From 51d103bc5f93019751b818c201db955a811efcd1 Mon Sep 17 00:00:00 2001 From: Duncaen Date: Tue, 28 Jul 2026 18:12:36 +0200 Subject: [PATCH 1/2] apparmor: cleanup - cleanup template - enable more checks - remove old custom php-fpm profile - allow cross building perl library - move apparmor syscall and library man pages to libapparmor-devel - add missing python dependencies --- .../apparmor/files/profiles/usr.bin.php-fpm | 45 ----------- srcpkgs/apparmor/patches/fix-perl-cross.patch | 11 +++ srcpkgs/apparmor/template | 78 ++++++++++--------- 3 files changed, 51 insertions(+), 83 deletions(-) delete mode 100644 srcpkgs/apparmor/files/profiles/usr.bin.php-fpm create mode 100644 srcpkgs/apparmor/patches/fix-perl-cross.patch diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm b/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm deleted file mode 100644 index 0b036965da1dfe..00000000000000 --- a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm +++ /dev/null @@ -1,45 +0,0 @@ -# vim:syntax=apparmor - -abi , - -# NOTE: This profile uses TCP sockets by default -# If you wish for php-fpm to listen to unix socket, -# add the following permission to local/usr.bin.php-fpm -# /path/to/your/unix/socket w, - -include - -# This is PHP open_basedir where script can only be executed from. -# /home, /tmp have been removed to not open permissions too widely -# /usr/share/pear have been removed to have its own permission -@{PHP_BASEDIRS} = /srv/www/ /var/www/ /usr/share/webapps/ - -profile php-fpm /usr/bin/php-fpm { - include - include - include - include - - capability setgid, - capability setuid, - capability kill, - - /etc/php/php-fpm.conf r, - /etc/php/php-fpm.d/* r, - - # This is set to make php-fpm work by default, but if you don't use these paths - # add "deny @{PHP_BASEDIRS}/** r," to local.usr.bin.php-fpm and add read rights - # to where your PHP app is located - @{PHP_BASEDIRS}/** r, - - /usr/bin/php-fpm mr, - - /usr/share/pear/** r, - /usr/share/php/fpm/status.html r, - - /var/log/php-fpm.log w, - - # Site-specific additions and overrides. See local/README for details. - include if exists - -} diff --git a/srcpkgs/apparmor/patches/fix-perl-cross.patch b/srcpkgs/apparmor/patches/fix-perl-cross.patch new file mode 100644 index 00000000000000..a4b29d7817f8ad --- /dev/null +++ b/srcpkgs/apparmor/patches/fix-perl-cross.patch @@ -0,0 +1,11 @@ +--- a/libraries/libapparmor/swig/perl/Makefile.am ++++ b/libraries/libapparmor/swig/perl/Makefile.am +@@ -11,7 +11,7 @@ + LibAppArmor.pm: libapparmor_wrap.c + + Makefile.perl: Makefile.PL LibAppArmor.pm +- $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ ++ $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC) + sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl + sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl + diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template index 71e38441041608..1b06fc6c1aa56a 100644 --- a/srcpkgs/apparmor/template +++ b/srcpkgs/apparmor/template @@ -1,18 +1,18 @@ # Template file for 'apparmor' pkgname=apparmor version=4.1.7 -revision=1 +revision=2 build_wrksrc=libraries/libapparmor +build_helper="python3" build_style=gnu-configure conf_files="/etc/apparmor.d/local/* /etc/apparmor/*" make_dirs="/etc/apparmor.d/disable 0755 root root" configure_args="$(vopt_with python) $(vopt_with perl)" -hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config - perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)" -makedepends="$(vopt_if python python3-devel)" -depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2 - python3-psutil python3-dbus iproute2" -checkdepends="dejagnu" +hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool + python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)" +makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)" +depends="runit-void-apparmor iproute2" +checkdepends="dejagnu " short_desc="Mandatory access control to restrict programs" maintainer="Orphaned " license="GPL-2.0-only" @@ -27,56 +27,57 @@ CFLAGS="-D_LARGEFILE64_SOURCE" CXXFLAGS="-D_LARGEFILE64_SOURCE" build_options="python perl" +build_options_default="python" -case "$XBPS_TARGET_MACHINE" in - x86_64*|aarch64*|i686*) - build_options_default+=" python" - ;; -esac +if [ "${build_option_perl}" -o "${build_option_python}" ]; then + hostmakedepends+=" swig" +fi -if [ -z "$CROSS_BUILD" ]; then - build_options_default+=" perl" +if [ "${build_option_python}" ]; then + depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" + checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" fi -pre_configure() { - cd ${wrksrc}/libraries/libapparmor - autoreconf -fiv +post_patch() { + # add custom profiles + cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/" } -pre_build() { - # Replace release profiles with our own - cd ${wrksrc} - cp ${FILESDIR}/profiles/* profiles/apparmor.d/ +pre_configure() { + autoreconf -fiv } post_build() { - cd ${wrksrc} + make ${makejobs} -C "${wrksrc}/binutils" + make ${makejobs} -C "${wrksrc}/parser" + make ${makejobs} -C "${wrksrc}/utils" + make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor" + make ${makejobs} -C "${wrksrc}/profiles" +} - make ${makejobs} -C binutils - make ${makejobs} -C utils - make ${makejobs} -C parser - make ${makejobs} -C profiles +do_check() { + make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check + make ${makejobs} -C "${wrksrc}/binutils" check + make ${makejobs} -C "${wrksrc}/parser" check + make ${makejobs} -C "${wrksrc}/utils" check + # make ${makejobs} -C "${wrksrc}/profiles" check # broken + make ${makejobs} -C "${wrksrc}/profiles" check-parser + make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d } post_install() { - cd ${wrksrc} commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\"" - make $commonflags install -C binutils + make $commonflags install -C "${wrksrc}/binutils" make $commonflags \ BINDIR="${DESTDIR}/usr/bin" \ VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \ - install -C utils + install -C "${wrksrc}/utils" make $commonflags \ APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \ - install -C parser - make DESTDIR="${DESTDIR}" install -C profiles - - # requires perl bindings not generated when cross-compiling - if [ -z "$build_option_perl" ]; then - rm -f ${DESTDIR}/usr/bin/aa-notify - fi + install -C "${wrksrc}/parser" + make DESTDIR="${DESTDIR}" install -C "${wrksrc}/profiles" - vinstall utils/aa-notify.desktop 644 usr/share/applications + vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications vdoc "${FILESDIR}/README.voidlinux" } @@ -90,6 +91,7 @@ libapparmor_package() { fi if [ "$build_option_python" ]; then vmove "${py3_sitelib}/LibAppArmor*" + vmove "${py3_sitelib}/_LibAppArmor*.so" fi vmove usr/share/man/man2 vmove usr/share/man/man3 @@ -99,7 +101,7 @@ libapparmor_package() { libapparmor-devel_package() { short_desc+=" - Library development files" license="LGPL-2.1-only" - depends="lib${sourcepkg}-${version}_${revision}" + depends="libapparmor-${version}_${revision}" pkg_install() { vmove usr/include vmove "usr/lib/*.a" From 97d0e6790c07654f99bb3a1916cce17677df0293 Mon Sep 17 00:00:00 2001 From: Duncaen Date: Wed, 29 Jul 2026 22:11:31 +0200 Subject: [PATCH 2/2] runit-void: remove /etc/default/apparmor settings Remove the mode switch in the /etc/runit/core-services/09-apparmor.sh script that causes issues. The `apparmor_parser -C` flag that was used to set the profiles into complain mode will force profiles that have the `unconfined` flag set into complain mode instead, which enables further restrictions that may break things. And there is no alternative flag to only set profiles that have the enforce flag to complain. The native kernel module parameter apparmor.mode should be used instead. As it puts apparmor into complain mode instead of trying to force profiles into complain mode. This fixes bwrap when executed by flatpak which has a profile with the unconfined flag set. --- srcpkgs/runit-void/files/09-apparmor.sh | 20 +++---------------- srcpkgs/runit-void/files/apparmor | 7 ------- .../runit-void-apparmor.INSTALL.msg | 7 +++++++ srcpkgs/runit-void/template | 11 ++++------ 4 files changed, 14 insertions(+), 31 deletions(-) delete mode 100644 srcpkgs/runit-void/files/apparmor create mode 100644 srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg diff --git a/srcpkgs/runit-void/files/09-apparmor.sh b/srcpkgs/runit-void/files/09-apparmor.sh index e2c87a6b6225fd..9ec6881c2d63a0 100644 --- a/srcpkgs/runit-void/files/09-apparmor.sh +++ b/srcpkgs/runit-void/files/09-apparmor.sh @@ -3,25 +3,11 @@ # AppArmor is not enabled in kernel, silently exit [ ! -d /sys/kernel/security/apparmor ] && return -# Load config -[ -r /etc/default/apparmor ] && . /etc/default/apparmor - # Proceed to load profiles depending on user settings msg "Loading AppArmor profiles..." -if [ -n "$APPARMOR" ]; then - if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then - printf '! AppArmor set to %s - ignoring profiles\n' "$APPARMOR" - return - fi - - [ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C" - - if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then - find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a $AACOMPLAIN -- {} + - else - printf '! AppArmor installation problem - ensure you have installed apparmor package\n' - fi +if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then + find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a -- {} + else - printf '! AppArmor disabled - ignoring profiles\n' + printf '! AppArmor installation problem - ensure you have installed apparmor package\n' fi diff --git a/srcpkgs/runit-void/files/apparmor b/srcpkgs/runit-void/files/apparmor deleted file mode 100644 index b32ce11a11ef34..00000000000000 --- a/srcpkgs/runit-void/files/apparmor +++ /dev/null @@ -1,7 +0,0 @@ -# AppArmor configuration - -# Possible options: -# - disable -# - complain -# - enforce -APPARMOR=complain diff --git a/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg new file mode 100644 index 00000000000000..1d55143bf860e5 --- /dev/null +++ b/srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg @@ -0,0 +1,7 @@ +The `/etc/default/apparmor` configuration file was removed. The system will now +boot in `enforce` mode by default. + +To boot in complain mode, add `apparmor.mode=complain` to the kernel command +line, or change the mode at runtime: + + # echo -n complain > /sys/module/apparmor/parameters/mode diff --git a/srcpkgs/runit-void/template b/srcpkgs/runit-void/template index a915b5434fb51e..6a3131751aa8e6 100644 --- a/srcpkgs/runit-void/template +++ b/srcpkgs/runit-void/template @@ -1,16 +1,16 @@ # Template file for 'runit-void' pkgname=runit-void version=20250212 -revision=3 +revision=4 build_style=gnu-makefile +depends="virtual?awk procps-ng runit" short_desc="Void Linux runit scripts" -maintainer="Enno Boland " +maintainer="Orphaned " license="CC0-1.0" homepage="https://github.com/void-linux/void-runit" distfiles="https://github.com/void-linux/void-runit/archive/refs/tags/${version}.tar.gz" checksum=c0d3ecea4dae5bba8ca3e563706847ef3b6cbdfcc19b8bf69b3f7a9bc0451f50 -depends="virtual?awk procps-ng runit" conf_files=" /etc/hostname /etc/locale.conf @@ -29,8 +29,7 @@ make_dirs=" alternatives=" logger:logger:/usr/bin/vlogger - logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8 -" + logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8" post_install() { vmkdir usr/bin @@ -50,9 +49,7 @@ post_install() { runit-void-apparmor_package() { short_desc+=" - AppArmor initialization" depends="${sourcepkg}-${version}_${revision}" - conf_files="/etc/default/apparmor" pkg_install() { - vmove etc/default/apparmor vmove etc/runit/core-services/09-apparmor.sh } }