[gentoo-commits] proj/hardened-dev:master commit in: sys-apps/apparmor/files/, sys-apps/apparmor/

[Michael Palimaka]

commit:     670625009874671eb04622eca3b1fe3a3ccf274c
Author:     Michael Palimaka <kensington <AT> gentoo <DOT> org>
AuthorDate: Sat Jun 29 13:25:06 2013 +0000
Commit:     Michael Palimaka <kensington <AT> gentoo <DOT> org>
CommitDate: Sat Jun 29 13:25:34 2013 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-dev.git;a=commit;h=67062500

sys-apps/apparmor: replace init script with a wrapper around upstream's RC functions. This removes a lot of duplicate functionality.

Package-Manager: portage-2.1.12.11
Manifest-Sign-Key: 675D0D2C

---
 ...armor-2.8.1.ebuild => apparmor-2.8.1-r1.ebuild} |   6 +-
 .../apparmor/files/apparmor-2.8.1-makefile.patch   |   6 +-
 sys-apps/apparmor/files/apparmor-init              | 234 +++++----------------
 3 files changed, 61 insertions(+), 185 deletions(-)

diff --git a/sys-apps/apparmor/apparmor-2.8.1.ebuild b/sys-apps/apparmor/apparmor-2.8.1-r1.ebuild
similarity index 88%
rename from sys-apps/apparmor/apparmor-2.8.1.ebuild
rename to sys-apps/apparmor/apparmor-2.8.1-r1.ebuild
index 18d9566..531cfb9 100644
--- a/sys-apps/apparmor/apparmor-2.8.1.ebuild
+++ b/sys-apps/apparmor/apparmor-2.8.1-r1.ebuild
@@ -35,6 +35,10 @@ S=${WORKDIR}/apparmor-${PV}/parser
 src_prepare() {
 	epatch "${FILESDIR}"/${P}-makefile.patch
 
+	# remove warning about missing file that controls features
+	# we don't currently support
+	sed -e "/installation problem/ctrue" -i rc.apparmor.functions || die
+
 	local lang
 	for lang in ${LANGS}; do
 		if ! use linguas_${lang}; then
@@ -49,7 +53,7 @@ src_compile()  {
 }
 
 src_install() {
-	emake DESTDIR="${D}" arch manpages install
+	default
 
 	dodir /etc/apparmor.d
 

diff --git a/sys-apps/apparmor/files/apparmor-2.8.1-makefile.patch b/sys-apps/apparmor/files/apparmor-2.8.1-makefile.patch
index 9575d00..0888c15 100644
--- a/sys-apps/apparmor/files/apparmor-2.8.1-makefile.patch
+++ b/sys-apps/apparmor/files/apparmor-2.8.1-makefile.patch
@@ -9,7 +9,7 @@
  
  YACC	:= /usr/bin/bison
  YFLAGS	:= -d
-@@ -152,7 +152,7 @@
+@@ -153,7 +153,7 @@
  	ln -s `$(CXX) -print-file-name=libstdc++.a`
  
  apparmor_parser: $(OBJECTS) $(AAREOBJECTS)
@@ -18,15 +18,17 @@
  	      ${LEXLIB}  $(AAREOBJECTS) $(AARE_LDFLAGS)
  
  parser_yacc.c parser_yacc.h: parser_yacc.y parser.h
-@@ -284,11 +284,7 @@
+@@ -284,11 +284,9 @@
  .PHONY: install-indep
  install-indep:
  	install -m 755 -d $(INSTALL_CONFDIR)
 -	install -m 644 subdomain.conf $(INSTALL_CONFDIR)
++	install -m 755 -d ${DESTDIR}/usr/libexec
  	install -m 644 parser.conf $(INSTALL_CONFDIR)
 -	install -m 755 -d ${DESTDIR}/var/lib/apparmor
 -	install -m 755 -d $(APPARMOR_BIN_PREFIX)
 -	install -m 755 rc.apparmor.functions $(APPARMOR_BIN_PREFIX)
++	install -m 755 rc.apparmor.functions ${DESTDIR}/usr/libexec
  	$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
  	$(MAKE) install_manpages DESTDIR=${DESTDIR}
  

diff --git a/sys-apps/apparmor/files/apparmor-init b/sys-apps/apparmor/files/apparmor-init
index 6a7ba88..ac1d8d5 100755
--- a/sys-apps/apparmor/files/apparmor-init
+++ b/sys-apps/apparmor/files/apparmor-init
@@ -8,215 +8,85 @@ description_reload="Reload all profiles"
 
 extra_started_commands="reload"
 
-start() {
-	ebegin "Starting ${SVCNAME}"
-	eindent
-
-	if ! check_config || ! remove_profiles || ! load_profiles load ; then
-		eend 1
-		return 1
-	fi
-
-	eoutdent
-	eend 0
-}
-
-stop() {
-	ebegin "Stopping ${SVCNAME}"
+aa_action() {
+	local arg=$1
+	local return
 
-	if ! check_config ; then
-		eend 1
-		return 1
-	fi
-
-	eindent
-	ebegin "Removing profiles"
-	remove_profiles
-	eoutdent
-	rc=$?
-	eend $rc
-	return $rc
-}
-
-reload() {
-	ebegin "Reloading ${SVCNAME} profiles"
-	eindent
+	shift
+	$*
+	return=$?
 
-	if ! ( check_config && load_profiles reload && unload_obsolete_profiles ); then
-		eend 1
-		return 1
-	fi
-
-	eoutdent
-	eend 0
-	return 0
-}
-
-check_config() {
-	if [ -z "$PARSER" -o -z "$PROFILE_DIR" -o -z "$SECURITYFS" ]; then
-		eerror "/etc/conf.d/${SVCNAME} has missing variables"
-		return 1
-	fi
-
-	if ! is_securityfs_mounted ; then
-		if ! mount_securityfs ; then
-			eerror "Failed to mount securityfs"
-			return 1
-		fi
-	fi
-
-	if ! is_apparmor_present ; then
-		modprobe -q apparmor
-		if ! is_apparmor_present ; then
-			eerror "${SVCNAME} kernel support is not present"
-			return 1
-		fi
+	if [ ${return} -eq 0 ]; then
+		aa_log_success_msg $arg
+	else
+		aa_log_failure_msg arg
 	fi
 
-	if ! check_apparmor_compat ; then
-		eerror "${SVCNAME} compatibility is not present in the kernel"
-		return 1
-	fi
+	return $return
 }
 
-get_profile_files() {
-	ARGS=""
-	IGNORES="$( find ${PROFILE_DIR} -name .ignore )"
-	LENGTH=$( echo "$IGNORES" | wc -l )
-
-	I=1;
-	for IGNORE in $IGNORES; do
-		ARGS="${ARGS} -path $( dirname ${IGNORE} ) -prune"
-		if [ $LENGTH -gt 1 -a $I -lt $LENGTH ]; then
-			ARGS="${ARGS} -o"
-		fi
-		I=$(($I+1))
-	done
-
-	if [ -n "$ARGS" ]; then
-		ARGS="${ARGS} -o"
-	fi
-
-	PROFILES="find ${PROFILE_DIR} "$ARGS" -type f -print"
-
-	echo $( $PROFILES )
+aa_log_action_start() {
+	ebegin $1
 }
 
-get_active_profiles() {
-	PROFILES=`sed -e "s/ (\(enforce\|complain\))//" "${SECURITYFS}/profiles"`
-	echo $PROFILES
+aa_log_action_end() {
+	eend $1
 }
 
-load_profiles() {
-	case "$1" in
-		load)
-			PARSER_ARGS="--add"
-			MESSAGE="Loading ${SVCNAME} profiles"
-			;;
-		reload)
-			PARSER_ARGS="--replace"
-			MESSAGE="Reloading ${SVCNAME} profiles"
-			;;
-		*)
-			eerror "Invalid load_profile argument"
-			exit 1
-			;;
-	esac	
-
-	if [ ! -x "${PARSER}" ]; then
-		eerror "Could not find apparmor_parser"
-		return 1
-	fi
-
-	if [ ! -d "${PROFILE_DIR}" -o -z "$(ls $PROFILE_DIR 2> /dev/null)" ]; then
-		ewarn "No profiles found"
-		return 0
-	fi
-
-	PROFILES="$(get_profile_files)"
-
-	for PROFILE in $PROFILES; do
-		$PARSER $PARSER_ARGS $PROFILE
-		if [ $? -ne 0 ]; then
-			if [ "${PARSER_ARGS}" = "replace" ]; then
-				ewarn "Error loading '${PROFILE}', continuing"
-			else
-				eerror "Error loading '${PROFILE}', aborting"
-				remove_profiles
-				return 1
-			fi
-		fi
-	done
-
-	return 0
+aa_log_success_msg() {
+	einfo $1
 }
 
-remove_profiles() {
-	PROFILES=$(get_active_profiles)
-	for PROFILE in $PROFILES; do
-		#use printf instead of echo -n for POSIX compatibility
-		printf '%s' "$PROFILE" > "${SECURITYFS}/.remove"
-	done
-	return 0
+aa_log_warning_msg() {
+	ewarn $1
 }
 
-is_securityfs_mounted() {
-	grep -q securityfs /proc/filesystems && grep -q securityfs /proc/mounts
-	return $?
+aa_log_failure_msg() {
+	eerror $1
 }
 
-mount_securityfs() {
-	if [ grep -q securityfs /proc/filesystems ]; then
-		mount -t securityfs securityfs "${SECURITYFS}"
-		return $?
-	else
-		return 1
-	fi
+aa_log_skipped_msg() {
+	einfo $1
 }
 
-is_apparmor_present() {
-	grep -q "^apparmor" /proc/modules
-	[ $? -ne 0 -a -d /sys/module/apparmor ]
-	return $?
+aa_log_daemon_msg() {
+	einfo $1
 }
 
-check_apparmor_compat() {
-	if [ -f "${SECURITYFS}/profiles" ]; then
-		return 0
-	else
-		return 1
-	fi
+aa_log_end_msg() {
+	eend $1
 }
 
-unload_obsolete_profiles() {
-	TEMPDIR=$(umask 0077 && mktemp -d)
+. /usr/libexec/rc.apparmor.functions
 
-	if [ ! -d "${TEMPDIR}" ]; then
-		eerror "Failed to create temporary directory"
-		return 1
-	fi
-
-	cd $TEMPDIR
+start() {
+	ebegin "Starting AppArmor"
+	eindent
 
-	local active_profiles=$(get_active_profiles)
-	if [ -z "${active_profiles}" ] ; then
-		return 0
+	if ! is_apparmor_loaded ; then
+		load_module
+		if [ $? -ne 0 ]; then
+			eerror "AppArmor kernel support is not present"
+			eend 1
+			return 1
+		fi
 	fi
 
-	echo ${active_profiles} | tr ' ' '\n' | sort > old
-
-	for PROFILE in $(get_profile_files); do
-		echo $(${PARSER} -N "$PROFILE") >> new
-	done
+	parse_profiles load
 
-	sort new > new_sorted
-
-	for PROFILE in $(comm -2 -3 old new_sorted); do
-		#use printf instead of echo -n for POSIX compatibility
-		printf '%s' "$PROFILE" > "${SECURITYFS}/.remove"
-	done
+	eoutdent
+}
 
-	rm -rf "${TEMPDIR}"
+stop() {
+	ebegin "Stopping AppArmor"
+	eindent
+	apparmor_stop
+	eoutdent
+}
 
-	return 0
+reload() {
+	# todo: split out clean_profiles into its own function upstream
+	# so we can do parse_profiles reload && clean_profiles
+	# and do a proper reload instead of restart
+	apparmor_restart
 }