feat(prebuild): make prebuild available as an external package.

Usefull for downstream repo.

pkg/prebuild/build.go

@@ -0,0 +1,65 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/roddhjav/apparmor.d/pkg/aa"
+	"golang.org/x/exp/slices"
+)
+
+// Build the profiles with the following build tasks
+var Builds = []BuildFunc{
+	BuildUserspace,
+}
+
+var (
+	regABI           = regexp.MustCompile(`abi <abi/[0-9.]*>,\n`)
+	regAttachments   = regexp.MustCompile(`(profile .* @{exec_path})`)
+	regFlag          = regexp.MustCompile(`flags=\(([^)]+)\)`)
+	regProfileHeader = regexp.MustCompile(` {`)
+)
+
+type BuildFunc func(string) string
+
+// Set complain flag on all profiles
+func BuildComplain(profile string) string {
+
+	flags := []string{}
+	matches := regFlag.FindStringSubmatch(profile)
+	if len(matches) != 0 {
+		flags = strings.Split(matches[1], ",")
+		if slices.Contains(flags, "complain") {
+			return profile
+		}
+	}
+	flags = append(flags, "complain")
+	strFlags := " flags=(" + strings.Join(flags, ",") + ") {"
+
+	// Remove all flags definition, then set manifest' flags
+	profile = regFlag.ReplaceAllLiteralString(profile, "")
+	return regProfileHeader.ReplaceAllLiteralString(profile, strFlags)
+}
+
+// Bypass userspace tools restriction
+func BuildUserspace(profile string) string {
+	p := aa.NewAppArmorProfile(profile)
+	p.ParseVariables()
+	p.ResolveAttachments()
+	att := p.NestAttachments()
+	matches := regAttachments.FindAllString(profile, -1)
+	if len(matches) > 0 {
+		strheader := strings.Replace(matches[0], "@{exec_path}", att, -1)
+		return regAttachments.ReplaceAllLiteralString(profile, strheader)
+	}
+	return profile
+}
+
+// Remove abi header for distributions that do not support it
+func BuildABI(profile string) string {
+	return regABI.ReplaceAllLiteralString(profile, "")
+}

pkg/prebuild/prebuild.go

@@ -0,0 +1,50 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"github.com/arduino/go-paths-helper"
+)
+
+var (
+	Distribution  string
+	DistDir       *paths.Path
+	Root          *paths.Path
+	RootApparmord *paths.Path
+)
+
+func init() {
+	DistDir = paths.New("dists")
+	Root = paths.New(".build")
+	RootApparmord = Root.Join("apparmor.d")
+	Distribution = getSupportedDistribution()
+}
+
+func Prepare() error {
+	for _, fct := range Prepares {
+		if err := fct(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func Build() error {
+	files, _ := RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories())
+	for _, file := range files {
+		if !file.Exist() {
+			continue
+		}
+		content, _ := file.ReadFile()
+		profile := string(content)
+		for _, fct := range Builds {
+			profile = fct(profile)
+		}
+		if err := file.WriteFile([]byte(profile)); err != nil {
+			panic(err)
+		}
+	}
+	return nil
+}

pkg/prebuild/prebuild_test.go

@@ -0,0 +1,87 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+)
+
+func chdirGitRoot() {
+	cmd := exec.Command("git", "rev-parse", "--show-toplevel")
+	out, err := cmd.Output()
+	if err != nil {
+		panic(err)
+	}
+	root := string(out)[0 : len(out)-1]
+	if err := os.Chdir(root); err != nil {
+		panic(err)
+	}
+}
+
+func Test_PreBuild(t *testing.T) {
+	tests := []struct {
+		name     string
+		wantErr  bool
+		full     bool
+		complain bool
+		dist     string
+	}{
+		{
+			name:     "Build for Archlinux",
+			wantErr:  false,
+			full:     false,
+			complain: true,
+			dist:     "arch",
+		},
+		{
+			name:     "Build for Ubuntu",
+			wantErr:  false,
+			full:     true,
+			complain: false,
+			dist:     "ubuntu",
+		},
+		{
+			name:     "Build for Debian",
+			wantErr:  false,
+			full:     true,
+			complain: false,
+			dist:     "debian",
+		},
+		{
+			name:     "Build for OpenSUSE Tumbleweed",
+			wantErr:  false,
+			full:     true,
+			complain: true,
+			dist:     "opensuse",
+		},
+		// {
+		// 	name:     "Build for Fedora",
+		// 	wantErr:  true,
+		// 	full:     false,
+		// 	complain: false,
+		// 	dist:     "fedora",
+		// },
+	}
+	chdirGitRoot()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Distribution = tt.dist
+			if tt.full {
+				Prepares = append(Prepares, SetFullSystemPolicy)
+			}
+			if tt.complain {
+				Builds = append(Builds, BuildComplain)
+			}
+			if err := Prepare(); (err != nil) != tt.wantErr {
+				t.Errorf("Prepare() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if err := Build(); (err != nil) != tt.wantErr {
+				t.Errorf("Build() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

pkg/prebuild/prepare.go

@@ -0,0 +1,204 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/arduino/go-paths-helper"
+	"github.com/roddhjav/apparmor.d/pkg/logging"
+)
+
+// Prepare the build directory with the following tasks
+var Prepares = []PrepareFunc{
+	Synchronise,
+	Ignore,
+	Merge,
+	Configure,
+	SetFlags,
+}
+
+type PrepareFunc func() error
+
+// Initialize a new clean apparmor.d build directory
+func Synchronise() error {
+	dirs := paths.PathList{RootApparmord, Root.Join("root")}
+	for _, dir := range dirs {
+		if err := dir.RemoveAll(); err != nil {
+			return err
+		}
+	}
+	for _, path := range []string{"./apparmor.d", "./root"} {
+		cmd := exec.Command("rsync", "-a", path, Root.String())
+		if err := cmd.Run(); err != nil {
+			return err
+		}
+	}
+	logging.Success("Initialize a new clean apparmor.d build directory")
+	return nil
+}
+
+// Ignore profiles and files as defined in dists/ignore/
+func Ignore() error {
+	for _, name := range []string{"main.ignore", Distribution + ".ignore"} {
+		path := DistDir.Join("ignore", name)
+		if !path.Exist() {
+			continue
+		}
+		lines, _ := path.ReadFileAsLines()
+		for _, line := range lines {
+			if strings.HasPrefix(line, "#") || line == "" {
+				continue
+			}
+			profile := Root.Join(line)
+			if profile.NotExist() {
+				files, err := RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterNames(line))
+				if err != nil {
+					return err
+				}
+				for _, path := range files {
+					if err := path.RemoveAll(); err != nil {
+						return err
+					}
+				}
+			} else {
+				if err := profile.RemoveAll(); err != nil {
+					return err
+				}
+			}
+		}
+		logging.Success("Ignore profiles/files in %s", path)
+	}
+	return nil
+}
+
+// Merge all profiles in a new apparmor.d directory
+func Merge() error {
+	var dirToMerge = []string{
+		"groups/*/*", "groups",
+		"profiles-*-*/*", "profiles-*",
+	}
+
+	idx := 0
+	for idx < len(dirToMerge)-1 {
+		dirMoved, dirRemoved := dirToMerge[idx], dirToMerge[idx+1]
+		files, err := filepath.Glob(RootApparmord.Join(dirMoved).String())
+		if err != nil {
+			return err
+		}
+		for _, file := range files {
+			err := os.Rename(file, RootApparmord.Join(filepath.Base(file)).String())
+			if err != nil {
+				return err
+			}
+		}
+
+		files, err = filepath.Glob(RootApparmord.Join(dirRemoved).String())
+		if err != nil {
+			return err
+		}
+		for _, file := range files {
+			if err := paths.New(file).RemoveAll(); err != nil {
+				return err
+			}
+		}
+		idx = idx + 2
+	}
+	logging.Success("Merge all profiles")
+	return nil
+}
+
+// Set the distribution specificities
+func Configure() (err error) {
+	switch Distribution {
+	case "arch":
+		err = setLibexec("/{usr/,}lib")
+
+	case "opensuse":
+		err = setLibexec("/{usr/,}libexec")
+
+	case "debian", "ubuntu", "whonix":
+		if err := setLibexec("/{usr/,}libexec"); err != nil {
+			return err
+		}
+
+		// Copy Ubuntu specific profiles
+		if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {
+			return err
+		}
+		if Distribution == "ubuntu" {
+			break
+		}
+
+		// Copy debian specific profiles
+		if err := copyTo(DistDir.Join("debian"), RootApparmord); err != nil {
+			return err
+		}
+
+	default:
+		return fmt.Errorf("%s is not a supported distribution", Distribution)
+
+	}
+	return err
+}
+
+// Set flags on some profiles according to manifest defined in `dists/flags/`
+func SetFlags() error {
+	for _, name := range []string{"main.flags", Distribution + ".flags"} {
+		path := DistDir.Join("flags", name)
+		if !path.Exist() {
+			continue
+		}
+		lines, _ := path.ReadFileAsLines()
+		for _, line := range lines {
+			if strings.HasPrefix(line, "#") || line == "" {
+				continue
+			}
+			manifest := strings.Split(line, " ")
+			profile := manifest[0]
+			file := RootApparmord.Join(profile)
+			if !file.Exist() {
+				logging.Warning("Profile %s not found", profile)
+				continue
+			}
+
+			// If flags is set, overwrite profile flag
+			if len(manifest) > 1 {
+				flags := " flags=(" + manifest[1] + ") {"
+				content, err := file.ReadFile()
+				if err != nil {
+					return err
+				}
+
+				// Remove all flags definition, then set manifest' flags
+				res := regFlag.ReplaceAllLiteralString(string(content), "")
+				res = regProfileHeader.ReplaceAllLiteralString(res, flags)
+				if err := file.WriteFile([]byte(res)); err != nil {
+					return err
+				}
+			}
+		}
+		logging.Success("Set profile flags from %s", path)
+	}
+	return nil
+}
+
+// Set AppArmor for full system policy
+// See https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy
+// https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads
+func SetFullSystemPolicy() error {
+	for _, name := range []string{"init", "systemd"} {
+		err := paths.New("apparmor.d/groups/_full/" + name).CopyTo(RootApparmord.Join(name))
+		if err != nil {
+			return err
+		}
+	}
+	logging.Success("Configure AppArmor for full system policy")
+	return nil
+}

pkg/prebuild/tools.go

@@ -0,0 +1,78 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"os"
+	"strings"
+
+	"github.com/arduino/go-paths-helper"
+	"github.com/roddhjav/apparmor.d/pkg/aa"
+	"golang.org/x/exp/slices"
+)
+
+var (
+	osReleaseFile   = "/etc/os-release"
+	firstPartyDists = []string{"arch", "debian", "ubuntu", "opensuse", "whonix"}
+)
+
+func getSupportedDistribution() string {
+	dist, present := os.LookupEnv("DISTRIBUTION")
+	if present {
+		return dist
+	}
+
+	lines, err := paths.New(osReleaseFile).ReadFileAsLines()
+	if err != nil {
+		panic(err)
+	}
+
+	id := ""
+	id_like := ""
+	for _, line := range lines {
+		item := strings.Split(line, "=")
+		if item[0] == "ID" {
+			id = strings.Split(strings.Trim(item[1], "\""), " ")[0]
+		} else if item[0] == "ID_LIKE" {
+			id_like = strings.Split(strings.Trim(item[1], "\""), " ")[0]
+		}
+	}
+
+	if slices.Contains(firstPartyDists, id) {
+		return id
+	} else if slices.Contains(firstPartyDists, id_like) {
+		return id_like
+	}
+	return id
+}
+
+func setLibexec(libexec string) error {
+	aa.Tunables["libexec"] = []string{libexec}
+	file, err := RootApparmord.Join("tunables", "multiarch.d", "apparmor.d").Append()
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	_, err = file.WriteString(`@{libexec}=` + libexec)
+	return err
+}
+
+func copyTo(src *paths.Path, dst *paths.Path) error {
+	files, err := src.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories())
+	if err != nil {
+		return err
+	}
+	for _, file := range files {
+		destination, err := file.RelFrom(src)
+		if err != nil {
+			return err
+		}
+		destination = dst.JoinPath(destination)
+		if err := file.CopyTo(destination); err != nil {
+			return err
+		}
+	}
+	return nil
+}

pkg/prebuild/tools_test.go

@@ -2,7 +2,7 @@
 // Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
 // SPDX-License-Identifier: GPL-2.0-only
 
-package util
+package prebuild
 
 import (
 	"testing"
@@ -78,59 +78,49 @@ ANSI_COLOR="0;38;2;60;110;180"
 LOGO=fedora-logo-icon`
 )
 
-func TestGetSupportedDistribution(t *testing.T) {
+func Test_getSupportedDistribution(t *testing.T) {
 	tests := []struct {
 		name      string
 		osRelease string
 		want      string
-		wantErr   bool
 	}{
 		{
 			name:      "Archlinux",
 			osRelease: Archlinux,
 			want:      "arch",
-			wantErr:   false,
 		},
 		{
 			name:      "Ubuntu",
 			osRelease: Ubuntu,
 			want:      "ubuntu",
-			wantErr:   false,
 		},
 		{
 			name:      "Debian",
 			osRelease: Debian,
 			want:      "debian",
-			wantErr:   false,
 		},
 		{
 			name:      "OpenSUSE Tumbleweed",
 			osRelease: OpenSUSETumbleweed,
 			want:      "opensuse",
-			wantErr:   false,
-		},
-		{
-			name:      "Fedora",
-			osRelease: Fedora,
-			want:      "fedora",
-			wantErr:   true,
 		},
+		// {
+		// 	name:      "Fedora",
+		// 	osRelease: Fedora,
+		// 	want:      "fedora",
+		// },
 	}
 
-	osReleaseFile = "os-release"
+	osReleaseFile = "/tmp/os-release"
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			err := paths.New(osReleaseFile).WriteFile([]byte(tt.osRelease))
 			if err != nil {
 				return
 			}
-			got, err := GetSupportedDistribution()
-			if (err != nil) != tt.wantErr {
-				t.Errorf("ReadLinuxDistribution() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
+			got := getSupportedDistribution()
 			if got != tt.want {
-				t.Errorf("ReadLinuxDistribution() = %v, want %v", got, tt.want)
+				t.Errorf("getSupportedDistribution() = %v, want %v", got, tt.want)
 			}
 		})
 	}

pkg/util/os.go

@@ -1,47 +0,0 @@
-// apparmor.d - Full set of apparmor profiles
-// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
-// SPDX-License-Identifier: GPL-2.0-only
-
-package util
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/arduino/go-paths-helper"
-)
-
-var osReleaseFile = "/etc/os-release"
-
-var firstPartyDists = []string{"arch", "debian", "ubuntu", "opensuse", "whonix"}
-
-func GetSupportedDistribution() (string, error) {
-	dist, present := os.LookupEnv("DISTRIBUTION")
-	if present {
-		return dist, nil
-	}
-
-	lines, err := paths.New(osReleaseFile).ReadFileAsLines()
-	if err != nil {
-		return "", err
-	}
-
-	id := ""
-	id_like := ""
-	for _, line := range lines {
-		item := strings.Split(line, "=")
-		if item[0] == "ID" {
-			id = strings.Split(strings.Trim(item[1], "\""), " ")[0]
-		} else if item[0] == "ID_LIKE" {
-			id_like = strings.Split(strings.Trim(item[1], "\""), " ")[0]
-		}
-	}
-
-	if InSlice(id, firstPartyDists) {
-		return id, nil
-	} else if InSlice(id_like, firstPartyDists) {
-		return id_like, nil
-	}
-	return id, fmt.Errorf("%s is not a supported distribution", id)
-}

pkg/util/tools.go

@@ -7,7 +7,6 @@ package util
 import (
 	"encoding/hex"
 	"regexp"
-	"sort"
 )
 
 var isHexa = regexp.MustCompile("^[0-9A-Fa-f]+$")
@@ -35,10 +34,3 @@ func RemoveDuplicate[T comparable](inlist []T) []T {
 	}
 	return list
 }
-
-func InSlice(item string, slice []string) bool {
-	sort.Strings(slice)
-	i := sort.SearchStrings(slice, item)
-	return i < len(slice) && slice[i] == item
-}
-