mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-25 06:27:49 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

build(debian): use hide instead of displace to overwrite upstream profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-10 14:43:43 +00:00
parent b342df689a
commit f5aacbd029
Failed to generate hash of commit
6 changed files with 30 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
debian/apparmor.d.displace vendored
View file

@ -1,5 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This file is automatically edited by `make`, all edit will be lost.

1
debian/apparmor.d.displace-extension vendored
View file

@ -1 +0,0 @@
.apparmor.d

9
debian/apparmor.d.hide vendored
View file

@ -1,8 +1 @@
# apparmor.d - Full set of apparmor profiles # This file is generated by "make", all edit will be lost.
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
/etc/apparmor.d/usr.bin.firefox
/etc/apparmor.d/usr.sbin.cups-browsed
/etc/apparmor.d/usr.sbin.cupsd
/etc/apparmor.d/usr.sbin.rsyslogd

2
dists/displace → dists/overwrite
View file

@ -3,7 +3,7 @@
# them by our own. # them by our own.
# File format: one profile name by line. # File format: one profile name by line.
# This is managed globally in this file and not in debian/apparmor.d.displace as # This is managed globally in this file and not in debian/apparmor.d.hide as
# it applies to all distributions using apparmor 4.0+ # it applies to all distributions using apparmor 4.0+
brave brave

12
pkg/prebuild/prepare.go
View file

@ -131,19 +131,17 @@ func Configure() ([]string, error) {
case "arch", "opensuse": case "arch", "opensuse":
case "ubuntu": case "ubuntu":
debianDisplaceClean() debianOverwriteClean()
if needDisplace { if overwrite {
filesToDisplace := overwriteProfile(DistDir.Join("displace")) profiles := getOverwriteProfiles()
if err := displaceFiles(filesToDisplace); err != nil { debianOverwrite(profiles)
return res, err
}
} else { } else {
if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil { if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {
return res, err return res, err
} }
} }
case "debian", "whonix": case "debian", "whonix":
debianDisplaceClean() debianOverwriteClean()
// Copy Debian specific abstractions // Copy Debian specific abstractions
if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil { if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {

38
pkg/prebuild/tools.go
View file

@ -91,36 +91,44 @@ func copyTo(src *paths.Path, dst *paths.Path) error {
return nil return nil
} }
// Displace files in the package sources // Overwrite upstream profile: rename our profile & hide upstream
func displaceFiles(files []string) error { func debianOverwrite(files []string) {
const ext = ".apparmor.d" const ext = ".apparmor.d"
file, err := paths.New("debian/apparmor.d.hide").Append()
if err != nil {
panic(err)
}
for _, name := range files { for _, name := range files {
origin := RootApparmord.Join(name) origin := RootApparmord.Join(name)
dest := RootApparmord.Join(name + ext) dest := RootApparmord.Join(name + ext)
if err := origin.Rename(dest); err != nil { if err := origin.Rename(dest); err != nil {
return err panic(err)
} }
file, err := paths.New("debian/apparmor.d.displace").Append() if _, err := file.WriteString("/etc/apparmor.d/" + name + "\n"); err != nil {
if err != nil { panic(err)
return err
}
if _, err := file.WriteString("/etc/apparmor.d/" + name + ext + "\n"); err != nil {
return err
} }
} }
return nil
} }
// Clean the debian/displace file // Clean the debian/apparmor.d.hide file
func debianDisplaceClean() { func debianOverwriteClean() {
if _, err := paths.New("debian/apparmor.d.displace").Create(); err != nil { const debianHide = `# This file is generated by "make", all edit will be lost.
/etc/apparmor.d/usr.bin.firefox
/etc/apparmor.d/usr.sbin.cups-browsed
/etc/apparmor.d/usr.sbin.cupsd
/etc/apparmor.d/usr.sbin.rsyslogd
`
path := paths.New("debian/apparmor.d.hide")
if err := path.WriteFile([]byte(debianHide)); err != nil {
panic(err) panic(err)
} }
} }
func overwriteProfile(path *paths.Path) []string { // Get the list of upstream profiles to overwrite from dist/overwrite
func getOverwriteProfiles() []string {
res := []string{} res := []string{}
lines, err := path.ReadFileAsLines() lines, err := DistDir.Join("overwrite").ReadFileAsLines()
if err != nil { if err != nil {
panic(err) panic(err)
} }