From 909fbb4b3e890bd8542b8563970caa16ce568bab Mon Sep 17 00:00:00 2001 From: Duncaen Date: Tue, 28 Jul 2026 18:12:36 +0200 Subject: [PATCH] apparmor: cleanup - cleanup template - enable more checks - remove old custom php-fpm profile - allow cross building perl library - move apparmor syscall and library man pages to libapparmor-devel - add missing python dependencies - add patch for xbps .new-* style files --- .../apparmor/files/profiles/usr.bin.php-fpm | 45 --------- ...ps-style-backup-files-for-void-linux.patch | 85 +++++++++++++++++ srcpkgs/apparmor/patches/fix-perl-cross.patch | 11 +++ srcpkgs/apparmor/template | 95 ++++++++++--------- 4 files changed, 145 insertions(+), 91 deletions(-) delete mode 100644 srcpkgs/apparmor/files/profiles/usr.bin.php-fpm create mode 100644 srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch create mode 100644 srcpkgs/apparmor/patches/fix-perl-cross.patch diff --git a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm b/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm deleted file mode 100644 index 0b036965da1..00000000000 --- a/srcpkgs/apparmor/files/profiles/usr.bin.php-fpm +++ /dev/null @@ -1,45 +0,0 @@ -# vim:syntax=apparmor - -abi , - -# NOTE: This profile uses TCP sockets by default -# If you wish for php-fpm to listen to unix socket, -# add the following permission to local/usr.bin.php-fpm -# /path/to/your/unix/socket w, - -include - -# This is PHP open_basedir where script can only be executed from. -# /home, /tmp have been removed to not open permissions too widely -# /usr/share/pear have been removed to have its own permission -@{PHP_BASEDIRS} = /srv/www/ /var/www/ /usr/share/webapps/ - -profile php-fpm /usr/bin/php-fpm { - include - include - include - include - - capability setgid, - capability setuid, - capability kill, - - /etc/php/php-fpm.conf r, - /etc/php/php-fpm.d/* r, - - # This is set to make php-fpm work by default, but if you don't use these paths - # add "deny @{PHP_BASEDIRS}/** r," to local.usr.bin.php-fpm and add read rights - # to where your PHP app is located - @{PHP_BASEDIRS}/** r, - - /usr/bin/php-fpm mr, - - /usr/share/pear/** r, - /usr/share/php/fpm/status.html r, - - /var/log/php-fpm.log w, - - # Site-specific additions and overrides. See local/README for details. - include if exists - -} diff --git a/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch b/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch new file mode 100644 index 00000000000..89d8810833b --- /dev/null +++ b/srcpkgs/apparmor/patches/0001-add-xbps-style-backup-files-for-void-linux.patch @@ -0,0 +1,85 @@ +From cb4141646e5fd58261cc345e02a7f0c88e24a07d Mon Sep 17 00:00:00 2001 +From: Duncan Overbruck +Date: Sat, 1 Aug 2026 17:47:11 +0200 +Subject: [PATCH] add xbps style backup files for void linux + +--- + libraries/libapparmor/src/private.c | 4 ++++ + parser/apparmor_parser.pod | 2 +- + utils/apparmor/common.py | 3 +++ + utils/test/test-aa.py | 3 +++ + 4 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/libraries/libapparmor/src/private.c b/libraries/libapparmor/src/private.c +index 39b578972..afca9cc5f 100644 +--- a/libraries/libapparmor/src/private.c ++++ b/libraries/libapparmor/src/private.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -179,6 +180,9 @@ int _aa_is_blacklisted(const char *name) + } + } + ++ if (fnmatch(name, "*.new-*", 0) == 0) ++ return 1; ++ + return 0; + } + +diff --git a/parser/apparmor_parser.pod b/parser/apparmor_parser.pod +index 470585202..b5a788ab2 100644 +--- a/parser/apparmor_parser.pod ++++ b/parser/apparmor_parser.pod +@@ -47,7 +47,7 @@ name containing a set of profiles. If a directory is specified then the + B will try to do a profile load for each file in the + directory that is not a dot file, or explicitly black listed (*.dpkg-new, + *.dpkg-old, *.dpkg-dist, *.dpkg-bak, *.dpkg-remove, *.pacsave, *.pacnew, +-*.rpmnew, *.rpmsave, *.orig, *.rej, *~). ++*.rpmnew, *.rpmsave, *.orig, *.rej, *~, *.new-*). + The B will fall back to taking input from standard input if + a profile or directory is not supplied. + +diff --git a/utils/apparmor/common.py b/utils/apparmor/common.py +index 73d1c6fe3..8f6bbbb45 100644 +--- a/utils/apparmor/common.py ++++ b/utils/apparmor/common.py +@@ -18,6 +18,7 @@ import signal + import sys + import termios + import tty ++import fnmatch + from tempfile import NamedTemporaryFile + + DEBUGGING = False +@@ -183,6 +184,8 @@ def is_skippable_file(path): + '.pacsave', '.pacnew', '.rpmnew', '.rpmsave', '.orig', '.rej', '~') + if basename.endswith(skippable_suffix): + return True ++ if fnmatch.fnmatch(basename, "*.new-*"): ++ return True + + return False + +diff --git a/utils/test/test-aa.py b/utils/test/test-aa.py +index c51d18671..44a788073 100644 +--- a/utils/test/test-aa.py ++++ b/utils/test/test-aa.py +@@ -505,6 +505,9 @@ class AaTest_is_skippable_file(AATest): + def test_skippable_16(self): + self.assertTrue(is_skippable_file('README')) + ++ def test_skippable_17(self): ++ self.assertTrue(is_skippable_file('bin.ping.new-1.0_1')) ++ + + class AaTest_parse_profile_data(AATest): + def test_parse_empty_profile_01(self): +-- +2.55.0 + diff --git a/srcpkgs/apparmor/patches/fix-perl-cross.patch b/srcpkgs/apparmor/patches/fix-perl-cross.patch new file mode 100644 index 00000000000..a4b29d7817f --- /dev/null +++ b/srcpkgs/apparmor/patches/fix-perl-cross.patch @@ -0,0 +1,11 @@ +--- a/libraries/libapparmor/swig/perl/Makefile.am ++++ b/libraries/libapparmor/swig/perl/Makefile.am +@@ -11,7 +11,7 @@ + LibAppArmor.pm: libapparmor_wrap.c + + Makefile.perl: Makefile.PL LibAppArmor.pm +- $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ ++ $(PERL) $< PREFIX=$(prefix) MAKEFILE=$@ CC=$(CC) LD=$(CC) + sed -ie 's/LD_RUN_PATH="\x24(LD_RUN_PATH)"//g' Makefile.perl + sed -ie 's/^LD_RUN_PATH.*//g' Makefile.perl + diff --git a/srcpkgs/apparmor/template b/srcpkgs/apparmor/template index 71e38441041..750fa2991a8 100644 --- a/srcpkgs/apparmor/template +++ b/srcpkgs/apparmor/template @@ -1,18 +1,18 @@ # Template file for 'apparmor' pkgname=apparmor version=4.1.7 -revision=1 +revision=2 build_wrksrc=libraries/libapparmor +build_helper="python3" build_style=gnu-configure conf_files="/etc/apparmor.d/local/* /etc/apparmor/*" make_dirs="/etc/apparmor.d/disable 0755 root root" configure_args="$(vopt_with python) $(vopt_with perl)" -hostmakedepends="bison flex gettext python3 which python3-setuptools pkg-config - perl autoconf-archive automake libtool python3-packaging-bootstrap $(vopt_if python swig)" -makedepends="$(vopt_if python python3-devel)" -depends="runit-void-apparmor libapparmor-${version}_${revision} python3-notify2 - python3-psutil python3-dbus iproute2" -checkdepends="dejagnu" +hostmakedepends="bison flex gettext pkg-config autoconf-archive automake which libtool + python3 python3-setuptools python3-packaging-bootstrap $(vopt_if perl perl)" +makedepends="$(vopt_if python python3-devel) pam-devel $(vopt_if perl perl)" +depends="runit-void-apparmor iproute2" +checkdepends="dejagnu " short_desc="Mandatory access control to restrict programs" maintainer="Orphaned " license="GPL-2.0-only" @@ -27,56 +27,58 @@ CFLAGS="-D_LARGEFILE64_SOURCE" CXXFLAGS="-D_LARGEFILE64_SOURCE" build_options="python perl" +build_options_default="python" -case "$XBPS_TARGET_MACHINE" in - x86_64*|aarch64*|i686*) - build_options_default+=" python" - ;; -esac - -if [ -z "$CROSS_BUILD" ]; then - build_options_default+=" perl" +if [ "${build_option_perl}" -o "${build_option_python}" ]; then + hostmakedepends+=" swig" fi +if [ "${build_option_python}" ]; then + depends+=" python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" + checkdepends+=" flake8 python3-notify2 python3-psutil python3-dbus python3-tkinter python3-gobject" +fi + +post_patch() { + # add custom profiles + cp -vn "${FILESDIR}"/profiles/* "${wrksrc}/profiles/apparmor.d/" +} + pre_configure() { - cd ${wrksrc}/libraries/libapparmor autoreconf -fiv } -pre_build() { - # Replace release profiles with our own - cd ${wrksrc} - cp ${FILESDIR}/profiles/* profiles/apparmor.d/ -} - post_build() { - cd ${wrksrc} - - make ${makejobs} -C binutils - make ${makejobs} -C utils - make ${makejobs} -C parser - make ${makejobs} -C profiles + make ${makejobs} -C "${wrksrc}/binutils" + make ${makejobs} -C "${wrksrc}/parser" + make ${makejobs} -C "${wrksrc}/utils" + make ${makejobs} -C "${wrksrc}/changehat/pam_apparmor" + make ${makejobs} -C "${wrksrc}/profiles" } -post_install() { - cd ${wrksrc} - commonflags="DESTDIR=\"${DESTDIR}\" SBINDIR=\"${DESTDIR}/usr/bin\" USR_SBINDIR=\"${DESTDIR}/usr/bin\"" - make $commonflags install -C binutils - make $commonflags \ - BINDIR="${DESTDIR}/usr/bin" \ - VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" \ - install -C utils - make $commonflags \ - APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" \ - install -C parser - make DESTDIR="${DESTDIR}" install -C profiles +do_check() { + make ${makejobs} -C "${wrksrc}/libraries/libapparmor" check + make ${makejobs} -C "${wrksrc}/binutils" check + make ${makejobs} -C "${wrksrc}/parser" check + make ${makejobs} -C "${wrksrc}/utils" check + # make ${makejobs} -C "${wrksrc}/profiles" check # broken + make ${makejobs} -C "${wrksrc}/profiles" check-parser + make ${makejobs} -C "${wrksrc}/profiles" check-abstractions.d +} - # requires perl bindings not generated when cross-compiling - if [ -z "$build_option_perl" ]; then - rm -f ${DESTDIR}/usr/bin/aa-notify - fi +do_install() { + local _args=( + "DESTDIR=\"${DESTDIR}\"" + "SBINDIR=\"${DESTDIR}/usr/bin\"" + "BINDIR=\"${DESTDIR}/usr/bin\"" + "USR_SBINDIR=\"${DESTDIR}/usr/bin\"" + ) + make -C "${wrksrc}/libraries/libapparmor" "${_args[@]}" install + make -C "${wrksrc}/binutils" "${_args[@]}" install + make -C "${wrksrc}/utils" "${_args[@]}" VIM_INSTALL_PATH="${DESTDIR}/usr/share/vim/vimfiles/syntax" install + make -C "${wrksrc}/parser" "${_args[@]}" APPARMOR_BIN_PREFIX="${DESTDIR}/usr/lib/apparmor" install + make -C "${wrksrc}/profiles" "${_args[@]}" install - vinstall utils/aa-notify.desktop 644 usr/share/applications + vinstall "${wrksrc}/utils/aa-notify.desktop" 644 usr/share/applications vdoc "${FILESDIR}/README.voidlinux" } @@ -90,6 +92,7 @@ libapparmor_package() { fi if [ "$build_option_python" ]; then vmove "${py3_sitelib}/LibAppArmor*" + vmove "${py3_sitelib}/_LibAppArmor*.so" fi vmove usr/share/man/man2 vmove usr/share/man/man3 @@ -99,7 +102,7 @@ libapparmor_package() { libapparmor-devel_package() { short_desc+=" - Library development files" license="LGPL-2.1-only" - depends="lib${sourcepkg}-${version}_${revision}" + depends="libapparmor-${version}_${revision}" pkg_install() { vmove usr/include vmove "usr/lib/*.a"