mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-24 14:06:47 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

build(debian): use hide instead of displace to overwrite upstream profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-10 14:43:43 +00:00
parent b342df689a
commit f5aacbd029
Failed to generate hash of commit
6 changed files with 30 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
debian/apparmor.d.displace vendored
View file

@ -1,5 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This file is automatically edited by `make`, all edit will be lost.

1
debian/apparmor.d.displace-extension vendored
View file

@ -1 +0,0 @@
.apparmor.d

9
debian/apparmor.d.hide vendored
View file

@ -1,8 +1 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
/etc/apparmor.d/usr.bin.firefox
/etc/apparmor.d/usr.sbin.cups-browsed
/etc/apparmor.d/usr.sbin.cupsd
/etc/apparmor.d/usr.sbin.rsyslogd
# This file is generated by "make", all edit will be lost.

2
dists/displace → dists/overwrite
View file

@ -3,7 +3,7 @@
# them by our own.
# File format: one profile name by line.
# This is managed globally in this file and not in debian/apparmor.d.displace as
# This is managed globally in this file and not in debian/apparmor.d.hide as
# it applies to all distributions using apparmor 4.0+
brave

12
pkg/prebuild/prepare.go
View file

@ -131,19 +131,17 @@ func Configure() ([]string, error) {
case "arch", "opensuse":
case "ubuntu":
debianDisplaceClean()
if needDisplace {
filesToDisplace := overwriteProfile(DistDir.Join("displace"))
if err := displaceFiles(filesToDisplace); err != nil {
return res, err
}
debianOverwriteClean()
if overwrite {
profiles := getOverwriteProfiles()
debianOverwrite(profiles)
} else {
if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {
return res, err
}
}
case "debian", "whonix":
debianDisplaceClean()
debianOverwriteClean()
// Copy Debian specific abstractions
if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {

38
pkg/prebuild/tools.go
View file

@ -91,36 +91,44 @@ func copyTo(src *paths.Path, dst *paths.Path) error {
return nil
}
// Displace files in the package sources
func displaceFiles(files []string) error {
// Overwrite upstream profile: rename our profile & hide upstream
func debianOverwrite(files []string) {
const ext = ".apparmor.d"
file, err := paths.New("debian/apparmor.d.hide").Append()
if err != nil {
panic(err)
}
for _, name := range files {
origin := RootApparmord.Join(name)
dest := RootApparmord.Join(name + ext)
if err := origin.Rename(dest); err != nil {
return err
panic(err)
}
file, err := paths.New("debian/apparmor.d.displace").Append()
if err != nil {
return err
}
if _, err := file.WriteString("/etc/apparmor.d/" + name + ext + "\n"); err != nil {
return err
if _, err := file.WriteString("/etc/apparmor.d/" + name + "\n"); err != nil {
panic(err)
}
}
return nil
}
// Clean the debian/displace file
func debianDisplaceClean() {
if _, err := paths.New("debian/apparmor.d.displace").Create(); err != nil {
// Clean the debian/apparmor.d.hide file
func debianOverwriteClean() {
const debianHide = `# This file is generated by "make", all edit will be lost.
/etc/apparmor.d/usr.bin.firefox
/etc/apparmor.d/usr.sbin.cups-browsed
/etc/apparmor.d/usr.sbin.cupsd
/etc/apparmor.d/usr.sbin.rsyslogd
`
path := paths.New("debian/apparmor.d.hide")
if err := path.WriteFile([]byte(debianHide)); err != nil {
panic(err)
}
}
func overwriteProfile(path *paths.Path) []string {
// Get the list of upstream profiles to overwrite from dist/overwrite
func getOverwriteProfiles() []string {
res := []string{}
lines, err := path.ReadFileAsLines()
lines, err := DistDir.Join("overwrite").ReadFileAsLines()
if err != nil {
panic(err)
}