diff options
Diffstat (limited to 'recipes-mac/AppArmor/files/apparmor.rc')
| -rw-r--r-- | recipes-mac/AppArmor/files/apparmor.rc | 98 |
1 files changed, 0 insertions, 98 deletions
diff --git a/recipes-mac/AppArmor/files/apparmor.rc b/recipes-mac/AppArmor/files/apparmor.rc deleted file mode 100644 index 1507d7b..0000000 --- a/recipes-mac/AppArmor/files/apparmor.rc +++ /dev/null | |||
| @@ -1,98 +0,0 @@ | |||
| 1 | description "Pre-cache and pre-load apparmor profiles" | ||
| 2 | author "Dimitri John Ledkov <xnox@ubuntu.com> and Jamie Strandboge <jamie@ubuntu.com>" | ||
| 3 | |||
| 4 | task | ||
| 5 | |||
| 6 | start on starting rc-sysinit | ||
| 7 | |||
| 8 | script | ||
| 9 | [ -d /rofs/etc/apparmor.d ] && exit 0 # do not load on liveCD | ||
| 10 | [ -d /sys/module/apparmor ] || exit 0 # do not load without AppArmor | ||
| 11 | [ -x /sbin/apparmor_parser ] || exit 0 # do not load without parser | ||
| 12 | |||
| 13 | . /lib/apparmor/functions | ||
| 14 | |||
| 15 | systemd-detect-virt --quiet --container && ! is_container_with_internal_policy && exit 0 || true | ||
| 16 | |||
| 17 | # Need securityfs for any mode | ||
| 18 | if [ ! -d /sys/kernel/security/apparmor ]; then | ||
| 19 | if cut -d" " -f2,3 /proc/mounts | grep -q "^/sys/kernel/security securityfs"'$' ; then | ||
| 20 | exit 0 | ||
| 21 | else | ||
| 22 | mount -t securityfs none /sys/kernel/security || exit 0 | ||
| 23 | fi | ||
| 24 | fi | ||
| 25 | |||
| 26 | [ -w /sys/kernel/security/apparmor/.load ] || exit 0 | ||
| 27 | |||
| 28 | apparmor_was_updated=0 | ||
| 29 | if ! compare_previous_version ; then | ||
| 30 | # On snappy flavors, if the current and previous versions are | ||
| 31 | # different then clear the system cache. snappy will handle | ||
| 32 | # "$PROFILES_CACHE_VAR" itself (on Touch flavors | ||
| 33 | # compare_previous_version always returns '0' since snappy | ||
| 34 | # isn't available). | ||
| 35 | clear_cache_system | ||
| 36 | apparmor_was_updated=1 | ||
| 37 | elif ! compare_and_save_debsums apparmor ; then | ||
| 38 | # If the system policy has been updated since the last time we | ||
| 39 | # ran, clear the cache to prevent potentially stale binary | ||
| 40 | # cache files after an Ubuntu image based upgrade (LP: | ||
| 41 | # #1350673). This can be removed once all system image flavors | ||
| 42 | # move to snappy (on snappy systems compare_and_save_debsums | ||
| 43 | # always returns '0' since /var/lib/dpkg doesn't exist). | ||
| 44 | clear_cache | ||
| 45 | apparmor_was_updated=1 | ||
| 46 | fi | ||
| 47 | |||
| 48 | if [ -x /usr/bin/aa-clickhook ] || [ -x /usr/bin/aa-profile-hook ] ; then | ||
| 49 | # If packages for system policy that affect click packages have | ||
| 50 | # been updated since the last time we ran, run aa-clickhook -f | ||
| 51 | force_clickhook=0 | ||
| 52 | force_profile_hook=0 | ||
| 53 | if ! compare_and_save_debsums apparmor-easyprof-ubuntu ; then | ||
| 54 | force_clickhook=1 | ||
| 55 | fi | ||
| 56 | if ! compare_and_save_debsums apparmor-easyprof-ubuntu-snappy ; then | ||
| 57 | force_clickhook=1 | ||
| 58 | fi | ||
| 59 | if ! compare_and_save_debsums click-apparmor ; then | ||
| 60 | force_clickhook=1 | ||
| 61 | force_profile_hook=1 | ||
| 62 | fi | ||
| 63 | if [ -x /usr/bin/aa-clickhook ] && ([ $force_clickhook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then | ||
| 64 | aa-clickhook -f | ||
| 65 | fi | ||
| 66 | if [ -x /usr/bin/aa-profile-hook ] && ([ $force_profile_hook -eq 1 ] || [ $apparmor_was_updated -eq 1 ]) ; then | ||
| 67 | aa-profile-hook -f | ||
| 68 | fi | ||
| 69 | fi | ||
| 70 | |||
| 71 | if [ "$ACTION" = "teardown" ]; then | ||
| 72 | running_profile_names | while read profile; do | ||
| 73 | unload_profile "$profile" | ||
| 74 | done | ||
| 75 | exit 0 | ||
| 76 | fi | ||
| 77 | |||
| 78 | if [ "$ACTION" = "clear" ]; then | ||
| 79 | clear_cache | ||
| 80 | exit 0 | ||
| 81 | fi | ||
| 82 | |||
| 83 | if [ "$ACTION" = "reload" ] || [ "$ACTION" = "force-reload" ]; then | ||
| 84 | clear_cache | ||
| 85 | load_configured_profiles | ||
| 86 | unload_obsolete_profiles | ||
| 87 | exit 0 | ||
| 88 | fi | ||
| 89 | |||
| 90 | # Note: if apparmor-easyprof-ubuntu md5sums didn't match up above, | ||
| 91 | # aa-clickhook will have already compiled the policy, generated the cache | ||
| 92 | # files and loaded them into the kernel by this point, so reloading click | ||
| 93 | # policy from cache, while fairly fast (<2 seconds for 250 profiles on | ||
| 94 | # armhf), is redundant. Fixing this would complicate the logic quite a bit | ||
| 95 | # and it wouldn't improve the (by far) common case (ie, when | ||
| 96 | # 'aa-clickhook -f' is not run). | ||
| 97 | load_configured_profiles | ||
| 98 | end script | ||