1 files changed, 271 insertions, 0 deletions

diff --git a/recipes-security/AppArmor/files/functions b/recipes-security/AppArmor/files/functions
new file mode 100644
index 0000000..cef8cfe
--- /dev/null
+++ b/recipes-security/AppArmor/files/functions
@@ -0,0 +1,271 @@
+# /lib/apparmor/functions for Debian -*- shell-script -*-
+# ----------------------------------------------------------------------
+#    Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
+#     NOVELL (All rights reserved)
+#    Copyright (c) 2008-2010 Canonical, Ltd.
+#
+#    This program is free software; you can redistribute it and/or
+#    modify it under the terms of version 2 of the GNU General Public
+#    License published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program; if not, contact Novell, Inc.
+# ----------------------------------------------------------------------
+# Authors:
+#  Kees Cook <kees@ubuntu.com>
+
+PROFILES="/etc/apparmor.d"
+PROFILES_CACHE="$PROFILES/cache"
+PROFILES_VAR="/var/lib/apparmor/profiles"
+PROFILES_SNAPPY="/var/lib/snapd/apparmor/profiles"
+PROFILES_CACHE_VAR="/var/cache/apparmor"
+PARSER="/sbin/apparmor_parser"
+SECURITYFS="/sys/kernel/security"
+export AA_SFS="$SECURITYFS/apparmor"
+
+# Suppress warnings when booting in quiet mode
+quiet_arg=""
+[ "${QUIET:-no}" = yes ] && quiet_arg="-q"
+[ "${quiet:-n}" = y ] && quiet_arg="-q"
+
+foreach_configured_profile() {
+        rc_all="0"
+        for pdir in "$PROFILES" "$PROFILES_VAR" "$PROFILES_SNAPPY" ; do
+                if [ ! -d "$pdir" ]; then
+                        continue
+                fi
+                num=`find "$pdir" -type f ! -name '*.md5sums' | wc -l`
+                if [ "$num" = "0" ]; then
+                        continue
+                fi
+
+                cache_dir="$PROFILES_CACHE"
+                if [ -d "$PROFILES_CACHE_VAR" ] && [ "$pdir" = "$PROFILES_VAR" ] || [ "$pdir" = "$PROFILES_SNAPPY" ]; then
+                        cache_dir="$PROFILES_CACHE_VAR"
+                fi
+                cache_args="--cache-loc=$cache_dir"
+                if [ ! -d "$cache_dir" ]; then
+                        cache_args=
+                fi
+
+                # LP: #1383858 - expr tree simplification is too slow for
+                # Touch policy on ARM, so disable it for now
+                cache_extra_args=
+                if [ -d "$PROFILES_CACHE_VAR" ] && [ "$pdir" = "$PROFILES_VAR" ] || [ "$pdir" = "$PROFILES_SNAPPY" ]; then
+                        cache_extra_args="-O no-expr-simplify"
+                fi
+
+                # If need to compile everything, then use -n1 with xargs to
+                # take advantage of -P. When cache files are in use, omit -n1
+                # since it is considerably faster on moderately sized profile
+                # sets to give the parser all the profiles to load at once
+                n1_args=
+                num=`find "$cache_dir" -type f ! -name '.features' | wc -l`
+                if [ "$num" = "0" ]; then
+                        n1_args="-n1"
+                fi
+
+                (ls -1 "$pdir" | egrep -v '(\.dpkg-(new|old|dist|bak)|~)$' | \
+                while read profile; do
+                        if [ -f "$pdir"/"$profile" ]; then
+                                echo "$pdir"/"$profile"
+                        fi
+                done) | \
+                xargs $n1_args -d"\n" -P$(getconf _NPROCESSORS_ONLN) "$PARSER" "$@" $cache_args $cache_extra_args -- || {
+                        rc_all="$?"
+                        # FIXME: when the parser properly handles broken
+                        # profiles (LP: #1377338), remove this if statement.
+                        # For now, if the xargs returns with error, just run
+                        # through everything with -n1. (This could be broken
+                        # out and refactored, but this is temporary so make it
+                        # easy to understand and revert)
+                        if [ "$rc_all" != "0" ]; then
+                                (ls -1 "$pdir" | \
+                                egrep -v '(\.dpkg-(new|old|dist|bak)|~)$' | \
+                                while read profile; do
+                                        if [ -f "$pdir"/"$profile" ]; then
+                                                echo "$pdir"/"$profile"
+                                        fi
+                                done) | \
+                                xargs -n1 -d"\n" -P$(getconf _NPROCESSORS_ONLN) "$PARSER" "$@" $cache_args $cache_extra_args -- || {
+                                        rc_all="$?"
+                                }
+                        fi
+                }
+        done
+        return $rc_all
+}
+
+load_configured_profiles() {
+        clear_cache_if_outdated
+        foreach_configured_profile $quiet_arg --write-cache --replace
+}
+
+load_configured_profiles_without_caching() {
+        foreach_configured_profile $quiet_arg --replace
+}
+
+recache_profiles() {
+        clear_cache
+        foreach_configured_profile $quiet_arg --write-cache --skip-kernel-load
+}
+
+configured_profile_names() {
+        foreach_configured_profile $quiet_arg -N 2>/dev/null | LC_COLLATE=C sort | grep -v '//'
+}
+
+running_profile_names() {
+        # Output a sorted list of loaded profiles, skipping libvirt's
+        # dynamically generated files
+        cat "$AA_SFS"/profiles | sed -e "s/ (\(enforce\|complain\))$//" | egrep -v '^libvirt-[0-9a-f\-]+$' | LC_COLLATE=C sort | grep -v '//'
+}
+
+unload_profile() {
+        echo -n "$1" > "$AA_SFS"/.remove
+}
+
+clear_cache() {
+        clear_cache_system
+        clear_cache_var
+}
+
+clear_cache_system() {
+        find "$PROFILES_CACHE" -maxdepth 1 -type f -print0 | xargs -0 rm -f --
+}
+
+clear_cache_var() {
+        find "$PROFILES_CACHE_VAR" -maxdepth 1 -type f -print0 | xargs -0 rm -f --
+}
+
+read_features_dir()
+{
+        for f in `ls -AU "$1"` ; do
+                if [ -f "$1/$f" ] ; then
+                        read -r KF < "$1/$f" || true
+                        echo -n "$f {$KF } "
+                elif [ -d "$1/$f" ] ; then
+                        echo -n "$f {"
+                        KF=`read_features_dir "$1/$f"` || true
+                        echo -n "$KF} "
+                fi
+        done
+}
+
+clear_cache_if_outdated() {
+        if [ -r "$PROFILES_CACHE"/.features ]; then
+                if [ -d "$AA_SFS"/features ]; then
+                        KERN_FEATURES=`read_features_dir "$AA_SFS"/features`
+                else
+                        read -r KERN_FEATURES < "$AA_SFS"/features
+                fi
+                CACHE_FEATURES=`tr '\n' ' ' < "$PROFILES_CACHE"/.features`
+                if [ "$KERN_FEATURES" != "$CACHE_FEATURES" ]; then
+                        clear_cache
+                fi
+        fi
+}
+
+unload_obsolete_profiles() {
+        # Currently we must re-parse all the profiles to get policy names.  :(
+        aa_configured=$(mktemp -t aa-XXXXXX)
+        configured_profile_names > "$aa_configured" || true
+        aa_loaded=$(mktemp -t aa-XXXXXX)
+        running_profile_names > "$aa_loaded" || true
+        LC_COLLATE=C comm -2 -3 "$aa_loaded" "$aa_configured" | while read profile ; do
+                unload_profile "$profile"
+        done
+        rm -f "$aa_configured" "$aa_loaded"
+}
+
+# If the system debsum differs from the saved debsum, the new system debsum is
+# saved and non-zero is returned. Returns 0 if the two debsums matched or if
+# the system debsum file does not exist. This can be removed when system image
+# flavors all move to snappy.
+compare_and_save_debsums() {
+        pkg="$1"
+
+        if [ -n $pkg ] && [ -d "$PROFILES_VAR" ]; then
+                sums="/var/lib/dpkg/info/${pkg}.md5sums"
+                # store saved md5sums in /var/lib/apparmor/profiles since
+                # /var/cache/apparmor might be cleared by apparmor
+                saved_sums="${PROFILES_VAR}/.${pkg}.md5sums"
+
+                if [ -f "$sums" ] && \
+                   ! diff -q "$sums" "$saved_sums" 2>&1 >/dev/null ; then
+                        cp -f "$sums" "$saved_sums"
+                        return 1
+                fi
+        fi
+
+        return 0
+}
+
+compare_previous_version() {
+        installed="/usr/share/snappy/security-policy-version"
+        previous="/var/lib/snappy/security-policy-version"
+
+        # When just $previous doesn't exist, assume this is a new system with
+        # no cache and don't do anything special.
+        if [ -f "$installed" ] && [ -f "$previous" ]; then
+                pv=`grep '^apparmor/' "$previous" | cut -d ' ' -f 2`
+                iv=`grep '^apparmor/' "$installed" | cut -d ' ' -f 2`
+                if [ -n "$iv" ] && [ -n "$pv" ] && [ "$iv" != "$pv" ]; then
+                        # snappy updates $previous elsewhere, so just return
+                        return 1
+                fi
+        fi
+
+        return 0
+}
+
+# Checks to see if the current container is capable of having internal AppArmor
+# profiles that should be loaded. Callers of this function should have already
+# verified that they're running inside of a container environment with
+# something like `systemd-detect-virt --container`.
+#
+# The only known container environments capable of supporting internal policy
+# are LXD and LXC environment.
+#
+# Returns 0 if the container environment is capable of having its own internal
+# policy and non-zero otherwise.
+#
+# IMPORTANT: This function will return 0 in the case of a non-LXD/non-LXC
+# system container technology being nested inside of a LXD/LXC container that
+# utilized an AppArmor namespace and profile stacking. The reason 0 will be
+# returned is because .ns_stacked will be "yes" and .ns_name will still match
+# "lx[dc]-*" since the nested system container technology will not have set up
+# a new AppArmor profile namespace. This will result in the nested system
+# container's boot process to experience failed policy loads but the boot
+# process should continue without any loss of functionality. This is an
+# unsupported configuration that cannot be properly handled by this function.
+is_container_with_internal_policy() {
+        local ns_stacked_path="${AA_SFS}/.ns_stacked"
+        local ns_name_path="${AA_SFS}/.ns_name"
+        local ns_stacked
+        local ns_name
+
+        if ! [ -f "$ns_stacked_path" ] || ! [ -f "$ns_name_path" ]; then
+                return 1
+        fi
+
+        read -r ns_stacked < "$ns_stacked_path"
+        if [ "$ns_stacked" != "yes" ]; then
+                return 1
+        fi
+
+        # LXD and LXC set up AppArmor namespaces starting with "lxd-" and
+        # "lxc-", respectively. Return non-zero for all other namespace
+        # identifiers.
+        read -r ns_name < "$ns_name_path"
+        if [ "${ns_name#lxd-*}" = "$ns_name" ] && \
+           [ "${ns_name#lxc-*}" = "$ns_name" ]; then
+                return 1
+        fi
+
+        return 0
+}