profstats

2 files changed, 42 insertions, 20 deletions

diff --git a/README.md b/README.md
index 9d4545e55..ff5427ebd 100644
--- a/README.md
+++ b/README.md
@@ -170,27 +170,29 @@ $ ./profstats *.profile
 Warning: multiple caps in transmission-daemon.profile
 
 Stats:
-    profiles                    1031
-    include local profile       1031   (include profile-name.local)
-    include globals             1031   (include globals.local)
-    blacklist ~/.ssh            1007   (include disable-common.inc)
-    seccomp                     976
-    capabilities                1030
-    noexec                      901   (include disable-exec.inc)
-    memory-deny-write-execute   221
-    apparmor                    555
-    private-bin                 544
-    private-dev                 897
-    private-etc                 435
-    private-tmp                 785
-    whitelist home directory    474
-    whitelist var               699   (include whitelist-var-common.inc)
-    whitelist run/user          336   (include whitelist-runuser-common.inc
+    profiles                    1064
+    include local profile       1064   (include profile-name.local)
+    include globals             1064   (include globals.local)
+    blacklist ~/.ssh            959   (include disable-common.inc)
+    seccomp                     975
+    capabilities                1063
+    noexec                      944   (include disable-exec.inc)
+    memory-deny-write-execute   229
+    apparmor                    605
+    private-bin                 564
+    private-dev                 932
+    private-etc                 462
+    private-tmp                 823
+    whitelist home directory    502
+    whitelist var               744   (include whitelist-var-common.inc)
+    whitelist run/user          461   (include whitelist-runuser-common.inc
                                         or blacklist ${RUNUSER})
-    whitelist usr/share         359   (include whitelist-usr-share-common.inc
-    net none                    333
-    dbus-user none              523
-    dbus-system none            632
+    whitelist usr/share         451   (include whitelist-usr-share-common.inc
+    net none                    345
+    dbus-user none              564
+    dbus-user filter            85
+    dbus-system none            696
+    dbus-system filter          7
 ```
 
 ### New profiles:
diff --git a/src/profstats/main.c b/src/profstats/main.c
index 4c1221464..1380c87f7 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -30,6 +30,8 @@ static int cnt_seccomp = 0;
 static int cnt_caps = 0;
 static int cnt_dbus_system_none = 0;
 static int cnt_dbus_user_none = 0;
+static int cnt_dbus_system_filter = 0;
+static int cnt_dbus_user_filter = 0;
 static int cnt_dotlocal = 0;
 static int cnt_globalsdotlocal = 0;
 static int cnt_netnone = 0;
@@ -152,8 +154,12 @@ void process_file(const char *fname) {
                         cnt_privateetc++;
                 else if (strncmp(ptr, "dbus-system none", 16) == 0)
                         cnt_dbus_system_none++;
+                else if (strncmp(ptr, "dbus-system", 11) == 0)
+                        cnt_dbus_system_filter++;
                 else if (strncmp(ptr, "dbus-user none", 14) == 0)
                         cnt_dbus_user_none++;
+                else if (strncmp(ptr, "dbus-user", 9) == 0)
+                        cnt_dbus_user_filter++;
                 else if (strncmp(ptr, "include ", 8) == 0) {
                         // not processing .local files
                         if (strstr(ptr, ".local")) {
@@ -257,7 +263,9 @@ int main(int argc, char **argv) {
                 int whitelistrunuser = cnt_whitelistrunuser;
                 int whitelistusrshare = cnt_whitelistusrshare;
                 int dbussystemnone = cnt_dbus_system_none;
+                int dbussystemfilter = cnt_dbus_system_filter;
                 int dbususernone = cnt_dbus_user_none;
+                int dbususerfilter = cnt_dbus_user_filter;
                 int ssh = cnt_ssh;
                 int mdwx = cnt_mdwx;
 
@@ -278,6 +286,16 @@ int main(int argc, char **argv) {
                         cnt_globalsdotlocal = globalsdotlocal + 1;
                 if (cnt_whitelistrunuser > (whitelistrunuser + 1))
                         cnt_whitelistrunuser = whitelistrunuser + 1;
+                if (cnt_seccomp > (seccomp + 1))
+                        cnt_seccomp = seccomp + 1;
+                if (cnt_dbus_user_none > (dbususernone + 1))
+                        cnt_dbus_user_none = dbususernone + 1;
+                if (cnt_dbus_user_filter > (dbususerfilter + 1))
+                        cnt_dbus_user_filter = dbususerfilter + 1;
+                if (cnt_dbus_system_none > (dbussystemnone + 1))
+                        cnt_dbus_system_none = dbussystemnone + 1;
+                if (cnt_dbus_system_filter > (dbussystemfilter + 1))
+                        cnt_dbus_system_filter = dbussystemfilter + 1;
 
                 if (arg_dbus_system_none && dbussystemnone == cnt_dbus_system_none)
                         printf("No dbus-system none found in %s\n", argv[i]);
@@ -337,7 +355,9 @@ int main(int argc, char **argv) {
         printf("    whitelist usr/share\t\t%d   (include whitelist-usr-share-common.inc\n", cnt_whitelistusrshare);
         printf("    net none\t\t\t%d\n", cnt_netnone);
         printf("    dbus-user none \t\t%d\n", cnt_dbus_user_none);
+        printf("    dbus-user filter \t\t%d\n", cnt_dbus_user_filter);
         printf("    dbus-system none \t\t%d\n", cnt_dbus_system_none);
+        printf("    dbus-system filter \t\t%d\n", cnt_dbus_system_filter);
         printf("\n");
         return 0;
 }