor module is not loaded.\n" if $verbose;
+  exit 1;
+}
+
+print "apparmor module is loaded.\n" if $verbose;
+
+$sd_mountpoint = find_subdomainfs();
+if (!$sd_mountpoint) {
+  print STDERR "apparmor filesystem is not mounted.\n" if $verbose;
+  exit 3;
+}
+
+if (! -r "$sd_mountpoint/profiles") {
+  print STDERR "You do not have enough privilege to read the profile set.\n" if $verbose;
+  exit 4;
+}
+
+#print "subdomainfs is at $sd_mountpoint.\n" if $verbose;
+
+# processes is a hash table :
+#   * keys : processes pid
+#   * values : hash containing information about the running process:
+#       * 'profile' : name of the profile applied to the running process
+#       * 'mode' : mode of the profile applied to the running process
+my %processes = ();
+my %enforced_processes = ();
+my %complain_processes = ();
+my %unconfined_processes = ();
+
+# profiles is a hash table :
+#  * keys : profile name
+#  * value : profile mode
+my %profiles;
+my @enforced_profiles = ();
+my @complain_profiles = ();
+
+%profiles = get_profiles($sd_mountpoint);
+@enforced_profiles = grep { $profiles{$_} eq 'enforce' } keys %profiles;
+@complain_profiles = grep { $profiles{$_} eq 'complain' } keys %profiles;
+
+# we consider the case where no profiles are loaded to be "disabled" as well
+my $rc = (keys(%profiles) == 0) ? 2 : 0;
+
+if ($check_enabled) {
+  exit $rc;
+}
+
+if ($count_profiled) {
+  print scalar(keys(%profiles)). "\n";
+  exit $rc;
+}
+
+if ($count_enforced) {
+  print $#enforced_profiles + 1 . "\n";
+  exit $rc;
+}
+
+if ($count_complain) {
+  print $#complain_profiles + 1 . "\n";
+  exit $rc;
+}
+
+
+if ($verbose) {
+  print keys(%profiles) . " profiles are loaded.\n";
+  print $#enforced_profiles + 1 . " profiles are in enforce mode.\n";
+  for (sort(@enforced_profiles)) {
+    print "   " . $_ . "\n";
+  }
+  print $#complain_profiles + 1 . " profiles are in complain mode.\n";
+  for (sort(@complain_profiles)) {
+    print "   " . $_ . "\n";
+  }
+}
+
+%processes = get_processes(%profiles);
+if ($verbose) {
+  for (keys(%processes)) {
+    $enforced_processes{$_} = $processes{$_} if $processes{$_}{'mode'} eq 'enforce';
+    $complain_processes{$_} = $processes{$_} if $processes{$_}{'mode'} eq 'complain';
+    # some early code uses unconfined instead of unconfined.
+    $unconfined_processes{$_} = $processes{$_} if $processes{$_}{'mode'} =~ /uncon(fi|strai)ned/;
+  }
+  print keys(%processes) . " processes have profiles defined.\n";
+  print keys(%enforced_processes) . " processes are in enforce mode :\n";
+  for (sort { $enforced_processes{$a}{'profile'} cmp $enforced_processes{$b}{'profile'} } keys(%enforced_processes)) {
+    print "   " . $enforced_processes{$_}{'profile'} . " ($_) \n";
+  }
+  print keys(%complain_processes) . " processes are in complain mode.\n";
+  for (sort { $complain_processes{$a}{'profile'} cmp $complain_processes{$b}{'profile'} } keys(%complain_processes)) {
+    print "   " . $complain_processes{$_}{'profile'} . " ($_) \n";
+  }
+  print keys(%unconfined_processes) . " processes are unconfined but have a profile defined.\n";
+  for (sort { $unconfined_processes{$a}{'profile'} cmp $unconfined_processes{$b}{'profile'} } keys(%unconfined_processes)) {
+    print "   " . $unconfined_processes{$_}{'profile'} . " ($_) \n";
+  }
+}
+
+exit $rc;