diff --git a/apparmor.d/abstractions/gstreamer b/apparmor.d/abstractions/gstreamer index 47a7d6b11..d827dac66 100644 --- a/apparmor.d/abstractions/gstreamer +++ b/apparmor.d/abstractions/gstreamer @@ -3,12 +3,13 @@ # Copyright (C) 2021-2024 Alexandre Pujol # SPDX-License-Identifier: GPL-2.0-only - @{lib}/frei0r-[0-9]/*.so mr, - @{lib}/gstreamer-@{int}.@{int}/gst-plugin-scanner{,x86_64} mrix, - @{lib}/@{multiarch}/gstreamer@{int}.@{int}/gstreamer-@{int}.@{int}/gst-plugin-scanner{,x86_64} mrix, @{lib}/@{multiarch}/libproxy/*/modules/*.so mr, - @{lib}/@{multiarch}/libproxy/*/pxgsettings ixr, @{lib}/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so mr, + @{lib}/frei0r-[0-9]/*.so mr, + + # FIXME: not compatible with FSP mode due conflicting x modifiers + @{lib}/@{multiarch}/gstreamer-1.0/gst-plugin-scanner mrix, + @{lib}/gstreamer-1.0/gst-plugin-scanner mrix, /etc/openni2/OpenNI.ini r, diff --git a/pkg/prebuild/prepare.go b/pkg/prebuild/prepare.go index 619255275..7b7f75ba5 100644 --- a/pkg/prebuild/prepare.go +++ b/pkg/prebuild/prepare.go @@ -12,6 +12,7 @@ import ( "github.com/arduino/go-paths-helper" "github.com/roddhjav/apparmor.d/pkg/logging" + "github.com/roddhjav/apparmor.d/pkg/util" ) // Prepare the build directory with the following tasks @@ -223,6 +224,19 @@ func SetFullSystemPolicy() ([]string, error) { return res, err } + // Fix conflicting x modifiers in abstractions - FIXME: Temporary solution + path = RootApparmord.Join("abstractions/gstreamer") + content, err = path.ReadFile() + if err != nil { + return res, err + } + out = string(content) + regFixConflictX := util.ToRegexRepl([]string{`.*gst-plugin-scanner.*`, ``}) + out = regFixConflictX.Replace(out) + if err := path.WriteFile([]byte(out)); err != nil { + return res, err + } + // Set systemd unit drop-in files return res, copyTo(paths.New("systemd/full/"), Root.Join("systemd")) } diff --git a/pkg/util/tools.go b/pkg/util/tools.go index d7c3072ec..3fb56bcc9 100644 --- a/pkg/util/tools.go +++ b/pkg/util/tools.go @@ -47,7 +47,7 @@ func RemoveDuplicate[T comparable](inlist []T) []T { } // ToRegexRepl convert slice of regex into a slice of RegexRepl -func ToRegexRepl(in []string) []RegexRepl { +func ToRegexRepl(in []string) RegexReplList { out := make([]RegexRepl, 0) idx := 0 for idx < len(in)-1 {