mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

build: enforce the use on the default profile on full mode.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-22 20:52:25 +00:00
parent 07acb8043b
commit 0d124065b9
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmd/prebuild/main.go
View File

@ -47,6 +47,7 @@ func aaPrebuild() error {
if full {
prebuild.Prepares = append(prebuild.Prepares, prebuild.SetFullSystemPolicy)
prebuild.Builds = append(prebuild.Builds, prebuild.BuildFullSystemPolicy)
} else {
prebuild.Prepares = append(prebuild.Prepares, prebuild.SetDefaultSystemd)
}

10
pkg/prebuild/build.go
View File

@ -22,6 +22,9 @@ var (
regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`)
regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`)
regProfileHeader = regexp.MustCompile(` {`)
regFullSystemPolicy = util.ToRegexRepl([]string{
`r(PU|U)x,`, `rPx,`,
})
regAbi4To3 = util.ToRegexRepl([]string{ // Currently Abi3 -> Abi4
`abi/3.0`, `abi/4.0`,
`# userns,`, `userns,`,
@ -91,3 +94,10 @@ func BuildABI3(profile string) string {
}
return profile
}
func BuildFullSystemPolicy(profile string) string {
for _, full := range regFullSystemPolicy {
profile = full.Regex.ReplaceAllString(profile, full.Repl)
}
return profile
}