feat(aa): modify the apparmor struct to support multiple profiles and subprofile.
This commit is contained in:
Alexandre Pujol
parent
507002c660
commit
4b753210e7
12 changed files with 467 additions and 394 deletions
|
|
@ -6,6 +6,7 @@ package aa
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"bytes"
|
"bytes"
|
||||||
|
"maps"
|
||||||
"reflect"
|
"reflect"
|
||||||
"slices"
|
"slices"
|
||||||
"sort"
|
"sort"
|
||||||
|
|
@ -20,16 +21,16 @@ var MagicRoot = paths.New("/etc/apparmor.d")
|
||||||
// AppArmorProfiles represents a full set of apparmor profiles
|
// AppArmorProfiles represents a full set of apparmor profiles
|
||||||
type AppArmorProfiles map[string]*AppArmorProfile
|
type AppArmorProfiles map[string]*AppArmorProfile
|
||||||
|
|
||||||
// ApparmorProfile represents a full apparmor profile.
|
// ApparmorProfile represents a full apparmor profile file.
|
||||||
// Warning: close to the BNF grammar of apparmor profile but not exactly the same (yet):
|
// Warning: close to the BNF grammar of apparmor profile but not exactly the same (yet):
|
||||||
// - Some rules are not supported yet (subprofile, hat...)
|
// - Some rules are not supported yet (subprofile, hat...)
|
||||||
// - The structure is simplified as it only aims at writing profile, not parsing it.
|
// - The structure is simplified as it only aims at writing profile, not parsing it.
|
||||||
type AppArmorProfile struct {
|
type AppArmorProfile struct {
|
||||||
Preamble
|
Preamble
|
||||||
Profile
|
Profiles []*Profile
|
||||||
}
|
}
|
||||||
|
|
||||||
// Preamble section of a profile
|
// Preamble section of a profile file,
|
||||||
type Preamble struct {
|
type Preamble struct {
|
||||||
Abi []*Abi
|
Abi []*Abi
|
||||||
Includes []*Include
|
Includes []*Include
|
||||||
|
|
@ -37,13 +38,29 @@ type Preamble struct {
|
||||||
Variables []*Variable
|
Variables []*Variable
|
||||||
}
|
}
|
||||||
|
|
||||||
// Profile section of a profile
|
// Profile represent a single AppArmor profile.
|
||||||
type Profile struct {
|
type Profile struct {
|
||||||
|
Rule
|
||||||
|
Header
|
||||||
|
Rules Rules
|
||||||
|
}
|
||||||
|
|
||||||
|
type Header struct {
|
||||||
Name string
|
Name string
|
||||||
Attachments []string
|
Attachments []string
|
||||||
Attributes map[string]string
|
Attributes map[string]string
|
||||||
Flags []string
|
Flags []string
|
||||||
Rules Rules
|
}
|
||||||
|
|
||||||
|
func (r *Profile) Less(other any) bool {
|
||||||
|
return false // TBD
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *Profile) Equals(other any) bool {
|
||||||
|
o, _ := other.(*Profile)
|
||||||
|
return r.Name == o.Name && slices.Equal(r.Attachments, o.Attachments) &&
|
||||||
|
maps.Equal(r.Attributes, o.Attributes) &&
|
||||||
|
slices.Equal(r.Flags, o.Flags)
|
||||||
}
|
}
|
||||||
|
|
||||||
// ApparmorRule generic interface
|
// ApparmorRule generic interface
|
||||||
|
|
@ -68,8 +85,20 @@ func (p *AppArmorProfile) String() string {
|
||||||
return res.String()
|
return res.String()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// GetDefaultProfile ensure a profile is always present in the profile file and
|
||||||
|
// return it, as a default profile.
|
||||||
|
func (p *AppArmorProfile) GetDefaultProfile() *Profile {
|
||||||
|
if len(p.Profiles) == 0 {
|
||||||
|
p.Profiles = append(p.Profiles, &Profile{})
|
||||||
|
}
|
||||||
|
return p.Profiles[0]
|
||||||
|
}
|
||||||
|
|
||||||
// AddRule adds a new rule to the profile from a log map
|
// AddRule adds a new rule to the profile from a log map
|
||||||
func (p *AppArmorProfile) AddRule(log map[string]string) {
|
// See utils/apparmor/logparser.py for the format of the log map
|
||||||
|
func (profile *AppArmorProfile) AddRule(log map[string]string) {
|
||||||
|
p := profile.GetDefaultProfile()
|
||||||
|
|
||||||
// Generate profile flags and extra rules
|
// Generate profile flags and extra rules
|
||||||
switch log["error"] {
|
switch log["error"] {
|
||||||
case "-2":
|
case "-2":
|
||||||
|
|
@ -138,7 +167,8 @@ func (p *AppArmorProfile) AddRule(log map[string]string) {
|
||||||
|
|
||||||
// Sort the rules in the profile
|
// Sort the rules in the profile
|
||||||
// Follow: https://apparmor.pujol.io/development/guidelines/#guidelines
|
// Follow: https://apparmor.pujol.io/development/guidelines/#guidelines
|
||||||
func (p *AppArmorProfile) Sort() {
|
func (profile *AppArmorProfile) Sort() {
|
||||||
|
for _, p := range profile.Profiles {
|
||||||
sort.Slice(p.Rules, func(i, j int) bool {
|
sort.Slice(p.Rules, func(i, j int) bool {
|
||||||
typeOfI := reflect.TypeOf(p.Rules[i])
|
typeOfI := reflect.TypeOf(p.Rules[i])
|
||||||
typeOfJ := reflect.TypeOf(p.Rules[j])
|
typeOfJ := reflect.TypeOf(p.Rules[j])
|
||||||
|
|
@ -156,6 +186,7 @@ func (p *AppArmorProfile) Sort() {
|
||||||
return p.Rules[i].Less(p.Rules[j])
|
return p.Rules[i].Less(p.Rules[j])
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// MergeRules merge similar rules together.
|
// MergeRules merge similar rules together.
|
||||||
// Steps:
|
// Steps:
|
||||||
|
|
@ -163,7 +194,8 @@ func (p *AppArmorProfile) Sort() {
|
||||||
// - Merge rule access. Eg: for same path, 'r' and 'w' becomes 'rw'
|
// - Merge rule access. Eg: for same path, 'r' and 'w' becomes 'rw'
|
||||||
//
|
//
|
||||||
// Note: logs.regCleanLogs helps a lot to do a first cleaning
|
// Note: logs.regCleanLogs helps a lot to do a first cleaning
|
||||||
func (p *AppArmorProfile) MergeRules() {
|
func (profile *AppArmorProfile) MergeRules() {
|
||||||
|
for _, p := range profile.Profiles {
|
||||||
for i := 0; i < len(p.Rules); i++ {
|
for i := 0; i < len(p.Rules); i++ {
|
||||||
for j := i + 1; j < len(p.Rules); j++ {
|
for j := i + 1; j < len(p.Rules); j++ {
|
||||||
typeOfI := reflect.TypeOf(p.Rules[i])
|
typeOfI := reflect.TypeOf(p.Rules[i])
|
||||||
|
|
@ -180,11 +212,13 @@ func (p *AppArmorProfile) MergeRules() {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
// Format the profile for better readability before printing it.
|
// Format the profile for better readability before printing it.
|
||||||
// Follow: https://apparmor.pujol.io/development/guidelines/#the-file-block
|
// Follow: https://apparmor.pujol.io/development/guidelines/#the-file-block
|
||||||
func (p *AppArmorProfile) Format() {
|
func (profile *AppArmorProfile) Format() {
|
||||||
const prefixOwner = " "
|
const prefixOwner = " "
|
||||||
|
for _, p := range profile.Profiles {
|
||||||
hasOwnerRule := false
|
hasOwnerRule := false
|
||||||
for i := len(p.Rules) - 1; i > 0; i-- {
|
for i := len(p.Rules) - 1; i > 0; i-- {
|
||||||
j := i - 1
|
j := i - 1
|
||||||
|
|
@ -211,3 +245,4 @@ func (p *AppArmorProfile) Format() {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
|
||||||
|
|
@ -51,11 +51,13 @@ func TestAppArmorProfile_String(t *testing.T) {
|
||||||
Values: []string{"@{bin}/foo", "@{lib}/foo"},
|
Values: []string{"@{bin}/foo", "@{lib}/foo"},
|
||||||
}},
|
}},
|
||||||
},
|
},
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
|
Header: Header{
|
||||||
Name: "foo",
|
Name: "foo",
|
||||||
Attachments: []string{"@{exec_path}"},
|
Attachments: []string{"@{exec_path}"},
|
||||||
Attributes: map[string]string{"security.tagged": "allowed"},
|
Attributes: map[string]string{"security.tagged": "allowed"},
|
||||||
Flags: []string{"complain", "attach_disconnected"},
|
Flags: []string{"complain", "attach_disconnected"},
|
||||||
|
},
|
||||||
Rules: []ApparmorRule{
|
Rules: []ApparmorRule{
|
||||||
&Include{IsMagic: true, Path: "abstractions/base"},
|
&Include{IsMagic: true, Path: "abstractions/base"},
|
||||||
&Include{IsMagic: true, Path: "abstractions/nameservice-strict"},
|
&Include{IsMagic: true, Path: "abstractions/nameservice-strict"},
|
||||||
|
|
@ -108,7 +110,7 @@ func TestAppArmorProfile_String(t *testing.T) {
|
||||||
&File{Path: "@{sys}/devices/@{pci}/class", Access: "r"},
|
&File{Path: "@{sys}/devices/@{pci}/class", Access: "r"},
|
||||||
includeLocal1,
|
includeLocal1,
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
want: readprofile("tests/string.aa"),
|
want: readprofile("tests/string.aa"),
|
||||||
},
|
},
|
||||||
|
|
@ -132,72 +134,72 @@ func TestAppArmorProfile_AddRule(t *testing.T) {
|
||||||
name: "capability",
|
name: "capability",
|
||||||
log: capability1Log,
|
log: capability1Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{capability1},
|
Rules: []ApparmorRule{capability1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "network",
|
name: "network",
|
||||||
log: network1Log,
|
log: network1Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{network1},
|
Rules: []ApparmorRule{network1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "mount",
|
name: "mount",
|
||||||
log: mount2Log,
|
log: mount2Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{mount2},
|
Rules: []ApparmorRule{mount2},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "signal",
|
name: "signal",
|
||||||
log: signal1Log,
|
log: signal1Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{signal1},
|
Rules: []ApparmorRule{signal1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "ptrace",
|
name: "ptrace",
|
||||||
log: ptrace2Log,
|
log: ptrace2Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{ptrace2},
|
Rules: []ApparmorRule{ptrace2},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "unix",
|
name: "unix",
|
||||||
log: unix1Log,
|
log: unix1Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{unix1},
|
Rules: []ApparmorRule{unix1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "dbus",
|
name: "dbus",
|
||||||
log: dbus2Log,
|
log: dbus2Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{dbus2},
|
Rules: []ApparmorRule{dbus2},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "file",
|
name: "file",
|
||||||
log: file2Log,
|
log: file2Log,
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{file2},
|
Rules: []ApparmorRule{file2},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
@ -221,20 +223,20 @@ func TestAppArmorProfile_Sort(t *testing.T) {
|
||||||
{
|
{
|
||||||
name: "all",
|
name: "all",
|
||||||
origin: &AppArmorProfile{
|
origin: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{
|
Rules: []ApparmorRule{
|
||||||
file2, network1, includeLocal1, dbus2, signal1, ptrace1,
|
file2, network1, includeLocal1, dbus2, signal1, ptrace1,
|
||||||
capability2, file1, dbus1, unix2, signal2, mount2,
|
capability2, file1, dbus1, unix2, signal2, mount2,
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{
|
Rules: []ApparmorRule{
|
||||||
capability2, network1, mount2, signal1, signal2, ptrace1,
|
capability2, network1, mount2, signal1, signal2, ptrace1,
|
||||||
unix2, dbus2, dbus1, file1, file2, includeLocal1,
|
unix2, dbus2, dbus1, file1, file2, includeLocal1,
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
@ -258,14 +260,14 @@ func TestAppArmorProfile_MergeRules(t *testing.T) {
|
||||||
{
|
{
|
||||||
name: "all",
|
name: "all",
|
||||||
origin: &AppArmorProfile{
|
origin: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{capability1, capability1, network1, network1, file1, file1},
|
Rules: []ApparmorRule{capability1, capability1, network1, network1, file1, file1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
want: &AppArmorProfile{
|
want: &AppArmorProfile{
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
Rules: []ApparmorRule{capability1, network1, file1},
|
Rules: []ApparmorRule{capability1, network1, file1},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
@ -297,9 +299,11 @@ func TestAppArmorProfile_Integration(t *testing.T) {
|
||||||
Values: []string{"@{bin}/aa-status", "@{bin}/apparmor_status"},
|
Values: []string{"@{bin}/aa-status", "@{bin}/apparmor_status"},
|
||||||
}},
|
}},
|
||||||
},
|
},
|
||||||
Profile: Profile{
|
Profiles: []*Profile{{
|
||||||
|
Header: Header{
|
||||||
Name: "aa-status",
|
Name: "aa-status",
|
||||||
Attachments: []string{"@{exec_path}"},
|
Attachments: []string{"@{exec_path}"},
|
||||||
|
},
|
||||||
Rules: Rules{
|
Rules: Rules{
|
||||||
&Include{IfExists: true, IsMagic: true, Path: "local/aa-status"},
|
&Include{IfExists: true, IsMagic: true, Path: "local/aa-status"},
|
||||||
&Capability{Name: "dac_read_search"},
|
&Capability{Name: "dac_read_search"},
|
||||||
|
|
@ -316,7 +320,7 @@ func TestAppArmorProfile_Integration(t *testing.T) {
|
||||||
&Capability{Name: "sys_ptrace"},
|
&Capability{Name: "sys_ptrace"},
|
||||||
&Ptrace{Access: "read"},
|
&Ptrace{Access: "read"},
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
want: readprofile("apparmor.d/profiles-a-f/aa-status"),
|
want: readprofile("apparmor.d/profiles-a-f/aa-status"),
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -5,6 +5,7 @@
|
||||||
package aa
|
package aa
|
||||||
|
|
||||||
type Rlimit struct {
|
type Rlimit struct {
|
||||||
|
Rule
|
||||||
Key string
|
Key string
|
||||||
Op string
|
Op string
|
||||||
Value string
|
Value string
|
||||||
|
|
|
||||||
|
|
@ -64,6 +64,7 @@ var (
|
||||||
"iouring",
|
"iouring",
|
||||||
"dbus",
|
"dbus",
|
||||||
"file",
|
"file",
|
||||||
|
"profile",
|
||||||
"include_if_exists",
|
"include_if_exists",
|
||||||
}
|
}
|
||||||
ruleWeights = map[string]int{}
|
ruleWeights = map[string]int{}
|
||||||
|
|
|
||||||
|
|
@ -22,286 +22,6 @@
|
||||||
{{ "@{" }}{{ .Name }}{{ "} = " }}{{ join .Values }}
|
{{ "@{" }}{{ .Name }}{{ "} = " }}{{ join .Values }}
|
||||||
{{ end -}}
|
{{ end -}}
|
||||||
|
|
||||||
{{- if or .Name .Attachments .Attributes .Flags -}}
|
{{- range .Profiles -}}
|
||||||
{{- "profile" -}}
|
{{ template "profile" . }}
|
||||||
{{- with .Name -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Attachments -}}
|
|
||||||
{{ " " }}{{ join . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Attributes -}}
|
|
||||||
{{ " xattrs=(" }}{{ join . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Flags -}}
|
|
||||||
{{ " flags=(" }}{{ join . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{ " {\n" }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- $oldtype := "" -}}
|
|
||||||
{{- range .Rules -}}
|
|
||||||
{{- $type := typeof . -}}
|
|
||||||
{{- if eq $type "Rule" -}}
|
|
||||||
{{- "\n" -}}
|
|
||||||
{{- continue -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- if and (ne $type $oldtype) (ne $oldtype "") -}}
|
|
||||||
{{- "\n" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- indent "" -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Include" -}}
|
|
||||||
{{ template "include" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Rlimit" -}}
|
|
||||||
{{ "set rlimit " }}{{ .Key }} {{ .Op }} {{ .Value }}{{ "," }}{{ template "comment" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Capability" -}}
|
|
||||||
{{ template "qualifier" . }}{{ "capability " }}{{ .Name }}{{ "," }}{{ template "comment" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Network" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{ "network" }}
|
|
||||||
{{- with .Domain -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Type -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- else -}}
|
|
||||||
{{- with .Protocol -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Mount" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "mount" -}}
|
|
||||||
{{- with .FsType -}}
|
|
||||||
{{ " fstype=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Options -}}
|
|
||||||
{{ " options=(" }}{{ join . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Source -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .MountPoint -}}
|
|
||||||
{{ " -> " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Umount" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "umount" -}}
|
|
||||||
{{- with .FsType -}}
|
|
||||||
{{ " fstype=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Options -}}
|
|
||||||
{{ " options=(" }}{{ join . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .MountPoint -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Remount" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "remount" -}}
|
|
||||||
{{- with .FsType -}}
|
|
||||||
{{ " fstype=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Options -}}
|
|
||||||
{{ " options=(" }}{{ join . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .MountPoint -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "PivotRoot" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "pivot_root" -}}
|
|
||||||
{{- with .OldRoot -}}
|
|
||||||
{{ " oldroot=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .NewRoot -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .TargetProfile -}}
|
|
||||||
{{ " -> " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "ChangeProfile" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "change_profile" -}}
|
|
||||||
{{- with .ExecMode -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Exec -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .ProfileName -}}
|
|
||||||
{{ " -> " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Mqueue" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "mqueue" -}}
|
|
||||||
{{- with .Access -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Type -}}
|
|
||||||
{{ " type=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Label -}}
|
|
||||||
{{ " label=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Name -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Unix" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "unix" -}}
|
|
||||||
{{- with .Access -}}
|
|
||||||
{{ " (" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Type -}}
|
|
||||||
{{ " type=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Protocol -}}
|
|
||||||
{{ " protocol=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Address -}}
|
|
||||||
{{ " addr=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Label -}}
|
|
||||||
{{ " label=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- if and .PeerLabel .PeerAddr -}}
|
|
||||||
{{ " peer=(label=" }}{{ .PeerLabel }}{{ ", addr="}}{{ .PeerAddr }}{{ ")" }}
|
|
||||||
{{- else -}}
|
|
||||||
{{- with .PeerLabel -}}
|
|
||||||
{{ overindent "peer=(label=" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .PeerAddr -}}
|
|
||||||
{{ overindent "peer=(addr=" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Ptrace" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "ptrace" -}}
|
|
||||||
{{- with .Access -}}
|
|
||||||
{{ " (" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Peer -}}
|
|
||||||
{{ " peer=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Signal" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "signal" -}}
|
|
||||||
{{- with .Access -}}
|
|
||||||
{{ " (" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Set -}}
|
|
||||||
{{ " set=(" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Peer -}}
|
|
||||||
{{ " peer=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "Dbus" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- "dbus" -}}
|
|
||||||
{{- if eq .Access "bind" -}}
|
|
||||||
{{ " bind bus=" }}{{ .Bus }}{{ " name=" }}{{ .Name }}
|
|
||||||
{{- else -}}
|
|
||||||
{{- with .Access -}}
|
|
||||||
{{ " " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Bus -}}
|
|
||||||
{{ " bus=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Path -}}
|
|
||||||
{{ " path=" }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{ "\n" }}
|
|
||||||
{{- with .Interface -}}
|
|
||||||
{{ overindent "interface=" }}{{ . }}{{ "\n" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .Member -}}
|
|
||||||
{{ overindent "member=" }}{{ . }}{{ "\n" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- if and .PeerName .PeerLabel -}}
|
|
||||||
{{ overindent "peer=(name=" }}{{ .PeerName }}{{ ", label="}}{{ .PeerLabel }}{{ ")" }}
|
|
||||||
{{- else -}}
|
|
||||||
{{- with .PeerName -}}
|
|
||||||
{{ overindent "peer=(name=" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- with .PeerLabel -}}
|
|
||||||
{{ overindent "peer=(label=" }}{{ . }}{{ ")" }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if eq $type "File" -}}
|
|
||||||
{{- template "qualifier" . -}}
|
|
||||||
{{- if .Owner -}}
|
|
||||||
{{- "owner " -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- .Path -}}
|
|
||||||
{{- " " -}}
|
|
||||||
{{- with .Padding -}}
|
|
||||||
{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- .Access -}}
|
|
||||||
{{- with .Target -}}
|
|
||||||
{{ " -> " }}{{ . }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- "," -}}
|
|
||||||
{{- template "comment" . -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- "\n" -}}
|
|
||||||
{{- $oldtype = $type -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- if or .Name .Attachments .Attributes .Flags -}}
|
|
||||||
{{- "}\n" -}}
|
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
|
|
|
||||||
303
pkg/aa/templates/profile.j2
Normal file
303
pkg/aa/templates/profile.j2
Normal file
|
|
@ -0,0 +1,303 @@
|
||||||
|
{{- /* apparmor.d - Full set of apparmor profiles */ -}}
|
||||||
|
{{- /* Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io> */ -}}
|
||||||
|
{{- /* SPDX-License-Identifier: GPL-2.0-only */ -}}
|
||||||
|
|
||||||
|
{{- define "profile" -}}
|
||||||
|
|
||||||
|
{{- if or .Name .Attachments .Attributes .Flags -}}
|
||||||
|
{{- "profile" -}}
|
||||||
|
{{- with .Name -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Attachments -}}
|
||||||
|
{{ " " }}{{ join . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Attributes -}}
|
||||||
|
{{ " xattrs=(" }}{{ join . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Flags -}}
|
||||||
|
{{ " flags=(" }}{{ join . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{ " {" }}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- "\n" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- $oldtype := "" -}}
|
||||||
|
{{- range .Rules -}}
|
||||||
|
{{- $type := typeof . -}}
|
||||||
|
{{- if eq $type "Rule" -}}
|
||||||
|
{{- "\n" -}}
|
||||||
|
{{- continue -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if and (ne $type $oldtype) (ne $oldtype "") -}}
|
||||||
|
{{- "\n" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- indent "" -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Include" -}}
|
||||||
|
{{ template "include" . }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Rlimit" -}}
|
||||||
|
{{ "set rlimit " }}{{ .Key }} {{ .Op }} {{ .Value }}{{ "," }}{{ template "comment" . }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Userns" -}}
|
||||||
|
{{- if .Create -}}
|
||||||
|
{{ template "qualifier" . }}{{ "userns," }}{{ template "comment" . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Capability" -}}
|
||||||
|
{{ template "qualifier" . }}{{ "capability " }}{{ .Name }}{{ "," }}{{ template "comment" . }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Network" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{ "network" }}
|
||||||
|
{{- with .Domain -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Type -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- with .Protocol -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Mount" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "mount" -}}
|
||||||
|
{{- with .FsType -}}
|
||||||
|
{{ " fstype=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Options -}}
|
||||||
|
{{ " options=(" }}{{ join . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Source -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .MountPoint -}}
|
||||||
|
{{ " -> " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Umount" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "umount" -}}
|
||||||
|
{{- with .FsType -}}
|
||||||
|
{{ " fstype=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Options -}}
|
||||||
|
{{ " options=(" }}{{ join . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .MountPoint -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Remount" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "remount" -}}
|
||||||
|
{{- with .FsType -}}
|
||||||
|
{{ " fstype=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Options -}}
|
||||||
|
{{ " options=(" }}{{ join . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .MountPoint -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "PivotRoot" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "pivot_root" -}}
|
||||||
|
{{- with .OldRoot -}}
|
||||||
|
{{ " oldroot=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .NewRoot -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .TargetProfile -}}
|
||||||
|
{{ " -> " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "ChangeProfile" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "change_profile" -}}
|
||||||
|
{{- with .ExecMode -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Exec -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .ProfileName -}}
|
||||||
|
{{ " -> " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Mqueue" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "mqueue" -}}
|
||||||
|
{{- with .Access -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Type -}}
|
||||||
|
{{ " type=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Label -}}
|
||||||
|
{{ " label=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Name -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Unix" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "unix" -}}
|
||||||
|
{{- with .Access -}}
|
||||||
|
{{ " (" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Type -}}
|
||||||
|
{{ " type=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Protocol -}}
|
||||||
|
{{ " protocol=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Address -}}
|
||||||
|
{{ " addr=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Label -}}
|
||||||
|
{{ " label=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if and .PeerLabel .PeerAddr -}}
|
||||||
|
{{ " peer=(label=" }}{{ .PeerLabel }}{{ ", addr="}}{{ .PeerAddr }}{{ ")" }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- with .PeerLabel -}}
|
||||||
|
{{ overindent "peer=(label=" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .PeerAddr -}}
|
||||||
|
{{ overindent "peer=(addr=" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Ptrace" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "ptrace" -}}
|
||||||
|
{{- with .Access -}}
|
||||||
|
{{ " (" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Peer -}}
|
||||||
|
{{ " peer=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Signal" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "signal" -}}
|
||||||
|
{{- with .Access -}}
|
||||||
|
{{ " (" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Set -}}
|
||||||
|
{{ " set=(" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Peer -}}
|
||||||
|
{{ " peer=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Dbus" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- "dbus" -}}
|
||||||
|
{{- if eq .Access "bind" -}}
|
||||||
|
{{ " bind bus=" }}{{ .Bus }}{{ " name=" }}{{ .Name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- with .Access -}}
|
||||||
|
{{ " " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Bus -}}
|
||||||
|
{{ " bus=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Path -}}
|
||||||
|
{{ " path=" }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{ "\n" }}
|
||||||
|
{{- with .Interface -}}
|
||||||
|
{{ overindent "interface=" }}{{ . }}{{ "\n" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .Member -}}
|
||||||
|
{{ overindent "member=" }}{{ . }}{{ "\n" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if and .PeerName .PeerLabel -}}
|
||||||
|
{{ overindent "peer=(name=" }}{{ .PeerName }}{{ ", label="}}{{ .PeerLabel }}{{ ")" }}
|
||||||
|
{{- else -}}
|
||||||
|
{{- with .PeerName -}}
|
||||||
|
{{ overindent "peer=(name=" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- with .PeerLabel -}}
|
||||||
|
{{ overindent "peer=(label=" }}{{ . }}{{ ")" }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "File" -}}
|
||||||
|
{{- template "qualifier" . -}}
|
||||||
|
{{- if .Owner -}}
|
||||||
|
{{- "owner " -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- .Path -}}
|
||||||
|
{{- " " -}}
|
||||||
|
{{- with .Padding -}}
|
||||||
|
{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- .Access -}}
|
||||||
|
{{- with .Target -}}
|
||||||
|
{{ " -> " }}{{ . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- "," -}}
|
||||||
|
{{- template "comment" . -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if eq $type "Profile" -}}
|
||||||
|
{{ template "profile" . }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- "\n" -}}
|
||||||
|
{{- $oldtype = $type -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if or .Name .Attachments .Attributes .Flags -}}
|
||||||
|
{{- "}\n" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- end -}}
|
||||||
|
|
@ -83,11 +83,13 @@ func (p *AppArmorProfile) resolve(str string) []string {
|
||||||
}
|
}
|
||||||
|
|
||||||
// ResolveAttachments resolve profile attachments defined in exec_path
|
// ResolveAttachments resolve profile attachments defined in exec_path
|
||||||
func (p *AppArmorProfile) ResolveAttachments() {
|
func (profile *AppArmorProfile) ResolveAttachments() {
|
||||||
for _, variable := range p.Variables {
|
p := profile.GetDefaultProfile()
|
||||||
|
|
||||||
|
for _, variable := range profile.Variables {
|
||||||
if variable.Name == "exec_path" {
|
if variable.Name == "exec_path" {
|
||||||
for _, value := range variable.Values {
|
for _, value := range variable.Values {
|
||||||
attachments := p.resolve(value)
|
attachments := profile.resolve(value)
|
||||||
if len(attachments) == 0 {
|
if len(attachments) == 0 {
|
||||||
panic("Variable not defined in: " + value)
|
panic("Variable not defined in: " + value)
|
||||||
}
|
}
|
||||||
|
|
@ -98,7 +100,8 @@ func (p *AppArmorProfile) ResolveAttachments() {
|
||||||
}
|
}
|
||||||
|
|
||||||
// NestAttachments return a nested attachment string
|
// NestAttachments return a nested attachment string
|
||||||
func (p *AppArmorProfile) NestAttachments() string {
|
func (profile *AppArmorProfile) NestAttachments() string {
|
||||||
|
p := profile.GetDefaultProfile()
|
||||||
if len(p.Attachments) == 0 {
|
if len(p.Attachments) == 0 {
|
||||||
return ""
|
return ""
|
||||||
} else if len(p.Attachments) == 1 {
|
} else if len(p.Attachments) == 1 {
|
||||||
|
|
|
||||||
|
|
@ -193,8 +193,9 @@ func TestAppArmorProfile_ResolveAttachments(t *testing.T) {
|
||||||
p := NewAppArmorProfile()
|
p := NewAppArmorProfile()
|
||||||
p.Variables = tt.variables
|
p.Variables = tt.variables
|
||||||
p.ResolveAttachments()
|
p.ResolveAttachments()
|
||||||
if !reflect.DeepEqual(p.Attachments, tt.want) {
|
profile := p.GetDefaultProfile()
|
||||||
t.Errorf("AppArmorProfile.ResolveAttachments() = %v, want %v", p.Attachments, tt.want)
|
if !reflect.DeepEqual(profile.Attachments, tt.want) {
|
||||||
|
t.Errorf("AppArmorProfile.ResolveAttachments() = %v, want %v", profile.Attachments, tt.want)
|
||||||
}
|
}
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
@ -242,7 +243,8 @@ func TestAppArmorProfile_NestAttachments(t *testing.T) {
|
||||||
for _, tt := range tests {
|
for _, tt := range tests {
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
p := NewAppArmorProfile()
|
p := NewAppArmorProfile()
|
||||||
p.Attachments = tt.Attachments
|
profile := p.GetDefaultProfile()
|
||||||
|
profile.Attachments = tt.Attachments
|
||||||
if got := p.NestAttachments(); got != tt.want {
|
if got := p.NestAttachments(); got != tt.want {
|
||||||
t.Errorf("AppArmorProfile.NestAttachments() = %v, want %v", got, tt.want)
|
t.Errorf("AppArmorProfile.NestAttachments() = %v, want %v", got, tt.want)
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -208,8 +208,9 @@ func (aaLogs AppArmorLogs) ParseToProfiles() aa.AppArmorProfiles {
|
||||||
}
|
}
|
||||||
|
|
||||||
if _, ok := profiles[name]; !ok {
|
if _, ok := profiles[name]; !ok {
|
||||||
profile := &aa.AppArmorProfile{}
|
profile := &aa.AppArmorProfile{
|
||||||
profile.Name = name
|
Profiles: []*aa.Profile{{Header: aa.Header{Name: name}}},
|
||||||
|
}
|
||||||
profile.AddRule(log)
|
profile.AddRule(log)
|
||||||
profiles[name] = profile
|
profiles[name] = profile
|
||||||
} else {
|
} else {
|
||||||
|
|
|
||||||
|
|
@ -299,8 +299,8 @@ func TestAppArmorLogs_ParseToProfiles(t *testing.T) {
|
||||||
aaLogs: append(append(refKmod, refPowerProfiles...), refKmod...),
|
aaLogs: append(append(refKmod, refPowerProfiles...), refKmod...),
|
||||||
want: aa.AppArmorProfiles{
|
want: aa.AppArmorProfiles{
|
||||||
"kmod": &aa.AppArmorProfile{
|
"kmod": &aa.AppArmorProfile{
|
||||||
Profile: aa.Profile{
|
Profiles: []*aa.Profile{{
|
||||||
Name: "kmod",
|
Header: aa.Header{Name: "kmod"},
|
||||||
Rules: aa.Rules{
|
Rules: aa.Rules{
|
||||||
&aa.Unix{
|
&aa.Unix{
|
||||||
Rule: aa.Rule{FileInherit: true},
|
Rule: aa.Rule{FileInherit: true},
|
||||||
|
|
@ -315,11 +315,11 @@ func TestAppArmorLogs_ParseToProfiles(t *testing.T) {
|
||||||
Protocol: "0",
|
Protocol: "0",
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
"power-profiles-daemon": &aa.AppArmorProfile{
|
"power-profiles-daemon": &aa.AppArmorProfile{
|
||||||
Profile: aa.Profile{
|
Profiles: []*aa.Profile{{
|
||||||
Name: "power-profiles-daemon",
|
Header: aa.Header{Name: "power-profiles-daemon"},
|
||||||
Rules: aa.Rules{
|
Rules: aa.Rules{
|
||||||
&aa.Dbus{
|
&aa.Dbus{
|
||||||
Access: "send",
|
Access: "send",
|
||||||
|
|
@ -331,7 +331,7 @@ func TestAppArmorLogs_ParseToProfiles(t *testing.T) {
|
||||||
PeerLabel: "dbus-daemon",
|
PeerLabel: "dbus-daemon",
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
},
|
}},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -97,7 +97,8 @@ func (d Dbus) sanityCheck(opt *Option) string {
|
||||||
|
|
||||||
func (d Dbus) own(rules map[string]string) *aa.AppArmorProfile {
|
func (d Dbus) own(rules map[string]string) *aa.AppArmorProfile {
|
||||||
interfaces := setInterfaces(rules)
|
interfaces := setInterfaces(rules)
|
||||||
p := &aa.AppArmorProfile{}
|
profile := &aa.AppArmorProfile{}
|
||||||
|
p := profile.GetDefaultProfile()
|
||||||
p.Rules = append(p.Rules, &aa.Dbus{
|
p.Rules = append(p.Rules, &aa.Dbus{
|
||||||
Access: "bind", Bus: rules["bus"], Name: rules["name"],
|
Access: "bind", Bus: rules["bus"], Name: rules["name"],
|
||||||
})
|
})
|
||||||
|
|
@ -127,12 +128,13 @@ func (d Dbus) own(rules map[string]string) *aa.AppArmorProfile {
|
||||||
Member: "Introspect",
|
Member: "Introspect",
|
||||||
PeerName: `":1.@{int}"`,
|
PeerName: `":1.@{int}"`,
|
||||||
})
|
})
|
||||||
return p
|
return profile
|
||||||
}
|
}
|
||||||
|
|
||||||
func (d Dbus) talk(rules map[string]string) *aa.AppArmorProfile {
|
func (d Dbus) talk(rules map[string]string) *aa.AppArmorProfile {
|
||||||
interfaces := setInterfaces(rules)
|
interfaces := setInterfaces(rules)
|
||||||
p := &aa.AppArmorProfile{}
|
profile := &aa.AppArmorProfile{}
|
||||||
|
p := profile.GetDefaultProfile()
|
||||||
for _, iface := range interfaces {
|
for _, iface := range interfaces {
|
||||||
p.Rules = append(p.Rules, &aa.Dbus{
|
p.Rules = append(p.Rules, &aa.Dbus{
|
||||||
Access: "send",
|
Access: "send",
|
||||||
|
|
@ -153,5 +155,5 @@ func (d Dbus) talk(rules map[string]string) *aa.AppArmorProfile {
|
||||||
PeerLabel: rules["label"],
|
PeerLabel: rules["label"],
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
return p
|
return profile
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -27,7 +27,7 @@ func init() {
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
func (d Exec) Apply(opt *Option, profile string) string {
|
func (d Exec) Apply(opt *Option, profileRaw string) string {
|
||||||
transition := "Px"
|
transition := "Px"
|
||||||
transitions := []string{"P", "U", "p", "u", "PU", "pu"}
|
transitions := []string{"P", "U", "p", "u", "PU", "pu"}
|
||||||
t := opt.ArgList[0]
|
t := opt.ArgList[0]
|
||||||
|
|
@ -36,7 +36,8 @@ func (d Exec) Apply(opt *Option, profile string) string {
|
||||||
delete(opt.ArgMap, t)
|
delete(opt.ArgMap, t)
|
||||||
}
|
}
|
||||||
|
|
||||||
p := &aa.AppArmorProfile{}
|
profile := &aa.AppArmorProfile{}
|
||||||
|
p := profile.GetDefaultProfile()
|
||||||
for name := range opt.ArgMap {
|
for name := range opt.ArgMap {
|
||||||
profiletoTransition := util.MustReadFile(cfg.RootApparmord.Join(name))
|
profiletoTransition := util.MustReadFile(cfg.RootApparmord.Join(name))
|
||||||
dstProfile := aa.DefaultTunables()
|
dstProfile := aa.DefaultTunables()
|
||||||
|
|
@ -53,9 +54,9 @@ func (d Exec) Apply(opt *Option, profile string) string {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
p.Sort()
|
profile.Sort()
|
||||||
rules := p.String()
|
rules := profile.String()
|
||||||
lenRules := len(rules)
|
lenRules := len(rules)
|
||||||
rules = rules[:lenRules-1]
|
rules = rules[:lenRules-1]
|
||||||
return strings.Replace(profile, opt.Raw, rules, -1)
|
return strings.Replace(profileRaw, opt.Raw, rules, -1)
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue