mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

build: enforce the use on the default profile on full mode.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-22 20:52:25 +00:00
parent 07acb8043b
commit 0d124065b9
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/prebuild/main.go
View File

@ -47,6 +47,7 @@ func aaPrebuild() error {
if full { if full {
prebuild.Prepares = append(prebuild.Prepares, prebuild.SetFullSystemPolicy) prebuild.Prepares = append(prebuild.Prepares, prebuild.SetFullSystemPolicy)
prebuild.Builds = append(prebuild.Builds, prebuild.BuildFullSystemPolicy)
} else { } else {
prebuild.Prepares = append(prebuild.Prepares, prebuild.SetDefaultSystemd) prebuild.Prepares = append(prebuild.Prepares, prebuild.SetDefaultSystemd)
} }

18
pkg/prebuild/build.go
View File

@ -19,10 +19,13 @@ var Builds = []BuildFunc{
} }
var ( var (
regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`) regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`)
regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`) regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`)
regProfileHeader = regexp.MustCompile(` {`) regProfileHeader = regexp.MustCompile(` {`)
regAbi4To3 = util.ToRegexRepl([]string{ // Currently Abi3 -> Abi4 regFullSystemPolicy = util.ToRegexRepl([]string{
`r(PU|U)x,`, `rPx,`,
})
regAbi4To3 = util.ToRegexRepl([]string{ // Currently Abi3 -> Abi4
`abi/3.0`, `abi/4.0`, `abi/3.0`, `abi/4.0`,
`# userns,`, `userns,`, `# userns,`, `userns,`,
}) })
@ -91,3 +94,10 @@ func BuildABI3(profile string) string {
} }
return profile return profile
} }
func BuildFullSystemPolicy(profile string) string {
for _, full := range regFullSystemPolicy {
profile = full.Regex.ReplaceAllString(profile, full.Repl)
}
return profile
}