mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
apparmor/parser/apparmor.service

29 lines
973 B
SYSTEMD
Raw Normal View History

Add apparmor.service and aa-teardown ... and the apparmor.systemd wrapper. Also add a new 'install-systemd' target to the Makefile to install these systemd-related files on (open)SUSE by default. Other distributions can follow by adding a dependency on 'install-systemd' on their 'install-$DISTRO' target. Note that apparmor.service has ExecStop=/bin/true to avoid that running processes get unconfined if someone accidently types systemctl restart apparmor (instead of using "reload") Use aa-teardown if you really want to unload all profiles. The files in this commit are used in openSUSE since a while, and also in Arch Linux. BTW: The condition on var-lib.mount is because openSUSE uses /var/lib/apparmor/cache/ - but with the changed btrfs layout on openSUSE, maybe I'll change that to /var/cache/apparmor/ which is a) used by Debian and b) more sane
2018-03-18 17:50:57 +01:00
[Unit]
Description=Load AppArmor profiles
DefaultDependencies=no
Before=sysinit.target
After=systemd-journald-audit.socket
Adjust cache paths in apparmor.service The initial apparmor.service assumed the profile cache is in /var/lib/apparmor/ which was an openSUSE-specific path that was chosen for historical reasons, but was far from perfect. In the meantime, the profile cache moved to /var/cache/apparmor/ and the read-only/packaged version was added in /usr/share/apparmor/cache/ This commit adjusts apparmor.service to use these paths.
2018-06-16 23:14:19 +02:00
# profile cache: /var/cache/apparmor/ and /usr/share/apparmor/cache/
After=var.mount var-cache.mount usr.mount usr-share.mount
Add apparmor.service and aa-teardown ... and the apparmor.systemd wrapper. Also add a new 'install-systemd' target to the Makefile to install these systemd-related files on (open)SUSE by default. Other distributions can follow by adding a dependency on 'install-systemd' on their 'install-$DISTRO' target. Note that apparmor.service has ExecStop=/bin/true to avoid that running processes get unconfined if someone accidently types systemctl restart apparmor (instead of using "reload") Use aa-teardown if you really want to unload all profiles. The files in this commit are used in openSUSE since a while, and also in Arch Linux. BTW: The condition on var-lib.mount is because openSUSE uses /var/lib/apparmor/cache/ - but with the changed btrfs layout on openSUSE, maybe I'll change that to /var/cache/apparmor/ which is a) used by Debian and b) more sane
2018-03-18 17:50:57 +01:00
ConditionSecurity=apparmor
Add Documentation=... to apparmor.service This is taken from Debian's apparmor.service, and is the first (and easiest) step to get the upstream and Debian file closer.
2023-10-29 10:49:33 +01:00
Documentation=man:apparmor(7)
Documentation=https://gitlab.com/apparmor/apparmor/wikis/home/
Add apparmor.service and aa-teardown ... and the apparmor.systemd wrapper. Also add a new 'install-systemd' target to the Makefile to install these systemd-related files on (open)SUSE by default. Other distributions can follow by adding a dependency on 'install-systemd' on their 'install-$DISTRO' target. Note that apparmor.service has ExecStop=/bin/true to avoid that running processes get unconfined if someone accidently types systemctl restart apparmor (instead of using "reload") Use aa-teardown if you really want to unload all profiles. The files in this commit are used in openSUSE since a while, and also in Arch Linux. BTW: The condition on var-lib.mount is because openSUSE uses /var/lib/apparmor/cache/ - but with the changed btrfs layout on openSUSE, maybe I'll change that to /var/cache/apparmor/ which is a) used by Debian and b) more sane
2018-03-18 17:50:57 +01:00
[Service]
Type=oneshot
ExecStart=/lib/apparmor/apparmor.systemd reload
ExecReload=/lib/apparmor/apparmor.systemd reload
# systemd maps 'restart' to 'stop; start' which means removing AppArmor confinement
# from running processes (and not being able to re-apply it later).
# Upstream systemd developers refused to implement an option that allows overriding
# this behaviour, therefore we have to make ExecStop a no-op to error out on the
# safe side.
#
# If you really want to unload all AppArmor profiles, run aa-teardown
ExecStop=/bin/true
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
Reference in a new issue Copy permalink