feat(aa): rename the main profile struct.

pkg/aa/apparmor.go

@@ -0,0 +1,214 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package aa
+
+import (
+	"bytes"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/arduino/go-paths-helper"
+)
+
+// Default Apparmor magic directory: /etc/apparmor.d/.
+var MagicRoot = paths.New("/etc/apparmor.d")
+
+// AppArmorProfileFiles represents a full set of apparmor profiles
+type AppArmorProfileFiles map[string]*AppArmorProfileFile
+
+// AppArmorProfileFile represents a full apparmor profile file.
+// Warning: close to the BNF grammar of apparmor profile but not exactly the same (yet):
+//   - Some rules are not supported yet (subprofile, hat...)
+//   - The structure is simplified as it only aims at writing profile, not parsing it.
+type AppArmorProfileFile struct {
+	Preamble
+	Profiles []*Profile
+}
+
+// Preamble section of a profile file,
+type Preamble struct {
+	Abi       []*Abi
+	Includes  []*Include
+	Aliases   []*Alias
+	Variables []*Variable
+}
+
+func NewAppArmorProfile() *AppArmorProfileFile {
+	return &AppArmorProfileFile{}
+}
+
+// String returns the formatted representation of a profile as a string
+func (f *AppArmorProfileFile) String() string {
+	var res bytes.Buffer
+	err := tmplAppArmorProfile.Execute(&res, f)
+	if err != nil {
+		return err.Error()
+	}
+	return res.String()
+}
+
+// GetDefaultProfile ensure a profile is always present in the profile file and
+// return it, as a default profile.
+func (f *AppArmorProfileFile) GetDefaultProfile() *Profile {
+	if len(f.Profiles) == 0 {
+		f.Profiles = append(f.Profiles, &Profile{})
+	}
+	return f.Profiles[0]
+}
+
+// AddRule adds a new rule to the profile from a log map
+// See utils/apparmor/logparser.py for the format of the log map
+func (f *AppArmorProfileFile) AddRule(log map[string]string) {
+	p := f.GetDefaultProfile()
+
+	// Generate profile flags and extra rules
+	switch log["error"] {
+	case "-2":
+		if !slices.Contains(p.Flags, "mediate_deleted") {
+			p.Flags = append(p.Flags, "mediate_deleted")
+		}
+	case "-13":
+		if strings.Contains(log["info"], "namespace creation restricted") {
+			p.Rules = append(p.Rules, newUsernsFromLog(log))
+		} else if strings.Contains(log["info"], "disconnected path") && !slices.Contains(p.Flags, "attach_disconnected") {
+			p.Flags = append(p.Flags, "attach_disconnected")
+		}
+	default:
+	}
+
+	switch log["class"] {
+	case "cap":
+		p.Rules = append(p.Rules, newCapabilityFromLog(log))
+	case "net":
+		if log["family"] == "unix" {
+			p.Rules = append(p.Rules, newUnixFromLog(log))
+		} else {
+			p.Rules = append(p.Rules, newNetworkFromLog(log))
+		}
+	case "mount":
+		if strings.Contains(log["flags"], "remount") {
+			p.Rules = append(p.Rules, newRemountFromLog(log))
+		} else {
+			switch log["operation"] {
+			case "mount":
+				p.Rules = append(p.Rules, newMountFromLog(log))
+			case "umount":
+				p.Rules = append(p.Rules, newUmountFromLog(log))
+			case "remount":
+				p.Rules = append(p.Rules, newRemountFromLog(log))
+			case "pivotroot":
+				p.Rules = append(p.Rules, newPivotRootFromLog(log))
+			}
+		}
+	case "posix_mqueue", "sysv_mqueue":
+		p.Rules = append(p.Rules, newMqueueFromLog(log))
+	case "signal":
+		p.Rules = append(p.Rules, newSignalFromLog(log))
+	case "ptrace":
+		p.Rules = append(p.Rules, newPtraceFromLog(log))
+	case "namespace":
+		p.Rules = append(p.Rules, newUsernsFromLog(log))
+	case "unix":
+		p.Rules = append(p.Rules, newUnixFromLog(log))
+	case "dbus":
+		p.Rules = append(p.Rules, newDbusFromLog(log))
+	case "file":
+		if log["operation"] == "change_onexec" {
+			p.Rules = append(p.Rules, newChangeProfileFromLog(log))
+		} else {
+			p.Rules = append(p.Rules, newFileFromLog(log))
+		}
+	default:
+		if strings.Contains(log["operation"], "dbus") {
+			p.Rules = append(p.Rules, newDbusFromLog(log))
+		} else if log["family"] == "unix" {
+			p.Rules = append(p.Rules, newUnixFromLog(log))
+		}
+	}
+}
+
+// Sort the rules in the profile
+// Follow: https://apparmor.pujol.io/development/guidelines/#guidelines
+func (f *AppArmorProfileFile) Sort() {
+	for _, p := range f.Profiles {
+		sort.Slice(p.Rules, func(i, j int) bool {
+			typeOfI := reflect.TypeOf(p.Rules[i])
+			typeOfJ := reflect.TypeOf(p.Rules[j])
+			if typeOfI != typeOfJ {
+				valueOfI := typeToValue(typeOfI)
+				valueOfJ := typeToValue(typeOfJ)
+				if typeOfI == reflect.TypeOf((*Include)(nil)) && p.Rules[i].(*Include).IfExists {
+					valueOfI = "include_if_exists"
+				}
+				if typeOfJ == reflect.TypeOf((*Include)(nil)) && p.Rules[j].(*Include).IfExists {
+					valueOfJ = "include_if_exists"
+				}
+				return ruleWeights[valueOfI] < ruleWeights[valueOfJ]
+			}
+			return p.Rules[i].Less(p.Rules[j])
+		})
+	}
+}
+
+// MergeRules merge similar rules together.
+// Steps:
+//   - Remove identical rules
+//   - Merge rule access. Eg: for same path, 'r' and 'w' becomes 'rw'
+//
+// Note: logs.regCleanLogs helps a lot to do a first cleaning
+func (f *AppArmorProfileFile) MergeRules() {
+	for _, p := range f.Profiles {
+		for i := 0; i < len(p.Rules); i++ {
+			for j := i + 1; j < len(p.Rules); j++ {
+				typeOfI := reflect.TypeOf(p.Rules[i])
+				typeOfJ := reflect.TypeOf(p.Rules[j])
+				if typeOfI != typeOfJ {
+					continue
+				}
+
+				// If rules are identical, merge them
+				if p.Rules[i].Equals(p.Rules[j]) {
+					p.Rules = append(p.Rules[:j], p.Rules[j+1:]...)
+					j--
+				}
+			}
+		}
+	}
+}
+
+// Format the profile for better readability before printing it.
+// Follow: https://apparmor.pujol.io/development/guidelines/#the-file-block
+func (f *AppArmorProfileFile) Format() {
+	const prefixOwner = "      "
+	for _, p := range f.Profiles {
+		hasOwnerRule := false
+		for i := len(p.Rules) - 1; i > 0; i-- {
+			j := i - 1
+			typeOfI := reflect.TypeOf(p.Rules[i])
+			typeOfJ := reflect.TypeOf(p.Rules[j])
+
+			// File rule
+			if typeOfI == reflect.TypeOf((*File)(nil)) && typeOfJ == reflect.TypeOf((*File)(nil)) {
+				letterI := getLetterIn(fileAlphabet, p.Rules[i].(*File).Path)
+				letterJ := getLetterIn(fileAlphabet, p.Rules[j].(*File).Path)
+
+				// Add prefix before rule path to align with other rule
+				if p.Rules[i].(*File).Owner {
+					hasOwnerRule = true
+				} else if hasOwnerRule {
+					p.Rules[i].(*File).Prefix = prefixOwner
+				}
+
+				if letterI != letterJ {
+					// Add a new empty line between Files rule of different type
+					hasOwnerRule = false
+					p.Rules = append(p.Rules[:i], append([]ApparmorRule{&Rule{}}, p.Rules[i:]...)...)
+				}
+			}
+		}
+	}
+}