libapparmor: 4.1.7 -> 5.0.0 (#515507)

pkgs/by-name/ap/apparmor-parser/package.nix

@@ -6,6 +6,7 @@
   bison,
   linuxHeaders ? stdenv.cc.libc.linuxHeaders,
   buildPackages,
+  zstd,
 
   # apparmor deps
   libapparmor,
@@ -23,15 +24,23 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     patchShebangs .
+
+    substituteInPlace init/rc.apparmor.functions \
+      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" \
+      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
+    sed -i init/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
     cd parser
 
     substituteInPlace Makefile \
       --replace-fail "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/sbin/apparmor_parser" "$out/bin/apparmor_parser" # FIXME
-    substituteInPlace rc.apparmor.functions \
-      --replace-fail "/usr/sbin/aa-status" "${lib.getExe' apparmor-bin-utils "aa-status"}"
-    sed -i rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
+
+    # strict format check causes yacc auto-generated code to fail.
+    # This is known, see https://gitlab.com/apparmor/apparmor/-/merge_requests/2039
+    # removing the compile-time check here downgrades the issue and allows compilation to succeed
+    substituteInPlace parser.h \
+      --replace-fail 'extern void yyerror(const char *msg, ...) __attribute__((noreturn, format(printf, 1, 2)));' \
+        'extern void yyerror(const char *msg, ...);'
   '';
 
   nativeBuildInputs = [
@@ -42,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libapparmor
+    zstd
     runtimeShellPackage
   ];
 

pkgs/by-name/ap/apparmor-profiles/package.nix

@@ -1,7 +1,9 @@
 {
+  lib,
   stdenv,
   which,
   callPackage,
+  python3,
 
   # apparmor deps
   libapparmor,
@@ -28,9 +30,16 @@ stdenv.mkDerivation {
     apparmor-utils
   ];
 
+  checkInputs = [
+    python3
+  ];
+
   preCheck = ''
     export USE_SYSTEM=1
     export LOGPROF="aa-logprof --configdir ${callPackage ./test_config.nix { }} --no-check-mountpoint"
+    patchShebangs ../parser/tst
+    substituteInPlace ../parser/tst/test_profile.py \
+      --replace-fail '../parser/apparmor_parser' '${lib.getExe apparmor-parser}'
   '';
 
   doCheck = true;

pkgs/by-name/li/libapparmor/package.nix

@@ -32,13 +32,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libapparmor";
-  version = "4.1.7";
+  version = "5.0.0";
 
   src = fetchFromGitLab {
     owner = "apparmor";
     repo = "apparmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yjqdUwHkQ1uiPKPZQVf/o8tGixQeIKNMOIYo4aVK7N0=";
+    hash = "sha256-seEREIc83alEPyZGD/GY48hjpqiw3QENnqYsdjHOGgs=";
   };
   sourceRoot = "${finalAttrs.src.name}/libraries/libapparmor";