felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

build: add the ability to set enforce all profiles.

Browse source 
Do not do that!!! It forces ALL profiles in enforce mode.
This commit is contained in:
Alexandre Pujol 2023-09-05 19:44:36 +01:00
parent 7c24dde028
commit cad27a3f78
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 45 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
cmd/prebuild/main.go
View file

@ -13,20 +13,22 @@ import (
"github.com/roddhjav/apparmor.d/pkg/prebuild"
)
const usage = `prebuild [-h] [--full] [--complain]
const usage = `prebuild [-h] [--full] [--complain | --enforce]
Internal tool to prebuild apparmor.d profiles for a given distribution.
Prebuild apparmor.d profiles for a given distribution.
Options:
-h, --help Show this help message and exit.
-f, --full Set AppArmor for full system policy.
-c, --complain Set complain flag on all profiles.
-e, --enforce Set enforce flag on all profiles.
`
var (
help bool
full bool
complain bool
enforce bool
)
func init() {
@ -36,6 +38,8 @@ func init() {
flag.BoolVar(&full, "full", false, "Set AppArmor for full system policy.")
flag.BoolVar(&complain, "c", false, "Set complain flag on all profiles.")
flag.BoolVar(&complain, "complain", false, "Set complain flag on all profiles.")
flag.BoolVar(&enforce, "e", false, "Set enforce flag on all profiles.")
flag.BoolVar(&enforce, "enforce", false, "Set enforce flag on all profiles.")
}
func aaPrebuild() error {
@ -46,6 +50,8 @@ func aaPrebuild() error {
}
if complain {
prebuild.Builds = append(prebuild.Builds, prebuild.BuildComplain)
} else if enforce {
prebuild.Builds = append(prebuild.Builds, prebuild.BuildEnforce)
}
if err := prebuild.Prepare(); err != nil {
@ -60,6 +66,8 @@ func aaPrebuild() error {
logging.Bullet("Bypass userspace tools restriction")
if complain {
logging.Bullet("Set complain flag on all profiles")
} else if enforce {
logging.Bullet("All profiles have been enforced")
}
return nil
}