Alexandre Pujol
parent
7c0863867e
commit
458db2601a
8 changed files with 965 additions and 0 deletions
107
pkg/aa/profile.go
Normal file
107
pkg/aa/profile.go
Normal file
|
|
@ -0,0 +1,107 @@
|
|||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
// Warning: this is purposely not using a Yacc parser. Its only aim is to
|
||||
// extract variables and attachments for apparmor.d profile
|
||||
|
||||
package aa
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/exp/maps"
|
||||
)
|
||||
|
||||
var (
|
||||
regVariablesDef = regexp.MustCompile(`@{(.*)}\s*[+=]+\s*(.*)`)
|
||||
regVariablesRef = regexp.MustCompile(`@{([^{}]+)}`)
|
||||
|
||||
// Tunables
|
||||
Tunables = map[string][]string{
|
||||
"libexec": {},
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"user_share_dirs": {"/home/*/.local/share"},
|
||||
"etc_ro": {"/{usr/,}etc/"},
|
||||
}
|
||||
)
|
||||
|
||||
type AppArmorProfile struct {
|
||||
Content string
|
||||
Variables map[string][]string
|
||||
Attachments []string
|
||||
}
|
||||
|
||||
func NewAppArmorProfile(content string) *AppArmorProfile {
|
||||
variables := make(map[string][]string)
|
||||
maps.Copy(variables, Tunables)
|
||||
return &AppArmorProfile{
|
||||
Content: content,
|
||||
Variables: variables,
|
||||
Attachments: []string{},
|
||||
}
|
||||
}
|
||||
|
||||
// ParseVariables extract all variables from the profile
|
||||
func (p *AppArmorProfile) ParseVariables() {
|
||||
matches := regVariablesDef.FindAllStringSubmatch(p.Content, -1)
|
||||
for _, match := range matches {
|
||||
if len(match) > 2 {
|
||||
key := match[1]
|
||||
values := match[2]
|
||||
if _, ok := p.Variables[key]; ok {
|
||||
p.Variables[key] = append(p.Variables[key], strings.Split(values, " ")...)
|
||||
} else {
|
||||
p.Variables[key] = strings.Split(values, " ")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// resolve recursively resolves all variables references
|
||||
func (p *AppArmorProfile) resolve(str string) []string {
|
||||
if strings.Contains(str, "@{") {
|
||||
vars := []string{}
|
||||
match := regVariablesRef.FindStringSubmatch(str)
|
||||
if len(match) > 1 {
|
||||
variable := match[0]
|
||||
varname := match[1]
|
||||
if len(p.Variables[varname]) > 1 {
|
||||
for _, value := range p.Variables[varname] {
|
||||
newVar := strings.ReplaceAll(str, variable, value)
|
||||
vars = append(vars, p.resolve(newVar)...)
|
||||
}
|
||||
} else {
|
||||
newVar := strings.ReplaceAll(str, variable, p.Variables[varname][0])
|
||||
vars = append(vars, p.resolve(newVar)...)
|
||||
}
|
||||
} else {
|
||||
vars = append(vars, str)
|
||||
}
|
||||
return vars
|
||||
}
|
||||
return []string{str}
|
||||
}
|
||||
|
||||
// ResolveAttachments resolve profile attachments defined in exec_path
|
||||
func (p *AppArmorProfile) ResolveAttachments() {
|
||||
for _, exec := range p.Variables["exec_path"] {
|
||||
p.Attachments = append(p.Attachments, p.resolve(exec)...)
|
||||
}
|
||||
}
|
||||
|
||||
// NestAttachments return a nested attachment string
|
||||
func (p *AppArmorProfile) NestAttachments() string {
|
||||
if len(p.Attachments) == 0 {
|
||||
return ""
|
||||
} else if len(p.Attachments) == 1 {
|
||||
return p.Attachments[0]
|
||||
} else {
|
||||
res := []string{}
|
||||
for _, attachment := range p.Attachments {
|
||||
res = append(res, attachment[1:])
|
||||
}
|
||||
return "/{" + strings.Join(res, ",") + "}"
|
||||
}
|
||||
}
|
||||
201
pkg/aa/profile_test.go
Normal file
201
pkg/aa/profile_test.go
Normal file
|
|
@ -0,0 +1,201 @@
|
|||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package aa
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestNewAppArmorProfile(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
content string
|
||||
want *AppArmorProfile
|
||||
}{
|
||||
{
|
||||
name: "aa",
|
||||
content: "",
|
||||
want: &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: map[string][]string{
|
||||
"libexec": {},
|
||||
"etc_ro": {"/{usr/,}etc/"},
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"user_share_dirs": {"/home/*/.local/share"},
|
||||
},
|
||||
Attachments: []string{},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if got := NewAppArmorProfile(tt.content); !reflect.DeepEqual(got, tt.want) {
|
||||
t.Errorf("NewAppArmorProfile() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_ParseVariables(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
content string
|
||||
want map[string][]string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
content: `@{firefox_name} = firefox{,-esr,-bin}
|
||||
@{firefox_lib_dirs} = /{usr/,}lib{,32,64}/@{firefox_name} /opt/@{firefox_name}
|
||||
@{firefox_config_dirs} = @{HOME}/.mozilla/
|
||||
@{firefox_cache_dirs} = @{user_cache_dirs}/mozilla/
|
||||
@{exec_path} = /{usr/,}bin/@{firefox_name} @{firefox_lib_dirs}/@{firefox_name}
|
||||
`,
|
||||
want: map[string][]string{
|
||||
"firefox_name": {"firefox{,-esr,-bin}"},
|
||||
"firefox_config_dirs": {"@{HOME}/.mozilla/"},
|
||||
"firefox_lib_dirs": {"/{usr/,}lib{,32,64}/@{firefox_name}", "/opt/@{firefox_name}"},
|
||||
"firefox_cache_dirs": {"@{user_cache_dirs}/mozilla/"},
|
||||
"exec_path": {"/{usr/,}bin/@{firefox_name}", "@{firefox_lib_dirs}/@{firefox_name}"},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "xorg",
|
||||
content: `@{exec_path} = /{usr/,}bin/X
|
||||
@{exec_path} += /{usr/,}bin/Xorg{,.bin}
|
||||
@{exec_path} += /{usr/,}lib/Xorg{,.wrap}
|
||||
@{exec_path} += /{usr/,}lib/xorg/Xorg{,.wrap}`,
|
||||
want: map[string][]string{
|
||||
"exec_path": {
|
||||
"/{usr/,}bin/X",
|
||||
"/{usr/,}bin/Xorg{,.bin}",
|
||||
"/{usr/,}lib/Xorg{,.wrap}",
|
||||
"/{usr/,}lib/xorg/Xorg{,.wrap}",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: tt.content,
|
||||
Variables: map[string][]string{},
|
||||
Attachments: []string{},
|
||||
}
|
||||
|
||||
p.ParseVariables()
|
||||
if !reflect.DeepEqual(p.Variables, tt.want) {
|
||||
t.Errorf("AppArmorProfile.ParseVariables() = %v, want %v", p.Variables, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_ResolveAttachments(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
variables map[string][]string
|
||||
want []string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
variables: map[string][]string{
|
||||
"firefox_name": {"firefox{,-esr,-bin}"},
|
||||
"firefox_lib_dirs": {"/{usr/,}/lib{,32,64}/@{firefox_name}", "/opt/@{firefox_name}"},
|
||||
"exec_path": {"/{usr/,}bin/@{firefox_name}", "@{firefox_lib_dirs}/@{firefox_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}bin/firefox{,-esr,-bin}",
|
||||
"/{usr/,}/lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
"/opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "chromium",
|
||||
variables: map[string][]string{
|
||||
"chromium_name": {"chromium"},
|
||||
"chromium_lib_dirs": {"/{usr/,}lib/@{chromium_name}"},
|
||||
"exec_path": {"@{chromium_lib_dirs}/@{chromium_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}lib/chromium/chromium",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "geoclue",
|
||||
variables: map[string][]string{
|
||||
"libexec": {"/{usr/,}libexec"},
|
||||
"exec_path": {"@{libexec}/geoclue", "@{libexec}/geoclue-2.0/demos/agent"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}libexec/geoclue",
|
||||
"/{usr/,}libexec/geoclue-2.0/demos/agent",
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "opera",
|
||||
variables: map[string][]string{
|
||||
"multiarch": {"*-linux-gnu*"},
|
||||
"chromium_name": {"opera{,-beta,-developer}"},
|
||||
"chromium_lib_dirs": {"/{usr/,}lib/@{multiarch}/@{chromium_name}"},
|
||||
"exec_path": {"@{chromium_lib_dirs}/@{chromium_name}"},
|
||||
},
|
||||
want: []string{
|
||||
"/{usr/,}lib/*-linux-gnu*/opera{,-beta,-developer}/opera{,-beta,-developer}",
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: tt.variables,
|
||||
Attachments: []string{},
|
||||
}
|
||||
p.ResolveAttachments()
|
||||
if !reflect.DeepEqual(p.Attachments, tt.want) {
|
||||
t.Errorf("AppArmorProfile.ResolveAttachments() = %v, want %v", p.Attachments, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAppArmorProfile_NestAttachments(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
Attachments []string
|
||||
want string
|
||||
}{
|
||||
{
|
||||
name: "firefox",
|
||||
Attachments: []string{
|
||||
"/{usr/,}bin/firefox{,-esr,-bin}",
|
||||
"/{usr/,}lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
"/opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}",
|
||||
},
|
||||
want: "/{{usr/,}bin/firefox{,-esr,-bin},{usr/,}lib{,32,64}/firefox{,-esr,-bin}/firefox{,-esr,-bin},opt/firefox{,-esr,-bin}/firefox{,-esr,-bin}}",
|
||||
},
|
||||
{
|
||||
name: "geoclue",
|
||||
Attachments: []string{
|
||||
"/{usr/,}libexec/geoclue",
|
||||
"/{usr/,}libexec/geoclue-2.0/demos/agent",
|
||||
},
|
||||
want: "/{{usr/,}libexec/geoclue,{usr/,}libexec/geoclue-2.0/demos/agent}",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
p := &AppArmorProfile{
|
||||
Content: "",
|
||||
Variables: map[string][]string{},
|
||||
Attachments: tt.Attachments,
|
||||
}
|
||||
if got := p.NestAttachments(); got != tt.want {
|
||||
t.Errorf("AppArmorProfile.NestAttachments() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
47
pkg/util/os.go
Normal file
47
pkg/util/os.go
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
)
|
||||
|
||||
var osReleaseFile = "/etc/os-release"
|
||||
|
||||
var firstPartyDists = []string{"arch", "debian", "ubuntu", "opensuse", "whonix"}
|
||||
|
||||
func GetSupportedDistribution() (string, error) {
|
||||
dist, present := os.LookupEnv("DISTRIBUTION")
|
||||
if present {
|
||||
return dist, nil
|
||||
}
|
||||
|
||||
lines, err := paths.New(osReleaseFile).ReadFileAsLines()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
id := ""
|
||||
id_like := ""
|
||||
for _, line := range lines {
|
||||
item := strings.Split(line, "=")
|
||||
if item[0] == "ID" {
|
||||
id = strings.Split(strings.Trim(item[1], "\""), " ")[0]
|
||||
} else if item[0] == "ID_LIKE" {
|
||||
id_like = strings.Split(strings.Trim(item[1], "\""), " ")[0]
|
||||
}
|
||||
}
|
||||
|
||||
if InSlice(id, firstPartyDists) {
|
||||
return id, nil
|
||||
} else if InSlice(id_like, firstPartyDists) {
|
||||
return id_like, nil
|
||||
}
|
||||
return id, fmt.Errorf("%s is not a supported distribution", id)
|
||||
}
|
||||
137
pkg/util/os_test.go
Normal file
137
pkg/util/os_test.go
Normal file
|
|
@ -0,0 +1,137 @@
|
|||
// apparmor.d - Full set of apparmor profiles
|
||||
// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
// SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/arduino/go-paths-helper"
|
||||
)
|
||||
|
||||
const (
|
||||
Archlinux = `NAME="Arch Linux"
|
||||
PRETTY_NAME="Arch Linux"
|
||||
ID=arch
|
||||
BUILD_ID=rolling
|
||||
ANSI_COLOR="38;2;23;147;209"
|
||||
HOME_URL="https://archlinux.org/"
|
||||
DOCUMENTATION_URL="https://wiki.archlinux.org/"
|
||||
SUPPORT_URL="https://bbs.archlinux.org/"
|
||||
BUG_REPORT_URL="https://bugs.archlinux.org/"
|
||||
PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
|
||||
LOGO=archlinux-logo`
|
||||
|
||||
Ubuntu = `PRETTY_NAME="Ubuntu 22.04.2 LTS"
|
||||
NAME="Ubuntu"
|
||||
VERSION_ID="22.04"
|
||||
VERSION="22.04.2 LTS (Jammy Jellyfish)"
|
||||
VERSION_CODENAME=jammy
|
||||
ID=ubuntu
|
||||
ID_LIKE=debian
|
||||
HOME_URL="https://www.ubuntu.com/"
|
||||
SUPPORT_URL="https://help.ubuntu.com/"
|
||||
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
|
||||
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
|
||||
UBUNTU_CODENAME=jammy`
|
||||
|
||||
Debian = `PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
|
||||
NAME="Debian GNU/Linux"
|
||||
VERSION_ID="11"
|
||||
VERSION="11 (bullseye)"
|
||||
VERSION_CODENAME=bullseye
|
||||
ID=debian
|
||||
HOME_URL="https://www.debian.org/"
|
||||
SUPPORT_URL="https://www.debian.org/support"
|
||||
BUG_REPORT_URL="https://bugs.debian.org/"`
|
||||
|
||||
OpenSUSETumbleweed = `ID="opensuse-tumbleweed"
|
||||
ID_LIKE="opensuse suse"
|
||||
VERSION_ID="20230404"
|
||||
PRETTY_NAME="openSUSE Tumbleweed"
|
||||
ANSI_COLOR="0;32"
|
||||
CPE_NAME="cpe:/o:opensuse:tumbleweed:20230404"
|
||||
BUG_REPORT_URL="https://bugs.opensuse.org"
|
||||
HOME_URL="https://www.opensuse.org/"
|
||||
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
|
||||
LOGO="distributor-logo-Tumbleweed"`
|
||||
|
||||
ArcoLinux = `NAME=ArcoLinux
|
||||
ID=arcolinux
|
||||
ID_LIKE=arch
|
||||
BUILD_ID=rolling
|
||||
ANSI_COLOR="0;36"
|
||||
HOME_URL="https://arcolinux.info/"
|
||||
SUPPORT_URL="https://arcolinuxforum.com/"
|
||||
BUG_REPORT_URL="https://github.com/arcolinux"
|
||||
LOGO=arcolinux-hello`
|
||||
|
||||
Fedora = `NAME="Fedora Linux"
|
||||
VERSION="37 (Workstation Edition)"
|
||||
ID=fedora
|
||||
VERSION_ID=37
|
||||
VERSION_CODENAME=""
|
||||
PLATFORM_ID="platform:f37"
|
||||
PRETTY_NAME="Fedora Linux 37 (Workstation Edition)"
|
||||
ANSI_COLOR="0;38;2;60;110;180"
|
||||
LOGO=fedora-logo-icon`
|
||||
)
|
||||
|
||||
func TestGetSupportedDistribution(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
osRelease string
|
||||
want string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "Archlinux",
|
||||
osRelease: Archlinux,
|
||||
want: "arch",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Ubuntu",
|
||||
osRelease: Ubuntu,
|
||||
want: "ubuntu",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Debian",
|
||||
osRelease: Debian,
|
||||
want: "debian",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "OpenSUSE Tumbleweed",
|
||||
osRelease: OpenSUSETumbleweed,
|
||||
want: "opensuse",
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "Fedora",
|
||||
osRelease: Fedora,
|
||||
want: "fedora",
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
osReleaseFile = "os-release"
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
err := paths.New(osReleaseFile).WriteFile([]byte(tt.osRelease))
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
got, err := GetSupportedDistribution()
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("ReadLinuxDistribution() error = %v, wantErr %v", err, tt.wantErr)
|
||||
return
|
||||
}
|
||||
if got != tt.want {
|
||||
t.Errorf("ReadLinuxDistribution() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue