Make rc.apparmor.functions suitable for Debian and Ubuntu

Debian and Ubuntu currently don't use rc.apparmor.functions. They have their own code for loading profiles, their own initscript and systemd unit.

As discussed initially on https://bugs.debian.org/870697 and https://salsa.debian.org/apparmor-team/apparmor/merge_requests/6#note_29153, to fix that without introducing regressions on Debian/Ubuntu, we need to upstream a number of changes, which is what this branch is about.

PR: https://gitlab.com/apparmor/apparmor/merge_requests/252
Acked-by: Christian Boltz <apparmor@cboltz.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>

parser/rc.apparmor.functions

@@ -1,7 +1,7 @@
 #!/bin/sh
 # ----------------------------------------------------------------------
 #    Copyright (c) 1999-2008 NOVELL (All rights reserved)
-#    Copyright (c) 2009-2012 Canonical Ltd. (All rights reserved)
+#    Copyright (c) 2009-2018 Canonical Ltd. (All rights reserved)
 #
 #    This program is free software; you can redistribute it and/or
 #    modify it under the terms of version 2 of the GNU General Public
@@ -31,28 +31,23 @@
 
 # Some nice defines that we use
 
-CONFIG_DIR=/etc/apparmor
 MODULE=apparmor
-if [ -f "${CONFIG_DIR}/${MODULE}.conf" ] ; then
-	APPARMOR_CONF="${CONFIG_DIR}/${MODULE}.conf"
-else
-	aa_log_warning_msg "Unable to find config file in ${CONFIG_DIR}, installation problem?"
-fi
-
-if [ -f "${APPARMOR_CONF}" ] ; then
-	#parse the conf file to see what we should do
-	. "${APPARMOR_CONF}"
-fi
-
 PARSER=/sbin/apparmor_parser
-
+PARSER_OPTS=
-# APPARMOR_DIR might be defined in apparmor.conf
+# Suppress warnings when booting in quiet mode
-if [ -d "${APPARMOR_DIR}" ] ; then
+if [ "${QUIET:-no}" = yes ] || [ "${quiet:-n}" = y ]; then
-	PROFILE_DIR=${APPARMOR_DIR}
+	PARSER_OPTS="$PARSER_OPTS --quiet"
-elif [ -d /etc/apparmor.d ] ; then
+fi
-	PROFILE_DIR=/etc/apparmor.d
+
+if [ -d /etc/apparmor.d ] ; then
+	PROFILE_DIRS=/etc/apparmor.d
+else
+	aa_log_warning_msg "Unable to find profiles directory, installation problem?"
+fi
+ADDITIONAL_PROFILE_DIR=/var/lib/snapd/apparmor/profiles
+if [ -d "$ADDITIONAL_PROFILE_DIR" ]; then
+	PROFILE_DIRS="${PROFILE_DIRS} ${ADDITIONAL_PROFILE_DIR}"
 fi
-ABSTRACTIONS="-I${PROFILE_DIR}"
 AA_STATUS=/usr/sbin/aa-status
 SECURITYFS=/sys/kernel/security
 
@@ -61,17 +56,54 @@ STATUS=0
 
 # Test if the apparmor "module" is present.
 is_apparmor_present() {
-	local modules=$1
+	[ -d /sys/module/apparmor ]
-	shift
+}
 
-	while [ $# -gt 0 ] ; do
+# Checks to see if the current container is capable of having internal AppArmor
-		modules="$modules|$1"
+# profiles that should be loaded. Callers of this function should have already
-		shift
+# verified that they're running inside of a container environment with
-	done
+# something like `systemd-detect-virt --container`.
+#
+# The only known container environments capable of supporting internal policy
+# are LXD and LXC environment.
+#
+# Returns 0 if the container environment is capable of having its own internal
+# policy and non-zero otherwise.
+#
+# IMPORTANT: This function will return 0 in the case of a non-LXD/non-LXC
+# system container technology being nested inside of a LXD/LXC container that
+# utilized an AppArmor namespace and profile stacking. The reason 0 will be
+# returned is because .ns_stacked will be "yes" and .ns_name will still match
+# "lx[dc]-*" since the nested system container technology will not have set up
+# a new AppArmor profile namespace. This will result in the nested system
+# container's boot process to experience failed policy loads but the boot
+# process should continue without any loss of functionality. This is an
+# unsupported configuration that cannot be properly handled by this function.
+is_container_with_internal_policy() {
+	local ns_stacked_path="${SFS_MOUNTPOINT}/.ns_stacked"
+	local ns_name_path="${SFS_MOUNTPOINT}/.ns_name"
+	local ns_stacked
+	local ns_name
 
-	[ $? -ne 0 -a -d /sys/module/apparmor ]
+	if ! [ -f "$ns_stacked_path" ] || ! [ -f "$ns_name_path" ]; then
+		return 1
+	fi
 
-	return $?
+	read -r ns_stacked < "$ns_stacked_path"
+	if [ "$ns_stacked" != "yes" ]; then
+		return 1
+	fi
+
+	# LXD and LXC set up AppArmor namespaces starting with "lxd-" and
+	# "lxc-", respectively. Return non-zero for all other namespace
+	# identifiers.
+	read -r ns_name < "$ns_name_path"
+	if [ "${ns_name#lxd-*}" = "$ns_name" ] && \
+	   [ "${ns_name#lxc-*}" = "$ns_name" ]; then
+		return 1
+	fi
+
+	return 0
 }
 
 # This set of patterns to skip needs to be kept in sync with
@@ -85,7 +117,6 @@ skip_profile() {
 	     "${profile%.rpmsave}" != "${profile}" -o \
 	     "${profile%.orig}" != "${profile}" -o \
 	     "${profile%.rej}" != "${profile}" -o \
-	     -e "${PROFILE_DIR}/disable/`basename ${profile}`" -o \
 	     "${profile%\~}" != "${profile}" ] ; then
 		return 1
 	fi
@@ -106,30 +137,68 @@ skip_profile() {
 	return 0
 }
 
-force_complain() {
+__parse_profiles_dir() {
-	local profile=$1
+	local parser_cmd="$1"
+	local profile_dir="$2"
+	local status=0
 
-	# if profile not in complain mode
+	if [ ! -d "$profile_dir" ]; then
-	if ! egrep -q "^/.*[ \t]+flags[ \t]*=[ \t]*\([ \t]*complain[ \t]*\)[ \t]+{" $profile ; then
+		aa_log_failure_msg "Profile directory not found: $profile_dir"
-		local link="${PROFILE_DIR}/force-complain/`basename ${profile}`"
+		return 1
-		if [ -e "$link" ] ; then
-			aa_log_warning_msg "found $link, forcing complain mode"
-			return 0
-		fi
 	fi
 
-	return 1
+	if [ -z "$(ls $profile_dir/)" ]; then
+		aa_log_failure_msg "No profiles found in $profile_dir"
+		return 1
+	fi
+
+	# Note: the parser automatically skips files that match skip_profile()
+	# when we pass it a directory, but not when we pass it an individual
+	# profile. So we need to use skip_profile only in the latter case,
+	# as long as the parser is in sync' with skip_profile().
+	"$PARSER" $PARSER_OPTS $parser_cmd -- "$profile_dir" || {
+		# FIXME: once the parser properly handles broken profiles
+		# (LP: #1377338), remove the following code and the
+		# skip_profile() function. For now, if the parser returns
+		# an error, just run it again separately on each profile.
+		for profile in $profile_dir/*; do
+			skip_profile "${profile}"
+			skip=$?
+			if [ "$skip" -eq 2 ]; then
+				# Ignore skip status == 2 (silent skip)
+				continue
+			elif [ "$skip" -ne 0 ] ; then
+				aa_log_skipped_msg "$profile"
+				logger -t "AppArmor(init)" -p daemon.warn \
+					"Skipping profile $profile"
+				continue
+			fi
+			if [ ! -f "${profile}" ] ; then
+				continue
+			fi
+			echo "$profile"
+		done | \
+		# Use xargs to parallelize calls to the parser over all CPUs
+		xargs -n1 -d"\n" --max-procs=$(getconf _NPROCESSORS_ONLN) \
+			"$PARSER" $PARSER_OPTS $parser_cmd --
+		if [ $? -ne 0 ]; then
+			status=1
+			aa_log_failure_msg "At least one profile failed to load"
+		fi
+	}
+
+	return $status
 }
 
 parse_profiles() {
 	# get parser arg
 	case "$1" in
 		load)
-			PARSER_ARGS="--add"
+			PARSER_CMD="--add"
 			PARSER_MSG="Loading AppArmor profiles "
 			;;
 		reload)
-			PARSER_ARGS="--replace"
+			PARSER_CMD="--replace"
 			PARSER_MSG="Reloading AppArmor profiles "
 			;;
 		*)
@@ -145,45 +214,10 @@ parse_profiles() {
 		exit 1
 	fi
 
-	if [ ! -d "$PROFILE_DIR" ]; then
+	for profile_dir in $PROFILE_DIRS; do
-		aa_log_failure_msg "Profile directory not found"
+		__parse_profiles_dir "$PARSER_CMD" "$profile_dir" || STATUS=$?
-		aa_log_action_end 1
-		exit 1
-	fi
-
-	if [ -z "$(ls $PROFILE_DIR/)" ]; then
-		aa_log_failure_msg "No profiles found"
-		aa_log_action_end 1
-		return 1
-	fi
-
-	for profile in $PROFILE_DIR/*; do
-		skip_profile "${profile}"
-		skip=$?
-		# Ignore skip status == 2 (silent skip)
-		if [ "$skip" -eq 1 ] ; then
-			aa_log_skipped_msg "$profile"
-			logger -t "AppArmor(init)" -p daemon.warn "Skipping profile $profile"
-			STATUS=2
-			continue
-		elif [ "$skip" -ne 0 ]; then
-			continue
-		fi
-		if [ -f "${profile}" ] ; then
-			COMPLAIN=""
-			if force_complain "${profile}" ; then
-				COMPLAIN="-C"
-			fi
-			$PARSER $ABSTRACTIONS $PARSER_ARGS $COMPLAIN "$profile" > /dev/null
-			if [ $? -ne 0 ]; then
-				aa_log_failure_msg "$profile failed to load"
-				STATUS=1
-			fi
-		fi
 	done
-	if [ $STATUS -eq 2 ]; then
+
-		STATUS=0
-	fi
 	aa_log_action_end "$STATUS"
 	return $STATUS
 }
@@ -195,18 +229,20 @@ profiles_names_list() {
 		exit 1
 	fi
 
-	if [ ! -d "$PROFILE_DIR" ]; then
+	for profile_dir in $PROFILE_DIRS; do
-		aa_log_failure_msg "- Profile directory not found"
+		if [ ! -d "$profile_dir" ]; then
-		exit 1
+			aa_log_warning_msg "- Profile directory not found: $profile_dir"
-	fi
+			continue
-
-	for profile in $PROFILE_DIR/*; do
-	        if skip_profile "${profile}" && [ -f "${profile}" ] ; then
-			LIST_ADD=$($PARSER $ABSTRACTIONS -N "$profile" )
-			if [ $? -eq 0 ]; then
-				echo "$LIST_ADD"
-			fi
 		fi
+
+		for profile in $profile_dir/*; do
+			if skip_profile "${profile}" && [ -f "${profile}" ] ; then
+				LIST_ADD=$($PARSER -N "$profile" )
+				if [ $? -eq 0 ]; then
+					echo "$LIST_ADD"
+				fi
+			fi
+		done
 	done
 }
 
@@ -231,7 +267,7 @@ is_apparmor_loaded() {
 		return 0
 	fi
 
-	is_apparmor_present apparmor
+	is_apparmor_present
 
 	return $?
 }
@@ -268,8 +304,6 @@ apparmor_start() {
 		return 1
 	fi
 
-	configure_owlsm
-
 	# if there is anything in the profiles file don't load
 	if ! read line < "$SFS_MOUNTPOINT/profiles"; then
 		parse_profiles load
@@ -331,7 +365,7 @@ apparmor_kill() {
 		return 1
 	fi
 
-	if is_apparmor_present apparmor ; then
+	if is_apparmor_present ; then
 		MODULE=apparmor
 	else
 		aa_log_failure_msg "AppArmor is builtin"
@@ -351,7 +385,6 @@ __apparmor_restart() {
 
 	aa_log_daemon_msg "Restarting AppArmor"
 
-	configure_owlsm
 	parse_profiles reload
 
 	rc=$?