feat(prebuild): make prebuild available as an external package.

Usefull for downstream repo.

pkg/prebuild/build.go

@@ -0,0 +1,65 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/roddhjav/apparmor.d/pkg/aa"
+	"golang.org/x/exp/slices"
+)
+
+// Build the profiles with the following build tasks
+var Builds = []BuildFunc{
+	BuildUserspace,
+}
+
+var (
+	regABI           = regexp.MustCompile(`abi <abi/[0-9.]*>,\n`)
+	regAttachments   = regexp.MustCompile(`(profile .* @{exec_path})`)
+	regFlag          = regexp.MustCompile(`flags=\(([^)]+)\)`)
+	regProfileHeader = regexp.MustCompile(` {`)
+)
+
+type BuildFunc func(string) string
+
+// Set complain flag on all profiles
+func BuildComplain(profile string) string {
+
+	flags := []string{}
+	matches := regFlag.FindStringSubmatch(profile)
+	if len(matches) != 0 {
+		flags = strings.Split(matches[1], ",")
+		if slices.Contains(flags, "complain") {
+			return profile
+		}
+	}
+	flags = append(flags, "complain")
+	strFlags := " flags=(" + strings.Join(flags, ",") + ") {"
+
+	// Remove all flags definition, then set manifest' flags
+	profile = regFlag.ReplaceAllLiteralString(profile, "")
+	return regProfileHeader.ReplaceAllLiteralString(profile, strFlags)
+}
+
+// Bypass userspace tools restriction
+func BuildUserspace(profile string) string {
+	p := aa.NewAppArmorProfile(profile)
+	p.ParseVariables()
+	p.ResolveAttachments()
+	att := p.NestAttachments()
+	matches := regAttachments.FindAllString(profile, -1)
+	if len(matches) > 0 {
+		strheader := strings.Replace(matches[0], "@{exec_path}", att, -1)
+		return regAttachments.ReplaceAllLiteralString(profile, strheader)
+	}
+	return profile
+}
+
+// Remove abi header for distributions that do not support it
+func BuildABI(profile string) string {
+	return regABI.ReplaceAllLiteralString(profile, "")
+}

pkg/prebuild/prebuild.go

@@ -0,0 +1,50 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"github.com/arduino/go-paths-helper"
+)
+
+var (
+	Distribution  string
+	DistDir       *paths.Path
+	Root          *paths.Path
+	RootApparmord *paths.Path
+)
+
+func init() {
+	DistDir = paths.New("dists")
+	Root = paths.New(".build")
+	RootApparmord = Root.Join("apparmor.d")
+	Distribution = getSupportedDistribution()
+}
+
+func Prepare() error {
+	for _, fct := range Prepares {
+		if err := fct(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func Build() error {
+	files, _ := RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories())
+	for _, file := range files {
+		if !file.Exist() {
+			continue
+		}
+		content, _ := file.ReadFile()
+		profile := string(content)
+		for _, fct := range Builds {
+			profile = fct(profile)
+		}
+		if err := file.WriteFile([]byte(profile)); err != nil {
+			panic(err)
+		}
+	}
+	return nil
+}

pkg/prebuild/prebuild_test.go

@@ -0,0 +1,87 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"os"
+	"os/exec"
+	"testing"
+)
+
+func chdirGitRoot() {
+	cmd := exec.Command("git", "rev-parse", "--show-toplevel")
+	out, err := cmd.Output()
+	if err != nil {
+		panic(err)
+	}
+	root := string(out)[0 : len(out)-1]
+	if err := os.Chdir(root); err != nil {
+		panic(err)
+	}
+}
+
+func Test_PreBuild(t *testing.T) {
+	tests := []struct {
+		name     string
+		wantErr  bool
+		full     bool
+		complain bool
+		dist     string
+	}{
+		{
+			name:     "Build for Archlinux",
+			wantErr:  false,
+			full:     false,
+			complain: true,
+			dist:     "arch",
+		},
+		{
+			name:     "Build for Ubuntu",
+			wantErr:  false,
+			full:     true,
+			complain: false,
+			dist:     "ubuntu",
+		},
+		{
+			name:     "Build for Debian",
+			wantErr:  false,
+			full:     true,
+			complain: false,
+			dist:     "debian",
+		},
+		{
+			name:     "Build for OpenSUSE Tumbleweed",
+			wantErr:  false,
+			full:     true,
+			complain: true,
+			dist:     "opensuse",
+		},
+		// {
+		// 	name:     "Build for Fedora",
+		// 	wantErr:  true,
+		// 	full:     false,
+		// 	complain: false,
+		// 	dist:     "fedora",
+		// },
+	}
+	chdirGitRoot()
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			Distribution = tt.dist
+			if tt.full {
+				Prepares = append(Prepares, SetFullSystemPolicy)
+			}
+			if tt.complain {
+				Builds = append(Builds, BuildComplain)
+			}
+			if err := Prepare(); (err != nil) != tt.wantErr {
+				t.Errorf("Prepare() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if err := Build(); (err != nil) != tt.wantErr {
+				t.Errorf("Build() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

pkg/prebuild/prepare.go

@@ -0,0 +1,204 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/arduino/go-paths-helper"
+	"github.com/roddhjav/apparmor.d/pkg/logging"
+)
+
+// Prepare the build directory with the following tasks
+var Prepares = []PrepareFunc{
+	Synchronise,
+	Ignore,
+	Merge,
+	Configure,
+	SetFlags,
+}
+
+type PrepareFunc func() error
+
+// Initialize a new clean apparmor.d build directory
+func Synchronise() error {
+	dirs := paths.PathList{RootApparmord, Root.Join("root")}
+	for _, dir := range dirs {
+		if err := dir.RemoveAll(); err != nil {
+			return err
+		}
+	}
+	for _, path := range []string{"./apparmor.d", "./root"} {
+		cmd := exec.Command("rsync", "-a", path, Root.String())
+		if err := cmd.Run(); err != nil {
+			return err
+		}
+	}
+	logging.Success("Initialize a new clean apparmor.d build directory")
+	return nil
+}
+
+// Ignore profiles and files as defined in dists/ignore/
+func Ignore() error {
+	for _, name := range []string{"main.ignore", Distribution + ".ignore"} {
+		path := DistDir.Join("ignore", name)
+		if !path.Exist() {
+			continue
+		}
+		lines, _ := path.ReadFileAsLines()
+		for _, line := range lines {
+			if strings.HasPrefix(line, "#") || line == "" {
+				continue
+			}
+			profile := Root.Join(line)
+			if profile.NotExist() {
+				files, err := RootApparmord.ReadDirRecursiveFiltered(nil, paths.FilterNames(line))
+				if err != nil {
+					return err
+				}
+				for _, path := range files {
+					if err := path.RemoveAll(); err != nil {
+						return err
+					}
+				}
+			} else {
+				if err := profile.RemoveAll(); err != nil {
+					return err
+				}
+			}
+		}
+		logging.Success("Ignore profiles/files in %s", path)
+	}
+	return nil
+}
+
+// Merge all profiles in a new apparmor.d directory
+func Merge() error {
+	var dirToMerge = []string{
+		"groups/*/*", "groups",
+		"profiles-*-*/*", "profiles-*",
+	}
+
+	idx := 0
+	for idx < len(dirToMerge)-1 {
+		dirMoved, dirRemoved := dirToMerge[idx], dirToMerge[idx+1]
+		files, err := filepath.Glob(RootApparmord.Join(dirMoved).String())
+		if err != nil {
+			return err
+		}
+		for _, file := range files {
+			err := os.Rename(file, RootApparmord.Join(filepath.Base(file)).String())
+			if err != nil {
+				return err
+			}
+		}
+
+		files, err = filepath.Glob(RootApparmord.Join(dirRemoved).String())
+		if err != nil {
+			return err
+		}
+		for _, file := range files {
+			if err := paths.New(file).RemoveAll(); err != nil {
+				return err
+			}
+		}
+		idx = idx + 2
+	}
+	logging.Success("Merge all profiles")
+	return nil
+}
+
+// Set the distribution specificities
+func Configure() (err error) {
+	switch Distribution {
+	case "arch":
+		err = setLibexec("/{usr/,}lib")
+
+	case "opensuse":
+		err = setLibexec("/{usr/,}libexec")
+
+	case "debian", "ubuntu", "whonix":
+		if err := setLibexec("/{usr/,}libexec"); err != nil {
+			return err
+		}
+
+		// Copy Ubuntu specific profiles
+		if err := copyTo(DistDir.Join("ubuntu"), RootApparmord); err != nil {
+			return err
+		}
+		if Distribution == "ubuntu" {
+			break
+		}
+
+		// Copy debian specific profiles
+		if err := copyTo(DistDir.Join("debian"), RootApparmord); err != nil {
+			return err
+		}
+
+	default:
+		return fmt.Errorf("%s is not a supported distribution", Distribution)
+
+	}
+	return err
+}
+
+// Set flags on some profiles according to manifest defined in `dists/flags/`
+func SetFlags() error {
+	for _, name := range []string{"main.flags", Distribution + ".flags"} {
+		path := DistDir.Join("flags", name)
+		if !path.Exist() {
+			continue
+		}
+		lines, _ := path.ReadFileAsLines()
+		for _, line := range lines {
+			if strings.HasPrefix(line, "#") || line == "" {
+				continue
+			}
+			manifest := strings.Split(line, " ")
+			profile := manifest[0]
+			file := RootApparmord.Join(profile)
+			if !file.Exist() {
+				logging.Warning("Profile %s not found", profile)
+				continue
+			}
+
+			// If flags is set, overwrite profile flag
+			if len(manifest) > 1 {
+				flags := " flags=(" + manifest[1] + ") {"
+				content, err := file.ReadFile()
+				if err != nil {
+					return err
+				}
+
+				// Remove all flags definition, then set manifest' flags
+				res := regFlag.ReplaceAllLiteralString(string(content), "")
+				res = regProfileHeader.ReplaceAllLiteralString(res, flags)
+				if err := file.WriteFile([]byte(res)); err != nil {
+					return err
+				}
+			}
+		}
+		logging.Success("Set profile flags from %s", path)
+	}
+	return nil
+}
+
+// Set AppArmor for full system policy
+// See https://gitlab.com/apparmor/apparmor/-/wikis/FullSystemPolicy
+// https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorInSystemd#early-policy-loads
+func SetFullSystemPolicy() error {
+	for _, name := range []string{"init", "systemd"} {
+		err := paths.New("apparmor.d/groups/_full/" + name).CopyTo(RootApparmord.Join(name))
+		if err != nil {
+			return err
+		}
+	}
+	logging.Success("Configure AppArmor for full system policy")
+	return nil
+}

pkg/prebuild/tools.go

@@ -0,0 +1,78 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"os"
+	"strings"
+
+	"github.com/arduino/go-paths-helper"
+	"github.com/roddhjav/apparmor.d/pkg/aa"
+	"golang.org/x/exp/slices"
+)
+
+var (
+	osReleaseFile   = "/etc/os-release"
+	firstPartyDists = []string{"arch", "debian", "ubuntu", "opensuse", "whonix"}
+)
+
+func getSupportedDistribution() string {
+	dist, present := os.LookupEnv("DISTRIBUTION")
+	if present {
+		return dist
+	}
+
+	lines, err := paths.New(osReleaseFile).ReadFileAsLines()
+	if err != nil {
+		panic(err)
+	}
+
+	id := ""
+	id_like := ""
+	for _, line := range lines {
+		item := strings.Split(line, "=")
+		if item[0] == "ID" {
+			id = strings.Split(strings.Trim(item[1], "\""), " ")[0]
+		} else if item[0] == "ID_LIKE" {
+			id_like = strings.Split(strings.Trim(item[1], "\""), " ")[0]
+		}
+	}
+
+	if slices.Contains(firstPartyDists, id) {
+		return id
+	} else if slices.Contains(firstPartyDists, id_like) {
+		return id_like
+	}
+	return id
+}
+
+func setLibexec(libexec string) error {
+	aa.Tunables["libexec"] = []string{libexec}
+	file, err := RootApparmord.Join("tunables", "multiarch.d", "apparmor.d").Append()
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	_, err = file.WriteString(`@{libexec}=` + libexec)
+	return err
+}
+
+func copyTo(src *paths.Path, dst *paths.Path) error {
+	files, err := src.ReadDirRecursiveFiltered(nil, paths.FilterOutDirectories())
+	if err != nil {
+		return err
+	}
+	for _, file := range files {
+		destination, err := file.RelFrom(src)
+		if err != nil {
+			return err
+		}
+		destination = dst.JoinPath(destination)
+		if err := file.CopyTo(destination); err != nil {
+			return err
+		}
+	}
+	return nil
+}

pkg/prebuild/tools_test.go

@@ -0,0 +1,127 @@
+// apparmor.d - Full set of apparmor profiles
+// Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
+// SPDX-License-Identifier: GPL-2.0-only
+
+package prebuild
+
+import (
+	"testing"
+
+	"github.com/arduino/go-paths-helper"
+)
+
+const (
+	Archlinux = `NAME="Arch Linux"
+PRETTY_NAME="Arch Linux"
+ID=arch
+BUILD_ID=rolling
+ANSI_COLOR="38;2;23;147;209"
+HOME_URL="https://archlinux.org/"
+DOCUMENTATION_URL="https://wiki.archlinux.org/"
+SUPPORT_URL="https://bbs.archlinux.org/"
+BUG_REPORT_URL="https://bugs.archlinux.org/"
+PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
+LOGO=archlinux-logo`
+
+	Ubuntu = `PRETTY_NAME="Ubuntu 22.04.2 LTS"
+NAME="Ubuntu"
+VERSION_ID="22.04"
+VERSION="22.04.2 LTS (Jammy Jellyfish)"
+VERSION_CODENAME=jammy
+ID=ubuntu
+ID_LIKE=debian
+HOME_URL="https://www.ubuntu.com/"
+SUPPORT_URL="https://help.ubuntu.com/"
+BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
+PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
+UBUNTU_CODENAME=jammy`
+
+	Debian = `PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
+NAME="Debian GNU/Linux"
+VERSION_ID="11"
+VERSION="11 (bullseye)"
+VERSION_CODENAME=bullseye
+ID=debian
+HOME_URL="https://www.debian.org/"
+SUPPORT_URL="https://www.debian.org/support"
+BUG_REPORT_URL="https://bugs.debian.org/"`
+
+	OpenSUSETumbleweed = `ID="opensuse-tumbleweed"
+ID_LIKE="opensuse suse"
+VERSION_ID="20230404"
+PRETTY_NAME="openSUSE Tumbleweed"
+ANSI_COLOR="0;32"
+CPE_NAME="cpe:/o:opensuse:tumbleweed:20230404"
+BUG_REPORT_URL="https://bugs.opensuse.org"
+HOME_URL="https://www.opensuse.org/"
+DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
+LOGO="distributor-logo-Tumbleweed"`
+
+	ArcoLinux = `NAME=ArcoLinux
+ID=arcolinux
+ID_LIKE=arch
+BUILD_ID=rolling
+ANSI_COLOR="0;36"
+HOME_URL="https://arcolinux.info/"
+SUPPORT_URL="https://arcolinuxforum.com/"
+BUG_REPORT_URL="https://github.com/arcolinux"
+LOGO=arcolinux-hello`
+
+	Fedora = `NAME="Fedora Linux"
+VERSION="37 (Workstation Edition)"
+ID=fedora
+VERSION_ID=37
+VERSION_CODENAME=""
+PLATFORM_ID="platform:f37"
+PRETTY_NAME="Fedora Linux 37 (Workstation Edition)"
+ANSI_COLOR="0;38;2;60;110;180"
+LOGO=fedora-logo-icon`
+)
+
+func Test_getSupportedDistribution(t *testing.T) {
+	tests := []struct {
+		name      string
+		osRelease string
+		want      string
+	}{
+		{
+			name:      "Archlinux",
+			osRelease: Archlinux,
+			want:      "arch",
+		},
+		{
+			name:      "Ubuntu",
+			osRelease: Ubuntu,
+			want:      "ubuntu",
+		},
+		{
+			name:      "Debian",
+			osRelease: Debian,
+			want:      "debian",
+		},
+		{
+			name:      "OpenSUSE Tumbleweed",
+			osRelease: OpenSUSETumbleweed,
+			want:      "opensuse",
+		},
+		// {
+		// 	name:      "Fedora",
+		// 	osRelease: Fedora,
+		// 	want:      "fedora",
+		// },
+	}
+
+	osReleaseFile = "/tmp/os-release"
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := paths.New(osReleaseFile).WriteFile([]byte(tt.osRelease))
+			if err != nil {
+				return
+			}
+			got := getSupportedDistribution()
+			if got != tt.want {
+				t.Errorf("getSupportedDistribution() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}