From 7f904d030ccd49b358f3d1878822c3bf3e5b0e71 Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 12 Apr 2025 22:47:33 +0200
Subject: [PATCH] feat(profile): add base mappings definition.

Used by profiles before to confine pre login script bfore transitionning to user hat.

It should only be enabled when mapping is enabled as otherwise the shell is not confined.
---
 apparmor.d/mappings/login/base | 30 ++++++++++++++++++++++++++++++
 apparmor.d/mappings/sshd/base  | 30 ++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 apparmor.d/mappings/login/base
 create mode 100644 apparmor.d/mappings/sshd/base

diff --git a/apparmor.d/mappings/login/base b/apparmor.d/mappings/login/base
new file mode 100644
index 000000000..f74b90418
--- /dev/null
+++ b/apparmor.d/mappings/login/base
@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# It is used by login to run pre login scripts (as root) such as the motd.
+# After the login, Apparmor libpam will transition to the roles defined in
+# other files under <mappings/login>
+
+  @{shells_path} rCx -> shell,
+
+  profile shell flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/shells>
+
+    @{shells_path}    rix,
+    @{bin}/env        rix,
+    @{bin}/run-parts  rix, #aa:only apt
+
+    #aa:only apt
+    /etc/update-motd.d/ r,
+    /etc/update-motd.d/*                            rPx,
+    /usr/share/landscape/landscape-sysinfo.wrapper  rPx,
+
+    @{run}/motd.dynamic.new rw,  #aa:only apt
+
+    include if exists <local/mappings/login/shell>
+  }
+
+# vim:syntax=apparmor
diff --git a/apparmor.d/mappings/sshd/base b/apparmor.d/mappings/sshd/base
new file mode 100644
index 000000000..dd9218d9c
--- /dev/null
+++ b/apparmor.d/mappings/sshd/base
@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# It is used by login to run pre login scripts (as root) such as the motd.
+# After the login, Apparmor libpam will transition to the roles defined in
+# other files under <mappings/login>
+
+  @{shells_path} rCx -> shell,
+
+  profile shell flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/shells>
+
+    @{shells_path}    rix,
+    @{bin}/env        rix,
+    @{bin}/run-parts  rix, #aa:only apt
+
+    #aa:only apt
+    /etc/update-motd.d/ r,
+    /etc/update-motd.d/*                            rPx,
+    /usr/share/landscape/landscape-sysinfo.wrapper  rPx,
+
+    @{run}/motd.dynamic.new rw,  #aa:only apt
+
+    include if exists <local/mappings/sshd/shell>
+  }
+
+# vim:syntax=apparmor