apparmor: cleanup - #61695
Conversation
e2eb698 to
97d0e67
Compare
| printf '! AppArmor installation problem - ensure you have installed apparmor package\n' | ||
| fi | ||
| if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then | ||
| find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a -- {} + |
There was a problem hiding this comment.
shame we don't have upstream support for skipping these files (https://gitlab.com/apparmor/apparmor/-/blob/master/utils/apparmor/common.py#L171). AIUI the apparmor tooling has some optimizations when you just run it against the whole directory vs. profile by profile.
There was a problem hiding this comment.
once upon a time I added the support, but I guess it got lost in the mix https://gitlab.com/apparmor/apparmor/-/merge_requests/230/diffs#diff-content-2d7d631567a2e800da349ed4e174f9680adc563d
There was a problem hiding this comment.
Looks like they moved to to letting apparmor_parser read/filter the directory, I'm going to write a patch, makes sense to use upstreams implementation so that it also works outside of the runit scripts.
- cleanup template - enable more checks - remove old custom php-fpm profile - allow cross building perl library - move apparmor syscall and library man pages to libapparmor-devel - add missing python dependencies - add patch for xbps .new-* style files
Remove the mode switch in the /etc/runit/core-services/09-apparmor.sh script that causes issues. The `apparmor_parser -C` flag that was used to set the profiles into complain mode will force profiles that have the `unconfined` flag set into complain mode instead, which enables further restrictions that may break things. And there is no alternative flag to only set profiles that have the enforce flag to complain. The native kernel module parameter apparmor.mode should be used instead. As it puts apparmor into complain mode instead of trying to force profiles into complain mode. This fixes bwrap when executed by flatpak which has a profile with the unconfined flag set.
2 participants
No description provided.