Now having seen that we can create our profile,
we're also going to look at how we can update the profile.
This might be necessary if program changes have happened.
Maybe there's been an update to your script or an update to a
manufacturer program and the profile now no longer works.
We can look at how we can fix it.
So here we are on the command line of this wonderful openSUSE system,
and we're going to modify our script.
So as we go through and open up our Python script,
we're just going to make a simple change to begin with,
just to show that we can actually write to the file.
You might not believe it, because you're saying we created an empty file,
but are we actually writing to the file?
So this has been allowed by AppArmor, and we're just going to change
the script a little bit so we have a file object,
so file = open.
We don't need the close element now, so we can go through and take this out.
We'll worry about closing it later,
but for the moment we don't need to worry about this.
We can go through now and actually write text to our file. So
we can use f.write as a very simple method,
and put in the text that we want to write through to our file,
so whatever we want, just a simple message.
And then we can go through and close off the write method.
And we can leave it like this.
We don't need to worry so much about closing our file,
because it will be closed when the script executes.
When the script has finished,
the file will be closed anyway. And we can see that we are writing to the file.
We can check that by using the cat command.
And it is allowed by AppArmor.
We have allowed the write permission, but we haven't allowed the read permission.
So what if we also tried to read from this script?
Well, it's not going to allow us.
Let's go through and check this.
I'm going to make sure that I do actually close off my file,
so I'm going to do the f.close. As I say,
the script will close the file, but because we're going to
close and open it again within the same script,
I want to make sure it's closed properly from the write
before I open it again for my read.
So I'm going to start a new try block.
We can go through and put pretty much the same information, so don't worry about
this, you can almost copy and paste this. But we're going to open up our file,
but instead of opening it up for a for appending, we're going to use the
character r for reading. So simple, isn't it?
Once we've done that, we don't need to print the information
anywhere, we can accept that it has read it, so we can then go
through and close off our file again.
So if we've got a read permission through to the file,
then we should be able to do this. And don't forget, we're
running this all as root. We can make sure then that we
print out information to say, yes,
look at this, how good were we, we were able to read from our file. So we can go
through and put our simple print and format print message,
Read file, and then whatever our file name is. Close
everything off. So that's if it succeeded, and we're not
expecting it to succeed to begin with.
If we then go through and put in our exception,
we can then go through and write our message saying, it all
fell apart. So we can go through and put our format print,
so Failed to read the file,
whatever the file name is, and close everything off.
And then we can go through and exit,
maybe even exit with a different error code here so we can
have an error code of 2 rather than 1.
If we go through now and execute it,
remember, AppArmor is still in place, that we Failed to read the file,
mytextfile. Hmm, things are not working terribly well, are they?
Well, don't despair. We have got an easy way to fix this.
So just in the same way we've got our genprof, we have got logprof, which
then reads from our log file for looking for violations. We don't have to
accept it, but we can see then the violations that are recorded and I can
then choose A to allow and S to save.
So that's now updated my profile. As I go through and execute my script now,
we can see then that I'm both able to create the file and read from the file. It really is as simple as this.