From e3b1143a6d49588235ad171fedabe186b630e588 Mon Sep 17 00:00:00 2001 From: Duncaen Date: Tue, 28 Jul 2026 18:12:36 +0200 Subject: [PATCH 1/2] apparmor: cleanup - cleanup template - enable more checks - remove old custom php-fpm profile - allow cross building perl library - move apparmor syscall and library man pages to libapparmor-devel - add missing python dependencies - add patch for xbps .new-* style files --- .../apparmor/files/profiles/usr.bin.php-fpm | 45 --------- ...ps-style-backup-files-for-void-linux.patch | 85 +++++++++++++++++ srcpkgs/apparmor/patches/fix-perl-cross.patch | 11 +++ srcpkgs/apparmor/template | 93 ++++++++++--------- 4 files changed, 144 insertions(+), 90 deletions(-) delete mode 100644 srcpkgs/apparmor/files/profiles/usr.bin.php-fpm create mode 100644 srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch create mode 100644 srcpkgs/apparmor/patches/fix-perl-cross.patch diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm b/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm deleted file mode 100644 index 0b036965da1dfe..00000000000000 --- a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm +++ /dev/null @@ -1,45 +0,0 @@ -# vim:syntax=apparmor - -abi , - -# NOTE: This profile uses TCP sockets by default -# If you wish for php-fpm to listen to unix socket, -# add the following permission to local/usr.bin.php-fpm -# /path/to/your/unix/socket w, - -include - -# This is PHP open_basedir where script can only be executed from. -# /home, /tmp have been removed to not open permissions too widely -# /usr/share/pear have been removed to have its own permission -@{PHP_BASEDIRS} = /srv/www/ /var/www/ /usr/share/webapps/ - -profile php-fpm /usr/bin/php-fpm { - include - include - include - include - - capability setgid, - capability setuid, - capability kill, - - /etc/php/php-fpm.conf r, - /etc/php/php-fpm.d/* r, - - # This is set to make php-fpm work by default, but if you don't use these paths - # add "deny @{PHP_BASEDIRS}/** r," to local.usr.bin.php-fpm and add read rights - # to where your PHP app is located - @{PHP_BASEDIRS}/** r, - - /usr/bin/php-fpm mr, - - /usr/share/pear/** r, - /usr/share/php/fpm/status.html r, - - /var/log/php-fpm.log w, - - # Site-specific additions and overrides. See local/README for details. - include if exists - -} diff --git a/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch b/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch new file mode 100644 index 00000000000000..89d8810833b927 --- /dev/null +++ b/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch @@ -0,0 +1,85 @@ +From cb4141646e5fd58261cc345e02a7f0c88e24a07d Mon Sep 17 00:00:00 2001 +From: Duncan Overbruck +Date: Sat, 1 Aug 2026 17:47:11 +0200 +Subject: [PATCH] add xbps style backup files for void linux + +--- + libraries/libapparmor/src/private.c | 4 ++++ + parser/apparmor_parser.pod | 2 +- + utils/apparmor/common.py | 3 +++ + utils/test/test-aa.py | 3 +++ + 4 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libraries/libapparmor/src/private.c b/libraries/libapparmor/src/private.c +index 39b578972..afca9cc5f 100644 +--- a/libraries/libapparmor/src/private.c ++++ b/libraries/libapparmor/src/private.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -179,6 +180,9 @@ int _aa_is_blacklisted(const char *name) + } + } + ++ if (fnmatch(name, "*.new-*", 0) == 0) ++ return 1; ++ + return 0; + } + +diff --git a/parser/apparmor_parser.pod b/parser/apparmor_parser.pod +index 470585202..b5a788ab2 100644 +--- a/parser/apparmor_parser.pod ++++ b/parser/apparmor_parser.pod +@@ -47,7 +47,7 @@ name containing a set of profiles. If a directory is specified then the + B will try to do a profile load for each file in the + directory that is not a dot file, or explicitly black listed (*.dpkg-new, + *.dpkg-old, *.dpkg-dist, *.dpkg-bak, *.dpkg-remove, *.pacsave, *.pacnew, +-*.rpmnew, *.rpmsave, *.orig, *.rej, *~). ++*.rpmnew, *.rpmsave, *.orig, *.rej, *~, *.new-*). + The B will fall back to taking input from standard input if + a profile or directory is not supplied. + +diff --git a/utils/apparmor/common.py b/utils/apparmor/common.py +index 73d1c6fe3..8f6bbbb45 100644 +--- a/utils/apparmor/common.py ++++ b/utils/apparmor/common.py +@@ -18,6 +18,7 @@ import signal + import sys + import termios + import tty ++import fnmatch + from tempfile import NamedTemporaryFile + + DEBUGGING = False +@@ -183,6 +184,8 @@ def is_skippable_file(path): + '.pacsave', '.pacnew', '.rpmnew', '.rpmsave', '.orig', '.rej', '~') + if basename.endswith(skippable_suffix): + return True ++ if fnmatch.fnmatch(basename, "*.new-*"): ++ return True + + return False + +diff --git a/utils/test/test-aa.py b/utils/test/test-aa.py +index c51d18671..44a788073 100644 +--- a/utils/test/test-aa.py ++++ b/utils/test/test-aa.py +@@ -505,6 +505,9 @@ class AaTest_is_skippable_file(AATest): + def test_skippable_16(self): + self.assertTrue(is_skippable_file('README')) + ++ def test_skippable_17(self): ++ self.assertTrue(is_skippable_file('bin.ping.new-1.0_1')) ++ + + class AaTest_parse_profile_data(AATest): + def test_parse_empty_profile_01(self): +-- +2.55.0 + diff --git a/srcpkgs/apparmor/patches/fix-perl-cross.patch b/srcpkgs/apparmor/patches/fix-perl-cross.patch new file mode 100644 index 00000000000000..a4b29d7817f8ad --- /dev/null +++ b/srcpkgs/apparmor/patches/fix-perl-cross.patch @@ -0,0 +1,11 @@ +--- a/libraries/libapparmor/swig/perl/Makefile.am ++++ b/libraries/libapparmor/swig/perl/Makefile.am +@@ -11,7 +11,7 @@ + LibAppArmor.pm: libapparmor_wrap.c + + Makefile.perl: Makefile.PL LibAppArmor.pm +- $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ ++ $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC) + sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl + sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl + diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template index 71e38441041608..750fa2991a89d7 100644 --- a/srcpkgs/apparmor/template +++ b/srcpkgs/apparmor/template @@ -1,18 +1,18 @@ # Template file for 'apparmor' pkgname=apparmor version=4.1.7 -revision=1 +revision=2 build_wrksrc=libraries/libapparmor +build_helper="python3" build_style=gnu-configure conf_files="/etc/apparmor.d/local/* /etc/apparmor/*" make_dirs="/etc/apparmor.d/disable 0755 root root" configure_args="$(vopt_with python) $(vopt_with perl)" -hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config - perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)" -makedepends="$(vopt_if python python3-devel)" -depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2 - python3-psutil python3-dbus iproute2" -checkdepends="dejagnu" +hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool + python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)" +makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)" +depends="runit-void-apparmor iproute2" +checkdepends="dejagnu " short_desc="Mandatory access control to restrict programs" maintainer="Orphaned " license="GPL-2.0-only" @@ -27,56 +27,58 @@ CFLAGS="-D_LARGEFILE64_SOURCE" CXXFLAGS="-D_LARGEFILE64_SOURCE" build_options="python perl" +build_options_default="python" -case "$XBPS_TARGET_MACHINE" in - x86_64*|aarch64*|i686*) - build_options_default+=" python" - ;; -esac +if [ "${build_option_perl}" -o "${build_option_python}" ]; then + hostmakedepends+=" swig" +fi -if [ -z "$CROSS_BUILD" ]; then - build_options_default+=" perl" +if [ "${build_option_python}" ]; then + depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" + checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" fi -pre_configure() { - cd ${wrksrc}/libraries/libapparmor - autoreconf -fiv +post_patch() { + # add custom profiles + cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/" } -pre_build() { - # Replace release profiles with our own - cd ${wrksrc} - cp ${FILESDIR}/profiles/* profiles/apparmor.d/ +pre_configure() { + autoreconf -fiv } post_build() { - cd ${wrksrc} - - make ${makejobs} -C binutils - make ${makejobs} -C utils - make ${makejobs} -C parser - make ${makejobs} -C profiles + make ${makejobs} -C "${wrksrc}/binutils" + make ${makejobs} -C "${wrksrc}/parser" + make ${makejobs} -C "${wrksrc}/utils" + make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor" + make ${makejobs} -C "${wrksrc}/profiles" } -post_install() { - cd ${wrksrc} - commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\"" - make $commonflags install -C binutils - make $commonflags \ - BINDIR="${DESTDIR}/usr/bin" \ - VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \ - install -C utils - make $commonflags \ - APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \ - install -C parser - make DESTDIR="${DESTDIR}" install -C profiles +do_check() { + make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check + make ${makejobs} -C "${wrksrc}/binutils" check + make ${makejobs} -C "${wrksrc}/parser" check + make ${makejobs} -C "${wrksrc}/utils" check + # make ${makejobs} -C "${wrksrc}/profiles" check # broken + make ${makejobs} -C "${wrksrc}/profiles" check-parser + make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d +} - # requires perl bindings not generated when cross-compiling - if [ -z "$build_option_perl" ]; then - rm -f ${DESTDIR}/usr/bin/aa-notify - fi +do_install() { + local _args=( + "DESTDIR=\"${DESTDIR}\"" + "SBINDIR=\"${DESTDIR}/usr/bin\"" + "BINDIR=\"${DESTDIR}/usr/bin\"" + "USR_SBINDIR=\"${DESTDIR}/usr/bin\"" + ) + make -C "${wrksrc}/libraries/libapparmor" "${_args[@]}" install + make -C "${wrksrc}/binutils" "${_args[@]}" install + make -C "${wrksrc}/utils" "${_args[@]}" VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" install + make -C "${wrksrc}/parser" "${_args[@]}" APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" install + make -C "${wrksrc}/profiles" "${_args[@]}" install - vinstall utils/aa-notify.desktop 644 usr/share/applications + vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications vdoc "${FILESDIR}/README.voidlinux" } @@ -90,6 +92,7 @@ libapparmor_package() { fi if [ "$build_option_python" ]; then vmove "${py3_sitelib}/LibAppArmor*" + vmove "${py3_sitelib}/_LibAppArmor*.so" fi vmove usr/share/man/man2 vmove usr/share/man/man3 @@ -99,7 +102,7 @@ libapparmor_package() { libapparmor-devel_package() { short_desc+=" - Library development files" license="LGPL-2.1-only" - depends="lib${sourcepkg}-${version}_${revision}" + depends="libapparmor-${version}_${revision}" pkg_install() { vmove usr/include vmove "usr/lib/*.a" From 5495960eaf91a3ca0d943d5ff16a780080da919d Mon Sep 17 00:00:00 2001 From: Duncaen Date: Wed, 29 Jul 2026 22:11:31 +0200 Subject: [PATCH 2/2] runit-void: remove /etc/default/apparmor settings Remove the mode switch in the /etc/runit/core-services/09-apparmor.sh script that causes issues. The `apparmor_parser -C` flag that was used to set the profiles into complain mode will force profiles that have the `unconfined` flag set into complain mode instead, which enables further restrictions that may break things. And there is no alternative flag to only set profiles that have the enforce flag to complain. The native kernel module parameter apparmor.mode should be used instead. As it puts apparmor into complain mode instead of trying to force profiles into complain mode. This fixes bwrap when executed by flatpak which has a profile with the unconfined flag set. --- srcpkgs/runit-void/files/09-apparmor.sh | 21 ++++--------------- srcpkgs/runit-void/files/apparmor | 7 ------- .../runit-void-apparmor.INSTALL.msg | 7 +++++++ srcpkgs/runit-void/template | 12 ++++------- 4 files changed, 15 insertions(+), 32 deletions(-) delete mode 100644 srcpkgs/runit-void/files/apparmor create mode 100644 srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg diff --git a/srcpkgs/runit-void/files/09-apparmor.sh b/srcpkgs/runit-void/files/09-apparmor.sh index e2c87a6b6225fd..b35a1a44cf0873 100644 --- a/srcpkgs/runit-void/files/09-apparmor.sh +++ b/srcpkgs/runit-void/files/09-apparmor.sh @@ -1,27 +1,14 @@ # vim: set ts=4 sw=4 et: # AppArmor is not enabled in kernel, silently exit +[ ! -d /sys/module/apparmor ] && return [ ! -d /sys/kernel/security/apparmor ] && return -# Load config -[ -r /etc/default/apparmor ] && . /etc/default/apparmor - # Proceed to load profiles depending on user settings msg "Loading AppArmor profiles..." -if [ -n "$APPARMOR" ]; then - if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then - printf '! AppArmor set to %s - ignoring profiles\n' "$APPARMOR" - return - fi - - [ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C" - - if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then - find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a $AACOMPLAIN -- {} + - else - printf '! AppArmor installation problem - ensure you have installed apparmor package\n' - fi +if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then + apparmor_parser -a -- /etc/apparmor.d else - printf '! AppArmor disabled - ignoring profiles\n' + printf '! AppArmor installation problem - ensure you have installed apparmor package\n' fi diff --git a/srcpkgs/runit-void/files/apparmor b/srcpkgs/runit-void/files/apparmor deleted file mode 100644 index b32ce11a11ef34..00000000000000 --- a/srcpkgs/runit-void/files/apparmor +++ /dev/null @@ -1,7 +0,0 @@ -# AppArmor configuration - -# Possible options: -# - disable -# - complain -# - enforce -APPARMOR=complain diff --git a/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg new file mode 100644 index 00000000000000..d121e5f59e9dc7 --- /dev/null +++ b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg @@ -0,0 +1,7 @@ +The `/etc/default/apparmor` configuration file was removed. The system will now +boot in `enforce` mode by default if apparmor is enabled. + +To boot in complain mode, add `apparmor.mode=complain` to the kernel command +line, or change the mode at runtime: + + # echo -n complain > /sys/module/apparmor/parameters/mode diff --git a/srcpkgs/runit-void/template b/srcpkgs/runit-void/template index a915b5434fb51e..c58058cd865c3e 100644 --- a/srcpkgs/runit-void/template +++ b/srcpkgs/runit-void/template @@ -1,16 +1,16 @@ # Template file for 'runit-void' pkgname=runit-void version=20250212 -revision=3 +revision=4 build_style=gnu-makefile +depends="virtual?awk procps-ng runit" short_desc="Void Linux runit scripts" -maintainer="Enno Boland " +maintainer="Orphaned " license="CC0-1.0" homepage="https://github.com/void-linux/void-runit" distfiles="https://github.com/void-linux/void-runit/archive/refs/tags/${version}.tar.gz" checksum=c0d3ecea4dae5bba8ca3e563706847ef3b6cbdfcc19b8bf69b3f7a9bc0451f50 -depends="virtual?awk procps-ng runit" conf_files=" /etc/hostname /etc/locale.conf @@ -29,15 +29,13 @@ make_dirs=" alternatives=" logger:logger:/usr/bin/vlogger - logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8 -" + logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8" post_install() { vmkdir usr/bin mv ${DESTDIR}/usr/sbin/* ${DESTDIR}/usr/bin vconf ${FILESDIR}/hostname vconf ${FILESDIR}/locale.conf - vinstall ${FILESDIR}/apparmor 644 /etc/default/ vinstall ${FILESDIR}/09-apparmor.sh 644 /etc/runit/core-services/ vmkdir usr/lib # Enable services at post-install time instead. @@ -50,9 +48,7 @@ post_install() { runit-void-apparmor_package() { short_desc+=" - AppArmor initialization" depends="${sourcepkg}-${version}_${revision}" - conf_files="/etc/default/apparmor" pkg_install() { - vmove etc/default/apparmor vmove etc/runit/core-services/09-apparmor.sh } }