Merge utils/test/test-profiles.py: Don't count profiles when USE_SYSTEM=1

If USE_SYSTEM=1 then we can't assume all the various profiles have been
installed and therefore that the counts of the profiles will be as expected. In
that case, simply testing that parsing the profiles occurs without errors is
sufficient.

Signed-off-by: Alex Murray <alex.murray@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/924
Merged-by: Alex Murray <alex.murray@canonical.com>

profiles/apparmor.d/curl

@@ -42,6 +42,10 @@ profile curl /usr/bin/curl {
   network inet6 stream,
   network inet6 dgram,
 
+  # Allow access to the snap socket until we can revisit it with delegation
+  # or profile refactoring
+  file rw @{run}/snapd.socket,
+
   # Site-specific additions and overrides. See local/README for details.
   include if exists <local/curl>
 }

profiles/apparmor.d/unix-chkpwd

@@ -30,6 +30,9 @@ profile unix-chkpwd /{,usr/}{,s}bin/unix_chkpwd {
   /run/host/userdb/*.user r,
   /run/host/userdb/*.user-privileged r,
 
+  # authd socket for PAM
+  @{run}/authd.sock rw,
+
   # file_inherit
   owner /dev/tty[0-9]* rw,
 

utils/test/test-profiles.py

@@ -9,6 +9,7 @@
 #
 # ------------------------------------------------------------------
 
+import os
 import unittest
 
 import apparmor.aa as aa
@@ -25,12 +26,22 @@ class TestFoo(AATest):
     def test_active_profiles(self):
         aa.read_profiles()
 
-        self.assertGreaterEqual(len(aa.active_profiles.profile_names), 42)
+        # when using system apparmor then we haven't necessarily installed all
+        # the profiles so checking against a specific number may fail - instead
+        # it is sufficient that profiles were read without an exception being
+        # thrown above
+        if os.getenv("USE_SYSTEM", "0") != "1":
+            self.assertGreaterEqual(len(aa.active_profiles.profile_names), 42)
 
     def test_extra_profiles(self):
         aa.read_inactive_profiles()
 
-        self.assertGreaterEqual(len(aa.extra_profiles.profile_names), 100)
+        # when using system apparmor then we haven't necessarily installed all
+        # the profiles so checking against a specific number may fail - instead
+        # it is sufficient that profiles were read without an exception being
+        # thrown above
+        if os.getenv("USE_SYSTEM", "0") != "1":
+            self.assertGreaterEqual(len(aa.extra_profiles.profile_names), 100)
 
 
 setup_aa(aa)