mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 07:54:17 +01:00
109 lines
2.4 KiB
Go
109 lines
2.4 KiB
Go
// apparmor.d - Full set of apparmor profiles
|
|
// Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
package prepare
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/arduino/go-paths-helper"
|
|
"github.com/roddhjav/apparmor.d/pkg/prebuild/cfg"
|
|
"github.com/roddhjav/apparmor.d/pkg/util"
|
|
)
|
|
|
|
type Configure struct {
|
|
cfg.Base
|
|
}
|
|
|
|
func init() {
|
|
RegisterTask(&Configure{
|
|
Base: cfg.Base{
|
|
Keyword: "configure",
|
|
Msg: "Set distribution specificities",
|
|
},
|
|
})
|
|
}
|
|
|
|
func (p Configure) Apply() ([]string, error) {
|
|
res := []string{}
|
|
switch cfg.Distribution {
|
|
case "arch", "opensuse":
|
|
|
|
case "ubuntu":
|
|
debianOverwriteClean()
|
|
if cfg.Overwrite {
|
|
profiles := getOverwriteProfiles()
|
|
debianOverwrite(profiles)
|
|
} else {
|
|
if err := util.CopyTo(cfg.DistDir.Join("ubuntu"), cfg.RootApparmord); err != nil {
|
|
return res, err
|
|
}
|
|
}
|
|
|
|
case "debian", "whonix":
|
|
debianOverwriteClean()
|
|
|
|
// Copy Debian specific abstractions
|
|
if err := util.CopyTo(cfg.DistDir.Join("ubuntu"), cfg.RootApparmord); err != nil {
|
|
return res, err
|
|
}
|
|
|
|
default:
|
|
return []string{}, fmt.Errorf("%s is not a supported distribution", cfg.Distribution)
|
|
|
|
}
|
|
return res, nil
|
|
}
|
|
|
|
// Overwrite upstream profile: rename our profile & hide upstream
|
|
func debianOverwrite(files []string) {
|
|
const ext = ".apparmor.d"
|
|
file, err := paths.New("debian/apparmor.d.hide").Append()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
for _, name := range files {
|
|
origin := cfg.RootApparmord.Join(name)
|
|
dest := cfg.RootApparmord.Join(name + ext)
|
|
if err := origin.Rename(dest); err != nil {
|
|
panic(err)
|
|
}
|
|
if _, err := file.WriteString("/etc/apparmor.d/" + name + "\n"); err != nil {
|
|
panic(err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Clean the debian/apparmor.d.hide file
|
|
func debianOverwriteClean() {
|
|
const debianHide = `# This file is generated by "make", all edit will be lost.
|
|
|
|
/etc/apparmor.d/usr.bin.firefox
|
|
/etc/apparmor.d/usr.sbin.cups-browsed
|
|
/etc/apparmor.d/usr.sbin.cupsd
|
|
/etc/apparmor.d/usr.sbin.rsyslogd
|
|
`
|
|
path := paths.New("debian/apparmor.d.hide")
|
|
if err := path.WriteFile([]byte(debianHide)); err != nil {
|
|
panic(err)
|
|
}
|
|
}
|
|
|
|
// Get the list of upstream profiles to overwrite from dist/overwrite
|
|
func getOverwriteProfiles() []string {
|
|
res := []string{}
|
|
lines, err := cfg.DistDir.Join("overwrite").ReadFileAsLines()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
for _, line := range lines {
|
|
if strings.HasPrefix(line, "#") || line == "" {
|
|
continue
|
|
}
|
|
res = append(res, line)
|
|
}
|
|
return res
|
|
}
|