apparmor: 4.0.3 -> 4.1.0, rewrite (#400430)
This commit is contained in:
Martin Weinelt
@@ -68,6 +68,16 @@ with lib.maintainers;
|
||||
];
|
||||
};
|
||||
|
||||
apparmor = {
|
||||
scope = "AppArmor-related modules, userspace tool packages and profiles";
|
||||
shortName = "apparmor";
|
||||
members = [
|
||||
julm
|
||||
thoughtpolice
|
||||
grimmauld
|
||||
];
|
||||
};
|
||||
|
||||
bazel = {
|
||||
members = [
|
||||
mboes
|
||||
|
||||
@@ -172,7 +172,7 @@ in
|
||||
logfiles = /dev/stdin
|
||||
|
||||
parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
|
||||
ldd = ${pkgs.glibc.bin}/bin/ldd
|
||||
ldd = ${lib.getExe' pkgs.stdenv.cc.libc "ldd"}
|
||||
logger = ${pkgs.util-linux}/bin/logger
|
||||
|
||||
# customize how file ownership permissions are presented
|
||||
@@ -275,8 +275,5 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
meta.maintainers = with lib.maintainers; [
|
||||
julm
|
||||
grimmauld
|
||||
];
|
||||
meta.maintainers = lib.teams.apparmor.members;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
pkg-config,
|
||||
which,
|
||||
buildPackages,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
|
||||
# testing
|
||||
perl,
|
||||
}:
|
||||
stdenv.mkDerivation {
|
||||
pname = "apparmor-bin-utils";
|
||||
inherit (libapparmor)
|
||||
version
|
||||
src
|
||||
;
|
||||
|
||||
sourceRoot = "${libapparmor.src.name}/binutils";
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
libapparmor
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
libapparmor
|
||||
];
|
||||
|
||||
makeFlags = [
|
||||
"LANGS="
|
||||
"USE_SYSTEM=1"
|
||||
"POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
|
||||
"POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
|
||||
"MANDIR=share/man"
|
||||
];
|
||||
|
||||
doCheck = true;
|
||||
checkInputs = [ perl ];
|
||||
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"BINDIR=$(out)/bin"
|
||||
"SBINDIR=$(out)/bin"
|
||||
];
|
||||
|
||||
meta = libapparmor.meta // {
|
||||
description = "Mandatory access control system - binary user-land utilities";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
stdenv,
|
||||
pkg-config,
|
||||
which,
|
||||
pam,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
}:
|
||||
stdenv.mkDerivation {
|
||||
pname = "apparmor-pam";
|
||||
inherit (libapparmor)
|
||||
version
|
||||
src
|
||||
;
|
||||
|
||||
postPatch = ''
|
||||
substituteInPlace Makefile \
|
||||
--replace-fail "pkg-config" "$PKG_CONFIG"
|
||||
'';
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
libapparmor
|
||||
pam
|
||||
];
|
||||
|
||||
sourceRoot = "${libapparmor.src.name}/changehat/pam_apparmor";
|
||||
|
||||
makeFlags = [ "USE_SYSTEM=1" ];
|
||||
installFlags = [ "DESTDIR=$(out)" ];
|
||||
|
||||
meta = libapparmor.meta // {
|
||||
description = "Mandatory access control system - PAM service";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
{
|
||||
lib,
|
||||
stdenv,
|
||||
which,
|
||||
flex,
|
||||
bison,
|
||||
linuxHeaders ? stdenv.cc.libc.linuxHeaders,
|
||||
buildPackages,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
|
||||
# testing
|
||||
perl,
|
||||
python3,
|
||||
bashInteractive,
|
||||
}:
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "apparmor-parser";
|
||||
inherit (libapparmor) version src;
|
||||
|
||||
postPatch = ''
|
||||
patchShebangs .
|
||||
cd parser
|
||||
|
||||
substituteInPlace Makefile \
|
||||
--replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
|
||||
substituteInPlace rc.apparmor.functions \
|
||||
--replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
|
||||
substituteInPlace rc.apparmor.functions \
|
||||
--replace-fail "/usr/sbin/aa-status" '$(which aa-status)'
|
||||
sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
|
||||
'';
|
||||
|
||||
nativeBuildInputs = [
|
||||
bison
|
||||
flex
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [ libapparmor ];
|
||||
|
||||
makeFlags = [
|
||||
"LANGS="
|
||||
"USE_SYSTEM=1"
|
||||
"INCLUDEDIR=${libapparmor}/include"
|
||||
"AR=${stdenv.cc.bintools.targetPrefix}ar"
|
||||
"POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
|
||||
"POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
|
||||
"MANDIR=share/man"
|
||||
] ++ lib.optional finalAttrs.doCheck "PROVE=${lib.getExe' perl "prove"}";
|
||||
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"DISTRO=unknown"
|
||||
];
|
||||
|
||||
preCheck = "pushd ./tst";
|
||||
|
||||
checkTarget = "tests";
|
||||
|
||||
postCheck = "popd";
|
||||
|
||||
doCheck = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isMusl;
|
||||
checkInputs = [
|
||||
bashInteractive
|
||||
perl
|
||||
python3
|
||||
];
|
||||
|
||||
meta = libapparmor.meta // {
|
||||
description = "Mandatory access control system - core library";
|
||||
mainProgram = "apparmor_parser";
|
||||
};
|
||||
})
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
stdenv,
|
||||
which,
|
||||
callPackage,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
apparmor-parser,
|
||||
apparmor-utils,
|
||||
}:
|
||||
stdenv.mkDerivation {
|
||||
pname = "apparmor-profiles";
|
||||
inherit (libapparmor) version src;
|
||||
|
||||
sourceRoot = "${libapparmor.src.name}/profiles";
|
||||
|
||||
nativeBuildInputs = [ which ];
|
||||
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"EXTRAS_DEST=$(out)/share/apparmor/extra-profiles"
|
||||
];
|
||||
|
||||
checkTarget = "check";
|
||||
|
||||
checkInputs = [
|
||||
apparmor-parser
|
||||
apparmor-utils
|
||||
];
|
||||
|
||||
preCheck = ''
|
||||
export USE_SYSTEM=1
|
||||
export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
|
||||
'';
|
||||
|
||||
doCheck = true;
|
||||
|
||||
meta = libapparmor.meta // {
|
||||
description = "Mandatory access control system - profiles";
|
||||
mainProgram = "apparmor_parser";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
{
|
||||
lib,
|
||||
runCommand,
|
||||
util-linux,
|
||||
stdenv,
|
||||
runtimeShell,
|
||||
bashInteractive,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
apparmor-parser,
|
||||
}:
|
||||
(runCommand "logprof_conf"
|
||||
{
|
||||
header = ''
|
||||
[settings]
|
||||
# /etc/apparmor.d/ is read-only on NixOS
|
||||
profiledir = /var/cache/apparmor/logprof
|
||||
inactive_profiledir = /etc/apparmor.d/disable
|
||||
# Use: journalctl -b --since today --grep audit: | aa-logprof
|
||||
logfiles = /dev/stdin
|
||||
|
||||
parser = ${lib.getExe apparmor-parser}
|
||||
ldd = ${lib.getExe' stdenv.cc.libc "ldd"}
|
||||
logger = ${util-linux}/bin/logger
|
||||
|
||||
# customize how file ownership permissions are presented
|
||||
# 0 - off
|
||||
# 1 - default of what ever mode the log reported
|
||||
# 2 - force the new permissions to be user
|
||||
# 3 - force all perms on the rule to be user
|
||||
default_owner_prompt = 1
|
||||
|
||||
[qualifiers]
|
||||
${runtimeShell} = icnu
|
||||
${bashInteractive}/bin/sh = icnu
|
||||
${bashInteractive}/bin/bash = icnu
|
||||
'';
|
||||
passAsFile = [ "header" ];
|
||||
}
|
||||
''
|
||||
mkdir $out
|
||||
cp $headerPath $out/logprof.conf
|
||||
ln -s ${libapparmor.src}/utils/severity.db $out/severity.db
|
||||
sed '1,/\[qualifiers\]/d' ${libapparmor.src}/utils/logprof.conf >> $out/logprof.conf
|
||||
''
|
||||
)
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
writeShellApplication,
|
||||
coreutils,
|
||||
gnused,
|
||||
gnugrep,
|
||||
which,
|
||||
|
||||
# apparmor deps
|
||||
apparmor-parser,
|
||||
apparmor-bin-utils,
|
||||
libapparmor,
|
||||
}:
|
||||
writeShellApplication {
|
||||
name = "apparmor-teardown";
|
||||
runtimeInputs = [
|
||||
apparmor-parser
|
||||
apparmor-bin-utils
|
||||
coreutils
|
||||
gnused
|
||||
gnugrep
|
||||
which
|
||||
];
|
||||
|
||||
text = ''
|
||||
set +e # the imported script tries to `read` an empty line
|
||||
# shellcheck source=/dev/null
|
||||
. ${apparmor-parser}/lib/apparmor/rc.apparmor.functions
|
||||
remove_profiles
|
||||
exit 0
|
||||
'';
|
||||
|
||||
inherit (libapparmor) meta;
|
||||
}
|
||||
@@ -0,0 +1,86 @@
|
||||
{
|
||||
lib,
|
||||
makeWrapper,
|
||||
gawk,
|
||||
perl,
|
||||
bash,
|
||||
stdenv,
|
||||
which,
|
||||
linuxHeaders ? stdenv.cc.libc.linuxHeaders,
|
||||
python3Packages,
|
||||
bashNonInteractive,
|
||||
buildPackages,
|
||||
|
||||
# apparmor deps
|
||||
libapparmor,
|
||||
apparmor-parser,
|
||||
apparmor-teardown,
|
||||
}:
|
||||
python3Packages.buildPythonApplication {
|
||||
pname = "apparmor-utils";
|
||||
inherit (libapparmor) version src;
|
||||
|
||||
postPatch =
|
||||
''
|
||||
patchShebangs .
|
||||
cd utils
|
||||
|
||||
substituteInPlace aa-remove-unknown \
|
||||
--replace-fail "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
|
||||
substituteInPlace Makefile \
|
||||
--replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
|
||||
sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' Makefile
|
||||
sed -i aa-unconfined -e "/my_env\['PATH'\]/d"
|
||||
''
|
||||
+ (lib.optionalString stdenv.hostPlatform.isMusl ''
|
||||
sed -i Makefile -e "/\<vim\>/d"
|
||||
'');
|
||||
|
||||
format = "other";
|
||||
strictDeps = true;
|
||||
|
||||
doCheck = true;
|
||||
|
||||
nativeBuildInputs = [
|
||||
makeWrapper
|
||||
which
|
||||
bashNonInteractive
|
||||
python3Packages.setuptools
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
bash
|
||||
perl
|
||||
];
|
||||
|
||||
pythonPath = [
|
||||
python3Packages.notify2
|
||||
python3Packages.psutil
|
||||
libapparmor
|
||||
];
|
||||
|
||||
makeFlags = [
|
||||
"LANGS="
|
||||
"POD2MAN=${lib.getExe' buildPackages.perl "pod2man"}"
|
||||
"POD2HTML=${lib.getExe' buildPackages.perl "pod2html"}"
|
||||
"MANDIR=share/man"
|
||||
];
|
||||
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"BINDIR=$(out)/bin"
|
||||
"VIM_INSTALL_PATH=$(out)/share"
|
||||
"PYPREFIX="
|
||||
];
|
||||
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/aa-remove-unknown \
|
||||
--prefix PATH : ${lib.makeBinPath [ gawk ]}
|
||||
|
||||
ln -s ${lib.getExe apparmor-teardown} $out/bin/aa-teardown
|
||||
'';
|
||||
|
||||
meta = libapparmor.meta // {
|
||||
description = "Mandatory access control system - script user-land utilities";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
runCommand,
|
||||
closureInfo,
|
||||
lib,
|
||||
}:
|
||||
{
|
||||
# The store path of the derivation is given in $path
|
||||
additionalRules ? [ ],
|
||||
# TODO: factorize here some other common paths
|
||||
# that may emerge from use cases.
|
||||
baseRules ? [
|
||||
"r $path"
|
||||
"r $path/etc/**"
|
||||
"mr $path/share/**"
|
||||
# Note that not all libraries are prefixed with "lib",
|
||||
# eg. glibc-2.30/lib/ld-2.30.so
|
||||
"mr $path/lib/**.so*"
|
||||
"mr $path/lib64/**.so*"
|
||||
# eg. glibc-2.30/lib/gconv/gconv-modules
|
||||
"r $path/lib/**"
|
||||
"r $path/lib64/**"
|
||||
# Internal executables
|
||||
"ixr $path/libexec/**"
|
||||
],
|
||||
name ? "",
|
||||
}:
|
||||
rootPaths:
|
||||
runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } ''
|
||||
touch $out
|
||||
while read -r path
|
||||
do printf >>$out "%s,\n" ${
|
||||
lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)
|
||||
}
|
||||
done <${closureInfo { inherit rootPaths; }}/store-paths
|
||||
''
|
||||
@@ -0,0 +1,104 @@
|
||||
{
|
||||
stdenv,
|
||||
lib,
|
||||
fetchFromGitLab,
|
||||
autoreconfHook,
|
||||
autoconf-archive,
|
||||
pkg-config,
|
||||
which,
|
||||
flex,
|
||||
bison,
|
||||
withPerl ?
|
||||
stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl,
|
||||
perl,
|
||||
withPython ? lib.meta.availableOn stdenv.hostPlatform python3Packages.python,
|
||||
python3Packages,
|
||||
swig,
|
||||
ncurses,
|
||||
libxcrypt,
|
||||
|
||||
# test
|
||||
dejagnu,
|
||||
|
||||
# passthru
|
||||
nix-update-script,
|
||||
nixosTests,
|
||||
callPackage,
|
||||
}:
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "libapparmor";
|
||||
version = "4.1.0";
|
||||
|
||||
src = fetchFromGitLab {
|
||||
owner = "apparmor";
|
||||
repo = "apparmor";
|
||||
tag = "v${finalAttrs.version}";
|
||||
hash = "sha256-oj6mGw/gvoRGpJqw72Lk6LJuurg8efjiV1pvZYbXz6A=";
|
||||
};
|
||||
sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";
|
||||
|
||||
postPatch = ''
|
||||
substituteInPlace swig/perl/Makefile.am \
|
||||
--replace-fail install_vendor install_site
|
||||
'';
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
nativeBuildInputs =
|
||||
[
|
||||
autoconf-archive
|
||||
autoreconfHook
|
||||
bison
|
||||
flex
|
||||
pkg-config
|
||||
swig
|
||||
ncurses
|
||||
which
|
||||
dejagnu
|
||||
]
|
||||
++ lib.optionals withPython [
|
||||
python3Packages.setuptools
|
||||
];
|
||||
|
||||
nativeCheckInputs = [
|
||||
python3Packages.pythonImportsCheckHook
|
||||
perl
|
||||
];
|
||||
|
||||
buildInputs =
|
||||
[ libxcrypt ] ++ (lib.optional withPerl perl) ++ (lib.optional withPython python3Packages.python);
|
||||
|
||||
# required to build apparmor-parser
|
||||
dontDisableStatic = true;
|
||||
|
||||
# https://gitlab.com/apparmor/apparmor/issues/1
|
||||
configureFlags = [
|
||||
(lib.withFeature withPerl "perl")
|
||||
(lib.withFeature withPython "python")
|
||||
];
|
||||
|
||||
doCheck = withPerl && withPython;
|
||||
|
||||
checkInputs = [ dejagnu ];
|
||||
|
||||
pythonImportsCheck = [
|
||||
"LibAppArmor"
|
||||
];
|
||||
|
||||
passthru = {
|
||||
updateScript = nix-update-script { };
|
||||
tests.nixos = nixosTests.apparmor;
|
||||
apparmorRulesFromClosure = callPackage ./apparmorRulesFromClosure.nix { };
|
||||
};
|
||||
|
||||
meta = {
|
||||
homepage = "https://apparmor.net/";
|
||||
description = "Mandatory access control system - core library";
|
||||
license = with lib.licenses; [
|
||||
gpl2Only
|
||||
lgpl21Only
|
||||
];
|
||||
maintainers = lib.teams.apparmor.members;
|
||||
platforms = lib.platforms.linux;
|
||||
};
|
||||
})
|
||||
@@ -1,30 +0,0 @@
|
||||
commit 166afaf144d6473464975438353257359dd51708
|
||||
Author: Andreas Wiese <andreas.wiese@kernkonzept.com>
|
||||
Date: Thu Feb 1 11:35:02 2024 +0100
|
||||
|
||||
aa-remove-unknown: fix readability check
|
||||
|
||||
This check is intended for ensuring that the profiles file can actually
|
||||
be opened. The *actual* check is performed by the shell, not the read
|
||||
utility, which won't even be executed if the input redirection (and
|
||||
hence the test) fails.
|
||||
|
||||
If the test succeeds, though, using `read` here might actually
|
||||
jeopardize the test result if there are no profiles loaded and the file
|
||||
is empty.
|
||||
|
||||
This commit fixes that case by simply using `true` instead of `read`.
|
||||
|
||||
diff --git a/utils/aa-remove-unknown b/utils/aa-remove-unknown
|
||||
index 0e00d6a0..3351feef 100755
|
||||
--- a/utils/aa-remove-unknown
|
||||
+++ b/utils/aa-remove-unknown
|
||||
@@ -63,7 +63,7 @@ fi
|
||||
# We have to do this check because error checking awk's getline() below is
|
||||
# tricky and, as is, results in an infinite loop when apparmorfs returns an
|
||||
# error from open().
|
||||
-if ! IFS= read -r _ < "$PROFILES" ; then
|
||||
+if ! true < "$PROFILES" ; then
|
||||
echo "ERROR: Unable to read apparmorfs profiles file" 1>&2
|
||||
exit 1
|
||||
elif [ ! -w "$REMOVE" ] ; then
|
||||
@@ -1,435 +0,0 @@
|
||||
{
|
||||
stdenv,
|
||||
lib,
|
||||
fetchFromGitLab,
|
||||
fetchpatch,
|
||||
makeWrapper,
|
||||
autoreconfHook,
|
||||
autoconf-archive,
|
||||
pkg-config,
|
||||
which,
|
||||
flex,
|
||||
bison,
|
||||
linuxHeaders ? stdenv.cc.libc.linuxHeaders,
|
||||
gawk,
|
||||
withPerl ?
|
||||
stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl,
|
||||
perl,
|
||||
withPython ?
|
||||
stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3,
|
||||
python3,
|
||||
swig,
|
||||
ncurses,
|
||||
pam,
|
||||
libnotify,
|
||||
buildPackages,
|
||||
coreutils,
|
||||
bash,
|
||||
gnugrep,
|
||||
gnused,
|
||||
kmod,
|
||||
writeShellScript,
|
||||
closureInfo,
|
||||
runCommand,
|
||||
libxcrypt,
|
||||
}:
|
||||
|
||||
let
|
||||
apparmor-version = "4.0.3";
|
||||
|
||||
apparmor-meta =
|
||||
component: with lib; {
|
||||
homepage = "https://apparmor.net/";
|
||||
description = "Mandatory access control system - ${component}";
|
||||
license = with licenses; [
|
||||
gpl2Only
|
||||
lgpl21Only
|
||||
];
|
||||
maintainers = with maintainers; [
|
||||
julm
|
||||
thoughtpolice
|
||||
grimmauld
|
||||
];
|
||||
platforms = platforms.linux;
|
||||
};
|
||||
|
||||
apparmor-sources = fetchFromGitLab {
|
||||
owner = "apparmor";
|
||||
repo = "apparmor";
|
||||
rev = "v${apparmor-version}";
|
||||
hash = "sha256-6RMttvlXepxUyqdZeDujjVGOwuXl/nXnjii4sA/ppc4=";
|
||||
};
|
||||
|
||||
aa-teardown = writeShellScript "aa-teardown" ''
|
||||
PATH="${
|
||||
lib.makeBinPath [
|
||||
coreutils
|
||||
gnused
|
||||
gnugrep
|
||||
]
|
||||
}:$PATH"
|
||||
. ${apparmor-parser}/lib/apparmor/rc.apparmor.functions
|
||||
remove_profiles
|
||||
'';
|
||||
|
||||
prePatchCommon = ''
|
||||
chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
|
||||
patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
|
||||
substituteInPlace ./common/Make.rules \
|
||||
--replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man" \
|
||||
--replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html" \
|
||||
--replace "/usr/share/man" "share/man"
|
||||
substituteInPlace ./utils/Makefile \
|
||||
--replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
|
||||
'';
|
||||
|
||||
patches =
|
||||
[
|
||||
./0001-aa-remove-unknown_empty-ruleset.patch
|
||||
|
||||
(fetchpatch {
|
||||
name = "basename.patch";
|
||||
url = "https://gitlab.com/apparmor/apparmor/-/commit/7fb040bde69ebdfce48cf1a01c1a62fd4f8eef0a.patch";
|
||||
hash = "sha256-RZ04nfcV8hTd2CO3mYcfOGCLke8+FhV7DPfmDqSSdWk=";
|
||||
})
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isMusl [
|
||||
(fetchpatch {
|
||||
url = "https://git.alpinelinux.org/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
|
||||
name = "0003-Added-missing-typedef-definitions-on-parser.patch";
|
||||
sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0";
|
||||
})
|
||||
];
|
||||
|
||||
python = python3.withPackages (ps: with ps; [ setuptools ]);
|
||||
|
||||
# Set to `true` after the next FIXME gets fixed or this gets some
|
||||
# common derivation infra. Too much copy-paste to fix one by one.
|
||||
doCheck = false;
|
||||
|
||||
# FIXME: convert these to a single multiple-outputs package?
|
||||
|
||||
libapparmor = stdenv.mkDerivation {
|
||||
pname = "libapparmor";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
# checking whether python bindings are enabled... yes
|
||||
# checking for python3... no
|
||||
# configure: error: python is required when enabling python bindings
|
||||
strictDeps = false;
|
||||
|
||||
nativeBuildInputs = [
|
||||
autoconf-archive
|
||||
autoreconfHook
|
||||
bison
|
||||
flex
|
||||
pkg-config
|
||||
swig
|
||||
ncurses
|
||||
which
|
||||
perl
|
||||
] ++ lib.optional withPython python;
|
||||
|
||||
buildInputs = [ libxcrypt ] ++ lib.optional withPerl perl ++ lib.optional withPython python;
|
||||
|
||||
# required to build apparmor-parser
|
||||
dontDisableStatic = true;
|
||||
|
||||
prePatch =
|
||||
prePatchCommon
|
||||
+ ''
|
||||
substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site
|
||||
'';
|
||||
inherit patches;
|
||||
|
||||
postPatch = ''
|
||||
cd ./libraries/libapparmor
|
||||
'';
|
||||
|
||||
# https://gitlab.com/apparmor/apparmor/issues/1
|
||||
configureFlags = [
|
||||
(lib.withFeature withPerl "perl")
|
||||
(lib.withFeature withPython "python")
|
||||
];
|
||||
|
||||
outputs = [ "out" ] ++ lib.optional withPython "python";
|
||||
|
||||
postInstall = lib.optionalString withPython ''
|
||||
mkdir -p $python/lib
|
||||
mv $out/lib/python* $python/lib/
|
||||
'';
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "library";
|
||||
};
|
||||
|
||||
apparmor-utils = python.pkgs.buildPythonApplication {
|
||||
pname = "apparmor-utils";
|
||||
version = apparmor-version;
|
||||
format = "other";
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
nativeBuildInputs = [
|
||||
makeWrapper
|
||||
which
|
||||
python
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
bash
|
||||
perl
|
||||
python
|
||||
libapparmor
|
||||
(libapparmor.python or null)
|
||||
];
|
||||
|
||||
propagatedBuildInputs = [
|
||||
(libapparmor.python or null)
|
||||
|
||||
# Used by aa-notify
|
||||
python.pkgs.notify2
|
||||
python.pkgs.psutil
|
||||
];
|
||||
|
||||
prePatch =
|
||||
prePatchCommon
|
||||
+
|
||||
# Do not build vim file
|
||||
lib.optionalString stdenv.hostPlatform.isMusl ''
|
||||
sed -i ./utils/Makefile -e "/\<vim\>/d"
|
||||
''
|
||||
+ ''
|
||||
sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile
|
||||
|
||||
sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d"
|
||||
|
||||
substituteInPlace utils/aa-remove-unknown \
|
||||
--replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
|
||||
'';
|
||||
inherit patches;
|
||||
postPatch = "cd ./utils";
|
||||
makeFlags = [ "LANGS=" ];
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"BINDIR=$(out)/bin"
|
||||
"VIM_INSTALL_PATH=$(out)/share"
|
||||
"PYPREFIX="
|
||||
];
|
||||
|
||||
postInstall = ''
|
||||
wrapProgram $out/bin/aa-remove-unknown \
|
||||
--prefix PATH : ${lib.makeBinPath [ gawk ]}
|
||||
|
||||
ln -s ${aa-teardown} $out/bin/aa-teardown
|
||||
'';
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "user-land utilities" // {
|
||||
broken = !(withPython && withPerl);
|
||||
};
|
||||
};
|
||||
|
||||
apparmor-bin-utils = stdenv.mkDerivation {
|
||||
pname = "apparmor-bin-utils";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
libapparmor
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
libapparmor
|
||||
];
|
||||
|
||||
prePatch = prePatchCommon;
|
||||
postPatch = ''
|
||||
cd ./binutils
|
||||
'';
|
||||
makeFlags = [
|
||||
"LANGS="
|
||||
"USE_SYSTEM=1"
|
||||
];
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"BINDIR=$(out)/bin"
|
||||
"SBINDIR=$(out)/bin"
|
||||
];
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "binary user-land utilities";
|
||||
};
|
||||
|
||||
apparmor-parser = stdenv.mkDerivation {
|
||||
pname = "apparmor-parser";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
nativeBuildInputs = [
|
||||
bison
|
||||
flex
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [ libapparmor ];
|
||||
|
||||
prePatch =
|
||||
prePatchCommon
|
||||
+ ''
|
||||
## techdoc.pdf still doesn't build ...
|
||||
substituteInPlace ./parser/Makefile \
|
||||
--replace "/usr/bin/bison" "${bison}/bin/bison" \
|
||||
--replace "/usr/bin/flex" "${flex}/bin/flex" \
|
||||
--replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \
|
||||
--replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
|
||||
substituteInPlace parser/rc.apparmor.functions \
|
||||
--replace "/sbin/apparmor_parser" "$out/bin/apparmor_parser"
|
||||
sed -i parser/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
|
||||
'';
|
||||
inherit patches;
|
||||
postPatch = ''
|
||||
cd ./parser
|
||||
'';
|
||||
makeFlags = [
|
||||
"LANGS="
|
||||
"USE_SYSTEM=1"
|
||||
"INCLUDEDIR=${libapparmor}/include"
|
||||
"AR=${stdenv.cc.bintools.targetPrefix}ar"
|
||||
];
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"DISTRO=unknown"
|
||||
];
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "rule parser";
|
||||
};
|
||||
|
||||
apparmor-pam = stdenv.mkDerivation {
|
||||
pname = "apparmor-pam";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
which
|
||||
];
|
||||
|
||||
buildInputs = [
|
||||
libapparmor
|
||||
pam
|
||||
];
|
||||
|
||||
postPatch = ''
|
||||
cd ./changehat/pam_apparmor
|
||||
'';
|
||||
makeFlags = [ "USE_SYSTEM=1" ];
|
||||
installFlags = [ "DESTDIR=$(out)" ];
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "PAM service";
|
||||
};
|
||||
|
||||
apparmor-profiles = stdenv.mkDerivation {
|
||||
pname = "apparmor-profiles";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
nativeBuildInputs = [ which ];
|
||||
|
||||
postPatch = ''
|
||||
cd ./profiles
|
||||
'';
|
||||
|
||||
installFlags = [
|
||||
"DESTDIR=$(out)"
|
||||
"EXTRAS_DEST=$(out)/share/apparmor/extra-profiles"
|
||||
];
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "profiles";
|
||||
};
|
||||
|
||||
apparmor-kernel-patches = stdenv.mkDerivation {
|
||||
pname = "apparmor-kernel-patches";
|
||||
version = apparmor-version;
|
||||
|
||||
src = apparmor-sources;
|
||||
|
||||
dontBuild = true;
|
||||
|
||||
installPhase = ''
|
||||
mkdir "$out"
|
||||
cp -R ./kernel-patches/* "$out"
|
||||
'';
|
||||
|
||||
inherit doCheck;
|
||||
|
||||
meta = apparmor-meta "kernel patches";
|
||||
};
|
||||
|
||||
# Generate generic AppArmor rules in a file, from the closure of given
|
||||
# rootPaths. To be included in an AppArmor profile like so:
|
||||
#
|
||||
# include "${apparmorRulesFromClosure { } [ pkgs.hello ]}"
|
||||
apparmorRulesFromClosure =
|
||||
{
|
||||
# The store path of the derivation is given in $path
|
||||
additionalRules ? [ ],
|
||||
# TODO: factorize here some other common paths
|
||||
# that may emerge from use cases.
|
||||
baseRules ? [
|
||||
"r $path"
|
||||
"r $path/etc/**"
|
||||
"mr $path/share/**"
|
||||
# Note that not all libraries are prefixed with "lib",
|
||||
# eg. glibc-2.30/lib/ld-2.30.so
|
||||
"mr $path/lib/**.so*"
|
||||
"mr $path/lib64/**.so*"
|
||||
# eg. glibc-2.30/lib/gconv/gconv-modules
|
||||
"r $path/lib/**"
|
||||
"r $path/lib64/**"
|
||||
# Internal executables
|
||||
"ixr $path/libexec/**"
|
||||
],
|
||||
name ? "",
|
||||
}:
|
||||
rootPaths:
|
||||
runCommand ("apparmor-closure-rules" + lib.optionalString (name != "") "-${name}") { } ''
|
||||
touch $out
|
||||
while read -r path
|
||||
do printf >>$out "%s,\n" ${
|
||||
lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)
|
||||
}
|
||||
done <${closureInfo { inherit rootPaths; }}/store-paths
|
||||
'';
|
||||
in
|
||||
{
|
||||
inherit
|
||||
libapparmor
|
||||
apparmor-utils
|
||||
apparmor-bin-utils
|
||||
apparmor-parser
|
||||
apparmor-pam
|
||||
apparmor-profiles
|
||||
apparmor-kernel-patches
|
||||
apparmorRulesFromClosure
|
||||
;
|
||||
}
|
||||
@@ -290,6 +290,7 @@ mapAliases {
|
||||
apacheKafka_3_6 = throw "apacheKafka_2_8 through _3_6 have been removed from nixpkgs as outdated"; # Added 2024-11-27
|
||||
antimicroX = throw "'antimicroX' has been renamed to/replaced by 'antimicrox'"; # Converted to throw 2024-10-17
|
||||
apacheAnt = ant; # Added 2024-11-28
|
||||
apparmor-kernel-patches = throw "'apparmor-kernel-patches' has been removed as they were unmaintained, irrelevant and effectively broken"; # Added 2025-04-20
|
||||
appimagekit = throw "'appimagekit' has been removed as it was broken in nixpkgs and archived upstream"; # Added 2025-04-19
|
||||
apple-sdk_10_12 = throw "apple-sdk_10_12 was removed as Nixpkgs no longer supports macOS 10.12; see the 25.05 release notes"; # Added 2024-10-27
|
||||
apple-sdk_10_13 = throw "apple-sdk_10_13 was removed as Nixpkgs no longer supports macOS 10.13; see the 25.05 release notes"; # Added 2024-10-27
|
||||
|
||||
@@ -11657,16 +11657,7 @@ with pkgs;
|
||||
armTrustedFirmwareS905
|
||||
;
|
||||
|
||||
inherit (callPackages ../os-specific/linux/apparmor { })
|
||||
libapparmor
|
||||
apparmor-utils
|
||||
apparmor-bin-utils
|
||||
apparmor-parser
|
||||
apparmor-pam
|
||||
apparmor-profiles
|
||||
apparmor-kernel-patches
|
||||
apparmorRulesFromClosure
|
||||
;
|
||||
inherit (libapparmor.passthru) apparmorRulesFromClosure;
|
||||
|
||||
ath9k-htc-blobless-firmware = callPackage ../os-specific/linux/firmware/ath9k { };
|
||||
ath9k-htc-blobless-firmware-unstable = callPackage ../os-specific/linux/firmware/ath9k {
|
||||
|
||||
Reference in New Issue
Block a user