Rethink the configure process.

.github/workflows/main.yml

@@ -30,8 +30,3 @@ jobs:
 
       - name: Show AppArmor log
         run: sudo aa-log
-
-      - name: Verify apparmor status
-        run: |
-          aa-status
-          sudo aa-status

PKGBUILD

@@ -20,7 +20,7 @@ prepare() {
   git clone "$startdir" "$srcdir/$pkgname"
   cd "$srcdir/$pkgname"
 
-  ./configure --distribution=archlinux
+  ./configure
 }
 
 build() {

configure

@@ -3,10 +3,14 @@
 # Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only
 
+DISTRIBUTION="$(lsb_release --id --short)"
+readonly DISTRIBUTION="${DISTRIBUTION,,}"
 readonly ROOT=.build
 
 _die()  { printf 'Error: %s\n' "$*" >&2 && exit 1; }
 _warning() { printf '   Warning: %s\n' "$*" >&2; }
+_title() { printf '%s\n' "$*" >&2; }
+_msg() { printf ' - %s\n' "$*" >&2; }
 
 # Displace files in the package sources
 # $@ List of files to displace
@@ -18,61 +22,63 @@ _displace_files() {
 
 # Initialize a new clean apparmor.d build directory
 initialize() {
-	rm -rf "${ROOT:?}" && rsync -a --exclude=.git . "$ROOT"
+	rm -rf "${ROOT:?}"
+	rsync -a ./apparmor.d "$ROOT"
+	rsync -a ./root "$ROOT"
 }
 
-# Ignore profiles in profiles.ignore
+# Ignore profiles and files as defined in dists/ignore/
 ignore() {
-	echo "  Ignore profiles in profiles.ignore."
+	for name in main.ignore "$DISTRIBUTION.ignore"; do
+		_msg "Ignore profiles/files in dists/ignore/$name"
 		while read -r profile; do
 			[[ "$profile" =~ ^\# ]] && continue
-		if [[ "$profile" == */ ]]; then
-			find "$ROOT/apparmor.d" -iname "${profile////}" -type d -exec rm -r {} \; 
+			if [[ -e "$profile" ]]; then
+				rm -r "${ROOT:?}/$profile"
 			else
 				find "$ROOT/apparmor.d" -iname "$profile" -type f -exec rm {} \;
 			fi
-    done <profiles.ignore
+		done <"dists/ignore/$name"
+	done
+}
+
+# Synchronise all profiles in a new apparmor.d directory.
+synchronise() {
+	_msg "Synchronise all profiles."
+	mv "${ROOT:?}/apparmor.d/groups/"*/* "${ROOT:?}/apparmor.d/"
+	rm -rf "${ROOT:?}/apparmor.d/groups/"
+	mv "${ROOT:?}/apparmor.d/profiles-"*-*/* "${ROOT:?}/apparmor.d/"
+	rm -rf "${ROOT:?}/apparmor.d/profiles-"*
 }
 
 # Set the distribution specificities
 configure() {
 	case "$DISTRIBUTION" in
-		archlinux)
-			echo "  Ignore non Archlinux profiles."
-			rm -rf \
-				"${ROOT:?}"/apparmor.d/abstractions/apt-common \
-				"${ROOT:?}"/apparmor.d/groups/apt \
-				"${ROOT:?}"/apparmor.d/groups/cron \
-				"${ROOT:?}"/root/etc/initramfs-tools
-
-			echo "  Configure libexec."
+		arch)
+			_msg "Configure libexec."
 			sed -i -e '/Debian/d' "$ROOT/apparmor.d/tunables/extend"
 
 			;;
 
-		debian)
-			echo "  Ignore non Debian profiles."
-			rm -rf \
-				"${ROOT:?}"/apparmor.d/groups/pacman \
-				"${ROOT:?}"/root/usr/share/libalpm/hooks/apparmor.hook
-
-			echo "  Configure libexec."
+		debian|ubuntu)
+			_msg "Configure libexec."
 			sed -i -e '/Archlinux/d' "$ROOT/apparmor.d/tunables/extend"
 
-			echo "  Debian does not support abi 3.0 yet."
+			_msg "$DISTRIBUTION does not support abi 3.0 yet."
 			find "$ROOT/apparmor.d" -type f -exec sed -e '/abi /d' -i {} \;
 
-			echo "  Debian does not have etc tunable."
+			_msg "$DISTRIBUTION does not have etc tunable."
 			sed -i -e '/etc/d' "$ROOT/apparmor.d/tunables/global"
 
-			echo "  Displace overwritten files."
+			_msg "Displace overwritten files."
 			_displace_files apparmor.d/tunables/global apparmor.d/tunables/xdg-user-dirs
 
-			if [[ "$(lsb_release -is)" == "Ubuntu" ]]; then
-				echo "  Ubuntu LTS compatibility."
+			if [[ "$DISTRIBUTION" == "ubuntu" ]]; then
+				_msg "Ubuntu LTS compatibility."
 				echo "@{run}=/run/ /var/run/" > "$ROOT/apparmor.d/tunables/run"
 				sed -i -e '/capability bpf/d' -e '/capability perfmon/d' \
-					"$ROOT/apparmor.d/groups/virt/libvirtd"
+					"$ROOT/apparmor.d/libvirtd"
+				cp -a dists/ubuntu/abstractions/* $ROOT/apparmor.d/abstractions
 			fi
 
 			;;
@@ -81,20 +87,11 @@ configure() {
 	esac
 }
 
-# Synchronise all profile in a new apparmor.d directory.
-synchronise() {
-	echo "Synchronise all profiles."
-	mv "${ROOT:?}/apparmor.d/groups/"*/* "${ROOT:?}/apparmor.d/"
-	rm -rf "${ROOT:?}/apparmor.d/groups/"
-	for dir in profiles-a-f profiles-g-l profiles-m-r profiles-s-z; do
-		mv "${ROOT:?}/apparmor.d/$dir/"* "${ROOT:?}/apparmor.d/"
-		rm -rf "${ROOT:?}/apparmor.d/$dir"
-	done
-}
-
 # Set flags on some profile
-setflags() {
-	echo "Set apparmor flags from profiles.flags"
+flags() {
+	for name in main.flags "$DISTRIBUTION.flags"; do
+		_msg "Set profiles flags from dists/flags/$name"
+
 		while read -r profile; do
 			IFS=' ' read -r -a manifest <<< "$profile"
 			profile="${manifest[0]}" flags="${manifest[1]}"
@@ -114,18 +111,13 @@ setflags() {
 					-i "$path"
 			fi
 
-    done <profiles.flags
-
-}
-
-# Set AppArmor for full system policy
-full() {
-	echo WIP
+		done <"dists/flags/$name"
+	done
 }
 
 # Set complain flag on all profile (Dev only)
 complain() {
-	echo "Set complain flag on all profile"
+	_msg "Set complain flag on all profiles"
 	for path in "${ROOT:?}/apparmor.d/"*; do
 		[[ -d "$path" ]] && continue
 		flags="$(grep -o -m 1 'flags=(.*)' "$path" | cut -d '(' -f2 | cut -d ')' -f1)"
@@ -138,13 +130,18 @@ complain() {
 	echo
 }
 
+# Set AppArmor for full system policy
+# See https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy
+full() {
+	cp -a apparmor.d/groups/_full/* "$ROOT/apparmor.d/"
+}
+
 # Print help message
 cmd_help() {
 	cat <<-_EOF
 	./configure [options] - Configure the apparmor.d package
 
 	Options:
-	    -d DIST, --dist=DIST Set the target Linux distribution: archlinux, debian
 	    -f, --full      Set AppArmor for full system policy
 	    -c, --complain  Set complain flag on all profiles
 	    -h, --help      Print this help message and exit
@@ -152,27 +149,31 @@ cmd_help() {
 }
 
 main() {
-	local opts err full=0 complain=0
-	small_arg="d:cfh"
-	long_arg="dist:,complain,full,help"
+	local opts err
+	FULL=0
+	COMPLAIN=0
+	small_arg="cfh"
+	long_arg="complain,full,help"
 	opts="$(getopt -o $small_arg -l $long_arg -n "$PROGRAM" -- "$@")"
 	err=$?
 	eval set -- "$opts"
 	while true; do case $1 in
-		-d|--dist) DISTRIBUTION="$2"; shift 2 ;;
-		-f|--full) full=1; shift ;; 
-		-c|--complain) complain=1; shift ;;
+		-f|--full) FULL=1; shift ;; 
+		-c|--complain) COMPLAIN=1; shift ;;
 		-h|--help) shift; cmd_help; exit 0 ;;
 		--) shift; break ;;
 	esac done
 	[[ $err -ne 0 ]] && { cmd_help; exit 1; }
 
-	echo "Set the configuration for $DISTRIBUTION."
+	_title "Set the configuration for $DISTRIBUTION."
 	initialize || _die "initializing build directory"
 	ignore || _die "removing ignored profiles"
-	configure || _die "configuring distributaion"
 	synchronise || _die "merging profiles"
-	setflags || _die "settings flags"
+	configure || _die "configuring distributaion"
+	flags || _die "settings flags"
+	[[ "$COMPLAIN" == 1 ]] && complain
+	[[ "$FULL" == 1 ]] && full
+	return 0
 }
 
 main "$@"

debian/rules

@@ -5,19 +5,19 @@
 
 %:
 	dh $@ --with=config-package
-
-override_dh_auto_configure:
-	./configure --dist=debian
 	export CGO_CPPFLAGS="${CPPFLAGS}"
 	export CGO_CFLAGS="${CFLAGS}"
 	export CGO_CXXFLAGS="${CXXFLAGS}"
 	export CGO_LDFLAGS="${LDFLAGS}"
 	export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
-	go build -o .build/ ./cmd/aa-log
+	go build ./cmd/aa-log
+
+override_dh_auto_configure:
+	./configure
 
 override_dh_install:
 	mv systemd system
 	find system -type f -exec \
 		install -Dm0644 {} $$(pwd)/debian/apparmor.d/usr/lib/systemd/{}.d/apparmor.conf \; 
-	install -Dm755 .build/aa-log $$(pwd)/debian/apparmor.d/usr/bin/aa-log
+	install -Dm755 aa-log $$(pwd)/debian/apparmor.d/usr/bin/aa-log
 	dh_install

dists/flags/arch.flags

@@ -0,0 +1,16 @@
+arch-audit complain
+archlinux-java complain
+aurpublish complain
+pacman complain
+pacman-conf attach_disconnected,complain
+pacman-hook-dconf complain
+pacman-hook-depmod complain
+pacman-hook-dkms complain
+pacman-hook-fontconfig complain
+pacman-hook-gio complain
+pacman-hook-gtk complain
+pacman-hook-mkinitcpio-install attach_disconnected,complain
+pacman-hook-mkinitcpio-remove complain
+pacman-hook-perl complain
+pacman-hook-systemd complain
+pacman-key complain

dists/flags/debian.flags

@@ -0,0 +1,22 @@
+dhclient complain
+dhclient-script complain
+dpkg complain
+dpkg-architecture complain
+dpkg-buildflags complain
+dpkg-checkbuilddeps complain
+dpkg-deb complain
+dpkg-divert complain
+dpkg-genbuildinfo complain
+dpkg-genchanges complain
+dpkg-preconfigure complain
+dpkg-query complain
+dpkg-split complain
+dpkg-status complain
+dpkg-trigger complain
+dpkg-vendor complain
+ifup complain
+macchanger complain
+resolvconf complain
+run-parts complain
+unattended-upgrade complain
+unattended-upgrade-shutdown attach_disconnected,complain

dists/flags/main.flags

@@ -1,8 +1,9 @@
+# Common profile flags definition for all distributions
+# One profile by line using the format: '<profile> <flags>'
+
 acpid attach_disconnected,complain
 adb complain
-aa-status
 agetty complain
-arch-audit complain
 at-spi-bus-launcher attach_disconnected
 auditd complain
 badblocks complain
@@ -37,9 +38,6 @@ fsck-ext4 complain
 fuse-overlayfs complain
 fusermount complain
 gdisk complain
-gdm attach_disconnected,complain
-gdm-session-worker attach_disconnected,complain
-gdm-wayland-session complain
 gdm-x-session attach_disconnected,complain
 gdm-xsession complain
 git complain
@@ -98,19 +96,6 @@ obexfs complain
 obexpush-atd complain
 obexpushd complain
 oomctl complain
-pacman complain
-pacman-conf attach_disconnected,complain
-pacman-hook-dconf complain
-pacman-hook-depmod complain
-pacman-hook-dkms complain
-pacman-hook-fontconfig complain
-pacman-hook-gio complain
-pacman-hook-gtk complain
-pacman-hook-mkinitcpio-install complain
-pacman-hook-mkinitcpio-remove complain
-pacman-hook-perl complain
-pacman-hook-systemd complain
-pacman-key complain
 pass complain
 pass-import complain
 pinentry-gtk-2 complain
@@ -178,7 +163,7 @@ systemd-socket-activate complain
 systemd-socket-proxyd complain
 systemd-stdio-bridge complain
 systemd-sulogin-shell complain
-systemd-sysctl complain
+systemd-sysctl attach_disconnected,complain
 systemd-sysext complain
 systemd-sysusers attach_disconnected,complain
 systemd-time-wait-sync complain

dists/flags/ubuntu.flags

@@ -0,0 +1 @@
+aa-status complain

dists/ignore/arch.ignore

@@ -0,0 +1,3 @@
+apparmor.d/abstractions/apt-common
+apparmor.d/groups/apt
+apparmor.d/groups/cron

dists/ignore/debian.ignore

@@ -0,0 +1,2 @@
+apparmor.d/groups/pacman
+root/usr/share/libalpm/hooks/apparmor.hook

dists/ignore/main.ignore

@@ -0,0 +1,13 @@
+# Common ignore file for all distributions
+# One ignore by line. Can be a profile name or a directory to ignore
+
+# Contains profile for full system confinement, only included when ./configure
+# is given the --full option
+apparmor.d/groups/_full
+
+apparmor.d/groups/apps
+
+anki
+torbrowser.Browser.firefox
+torbrowser.Browser.plugin-container
+torbrowser.Tor.tor

dists/ignore/ubuntu.ignore

@@ -0,0 +1,3 @@
+apparmor.d/groups/pacman
+apparmor.systemd
+root/usr/share/libalpm/hooks/apparmor.hook

dists/ubuntu/abstractions/dbus-network-manager-strict

@@ -1,7 +1,5 @@
 # vim:syntax=apparmor
 
-  abi <abi/3.0>,
-
   dbus send
        bus=system
        path=/org/freedesktop/NetworkManager

dists/ubuntu/abstractions/exo-open

@@ -1,7 +1,5 @@
 # vim:syntax=apparmor
 
-  abi <abi/3.0>,
-
 # This abstraction is designed to be used in a child profile to limit what
 # confined application can invoke via exo-open helper.
 #

profiles.ignore

@@ -1,6 +0,0 @@
-anki
-apps/
-apparmor.systemd
-torbrowser.Browser.firefox
-torbrowser.Browser.plugin-container
-torbrowser.Tor.tor