diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm b/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm deleted file mode 100644 index 0b036965da1dfe..00000000000000 --- a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm +++ /dev/null @@ -1,45 +0,0 @@ -# vim:syntax=apparmor - -abi , - -# NOTE: This profile uses TCP sockets by default -# If you wish for php-fpm to listen to unix socket, -# add the following permission to local/usr.bin.php-fpm -# /path/to/your/unix/socket w, - -include - -# This is PHP open_basedir where script can only be executed from. -# /home, /tmp have been removed to not open permissions too widely -# /usr/share/pear have been removed to have its own permission -@{PHP_BASEDIRS} = /srv/www/ /var/www/ /usr/share/webapps/ - -profile php-fpm /usr/bin/php-fpm { - include - include - include - include - - capability setgid, - capability setuid, - capability kill, - - /etc/php/php-fpm.conf r, - /etc/php/php-fpm.d/* r, - - # This is set to make php-fpm work by default, but if you don't use these paths - # add "deny @{PHP_BASEDIRS}/** r," to local.usr.bin.php-fpm and add read rights - # to where your PHP app is located - @{PHP_BASEDIRS}/** r, - - /usr/bin/php-fpm mr, - - /usr/share/pear/** r, - /usr/share/php/fpm/status.html r, - - /var/log/php-fpm.log w, - - # Site-specific additions and overrides. See local/README for details. - include if exists - -} diff --git a/srcpkgs/apparmor/patches/fix-perl-cross.patch b/srcpkgs/apparmor/patches/fix-perl-cross.patch new file mode 100644 index 00000000000000..a4b29d7817f8ad --- /dev/null +++ b/srcpkgs/apparmor/patches/fix-perl-cross.patch @@ -0,0 +1,11 @@ +--- a/libraries/libapparmor/swig/perl/Makefile.am ++++ b/libraries/libapparmor/swig/perl/Makefile.am +@@ -11,7 +11,7 @@ + LibAppArmor.pm: libapparmor_wrap.c + + Makefile.perl: Makefile.PL LibAppArmor.pm +- $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ ++ $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC) + sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl + sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl + diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template index 71e38441041608..1b06fc6c1aa56a 100644 --- a/srcpkgs/apparmor/template +++ b/srcpkgs/apparmor/template @@ -1,18 +1,18 @@ # Template file for 'apparmor' pkgname=apparmor version=4.1.7 -revision=1 +revision=2 build_wrksrc=libraries/libapparmor +build_helper="python3" build_style=gnu-configure conf_files="/etc/apparmor.d/local/* /etc/apparmor/*" make_dirs="/etc/apparmor.d/disable 0755 root root" configure_args="$(vopt_with python) $(vopt_with perl)" -hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config - perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)" -makedepends="$(vopt_if python python3-devel)" -depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2 - python3-psutil python3-dbus iproute2" -checkdepends="dejagnu" +hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool + python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)" +makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)" +depends="runit-void-apparmor iproute2" +checkdepends="dejagnu " short_desc="Mandatory access control to restrict programs" maintainer="Orphaned " license="GPL-2.0-only" @@ -27,56 +27,57 @@ CFLAGS="-D_LARGEFILE64_SOURCE" CXXFLAGS="-D_LARGEFILE64_SOURCE" build_options="python perl" +build_options_default="python" -case "$XBPS_TARGET_MACHINE" in - x86_64*|aarch64*|i686*) - build_options_default+=" python" - ;; -esac +if [ "${build_option_perl}" -o "${build_option_python}" ]; then + hostmakedepends+=" swig" +fi -if [ -z "$CROSS_BUILD" ]; then - build_options_default+=" perl" +if [ "${build_option_python}" ]; then + depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" + checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" fi -pre_configure() { - cd ${wrksrc}/libraries/libapparmor - autoreconf -fiv +post_patch() { + # add custom profiles + cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/" } -pre_build() { - # Replace release profiles with our own - cd ${wrksrc} - cp ${FILESDIR}/profiles/* profiles/apparmor.d/ +pre_configure() { + autoreconf -fiv } post_build() { - cd ${wrksrc} + make ${makejobs} -C "${wrksrc}/binutils" + make ${makejobs} -C "${wrksrc}/parser" + make ${makejobs} -C "${wrksrc}/utils" + make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor" + make ${makejobs} -C "${wrksrc}/profiles" +} - make ${makejobs} -C binutils - make ${makejobs} -C utils - make ${makejobs} -C parser - make ${makejobs} -C profiles +do_check() { + make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check + make ${makejobs} -C "${wrksrc}/binutils" check + make ${makejobs} -C "${wrksrc}/parser" check + make ${makejobs} -C "${wrksrc}/utils" check + # make ${makejobs} -C "${wrksrc}/profiles" check # broken + make ${makejobs} -C "${wrksrc}/profiles" check-parser + make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d } post_install() { - cd ${wrksrc} commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\"" - make $commonflags install -C binutils + make $commonflags install -C "${wrksrc}/binutils" make $commonflags \ BINDIR="${DESTDIR}/usr/bin" \ VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \ - install -C utils + install -C "${wrksrc}/utils" make $commonflags \ APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \ - install -C parser - make DESTDIR="${DESTDIR}" install -C profiles - - # requires perl bindings not generated when cross-compiling - if [ -z "$build_option_perl" ]; then - rm -f ${DESTDIR}/usr/bin/aa-notify - fi + install -C "${wrksrc}/parser" + make DESTDIR="${DESTDIR}" install -C "${wrksrc}/profiles" - vinstall utils/aa-notify.desktop 644 usr/share/applications + vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications vdoc "${FILESDIR}/README.voidlinux" } @@ -90,6 +91,7 @@ libapparmor_package() { fi if [ "$build_option_python" ]; then vmove "${py3_sitelib}/LibAppArmor*" + vmove "${py3_sitelib}/_LibAppArmor*.so" fi vmove usr/share/man/man2 vmove usr/share/man/man3 @@ -99,7 +101,7 @@ libapparmor_package() { libapparmor-devel_package() { short_desc+=" - Library development files" license="LGPL-2.1-only" - depends="lib${sourcepkg}-${version}_${revision}" + depends="libapparmor-${version}_${revision}" pkg_install() { vmove usr/include vmove "usr/lib/*.a" diff --git a/srcpkgs/runit-void/files/09-apparmor.sh b/srcpkgs/runit-void/files/09-apparmor.sh index e2c87a6b6225fd..9ec6881c2d63a0 100644 --- a/srcpkgs/runit-void/files/09-apparmor.sh +++ b/srcpkgs/runit-void/files/09-apparmor.sh @@ -3,25 +3,11 @@ # AppArmor is not enabled in kernel, silently exit [ ! -d /sys/kernel/security/apparmor ] && return -# Load config -[ -r /etc/default/apparmor ] && . /etc/default/apparmor - # Proceed to load profiles depending on user settings msg "Loading AppArmor profiles..." -if [ -n "$APPARMOR" ]; then - if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then - printf '! AppArmor set to %s - ignoring profiles\n' "$APPARMOR" - return - fi - - [ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C" - - if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then - find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a $AACOMPLAIN -- {} + - else - printf '! AppArmor installation problem - ensure you have installed apparmor package\n' - fi +if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then + find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a -- {} + else - printf '! AppArmor disabled - ignoring profiles\n' + printf '! AppArmor installation problem - ensure you have installed apparmor package\n' fi diff --git a/srcpkgs/runit-void/files/apparmor b/srcpkgs/runit-void/files/apparmor deleted file mode 100644 index b32ce11a11ef34..00000000000000 --- a/srcpkgs/runit-void/files/apparmor +++ /dev/null @@ -1,7 +0,0 @@ -# AppArmor configuration - -# Possible options: -# - disable -# - complain -# - enforce -APPARMOR=complain diff --git a/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg new file mode 100644 index 00000000000000..1d55143bf860e5 --- /dev/null +++ b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg @@ -0,0 +1,7 @@ +The `/etc/default/apparmor` configuration file was removed. The system will now +boot in `enforce` mode by default. + +To boot in complain mode, add `apparmor.mode=complain` to the kernel command +line, or change the mode at runtime: + + # echo -n complain > /sys/module/apparmor/parameters/mode diff --git a/srcpkgs/runit-void/template b/srcpkgs/runit-void/template index a915b5434fb51e..6a3131751aa8e6 100644 --- a/srcpkgs/runit-void/template +++ b/srcpkgs/runit-void/template @@ -1,16 +1,16 @@ # Template file for 'runit-void' pkgname=runit-void version=20250212 -revision=3 +revision=4 build_style=gnu-makefile +depends="virtual?awk procps-ng runit" short_desc="Void Linux runit scripts" -maintainer="Enno Boland " +maintainer="Orphaned " license="CC0-1.0" homepage="https://github.com/void-linux/void-runit" distfiles="https://github.com/void-linux/void-runit/archive/refs/tags/${version}.tar.gz" checksum=c0d3ecea4dae5bba8ca3e563706847ef3b6cbdfcc19b8bf69b3f7a9bc0451f50 -depends="virtual?awk procps-ng runit" conf_files=" /etc/hostname /etc/locale.conf @@ -29,8 +29,7 @@ make_dirs=" alternatives=" logger:logger:/usr/bin/vlogger - logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8 -" + logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8" post_install() { vmkdir usr/bin @@ -50,9 +49,7 @@ post_install() { runit-void-apparmor_package() { short_desc+=" - AppArmor initialization" depends="${sourcepkg}-${version}_${revision}" - conf_files="/etc/default/apparmor" pkg_install() { - vmove etc/default/apparmor vmove etc/runit/core-services/09-apparmor.sh } }