Skip to content

Rewrite log handling

Christian Boltz requested to merge cboltz/apparmor:cboltz-rewrite-logparser into master

logparser.py puts each log event on a big "stack" in self.pid. Later, handle_children() in aa.py then converts that (named 'log' in aa.py) to the prelog hasher.

This commit changes logparser.py to create a prelog-like structure itsself (named hashlog), which

  • removes one level of indirection
  • probably saves some memory because the hashlog automatically de-duplicates events

In aa.py, collapse_log() gets updated to work with hashlog. (There's also a handle_hashlog() function in this patch series, but it didn't survive the final patches ;-)

OTOH, the now superfluous code handling capability, network etc. events gets removed from handle_children(). The remaining parts of this function get split into ask_exec() and ask_addhat().

logparser.py gets a new function init_hashlog() to initialize hashlog for each profile. It also gets changed to store capability, network etc. events into hashlog instead of storing them in self.pid.

hashlog uses the full profile name as key, which is the first baby step to support nested child profiles. (for now, handle_hashlog() still splits the profile name into profile and hat.)

There are many more details, see the individual commits ;-)

Edited by Christian Boltz

Merge request reports