Skip to content

apparmor: cleanup #61695

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Duncaen wants to merge 2 commits into
base: master
Choose a base branch
from
Open

apparmor: cleanup #61695

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
51d103b
apparmor: cleanup
Duncaen Jul 28, 2026
97d0e67
runit-void: remove /etc/default/apparmor settings
Duncaen Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 0 additions & 45 deletions srcpkgs/apparmor/files/profiles/usr.bin.php-fpm
View file
Open in desktop

This file was deleted.

11 changes: 11 additions & 0 deletions srcpkgs/apparmor/patches/fix-perl-cross.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
--- a/libraries/libapparmor/swig/perl/Makefile.am
+++ b/libraries/libapparmor/swig/perl/Makefile.am
@@ -11,7 +11,7 @@
LibAppArmor.pm: libapparmor_wrap.c

Makefile.perl: Makefile.PL LibAppArmor.pm
- $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@
+ $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC)
sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl
sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl

78 changes: 40 additions & 38 deletions srcpkgs/apparmor/template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
# Template file for 'apparmor'
pkgname=apparmor
version=4.1.7
revision=1
revision=2
build_wrksrc=libraries/libapparmor
build_helper="python3"
build_style=gnu-configure
conf_files="/etc/apparmor.d/local/* /etc/apparmor/*"
make_dirs="/etc/apparmor.d/disable 0755 root root"
configure_args="$(vopt_with python) $(vopt_with perl)"
hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config
perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)"
makedepends="$(vopt_if python python3-devel)"
depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2
python3-psutil python3-dbus iproute2"
checkdepends="dejagnu"
hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool
python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)"
makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)"
depends="runit-void-apparmor iproute2"
checkdepends="dejagnu "
short_desc="Mandatory access control to restrict programs"
maintainer="Orphaned <orphan@voidlinux.org>"
license="GPL-2.0-only"
Expand All @@ -27,56 +27,57 @@ CFLAGS="-D_LARGEFILE64_SOURCE"
CXXFLAGS="-D_LARGEFILE64_SOURCE"

build_options="python perl"
build_options_default="python"

case "$XBPS_TARGET_MACHINE" in
x86_64*|aarch64*|i686*)
build_options_default+=" python"
;;
esac
if [ "${build_option_perl}" -o "${build_option_python}" ]; then
hostmakedepends+=" swig"
fi

if [ -z "$CROSS_BUILD" ]; then
build_options_default+=" perl"
if [ "${build_option_python}" ]; then
depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject"
checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject"
fi

pre_configure() {
cd ${wrksrc}/libraries/libapparmor
autoreconf -fiv
post_patch() {
# add custom profiles
cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/"
}

pre_build() {
# Replace release profiles with our own
cd ${wrksrc}
cp ${FILESDIR}/profiles/* profiles/apparmor.d/
pre_configure() {
autoreconf -fiv
}

post_build() {
cd ${wrksrc}
make ${makejobs} -C "${wrksrc}/binutils"
make ${makejobs} -C "${wrksrc}/parser"
make ${makejobs} -C "${wrksrc}/utils"
make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor"
make ${makejobs} -C "${wrksrc}/profiles"
}

make ${makejobs} -C binutils
make ${makejobs} -C utils
make ${makejobs} -C parser
make ${makejobs} -C profiles
do_check() {
make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check
make ${makejobs} -C "${wrksrc}/binutils" check
make ${makejobs} -C "${wrksrc}/parser" check
make ${makejobs} -C "${wrksrc}/utils" check
# make ${makejobs} -C "${wrksrc}/profiles" check # broken
make ${makejobs} -C "${wrksrc}/profiles" check-parser
make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d
}

post_install() {
cd ${wrksrc}
commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\""
make $commonflags install -C binutils
make $commonflags install -C "${wrksrc}/binutils"
make $commonflags \
BINDIR="${DESTDIR}/usr/bin" \
VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \
install -C utils
install -C "${wrksrc}/utils"
make $commonflags \
APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \
install -C parser
make DESTDIR="${DESTDIR}" install -C profiles

# requires perl bindings not generated when cross-compiling
if [ -z "$build_option_perl" ]; then
rm -f ${DESTDIR}/usr/bin/aa-notify
fi
install -C "${wrksrc}/parser"
make DESTDIR="${DESTDIR}" install -C "${wrksrc}/profiles"

vinstall utils/aa-notify.desktop 644 usr/share/applications
vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications
vdoc "${FILESDIR}/README.voidlinux"
}

Expand All @@ -90,6 +91,7 @@ libapparmor_package() {
fi
if [ "$build_option_python" ]; then
vmove "${py3_sitelib}/LibAppArmor*"
vmove "${py3_sitelib}/_LibAppArmor*.so"
fi
vmove usr/share/man/man2
vmove usr/share/man/man3
Expand All @@ -99,7 +101,7 @@ libapparmor_package() {
libapparmor-devel_package() {
short_desc+=" - Library development files"
license="LGPL-2.1-only"
depends="lib${sourcepkg}-${version}_${revision}"
depends="libapparmor-${version}_${revision}"
pkg_install() {
vmove usr/include
vmove "usr/lib/*.a"
Expand Down
20 changes: 3 additions & 17 deletions srcpkgs/runit-void/files/09-apparmor.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,25 +3,11 @@
# AppArmor is not enabled in kernel, silently exit
[ ! -d /sys/kernel/security/apparmor ] && return

# Load config
[ -r /etc/default/apparmor ] && . /etc/default/apparmor

# Proceed to load profiles depending on user settings
msg "Loading AppArmor profiles..."

if [ -n "$APPARMOR" ]; then
if [ "$APPARMOR" != "complain" -a "$APPARMOR" != "enforce" ]; then
printf '! AppArmor set to %s - ignoring profiles\n' "$APPARMOR"
return
fi

[ "$APPARMOR" = "complain" ] && AACOMPLAIN="-C"

if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then
find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a $AACOMPLAIN -- {} +
else
printf '! AppArmor installation problem - ensure you have installed apparmor package\n'
fi
if [ -d /etc/apparmor.d -a -x /usr/bin/apparmor_parser ]; then
find -L /etc/apparmor.d -maxdepth 1 -type f ! -name '*.new-*_*' -exec apparmor_parser -a -- {} +

@CameronNemo CameronNemo Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shame we don't have upstream support for skipping these files (https://gitlab.com/apparmor/apparmor/-/blob/master/utils/apparmor/common.py#L171). AIUI the apparmor tooling has some optimizations when you just run it against the whole directory vs. profile by profile.

@CameronNemo CameronNemo Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

once upon a time I added the support, but I guess it got lost in the mix https://gitlab.com/apparmor/apparmor/-/merge_requests/230/diffs#diff-content-2d7d631567a2e800da349ed4e174f9680adc563d

else
printf '! AppArmor disabled - ignoring profiles\n'
printf '! AppArmor installation problem - ensure you have installed apparmor package\n'
fi
7 changes: 0 additions & 7 deletions srcpkgs/runit-void/files/apparmor
View file
Open in desktop

This file was deleted.

7 changes: 7 additions & 0 deletions srcpkgs/runit-void/runit-void-apparmor.INSTALL.msg
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
The `/etc/default/apparmor` configuration file was removed. The system will now
boot in `enforce` mode by default.

To boot in complain mode, add `apparmor.mode=complain` to the kernel command
line, or change the mode at runtime:

# echo -n complain > /sys/module/apparmor/parameters/mode
11 changes: 4 additions & 7 deletions srcpkgs/runit-void/template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,16 @@
# Template file for 'runit-void'
pkgname=runit-void
version=20250212
revision=3
revision=4
build_style=gnu-makefile
depends="virtual?awk procps-ng runit"
short_desc="Void Linux runit scripts"
maintainer="Enno Boland <gottox@voidlinux.org>"
maintainer="Orphaned <orphan@voidlinux.org>"
license="CC0-1.0"
homepage="https://github.com/void-linux/void-runit"
distfiles="https://github.com/void-linux/void-runit/archive/refs/tags/${version}.tar.gz"
checksum=c0d3ecea4dae5bba8ca3e563706847ef3b6cbdfcc19b8bf69b3f7a9bc0451f50

depends="virtual?awk procps-ng runit"
conf_files="
/etc/hostname
/etc/locale.conf
Expand All @@ -29,8 +29,7 @@ make_dirs="

alternatives="
logger:logger:/usr/bin/vlogger
logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8
"
logger:/usr/share/man/man1/logger.1:/usr/share/man/man8/vlogger.8"

post_install() {
vmkdir usr/bin
Expand All @@ -50,9 +49,7 @@ post_install() {
runit-void-apparmor_package() {
short_desc+=" - AppArmor initialization"
depends="${sourcepkg}-${version}_${revision}"
conf_files="/etc/default/apparmor"
pkg_install() {
vmove etc/default/apparmor
vmove etc/runit/core-services/09-apparmor.sh
}
}
Loading