apparmor: cleanup

srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch

@@ -0,0 +1,85 @@
+From cb4141646e5fd58261cc345e02a7f0c88e24a07d Mon Sep 17 00:00:00 2001
+From: Duncan Overbruck <mail@duncano.de>
+Date: Sat, 1 Aug 2026 17:47:11 +0200
+Subject: [PATCH] add xbps style backup files for void linux
+
+---
+ libraries/libapparmor/src/private.c | 4 ++++
+ parser/apparmor_parser.pod          | 2 +-
+ utils/apparmor/common.py            | 3 +++
+ utils/test/test-aa.py               | 3 +++
+ 4 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/libraries/libapparmor/src/private.c b/libraries/libapparmor/src/private.c
+index 39b578972..afca9cc5f 100644
+--- a/libraries/libapparmor/src/private.c
++++ b/libraries/libapparmor/src/private.c
+@@ -17,6 +17,7 @@
+ #include <dirent.h>
+ #include <endian.h>
+ #include <errno.h>
++#include <fnmatch.h>
+ #include <fcntl.h>
+ #include <stdarg.h>
+ #include <stdbool.h>
+@@ -179,6 +180,9 @@ int _aa_is_blacklisted(const char *name)
+ 		}
+ 	}
+
++	if (fnmatch(name, "*.new-*", 0) == 0)
++		return 1;
++
+ 	return 0;
+ }
+
+diff --git a/parser/apparmor_parser.pod b/parser/apparmor_parser.pod
+index 470585202..b5a788ab2 100644
+--- a/parser/apparmor_parser.pod
++++ b/parser/apparmor_parser.pod
+@@ -47,7 +47,7 @@ name containing a set of profiles. If a directory is specified then the
+ B<apparmor_parser> will try to do a profile load for each file in the
+ directory that is not a dot file, or explicitly black listed (*.dpkg-new,
+ *.dpkg-old, *.dpkg-dist, *.dpkg-bak, *.dpkg-remove, *.pacsave, *.pacnew,
+-*.rpmnew, *.rpmsave, *.orig, *.rej, *~).
++*.rpmnew, *.rpmsave, *.orig, *.rej, *~, *.new-*).
+ The B<apparmor_parser> will fall back to taking input from standard input if
+ a profile or directory is not supplied.
+
+diff --git a/utils/apparmor/common.py b/utils/apparmor/common.py
+index 73d1c6fe3..8f6bbbb45 100644
+--- a/utils/apparmor/common.py
++++ b/utils/apparmor/common.py
+@@ -18,6 +18,7 @@ import signal
+ import sys
+ import termios
+ import tty
++import fnmatch
+ from tempfile import NamedTemporaryFile
+
+ DEBUGGING = False
+@@ -183,6 +184,8 @@ def is_skippable_file(path):
+         '.pacsave', '.pacnew', '.rpmnew', '.rpmsave', '.orig', '.rej', '~')
+     if basename.endswith(skippable_suffix):
+         return True
++    if fnmatch.fnmatch(basename, "*.new-*"):
++        return True
+
+     return False
+
+diff --git a/utils/test/test-aa.py b/utils/test/test-aa.py
+index c51d18671..44a788073 100644
+--- a/utils/test/test-aa.py
++++ b/utils/test/test-aa.py
+@@ -505,6 +505,9 @@ class AaTest_is_skippable_file(AATest):
+     def test_skippable_16(self):
+         self.assertTrue(is_skippable_file('README'))
+
++    def test_skippable_17(self):
++        self.assertTrue(is_skippable_file('bin.ping.new-1.0_1'))
++
+
+ class AaTest_parse_profile_data(AATest):
+     def test_parse_empty_profile_01(self):
+-- 
+2.55.0
+

srcpkgs/apparmor/patches/fix-perl-cross.patch

@@ -0,0 +1,11 @@
+--- a/libraries/libapparmor/swig/perl/Makefile.am
++++ b/libraries/libapparmor/swig/perl/Makefile.am
+@@ -11,7 +11,7 @@
+ LibAppArmor.pm: libapparmor_wrap.c
+
+ Makefile.perl: Makefile.PL LibAppArmor.pm
+-	$(PERL) $< PREFIX=$(prefix) MAKEFILE=$@
++	$(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC)
+ 	sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl
+ 	sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl
+

srcpkgs/apparmor/template

@@ -1,18 +1,18 @@
 # Template file for 'apparmor'
 pkgname=apparmor
 version=4.1.7
-revision=1
+revision=2
 build_wrksrc=libraries/libapparmor
+build_helper="python3"
 build_style=gnu-configure
 conf_files="/etc/apparmor.d/local/* /etc/apparmor/*"
 make_dirs="/etc/apparmor.d/disable 0755 root root"
 configure_args="$(vopt_with python) $(vopt_with perl)"
-hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config
- perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)"
-makedepends="$(vopt_if python python3-devel)"
-depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2
- python3-psutil python3-dbus iproute2"
-checkdepends="dejagnu"
+hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool
+ python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)"
+makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)"
+depends="runit-void-apparmor iproute2"
+checkdepends="dejagnu "
 short_desc="Mandatory access control to restrict programs"
 maintainer="Orphaned <orphan@voidlinux.org>"
 license="GPL-2.0-only"
@@ -27,56 +27,58 @@ CFLAGS="-D_LARGEFILE64_SOURCE"
 CXXFLAGS="-D_LARGEFILE64_SOURCE"
 
 build_options="python perl"
+build_options_default="python"
 
-case "$XBPS_TARGET_MACHINE" in
-	x86_64*|aarch64*|i686*)
-		build_options_default+=" python"
-	;;
-esac
+if [ "${build_option_perl}" -o "${build_option_python}" ]; then
+	hostmakedepends+=" swig"
+fi
 
-if [ -z "$CROSS_BUILD" ]; then
-	build_options_default+=" perl"
+if [ "${build_option_python}" ]; then
+	depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject"
+	checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject"
 fi
 
-pre_configure() {
-	cd ${wrksrc}/libraries/libapparmor
-	autoreconf -fiv
+post_patch() {
+	# add custom profiles
+	cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/"
 }
 
-pre_build() {
-	# Replace release profiles with our own
-	cd ${wrksrc}
-	cp ${FILESDIR}/profiles/* profiles/apparmor.d/
+pre_configure() {
+	autoreconf -fiv
 }
 
 post_build() {
-	cd ${wrksrc}
-
-	make ${makejobs} -C binutils
-	make ${makejobs} -C utils
-	make ${makejobs} -C parser
-	make ${makejobs} -C profiles
+	make ${makejobs} -C "${wrksrc}/binutils"
+	make ${makejobs} -C "${wrksrc}/parser"
+	make ${makejobs} -C "${wrksrc}/utils"
+	make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor"
+	make ${makejobs} -C "${wrksrc}/profiles"
 }
 
-post_install() {
-	cd ${wrksrc}
-	commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\""
-	make $commonflags install -C binutils
-	make $commonflags \
-		BINDIR="${DESTDIR}/usr/bin" \
-		VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \
-		install -C utils
-	make $commonflags \
-		APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \
-		install -C parser
-	make DESTDIR="${DESTDIR}" install -C profiles
+do_check() {
+	make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check
+	make ${makejobs} -C "${wrksrc}/binutils" check
+	make ${makejobs} -C "${wrksrc}/parser" check
+	make ${makejobs} -C "${wrksrc}/utils" check
+	# make ${makejobs} -C "${wrksrc}/profiles" check # broken
+	make ${makejobs} -C "${wrksrc}/profiles" check-parser
+	make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d
+}
 
-	# requires perl bindings not generated when cross-compiling
-	if [ -z "$build_option_perl" ]; then
-		rm -f ${DESTDIR}/usr/bin/aa-notify
-	fi
+do_install() {
+	local _args=(
+		"DESTDIR=\"${DESTDIR}\""
+		"SBINDIR=\"${DESTDIR}/usr/bin\""
+		"BINDIR=\"${DESTDIR}/usr/bin\""
+		"USR_SBINDIR=\"${DESTDIR}/usr/bin\""
+	)
+	make -C "${wrksrc}/libraries/libapparmor" "${_args[@]}" install
+	make -C "${wrksrc}/binutils" "${_args[@]}" install
+	make -C "${wrksrc}/utils" "${_args[@]}" VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" install
+	make -C "${wrksrc}/parser" "${_args[@]}" APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" install
+	make -C "${wrksrc}/profiles" "${_args[@]}" install
 
-	vinstall utils/aa-notify.desktop 644 usr/share/applications
+	vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications
 	vdoc "${FILESDIR}/README.voidlinux"
 }
 
@@ -90,6 +92,7 @@ libapparmor_package() {
 		fi
 		if [ "$build_option_python" ]; then
 			vmove "${py3_sitelib}/LibAppArmor*"
+			vmove "${py3_sitelib}/_LibAppArmor*.so"
 		fi
 		vmove usr/share/man/man2
 		vmove usr/share/man/man3
@@ -99,7 +102,7 @@ libapparmor_package() {
 libapparmor-devel_package() {
 	short_desc+=" - Library development files"
 	license="LGPL-2.1-only"
-	depends="lib${sourcepkg}-${version}_${revision}"
+	depends="libapparmor-${version}_${revision}"
 	pkg_install() {
 		vmove usr/include
 		vmove "usr/lib/*.a"

srcpkgs/runit-void/files/09-apparmor.sh

@@ -1,27 +1,14 @@
 # vim: set ts=4 sw=4 et:
 
 # AppArmor is not enabled in kernel, silently exit
+[ ! -d /sys/module/apparmor ] && return
 [ ! -d /sys/kernel/security/apparmor ] && return
 
-# Load config
-[ -r /etc/default/apparmor ] && . /etc/default/apparmor
-
 # Proceed to load profiles depending on user settings
 msg "Loading AppArmor profiles..."
 
-if [ -n "$APPARMOR" ]; then
-	if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then
-		printf '! AppArmor set to %s - ignoring profiles\n' "$APPARMOR"
-		return
-	fi
-
-	[ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C"
-
-	if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then
-		find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a $AACOMPLAIN -- {} +
-	else
-		printf '! AppArmor installation problem - ensure you have installed apparmor package\n'
-	fi
+if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then
+	apparmor_parser -a -- /etc/apparmor.d
 else
-	printf '! AppArmor disabled - ignoring profiles\n'
+	printf '! AppArmor installation problem - ensure you have installed apparmor package\n'
 fi

srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg

@@ -0,0 +1,7 @@
+The `/etc/default/apparmor` configuration file was removed. The system will now
+boot in `enforce` mode by default if apparmor is enabled.
+
+To boot in complain mode, add `apparmor.mode=complain` to the kernel command
+line, or change the mode at runtime:
+
+	# echo -n complain > /sys/module/apparmor/parameters/mode

srcpkgs/runit-void/template

@@ -1,16 +1,16 @@
 # Template file for 'runit-void'
 pkgname=runit-void
 version=20250212
-revision=3
+revision=4
 build_style=gnu-makefile
+depends="virtual?awk procps-ng runit"
 short_desc="Void Linux runit scripts"
-maintainer="Enno Boland <gottox@voidlinux.org>"
+maintainer="Orphaned <orphan@voidlinux.org>"
 license="CC0-1.0"
 homepage="https://github.com/void-linux/void-runit"
 distfiles="https://github.com/void-linux/void-runit/archive/refs/tags/${version}.tar.gz"
 checksum=c0d3ecea4dae5bba8ca3e563706847ef3b6cbdfcc19b8bf69b3f7a9bc0451f50
 
-depends="virtual?awk procps-ng runit"
 conf_files="
  /etc/hostname
  /etc/locale.conf
@@ -29,15 +29,13 @@ make_dirs="
 
 alternatives="
  logger:logger:/usr/bin/vlogger
- logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8
-"
+ logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8"
 
 post_install() {
 	vmkdir usr/bin
 	mv ${DESTDIR}/usr/sbin/* ${DESTDIR}/usr/bin
 	vconf ${FILESDIR}/hostname
 	vconf ${FILESDIR}/locale.conf
-	vinstall ${FILESDIR}/apparmor 644 /etc/default/
 	vinstall ${FILESDIR}/09-apparmor.sh 644 /etc/runit/core-services/
 	vmkdir usr/lib
 	# Enable services at post-install time instead.
@@ -50,9 +48,7 @@ post_install() {
 runit-void-apparmor_package() {
 	short_desc+=" - AppArmor initialization"
 	depends="${sourcepkg}-${version}_${revision}"
-	conf_files="/etc/default/apparmor"
 	pkg_install() {
-		vmove etc/default/apparmor
 		vmove etc/runit/core-services/09-apparmor.sh
 	}
 }