105 lines
2.8 KiB
Go
105 lines
2.8 KiB
Go
// apparmor.d - Full set of apparmor profiles
|
|
// Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
// SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
package prepare
|
|
|
|
import (
|
|
"regexp"
|
|
|
|
"github.com/roddhjav/apparmor.d/pkg/paths"
|
|
"github.com/roddhjav/apparmor.d/pkg/prebuild"
|
|
)
|
|
|
|
var (
|
|
tunables = map[string]string{
|
|
// Set systemd profiles name
|
|
"sd": "sd",
|
|
"sdu": "sdu",
|
|
"systemd_user": "systemd-user",
|
|
"systemd": "systemd",
|
|
|
|
// With FSP on apparmor 4.1+, the dbus profiles don't get stacked as they
|
|
"dbus_system": "dbus-system",
|
|
"dbus_session": "dbus-session",
|
|
|
|
// Update name of stacked profiles
|
|
"apt_news": "",
|
|
"colord": "",
|
|
"e2scrub_all": "",
|
|
"e2scrub": "",
|
|
"fprintd": "",
|
|
"fwupd": "",
|
|
"fwupdmgr": "",
|
|
"geoclue": "",
|
|
"irqbalance": "",
|
|
"logrotate": "",
|
|
"ModemManager": "",
|
|
"nm_priv_helper": "",
|
|
"pcscd": "",
|
|
"polkitd": "",
|
|
"power_profiles_daemon": "",
|
|
"rsyslogd": "",
|
|
"systemd_coredump": "",
|
|
"systemd_homed": "",
|
|
"systemd_hostnamed": "",
|
|
"systemd_importd": "",
|
|
"systemd_initctl": "",
|
|
"systemd_journal_remote": "",
|
|
"systemd_journald": "",
|
|
"systemd_localed": "",
|
|
"systemd_logind": "",
|
|
"systemd_machined": "",
|
|
"systemd_networkd": "",
|
|
"systemd_oomd": "",
|
|
"systemd_resolved": "",
|
|
"systemd_rfkill": "",
|
|
"systemd_timedated": "",
|
|
"systemd_timesyncd": "",
|
|
"systemd_userdbd": "",
|
|
"upowerd": "",
|
|
}
|
|
)
|
|
|
|
type FullSystemPolicy struct {
|
|
prebuild.Base
|
|
}
|
|
|
|
func init() {
|
|
RegisterTask(&FullSystemPolicy{
|
|
Base: prebuild.Base{
|
|
Keyword: "fsp",
|
|
Msg: "Configure AppArmor for full system policy",
|
|
},
|
|
})
|
|
}
|
|
|
|
func (p FullSystemPolicy) Apply() ([]string, error) {
|
|
res := []string{}
|
|
|
|
// Install full system policy profiles
|
|
if err := paths.New("apparmor.d/groups/_full/").CopyFS(prebuild.Root.Join("apparmor.d")); err != nil {
|
|
return res, err
|
|
}
|
|
|
|
// Set profile name for FSP
|
|
path := prebuild.RootApparmord.Join("tunables/multiarch.d/profiles")
|
|
out, err := path.ReadFileAsString()
|
|
if err != nil {
|
|
return res, err
|
|
}
|
|
for varname, profile := range tunables {
|
|
pattern := regexp.MustCompile(`(@\{p_` + varname + `}=)([^\s]+)`)
|
|
if profile == "" {
|
|
out = pattern.ReplaceAllString(out, `@{p_`+varname+`}={$2,sd//&$2,$2//&sd}`)
|
|
} else {
|
|
out = pattern.ReplaceAllString(out, `@{p_`+varname+`}=`+profile)
|
|
}
|
|
}
|
|
if err := path.WriteFile([]byte(out)); err != nil {
|
|
return res, err
|
|
}
|
|
|
|
// Set systemd unit drop-in files
|
|
return res, paths.CopyTo(prebuild.SystemdDir.Join("full"), prebuild.Root.Join("systemd"))
|
|
}
|