1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
5 # include <sys/apparmor.h>
9 #include "apparmor-setup.h"
10 #include "apparmor-util.h"
15 #include "string-util.h"
19 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_policy_cache
*, aa_policy_cache_unref
, NULL
);
20 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(aa_features
*, aa_features_unref
, NULL
);
23 int mac_apparmor_setup(void) {
25 _cleanup_(aa_policy_cache_unrefp
) aa_policy_cache
*policy_cache
= NULL
;
26 _cleanup_(aa_features_unrefp
) aa_features
*features
= NULL
;
27 _cleanup_free_
char *current_profile
= NULL
, *cache_dir_path
= NULL
;
30 if (!mac_apparmor_use()) {
31 log_debug("AppArmor either not supported by the kernel or disabled.");
35 /* To enable LSM stacking a patch to the kernel is proposed to create a
36 * per-LSM subdirectory to distinguish between the LSMs. Therefore, we
37 * read the file from the LSM specific directory first and only if that
38 * fails the one from the generic directory.
40 FOREACH_STRING(current_file
, "/proc/self/attr/apparmor/current", "/proc/self/attr/current") {
41 r
= read_one_line_file(current_file
, ¤t_profile
);
45 log_warning_errno(r
, "Failed to read current AppArmor profile from file %s, ignoring: %m", current_file
);
49 if (!current_profile
) {
50 log_warning("Failed to get the current AppArmor profile of systemd from /proc/self/attr/apparmor/current or /proc/self/attr/current, ignoring.");
53 if (!streq(current_profile
, "unconfined")) {
54 log_debug("We are already confined in an AppArmor profile.");
58 r
= aa_features_new_from_kernel(&features
);
60 log_warning_errno(errno
, "Failed to get the AppArmor feature set from the kernel, ignoring: %m");
63 cache_dir_path
= aa_policy_cache_dir_path_preview(features
, AT_FDCWD
, "/etc/apparmor/earlypolicy");
64 if (!cache_dir_path
) {
65 log_debug_errno(errno
, "Failed to get the path of the early AppArmor policy cache directory.");
69 /* aa_policy_cache_new will internally use the same path as aa_policy_cache_dir_path_preview has returned. */
70 r
= aa_policy_cache_new(&policy_cache
, features
, AT_FDCWD
, "/etc/apparmor/earlypolicy", 0);
72 if (errno
== ENOENT
) {
73 log_debug_errno(errno
, "The early AppArmor policy cache directory %s does not exist.", cache_dir_path
);
76 log_warning_errno(errno
, "Failed to create a new AppArmor policy cache, ignoring: %m");
79 r
= aa_policy_cache_replace_all(policy_cache
, NULL
);
81 log_warning_errno(errno
, "Failed to load the profiles from the early AppArmor policy cache directory %s, ignoring: %m", cache_dir_path
);
85 log_info("Successfully loaded all binary profiles from AppArmor early policy cache at %s.", cache_dir_path
);
87 r
= aa_change_profile("systemd");
90 log_debug_errno(errno
, "Failed to change to AppArmor profile 'systemd'. Please ensure that one of the binary profile files in policy cache directory %s contains a profile with that name.", cache_dir_path
);
92 log_error_errno(errno
, "Failed to change to AppArmor profile 'systemd': %m");
96 log_info("Changed to AppArmor profile systemd.");