chore: cosmetic & fix.

pkg/aa/preamble.go

@@ -6,24 +6,21 @@ package aa
 
 import (
 	"slices"
+)
 
 const (
 	tokABI      = "abi"
 	tokALIAS    = "alias"
 	tokINCLUDE  = "include"
 	tokIFEXISTS = "if exists"
+	tokVARIABLE = "@{"
+	tokCOMMENT  = "#"
 )
 
 type Comment struct {
 	RuleBase
 }
 
-func newCommentFromRule(rule rule) (Rule, error) {
-	base := newRuleFromRule(rule)
-	base.IsLineRule = true
-	return &Comment{RuleBase: base}, nil
-}
-
 func (r *Comment) Less(other any) bool {
 	return false
 }
@@ -152,8 +149,6 @@ type Variable struct {
 	Define bool
 }
 
-}
-
 func (r *Variable) Less(other any) bool {
 	o, _ := other.(*Variable)
 	if r.Name != o.Name {

pkg/aa/rules.go

@@ -62,6 +62,17 @@ func (r Rules) GetVariables() []*Variable {
 	return res
 }
 
+func (r Rules) GetIncludes() []*Include {
+	res := make([]*Include, 0)
+	for _, rule := range r {
+		switch rule.(type) {
+		case *Include:
+			res = append(res, rule.(*Include))
+		}
+	}
+	return res
+}
+
 // Must is a helper that wraps a call to a function returning (any, error) and
 // panics if the error is non-nil.
 func Must[T any](v T, err error) T {

pkg/aa/template.go

@@ -8,7 +8,6 @@ import (
 	"embed"
 	"fmt"
 	"reflect"
-	"slices"
 	"strings"
 	"text/template"
 )
@@ -36,11 +35,23 @@ var (
 
 	// The apparmor templates
 	tmpl = generateTemplates([]string{
-		"apparmor", tokPROFILE, "rules", // Global templates
+		// Global templates
-		tokINCLUDE, tokRLIMIT, tokCAPABILITY, tokNETWORK,
+		"apparmor",
-		tokMOUNT, tokPIVOTROOT, tokCHANGEPROFILE, tokSIGNAL,
+		tokPROFILE,
-		tokPTRACE, tokUNIX, tokUSERNS, tokIOURING,
+		"rules",
-		tokDBUS, "file", "variable",
+
+		// Preamble templates
+		tokABI,
+		tokALIAS,
+		tokINCLUDE,
+		"variable",
+		"comment",
+
+		// Rules templates
+		tokALL, tokRLIMIT, tokUSERNS, tokCAPABILITY, tokNETWORK,
+		tokMOUNT, tokREMOUNT, tokUMOUNT, tokPIVOTROOT, tokCHANGEPROFILE,
+		tokMQUEUE, tokIOURING, tokUNIX, tokPTRACE, tokSIGNAL, tokDBUS,
+		tokFILE, tokLINK,
 	})
 
 	// convert apparmor requested mask to apparmor access mode
@@ -72,6 +83,7 @@ var (
 		"unix",
 		"dbus",
 		"file",
+		"link",
 		"profile",
 		"include_if_exists",
 	}