Skip to content

hooks: add script to remove unneeded apparmor profiles #181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zyga wants to merge 1 commit into
base: master
Choose a base branch
from
Open

hooks: add script to remove unneeded apparmor profiles #181

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions hook-tests/800-remove-unneeded-profiles.test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
#!/bin/bash -e
set -x
APPARMOR_PROF_D="etc/apparmor.d"

Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The allowed_profs associative array is intentionally empty to indicate that no AppArmor profiles are expected in core20. Consider adding a comment here to make this explicit, such as: # Core20 expects no AppArmor profiles to remain after cleanup. This would improve code clarity for future maintainers.

Suggested change
# Core20 expects no AppArmor profiles to remain after cleanup, so this is intentionally empty

Copilot uses AI. Check for mistakes.
declare -A allowed_profs

num_prof=0

for profile in "$APPARMOR_PROF_D"/*; do
# Skip if it is a directory
if [ -d "$profile" ]; then
continue
fi
# Skip if not a regular file
if [ ! -f "$profile" ]; then
continue
fi
num_prof=$((num_prof + 1))

filename=$(basename "$profile")
if ! [[ -v allowed_profs["$filename"] ]]; then
printf "Apparmor profile %s is not allowed\n" "$filename"
exit 1
fi
done

if [ "$num_prof" -ne "${#allowed_profs[@]}" ]; then
# If there were more we would have failed in the loop
printf "Less number of apparmor profiles than expected\n"
exit 1
fi
54 changes: 54 additions & 0 deletions hooks/800-remove-unneeded-profiles.chroot
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
#!/bin/bash -ex

# Check profiles in /etc/apparmor.d/ and removes them if no matching binary
# exists.

APPARMOR_PROF_D="/etc/apparmor.d"

# The list of directories to check for binaries
SEARCH_DIRS=(
"/usr/bin"
"/usr/sbin"
"/usr/lib/systemd"
"/usr/lib/snapd"
"/usr/lib/cargo/bin"
)

echo "Starting AppArmor profile cleanup..."

# Iterate through files in /etc/apparmor.d/
for profile in "$APPARMOR_PROF_D"/*; do
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a check for directory existence before the loop or setting the nullglob option to handle the case where /etc/apparmor.d doesn't exist or is empty. While the current checks at lines 22-27 will prevent errors, adding 'shopt -s nullglob' before the loop would make the intent clearer and follow bash best practices for glob iteration.

Copilot uses AI. Check for mistakes.
# Skip if it is a directory
if [ -d "$profile" ]; then
continue
fi
# Skip if not a regular file
if [ ! -f "$profile" ]; then
continue
fi

filename=$(basename "$profile")

# unix-chkpwd profile is actually for unix_chkpwd, fix this naming issue here
if [ "$filename" = unix-chkpwd ]
then filename=unix_chkpwd
Comment on lines +33 to +34
Copy link

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The if-then statement should follow consistent formatting. The comparison value should be quoted for safety, and either put the then on the same line as if with a semicolon, or put then on a new line. Consider: if [ "$filename" = "unix-chkpwd" ]; then on one line, or split across lines with proper indentation matching the codebase style.

Suggested change
if [ "$filename" = unix-chkpwd ]
then filename=unix_chkpwd
if [ "$filename" = "unix-chkpwd" ]; then
filename=unix_chkpwd

Copilot uses AI. Check for mistakes.
fi

match_found=false
for target_dir in "${SEARCH_DIRS[@]}"; do
# Check if the file exists in the target directory
if [ -e "${target_dir}/${filename}" ]; then
match_found=true
break
fi
done

# If no match was found in any directory, perform deletion
if [ "$match_found" = false ]; then
echo "[DELETING] $profile"
rm "$profile"
fi

done

echo "Cleanup complete."
Loading