mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-14 23:43:56 +01:00
Alexandre Pujol
parent
7c0863867e
commit
458db2601a
66
cmd/prebuild/build.go
Normal file
66
cmd/prebuild/build.go
Normal file
@ -0,0 +1,66 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/roddhjav/apparmor.d/pkg/aa"
|
||||
"github.com/roddhjav/apparmor.d/pkg/util"
|
||||
)
|
||||
|
||||
var (
|
||||
regABI = regexp.MustCompile(`abi.*,\n`)
|
||||
regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`)
|
||||
regFlag = regexp.MustCompile(`flags=\(([^)]+)\)`)
|
||||
regProfileHeader = regexp.MustCompile(` {`)
|
||||
)
|
||||
|
||||
// Set complain flag on all profiles
|
||||
func BuildComplain(profile string) string {
|
||||
if !Complain {
|
||||
return profile
|
||||
}
|
||||
|
||||
flags := []string{}
|
||||
matches := regFlag.FindStringSubmatch(profile)
|
||||
if len(matches) != 0 {
|
||||
flags = strings.Split(matches[1], ",")
|
||||
if util.InSlice("complain", flags) {
|
||||
return profile
|
||||
}
|
||||
}
|
||||
flags = append(flags, "complain")
|
||||
strFlags := " flags=(" + strings.Join(flags, ",") + ") {"
|
||||
|
||||
// Remove all flags definition, then set manifest' flags
|
||||
profile = regFlag.ReplaceAllLiteralString(profile, "")
|
||||
return regProfileHeader.ReplaceAllLiteralString(profile, strFlags)
|
||||
}
|
||||
|
||||
// Bypass userspace tools restriction
|
||||
func BuildUserspace(profile string) string {
|
||||
p := aa.NewAppArmorProfile(profile)
|
||||
p.ParseVariables()
|
||||
p.ResolveAttachments()
|
||||
att := p.NestAttachments()
|
||||
matches := regAttachments.FindAllString(profile, -1)
|
||||
if len(matches) > 0 {
|
||||
strheader := strings.Replace(matches[0], "@{exec_path}", att, -1)
|
||||
return regAttachments.ReplaceAllLiteralString(profile, strheader)
|
||||
}
|
||||
return profile
|
||||
}
|
||||
|
||||
// Remove abi header for distributions that don't support it
|
||||
func BuildABI(profile string) string {
|
||||
switch Distribution {
|
||||
case "debian", "whonix":
|
||||
return regABI.ReplaceAllLiteralString(profile, "")
|
||||
default:
|
||||
return profile
|
||||
}
|
||||
}
|
||||
112
cmd/prebuild/main.go
Normal file
112
cmd/prebuild/main.go
Normal file
@ -0,0 +1,112 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
"github.com/roddhjav/apparmor.d/pkg/logging"
|
||||
"github.com/roddhjav/apparmor.d/pkg/util"
|
||||
)
|
||||
|
||||
const usage = `prebuild [-h] [--full] [--complain]
|
||||
|
||||
Internal tool to prebuild apparmor.d profiles for a given distribution.
|
||||
|
||||
Options:
|
||||
-h, --help Show this help message and exit.
|
||||
-d, --dist The target Linux distribution.
|
||||
-f, --full Set AppArmor for full system policy.
|
||||
-c, --complain Set complain flag on all profiles.
|
||||
`
|
||||
|
||||
var (
|
||||
help bool
|
||||
Full bool
|
||||
Complain bool
|
||||
Distribution string
|
||||
Root *paths.Path
|
||||
RootApparmord *paths.Path
|
||||
|
||||
// Prepare the build directory with the following tasks
|
||||
prepare = []prepareFunc{Synchronise, Ignore, Merge, Configure, SetFlags, SetFullSystemPolicy}
|
||||
|
||||
// Build the profiles with the following build tasks
|
||||
build = []buildFunc{BuildUserspace, BuildComplain, BuildABI}
|
||||
)
|
||||
|
||||
type prepareFunc func() error
|
||||
type buildFunc func(string) string
|
||||
|
||||
func init() {
|
||||
Root = paths.New(".build")
|
||||
RootApparmord = Root.Join("apparmor.d")
|
||||
Distribution, _ = util.GetSupportedDistribution()
|
||||
flag.BoolVar(&help, "h", false, "Show this help message and exit.")
|
||||
flag.BoolVar(&help, "help", false, "Show this help message and exit.")
|
||||
flag.BoolVar(&Full, "f", false, "Set AppArmor for full system policy.")
|
||||
flag.BoolVar(&Full, "full", false, "Set AppArmor for full system policy.")
|
||||
flag.BoolVar(&Complain, "c", false, "Set complain flag on all profiles.")
|
||||
flag.BoolVar(&Complain, "complain", false, "Set complain flag on all profiles.")
|
||||
}
|
||||
|
||||
// Build the profiles.
|
||||
func buildProfiles() error {
|
||||
files, _ := RootApparmord.ReadDir(paths.FilterOutDirectories())
|
||||
for _, file := range files {
|
||||
if !file.Exist() {
|
||||
continue
|
||||
}
|
||||
content, _ := file.ReadFile()
|
||||
profile := string(content)
|
||||
for _, fct := range build {
|
||||
profile = fct(profile)
|
||||
}
|
||||
if err := file.WriteFile([]byte(profile)); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func aaPrebuild() error {
|
||||
logging.Step("Building apparmor.d profiles for %s.", Distribution)
|
||||
|
||||
for _, fct := range prepare {
|
||||
if err := fct(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if err := buildProfiles(); err != nil {
|
||||
return err
|
||||
}
|
||||
logging.Success("Builded profiles with: ")
|
||||
logging.Bullet("Bypass userspace tools restriction")
|
||||
if Complain {
|
||||
logging.Bullet("Set complain flag on all profiles")
|
||||
}
|
||||
switch Distribution {
|
||||
case "debian", "whonix":
|
||||
logging.Bullet("%s does not support abi 3.0 yet", Distribution)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Usage = func() { fmt.Print(usage) }
|
||||
flag.Parse()
|
||||
if help {
|
||||
flag.Usage()
|
||||
os.Exit(0)
|
||||
}
|
||||
err := aaPrebuild()
|
||||
if err != nil {
|
||||
logging.Fatal(err.Error())
|
||||
}
|
||||
}
|
||||
80
cmd/prebuild/main_test.go
Normal file
80
cmd/prebuild/main_test.go
Normal file
@ -0,0 +1,80 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"os/exec"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func chdirGitRoot() {
|
||||
cmd := exec.Command("git", "rev-parse", "--show-toplevel")
|
||||
out, err := cmd.Output()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
root := string(out)[0 : len(out)-1]
|
||||
if err := os.Chdir(root); err != nil {
|
||||
panic(err)
|
||||
}
|
||||
}
|
||||
|
||||
func Test_aaPrebuild(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
wantErr bool
|
||||
full bool
|
||||
complain bool
|
||||
dist string
|
||||
}{
|
||||
{
|
||||
name: "Build for Archlinux",
|
||||
wantErr: false,
|
||||
full: false,
|
||||
complain: true,
|
||||
dist: "arch",
|
||||
},
|
||||
{
|
||||
name: "Build for Ubuntu",
|
||||
wantErr: false,
|
||||
full: true,
|
||||
complain: false,
|
||||
dist: "ubuntu",
|
||||
},
|
||||
{
|
||||
name: "Build for Debian",
|
||||
wantErr: false,
|
||||
full: true,
|
||||
complain: false,
|
||||
dist: "debian",
|
||||
},
|
||||
{
|
||||
name: "Build for OpenSUSE Tumbleweed",
|
||||
wantErr: false,
|
||||
full: true,
|
||||
complain: true,
|
||||
dist: "opensuse-tumbleweed",
|
||||
},
|
||||
{
|
||||
name: "Build for Fedora",
|
||||
wantErr: true,
|
||||
full: false,
|
||||
complain: false,
|
||||
dist: "fedora",
|
||||
},
|
||||
}
|
||||
chdirGitRoot()
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
Distribution = tt.dist
|
||||
Complain = tt.complain
|
||||
Full = tt.full
|
||||
if err := aaPrebuild(); (err != nil) != tt.wantErr {
|
||||
t.Errorf("aaPrebuild() error = %v, wantErr %v", err, tt.wantErr)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
215
cmd/prebuild/prepare.go
Normal file
215
cmd/prebuild/prepare.go
Normal file
@ -0,0 +1,215 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
"github.com/roddhjav/apparmor.d/pkg/aa"
|
||||
"github.com/roddhjav/apparmor.d/pkg/logging"
|
||||
)
|
||||
|
||||
// Initialize a new clean apparmor.d build directory
|
||||
func Synchronise() error {
|
||||
dirs := paths.PathList{RootApparmord, Root.Join("root")}
|
||||
for _, dir := range dirs {
|
||||
if err := dir.RemoveAll(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
for _, path := range []string{"./apparmor.d", "./root"} {
|
||||
cmd := exec.Command("rsync", "-a", path, Root.String())
|
||||
if err := cmd.Run(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
logging.Success("Initialize a new clean apparmor.d build directory")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Ignore profiles and files as defined in dists/ignore/
|
||||
func Ignore() error {
|
||||
for _, name := range []string{"main.ignore", Distribution + ".ignore"} {
|
||||
path := paths.New("dists/ignore/" + name)
|
||||
if !path.Exist() {
|
||||
continue
|
||||
}
|
||||
lines, _ := path.ReadFileAsLines()
|
||||
for _, line := range lines {
|
||||
if strings.HasPrefix(line, "#") || line == "" {
|
||||
continue
|
||||
}
|
||||
profile := Root.Join(line)
|
||||
if profile.NotExist() {
|
||||
files, err := RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterNames(line))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, path := range files {
|
||||
if err := path.RemoveAll(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if err := profile.RemoveAll(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
logging.Success("Ignore profiles/files in %s", path)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Merge all profiles in a new apparmor.d directory
|
||||
func Merge() error {
|
||||
var dirToMerge = []string{
|
||||
"groups/*/*", "groups",
|
||||
"profiles-*-*/*", "profiles-*",
|
||||
}
|
||||
|
||||
idx := 0
|
||||
for idx < len(dirToMerge)-1 {
|
||||
dirMoved, dirRemoved := dirToMerge[idx], dirToMerge[idx+1]
|
||||
files, err := filepath.Glob(RootApparmord.Join(dirMoved).String())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, file := range files {
|
||||
err := os.Rename(file, RootApparmord.Join(filepath.Base(file)).String())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
files, err = filepath.Glob(RootApparmord.Join(dirRemoved).String())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, file := range files {
|
||||
if err := paths.New(file).RemoveAll(); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
idx = idx + 2
|
||||
}
|
||||
logging.Success("Merge all profiles")
|
||||
return nil
|
||||
}
|
||||
|
||||
// Set the distribution specificities
|
||||
func Configure() error {
|
||||
switch Distribution {
|
||||
case "arch":
|
||||
aa.Tunables["libexec"] = []string{"/{usr/,}lib"}
|
||||
if err := setLibexec(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
case "ubuntu", "opensuse":
|
||||
aa.Tunables["libexec"] = []string{"/{usr/,}libexec"}
|
||||
if err := setLibexec(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
case "debian", "whonix":
|
||||
aa.Tunables["libexec"] = []string{"/{usr/,}libexec"}
|
||||
if err := setLibexec(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
for _, dirname := range []string{"abstractions", "tunables"} {
|
||||
files, err := filepath.Glob("dists/debian/" + dirname + "/*")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
for _, file := range files {
|
||||
path := paths.New(file)
|
||||
if err := path.CopyTo(RootApparmord.Join(dirname, path.Base())); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
default:
|
||||
return fmt.Errorf("%s is not a supported distribution", Distribution)
|
||||
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func setLibexec() error {
|
||||
file, err := RootApparmord.Join("tunables", "etc.d", "apparmor.d").Append()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
_, err = file.WriteString(`@{libexec}=` + aa.Tunables["libexec"][0])
|
||||
return err
|
||||
}
|
||||
|
||||
// Set flags on some profiles according to manifest defined in `dists/flags/`
|
||||
func SetFlags() error {
|
||||
for _, name := range []string{"main.flags", Distribution + ".flags"} {
|
||||
path := paths.New("dists/flags/" + name)
|
||||
if !path.Exist() {
|
||||
continue
|
||||
}
|
||||
lines, _ := path.ReadFileAsLines()
|
||||
for _, line := range lines {
|
||||
if strings.HasPrefix(line, "#") || line == "" {
|
||||
continue
|
||||
}
|
||||
manifest := strings.Split(line, " ")
|
||||
profile := manifest[0]
|
||||
file := RootApparmord.Join(profile)
|
||||
if !file.Exist() {
|
||||
logging.Warning("Profile %s not found", profile)
|
||||
continue
|
||||
}
|
||||
|
||||
// If flags is set, overwrite profile flag
|
||||
if len(manifest) > 1 {
|
||||
flags := " flags=(" + manifest[1] + ") {"
|
||||
content, err := file.ReadFile()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Remove all flags definition, then set manifest' flags
|
||||
res := regFlag.ReplaceAllLiteralString(string(content), "")
|
||||
res = regProfileHeader.ReplaceAllLiteralString(res, flags)
|
||||
if err := file.WriteFile([]byte(res)); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
}
|
||||
logging.Success("Set profile flags from %s", path)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Set AppArmor for full system policy
|
||||
// See https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy
|
||||
// https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads
|
||||
func SetFullSystemPolicy() error {
|
||||
if !Full {
|
||||
return nil
|
||||
}
|
||||
|
||||
for _, name := range []string{"init", "systemd"} {
|
||||
err := paths.New("apparmor.d/groups/_full/" + name).CopyTo(RootApparmord.Join(name))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
logging.Success("Configure AppArmor for full system policy")
|
||||
return nil
|
||||
}
|
||||
107
pkg/aa/profile.go
Normal file
107
pkg/aa/profile.go
Normal file
@ -0,0 +1,107 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
// Warning: this is purposely not using a Yacc parser. Its only aim is to
|
||||
// extract variables and attachments for apparmor.d profile
|
||||
|
||||
package aa
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/exp/maps"
|
||||
)
|
||||
|
||||
var (
|
||||
regVariablesDef = regexp.MustCompile(`@{(.*)}\s*[+=]+\s*(.*)`)
|
||||
regVariablesRef = regexp.MustCompile(`@{([^{}]+)}`)
|
||||
|
||||
// Tunables
|
||||
Tunables = map[string][]string{
|
||||
"libexec": {},
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"user_share_dirs": {"/home/*/.local/share"},
|
||||
"etc_ro": {"/{usr/,}etc/"},
|
||||
}
|
||||
)
|
||||
|
||||
type AppArmorProfile struct {
|
||||
Content string
|
||||
Variables map[string][]string
|
||||
Attachments []string
|
||||
}
|
||||
|
||||
func NewAppArmorProfile(content string) *AppArmorProfile {
|
||||
variables := make(map[string][]string)
|
||||
maps.Copy(variables, Tunables)
|
||||
return &AppArmorProfile{
|
||||
Content: content,
|
||||
Variables: variables,
|
||||
Attachments: []string{},
|
||||
}
|
||||
}
|
||||
|
||||
// ParseVariables extract all variables from the profile
|
||||
func (p *AppArmorProfile) ParseVariables() {
|
||||
matches := regVariablesDef.FindAllStringSubmatch(p.Content, -1)
|
||||
for _, match := range matches {
|
||||
if len(match) > 2 {
|
||||
key := match[1]
|
||||
values := match[2]
|
||||
if _, ok := p.Variables[key]; ok {
|
||||
p.Variables[key] = append(p.Variables[key], strings.Split(values, " ")...)
|
||||
} else {
|
||||
p.Variables[key] = strings.Split(values, " ")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// resolve recursively resolves all variables references
|
||||
func (p *AppArmorProfile) resolve(str string) []string {
|
||||
if strings.Contains(str, "@{") {
|
||||
vars := []string{}
|
||||
match := regVariablesRef.FindStringSubmatch(str)
|
||||
if len(match) > 1 {
|
||||
variable := match[0]
|
||||
varname := match[1]
|
||||
if len(p.Variables[varname]) > 1 {
|
||||
for _, value := range p.Variables[varname] {
|
||||
newVar := strings.ReplaceAll(str, variable, value)
|
||||
vars = append(vars, p.resolve(newVar)...)
|
||||
}
|
||||
} else {
|
||||
newVar := strings.ReplaceAll(str, variable, p.Variables[varname][0])
|
||||
vars = append(vars, p.resolve(newVar)...)
|
||||
}
|
||||
} else {
|
||||
vars = append(vars, str)
|
||||
}
|
||||
return vars
|
||||
}
|
||||
return []string{str}
|
||||
}
|
||||
|
||||
// ResolveAttachments resolve profile attachments defined in exec_path
|
||||
func (p *AppArmorProfile) ResolveAttachments() {
|
||||
for _, exec := range p.Variables["exec_path"] {
|
||||
p.Attachments = append(p.Attachments, p.resolve(exec)...)
|
||||
}
|
||||
}
|
||||
|
||||
// NestAttachments return a nested attachment string
|
||||
func (p *AppArmorProfile) NestAttachments() string {
|
||||
if len(p.Attachments) == 0 {
|
||||
return ""
|
||||
} else if len(p.Attachments) == 1 {
|
||||
return p.Attachments[0]
|
||||
} else {
|
||||
res := []string{}
|
||||
for _, attachment := range p.Attachments {
|
||||
res = append(res, attachment[1:])
|
||||
}
|
||||
return "/{" + strings.Join(res, ",") + "}"
|
||||
}
|
||||
}
|
||||
201
pkg/aa/profile_test.go
Normal file
201
pkg/aa/profile_test.go
Normal file
@ -0,0 +1,201 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package aa
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestNewAppArmorProfile(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
content string
|
||||
want *AppArmorProfile
|
||||
}{
|
||||
{
|
||||
name: "aa",
|
||||
content: "",
|
||||
want: &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: map[string][]string{
|
||||
"libexec": {},
|
||||
"etc_ro": {"/{usr/,}etc/"},
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"user_share_dirs": {"/home/*/.local/share"},
|
||||
},
|
||||
Attachments: []string{},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if got := NewAppArmorProfile(tt.content); !reflect.DeepEqual(got, tt.want) {
|
||||
t.Errorf("NewAppArmorProfile() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_ParseVariables(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
content string
|
||||
want map[string][]string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
content: `@{firefox_name} = firefox{,-esr,-bin}
|
||||
@{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name}
|
||||
@{firefox_config_dirs} = @{HOME}/.mozilla/
|
||||
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
|
||||
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
|
||||
`,
|
||||
want: map[string][]string{
|
||||
"firefox_name": {"firefox{,-esr,-bin}"},
|
||||
"firefox_config_dirs": {"@{HOME}/.mozilla/"},
|
||||
"firefox_lib_dirs": {"/{usr/,}lib{,32,64}/@{firefox_name}", "/opt/@{firefox_name}"},
|
||||
"firefox_cache_dirs": {"@{user_cache_dirs}/mozilla/"},
|
||||
"exec_path": {"/{usr/,}bin/@{firefox_name}", "@{firefox_lib_dirs}/@{firefox_name}"},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "xorg",
|
||||
content: `@{exec_path} = /{usr/,}bin/X
|
||||
@{exec_path} += /{usr/,}bin/Xorg{,.bin}
|
||||
@{exec_path} += /{usr/,}lib/Xorg{,.wrap}
|
||||
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}`,
|
||||
want: map[string][]string{
|
||||
"exec_path": {
|
||||
"/{usr/,}bin/X",
|
||||
"/{usr/,}bin/Xorg{,.bin}",
|
||||
"/{usr/,}lib/Xorg{,.wrap}",
|
||||
"/{usr/,}lib/xorg/Xorg{,.wrap}",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: tt.content,
|
||||
Variables: map[string][]string{},
|
||||
Attachments: []string{},
|
||||
}
|
||||
|
||||
p.ParseVariables()
|
||||
if !reflect.DeepEqual(p.Variables, tt.want) {
|
||||
t.Errorf("AppArmorProfile.ParseVariables() = %v, want %v", p.Variables, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_ResolveAttachments(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
variables map[string][]string
|
||||
want []string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
variables: map[string][]string{
|
||||
"firefox_name": {"firefox{,-esr,-bin}"},
|
||||
"firefox_lib_dirs": {"/{usr/,}/lib{,32,64}/@{firefox_name}", "/opt/@{firefox_name}"},
|
||||
"exec_path": {"/{usr/,}bin/@{firefox_name}", "@{firefox_lib_dirs}/@{firefox_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}bin/firefox{,-esr,-bin}",
|
||||
"/{usr/,}/lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
"/opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "chromium",
|
||||
variables: map[string][]string{
|
||||
"chromium_name": {"chromium"},
|
||||
"chromium_lib_dirs": {"/{usr/,}lib/@{chromium_name}"},
|
||||
"exec_path": {"@{chromium_lib_dirs}/@{chromium_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}lib/chromium/chromium",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "geoclue",
|
||||
variables: map[string][]string{
|
||||
"libexec": {"/{usr/,}libexec"},
|
||||
"exec_path": {"@{libexec}/geoclue", "@{libexec}/geoclue-2.0/demos/agent"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}libexec/geoclue",
|
||||
"/{usr/,}libexec/geoclue-2.0/demos/agent",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "opera",
|
||||
variables: map[string][]string{
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"chromium_name": {"opera{,-beta,-developer}"},
|
||||
"chromium_lib_dirs": {"/{usr/,}lib/@{multiarch}/@{chromium_name}"},
|
||||
"exec_path": {"@{chromium_lib_dirs}/@{chromium_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}lib/*-linux-gnu*/opera{,-beta,-developer}/opera{,-beta,-developer}",
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: tt.variables,
|
||||
Attachments: []string{},
|
||||
}
|
||||
p.ResolveAttachments()
|
||||
if !reflect.DeepEqual(p.Attachments, tt.want) {
|
||||
t.Errorf("AppArmorProfile.ResolveAttachments() = %v, want %v", p.Attachments, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_NestAttachments(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
Attachments []string
|
||||
want string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
Attachments: []string{
|
||||
"/{usr/,}bin/firefox{,-esr,-bin}",
|
||||
"/{usr/,}lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
"/opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
},
|
||||
want: "/{{usr/,}bin/firefox{,-esr,-bin},{usr/,}lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin},opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}}",
|
||||
},
|
||||
{
|
||||
name: "geoclue",
|
||||
Attachments: []string{
|
||||
"/{usr/,}libexec/geoclue",
|
||||
"/{usr/,}libexec/geoclue-2.0/demos/agent",
|
||||
},
|
||||
want: "/{{usr/,}libexec/geoclue,{usr/,}libexec/geoclue-2.0/demos/agent}",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: map[string][]string{},
|
||||
Attachments: tt.Attachments,
|
||||
}
|
||||
if got := p.NestAttachments(); got != tt.want {
|
||||
t.Errorf("AppArmorProfile.NestAttachments() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
47
pkg/util/os.go
Normal file
47
pkg/util/os.go
Normal file
@ -0,0 +1,47 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
)
|
||||
|
||||
var osReleaseFile = "/etc/os-release"
|
||||
|
||||
var firstPartyDists = []string{"arch", "debian", "ubuntu", "opensuse", "whonix"}
|
||||
|
||||
func GetSupportedDistribution() (string, error) {
|
||||
dist, present := os.LookupEnv("DISTRIBUTION")
|
||||
if present {
|
||||
return dist, nil
|
||||
}
|
||||
|
||||
lines, err := paths.New(osReleaseFile).ReadFileAsLines()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
id := ""
|
||||
id_like := ""
|
||||
for _, line := range lines {
|
||||
item := strings.Split(line, "=")
|
||||
if item[0] == "ID" {
|
||||
id = strings.Split(strings.Trim(item[1], "\""), " ")[0]
|
||||
} else if item[0] == "ID_LIKE" {
|
||||
id_like = strings.Split(strings.Trim(item[1], "\""), " ")[0]
|
||||
}
|
||||
}
|
||||
|
||||
if InSlice(id, firstPartyDists) {
|
||||
return id, nil
|
||||
} else if InSlice(id_like, firstPartyDists) {
|
||||
return id_like, nil
|
||||
}
|
||||
return id, fmt.Errorf("%s is not a supported distribution", id)
|
||||
}
|
||||
137
pkg/util/os_test.go
Normal file
137
pkg/util/os_test.go
Normal file
@ -0,0 +1,137 @@
|
||||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
)
|
||||
|
||||
const (
|
||||
Archlinux = `NAME="Arch Linux"
|
||||
PRETTY_NAME="Arch Linux"
|
||||
ID=arch
|
||||
BUILD_ID=rolling
|
||||
ANSI_COLOR="38;2;23;147;209"
|
||||
HOME_URL="https://archlinux.org/"
|
||||
DOCUMENTATION_URL="https://wiki.archlinux.org/"
|
||||
SUPPORT_URL="https://bbs.archlinux.org/"
|
||||
BUG_REPORT_URL="https://bugs.archlinux.org/"
|
||||
PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
|
||||
LOGO=archlinux-logo`
|
||||
|
||||
Ubuntu = `PRETTY_NAME="Ubuntu 22.04.2 LTS"
|
||||
NAME="Ubuntu"
|
||||
VERSION_ID="22.04"
|
||||
VERSION="22.04.2 LTS (Jammy Jellyfish)"
|
||||
VERSION_CODENAME=jammy
|
||||
ID=ubuntu
|
||||
ID_LIKE=debian
|
||||
HOME_URL="https://www.ubuntu.com/"
|
||||
SUPPORT_URL="https://help.ubuntu.com/"
|
||||
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
|
||||
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
|
||||
UBUNTU_CODENAME=jammy`
|
||||
|
||||
Debian = `PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
|
||||
NAME="Debian GNU/Linux"
|
||||
VERSION_ID="11"
|
||||
VERSION="11 (bullseye)"
|
||||
VERSION_CODENAME=bullseye
|
||||
ID=debian
|
||||
HOME_URL="https://www.debian.org/"
|
||||
SUPPORT_URL="https://www.debian.org/support"
|
||||
BUG_REPORT_URL="https://bugs.debian.org/"`
|
||||
|
||||
OpenSUSETumbleweed = `ID="opensuse-tumbleweed"
|
||||
ID_LIKE="opensuse suse"
|
||||
VERSION_ID="20230404"
|
||||
PRETTY_NAME="openSUSE Tumbleweed"
|
||||
ANSI_COLOR="0;32"
|
||||
CPE_NAME="cpe:/o:opensuse:tumbleweed:20230404"
|
||||
BUG_REPORT_URL="https://bugs.opensuse.org"
|
||||
HOME_URL="https://www.opensuse.org/"
|
||||
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
|
||||
LOGO="distributor-logo-Tumbleweed"`
|
||||
|
||||
ArcoLinux = `NAME=ArcoLinux
|
||||
ID=arcolinux
|
||||
ID_LIKE=arch
|
||||
BUILD_ID=rolling
|
||||
ANSI_COLOR="0;36"
|
||||
HOME_URL="https://arcolinux.info/"
|
||||
SUPPORT_URL="https://arcolinuxforum.com/"
|
||||
BUG_REPORT_URL="https://github.com/arcolinux"
|
||||
LOGO=arcolinux-hello`
|
||||
|
||||
Fedora = `NAME="Fedora Linux"
|
||||
VERSION="37 (Workstation Edition)"
|
||||
ID=fedora
|
||||
VERSION_ID=37
|
||||
VERSION_CODENAME=""
|
||||
PLATFORM_ID="platform:f37"
|
||||
PRETTY_NAME="Fedora Linux 37 (Workstation Edition)"
|
||||
ANSI_COLOR="0;38;2;60;110;180"
|
||||
LOGO=fedora-logo-icon`
|
||||
)
|
||||
|
||||
func TestGetSupportedDistribution(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
osRelease string
|
||||
want string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "Archlinux",
|
||||
osRelease: Archlinux,
|
||||
want: "arch",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Ubuntu",
|
||||
osRelease: Ubuntu,
|
||||
want: "ubuntu",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Debian",
|
||||
osRelease: Debian,
|
||||
want: "debian",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "OpenSUSE Tumbleweed",
|
||||
osRelease: OpenSUSETumbleweed,
|
||||
want: "opensuse",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Fedora",
|
||||
osRelease: Fedora,
|
||||
want: "fedora",
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
osReleaseFile = "os-release"
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
err := paths.New(osReleaseFile).WriteFile([]byte(tt.osRelease))
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
got, err := GetSupportedDistribution()
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("ReadLinuxDistribution() error = %v, wantErr %v", err, tt.wantErr)
|
||||
return
|
||||
}
|
||||
if got != tt.want {
|
||||
t.Errorf("ReadLinuxDistribution() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user