mirror of
https://gitlab.com/apparmor/apparmor
synced 2025-08-30 22:05:27 +00:00
Make rc.apparmor.functions suitable for Debian and Ubuntu
Debian and Ubuntu currently don't use rc.apparmor.functions. They have their own code for loading profiles, their own initscript and systemd unit. As discussed initially on https://bugs.debian.org/870697 and https://salsa.debian.org/apparmor-team/apparmor/merge_requests/6#note_29153, to fix that without introducing regressions on Debian/Ubuntu, we need to upstream a number of changes, which is what this branch is about. PR: https://gitlab.com/apparmor/apparmor/merge_requests/252 Acked-by: Christian Boltz <apparmor@cboltz.de> Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
John Johansen
@@ -1,7 +1,7 @@
|
||||
#!/bin/sh
|
||||
# ----------------------------------------------------------------------
|
||||
# Copyright (c) 1999-2008 NOVELL (All rights reserved)
|
||||
# Copyright (c) 2009-2012 Canonical Ltd. (All rights reserved)
|
||||
# Copyright (c) 2009-2018 Canonical Ltd. (All rights reserved)
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
@@ -31,28 +31,23 @@
|
||||
|
||||
# Some nice defines that we use
|
||||
|
||||
CONFIG_DIR=/etc/apparmor
|
||||
MODULE=apparmor
|
||||
if [ -f "${CONFIG_DIR}/${MODULE}.conf" ] ; then
|
||||
APPARMOR_CONF="${CONFIG_DIR}/${MODULE}.conf"
|
||||
else
|
||||
aa_log_warning_msg "Unable to find config file in ${CONFIG_DIR}, installation problem?"
|
||||
fi
|
||||
|
||||
if [ -f "${APPARMOR_CONF}" ] ; then
|
||||
#parse the conf file to see what we should do
|
||||
. "${APPARMOR_CONF}"
|
||||
fi
|
||||
|
||||
PARSER=/sbin/apparmor_parser
|
||||
|
||||
# APPARMOR_DIR might be defined in apparmor.conf
|
||||
if [ -d "${APPARMOR_DIR}" ] ; then
|
||||
PROFILE_DIR=${APPARMOR_DIR}
|
||||
elif [ -d /etc/apparmor.d ] ; then
|
||||
PROFILE_DIR=/etc/apparmor.d
|
||||
PARSER_OPTS=
|
||||
# Suppress warnings when booting in quiet mode
|
||||
if [ "${QUIET:-no}" = yes ] || [ "${quiet:-n}" = y ]; then
|
||||
PARSER_OPTS="$PARSER_OPTS --quiet"
|
||||
fi
|
||||
|
||||
if [ -d /etc/apparmor.d ] ; then
|
||||
PROFILE_DIRS=/etc/apparmor.d
|
||||
else
|
||||
aa_log_warning_msg "Unable to find profiles directory, installation problem?"
|
||||
fi
|
||||
ADDITIONAL_PROFILE_DIR=/var/lib/snapd/apparmor/profiles
|
||||
if [ -d "$ADDITIONAL_PROFILE_DIR" ]; then
|
||||
PROFILE_DIRS="${PROFILE_DIRS} ${ADDITIONAL_PROFILE_DIR}"
|
||||
fi
|
||||
ABSTRACTIONS="-I${PROFILE_DIR}"
|
||||
AA_STATUS=/usr/sbin/aa-status
|
||||
SECURITYFS=/sys/kernel/security
|
||||
|
||||
@@ -61,17 +56,54 @@ STATUS=0
|
||||
|
||||
# Test if the apparmor "module" is present.
|
||||
is_apparmor_present() {
|
||||
local modules=$1
|
||||
shift
|
||||
[ -d /sys/module/apparmor ]
|
||||
}
|
||||
|
||||
while [ $# -gt 0 ] ; do
|
||||
modules="$modules|$1"
|
||||
shift
|
||||
done
|
||||
# Checks to see if the current container is capable of having internal AppArmor
|
||||
# profiles that should be loaded. Callers of this function should have already
|
||||
# verified that they're running inside of a container environment with
|
||||
# something like `systemd-detect-virt --container`.
|
||||
#
|
||||
# The only known container environments capable of supporting internal policy
|
||||
# are LXD and LXC environment.
|
||||
#
|
||||
# Returns 0 if the container environment is capable of having its own internal
|
||||
# policy and non-zero otherwise.
|
||||
#
|
||||
# IMPORTANT: This function will return 0 in the case of a non-LXD/non-LXC
|
||||
# system container technology being nested inside of a LXD/LXC container that
|
||||
# utilized an AppArmor namespace and profile stacking. The reason 0 will be
|
||||
# returned is because .ns_stacked will be "yes" and .ns_name will still match
|
||||
# "lx[dc]-*" since the nested system container technology will not have set up
|
||||
# a new AppArmor profile namespace. This will result in the nested system
|
||||
# container's boot process to experience failed policy loads but the boot
|
||||
# process should continue without any loss of functionality. This is an
|
||||
# unsupported configuration that cannot be properly handled by this function.
|
||||
is_container_with_internal_policy() {
|
||||
local ns_stacked_path="${SFS_MOUNTPOINT}/.ns_stacked"
|
||||
local ns_name_path="${SFS_MOUNTPOINT}/.ns_name"
|
||||
local ns_stacked
|
||||
local ns_name
|
||||
|
||||
[ $? -ne 0 -a -d /sys/module/apparmor ]
|
||||
if ! [ -f "$ns_stacked_path" ] || ! [ -f "$ns_name_path" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
return $?
|
||||
read -r ns_stacked < "$ns_stacked_path"
|
||||
if [ "$ns_stacked" != "yes" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
# LXD and LXC set up AppArmor namespaces starting with "lxd-" and
|
||||
# "lxc-", respectively. Return non-zero for all other namespace
|
||||
# identifiers.
|
||||
read -r ns_name < "$ns_name_path"
|
||||
if [ "${ns_name#lxd-*}" = "$ns_name" ] && \
|
||||
[ "${ns_name#lxc-*}" = "$ns_name" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
# This set of patterns to skip needs to be kept in sync with
|
||||
@@ -85,7 +117,6 @@ skip_profile() {
|
||||
"${profile%.rpmsave}" != "${profile}" -o \
|
||||
"${profile%.orig}" != "${profile}" -o \
|
||||
"${profile%.rej}" != "${profile}" -o \
|
||||
-e "${PROFILE_DIR}/disable/`basename ${profile}`" -o \
|
||||
"${profile%\~}" != "${profile}" ] ; then
|
||||
return 1
|
||||
fi
|
||||
@@ -106,30 +137,68 @@ skip_profile() {
|
||||
return 0
|
||||
}
|
||||
|
||||
force_complain() {
|
||||
local profile=$1
|
||||
__parse_profiles_dir() {
|
||||
local parser_cmd="$1"
|
||||
local profile_dir="$2"
|
||||
local status=0
|
||||
|
||||
# if profile not in complain mode
|
||||
if ! egrep -q "^/.*[ \t]+flags[ \t]*=[ \t]*\([ \t]*complain[ \t]*\)[ \t]+{" $profile ; then
|
||||
local link="${PROFILE_DIR}/force-complain/`basename ${profile}`"
|
||||
if [ -e "$link" ] ; then
|
||||
aa_log_warning_msg "found $link, forcing complain mode"
|
||||
return 0
|
||||
fi
|
||||
if [ ! -d "$profile_dir" ]; then
|
||||
aa_log_failure_msg "Profile directory not found: $profile_dir"
|
||||
return 1
|
||||
fi
|
||||
|
||||
return 1
|
||||
if [ -z "$(ls $profile_dir/)" ]; then
|
||||
aa_log_failure_msg "No profiles found in $profile_dir"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Note: the parser automatically skips files that match skip_profile()
|
||||
# when we pass it a directory, but not when we pass it an individual
|
||||
# profile. So we need to use skip_profile only in the latter case,
|
||||
# as long as the parser is in sync' with skip_profile().
|
||||
"$PARSER" $PARSER_OPTS $parser_cmd -- "$profile_dir" || {
|
||||
# FIXME: once the parser properly handles broken profiles
|
||||
# (LP: #1377338), remove the following code and the
|
||||
# skip_profile() function. For now, if the parser returns
|
||||
# an error, just run it again separately on each profile.
|
||||
for profile in $profile_dir/*; do
|
||||
skip_profile "${profile}"
|
||||
skip=$?
|
||||
if [ "$skip" -eq 2 ]; then
|
||||
# Ignore skip status == 2 (silent skip)
|
||||
continue
|
||||
elif [ "$skip" -ne 0 ] ; then
|
||||
aa_log_skipped_msg "$profile"
|
||||
logger -t "AppArmor(init)" -p daemon.warn \
|
||||
"Skipping profile $profile"
|
||||
continue
|
||||
fi
|
||||
if [ ! -f "${profile}" ] ; then
|
||||
continue
|
||||
fi
|
||||
echo "$profile"
|
||||
done | \
|
||||
# Use xargs to parallelize calls to the parser over all CPUs
|
||||
xargs -n1 -d"\n" --max-procs=$(getconf _NPROCESSORS_ONLN) \
|
||||
"$PARSER" $PARSER_OPTS $parser_cmd --
|
||||
if [ $? -ne 0 ]; then
|
||||
status=1
|
||||
aa_log_failure_msg "At least one profile failed to load"
|
||||
fi
|
||||
}
|
||||
|
||||
return $status
|
||||
}
|
||||
|
||||
parse_profiles() {
|
||||
# get parser arg
|
||||
case "$1" in
|
||||
load)
|
||||
PARSER_ARGS="--add"
|
||||
PARSER_CMD="--add"
|
||||
PARSER_MSG="Loading AppArmor profiles "
|
||||
;;
|
||||
reload)
|
||||
PARSER_ARGS="--replace"
|
||||
PARSER_CMD="--replace"
|
||||
PARSER_MSG="Reloading AppArmor profiles "
|
||||
;;
|
||||
*)
|
||||
@@ -145,45 +214,10 @@ parse_profiles() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -d "$PROFILE_DIR" ]; then
|
||||
aa_log_failure_msg "Profile directory not found"
|
||||
aa_log_action_end 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$(ls $PROFILE_DIR/)" ]; then
|
||||
aa_log_failure_msg "No profiles found"
|
||||
aa_log_action_end 1
|
||||
return 1
|
||||
fi
|
||||
|
||||
for profile in $PROFILE_DIR/*; do
|
||||
skip_profile "${profile}"
|
||||
skip=$?
|
||||
# Ignore skip status == 2 (silent skip)
|
||||
if [ "$skip" -eq 1 ] ; then
|
||||
aa_log_skipped_msg "$profile"
|
||||
logger -t "AppArmor(init)" -p daemon.warn "Skipping profile $profile"
|
||||
STATUS=2
|
||||
continue
|
||||
elif [ "$skip" -ne 0 ]; then
|
||||
continue
|
||||
fi
|
||||
if [ -f "${profile}" ] ; then
|
||||
COMPLAIN=""
|
||||
if force_complain "${profile}" ; then
|
||||
COMPLAIN="-C"
|
||||
fi
|
||||
$PARSER $ABSTRACTIONS $PARSER_ARGS $COMPLAIN "$profile" > /dev/null
|
||||
if [ $? -ne 0 ]; then
|
||||
aa_log_failure_msg "$profile failed to load"
|
||||
STATUS=1
|
||||
fi
|
||||
fi
|
||||
for profile_dir in $PROFILE_DIRS; do
|
||||
__parse_profiles_dir "$PARSER_CMD" "$profile_dir" || STATUS=$?
|
||||
done
|
||||
if [ $STATUS -eq 2 ]; then
|
||||
STATUS=0
|
||||
fi
|
||||
|
||||
aa_log_action_end "$STATUS"
|
||||
return $STATUS
|
||||
}
|
||||
@@ -195,18 +229,20 @@ profiles_names_list() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ ! -d "$PROFILE_DIR" ]; then
|
||||
aa_log_failure_msg "- Profile directory not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for profile in $PROFILE_DIR/*; do
|
||||
if skip_profile "${profile}" && [ -f "${profile}" ] ; then
|
||||
LIST_ADD=$($PARSER $ABSTRACTIONS -N "$profile" )
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "$LIST_ADD"
|
||||
fi
|
||||
for profile_dir in $PROFILE_DIRS; do
|
||||
if [ ! -d "$profile_dir" ]; then
|
||||
aa_log_warning_msg "- Profile directory not found: $profile_dir"
|
||||
continue
|
||||
fi
|
||||
|
||||
for profile in $profile_dir/*; do
|
||||
if skip_profile "${profile}" && [ -f "${profile}" ] ; then
|
||||
LIST_ADD=$($PARSER -N "$profile" )
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "$LIST_ADD"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
done
|
||||
}
|
||||
|
||||
@@ -231,7 +267,7 @@ is_apparmor_loaded() {
|
||||
return 0
|
||||
fi
|
||||
|
||||
is_apparmor_present apparmor
|
||||
is_apparmor_present
|
||||
|
||||
return $?
|
||||
}
|
||||
@@ -268,8 +304,6 @@ apparmor_start() {
|
||||
return 1
|
||||
fi
|
||||
|
||||
configure_owlsm
|
||||
|
||||
# if there is anything in the profiles file don't load
|
||||
if ! read line < "$SFS_MOUNTPOINT/profiles"; then
|
||||
parse_profiles load
|
||||
@@ -331,7 +365,7 @@ apparmor_kill() {
|
||||
return 1
|
||||
fi
|
||||
|
||||
if is_apparmor_present apparmor ; then
|
||||
if is_apparmor_present ; then
|
||||
MODULE=apparmor
|
||||
else
|
||||
aa_log_failure_msg "AppArmor is builtin"
|
||||
@@ -351,7 +385,6 @@ __apparmor_restart() {
|
||||
|
||||
aa_log_daemon_msg "Restarting AppArmor"
|
||||
|
||||
configure_owlsm
|
||||
parse_profiles reload
|
||||
|
||||
rc=$?
|
||||
|
||||
Reference in New Issue
Block a user