File generate_spec.rb of Package smar-apparmor-profiles

Overview Repositories Revisions Requests Users Attributes Meta

File generate_spec.rb of Package smar-apparmor-profiles (Revision 4e34890f6a31f1e0b52b0c28fd50c132)

Currently displaying revision 4e34890f6a31f1e0b52b0c28fd50c132 , Show latest

#!/usr/bin/env ruby

# Generates spec so manual repetition is not necessary

require "fileutils"
require "pathname"
require "yaml"

class SystemdOverride
    SYSTEMD_OVERRIDES_DIR = "#{__dir__}/systemd_overrides"
    SYSTEMD_OVERRIDES_TAR = "systemd_overrides.tar"

at_exit do
        if Dir.exist? SYSTEMD_OVERRIDES_DIR
            FileUtils.rm_r SYSTEMD_OVERRIDES_DIR
        end
    end

def initialize
        Dir.mkdir SYSTEMD_OVERRIDES_DIR
    end

def finalize
        return unless Dir.exists? SYSTEMD_OVERRIDES_DIR
        return unless systemd_overrides_changed?

# Try to create reproducible tar.
        # NOTE: --mtime is not specified here, so archive actually will be different in
        # each generation, but that can be added to reproduce archive from certain time.
        tar_command = "tar"
        tar_command = "#{tar_command} --sort=name --owner=0 --group=0 --numeric-owner"
        tar_command = "#{tar_command} --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"
        tar_command = "#{tar_command} -cf #{SYSTEMD_OVERRIDES_TAR} systemd_overrides/"
        #puts "[DEBUG] Executing “#{tar_command}”."
        result = `#{tar_command}`
        unless $?.success?
            puts "Failed to execute “#{tar_command}”. Output:"
            puts result
            exit 21
        end

File.delete "#{SYSTEMD_OVERRIDES_TAR}.xz" if File.exist? "#{SYSTEMD_OVERRIDES_TAR}.xz"
        # Using single thread should make xz archives reproducible across systems.
        # Though since I always regenerate the files, metadata won’t match, so there will always
        # be new archive.
        # But since this is so small, this has no harm.
        xz_command = "xz --threads=1 #{SYSTEMD_OVERRIDES_TAR}"
        `#{xz_command}`

# Now there should be archive systemd_overrides.tar.xz.
    end

def install_lines_for_load_profile_by_systemd definition, package, service_name, profile_name, user: false
        if service_name == "system"
            profile_name.each do |service_name, profile_name|
                install_lines_for_load_profile_by_systemd definition, package, service_name, profile_name
            end
            return
        end
        if service_name == "user"
            profile_name.each do |service_name, profile_name|
                install_lines_for_load_profile_by_systemd definition, package, service_name, profile_name, user: true
            end
            return
        end

write_systemd_override_file package, service_name, profile_name, user: user

if user
            override_file = Pathname.new("systemd_overrides") / "user" / package["name"] / service_name / "#{profile_name}.conf"
            unitdir_tag = "%{_userunitdir}"
        else
            override_file = Pathname.new("systemd_overrides") / package["name"] / service_name / "#{profile_name}.conf"
            unitdir_tag = "%{_unitdir}"
        end
        definition << "mkdir -p %{buildroot}#{unitdir_tag}/#{service_name}.service.d/"
        definition << "mv #{override_file} %{buildroot}#{unitdir_tag}/#{service_name}.service.d/"
    end

private def write_systemd_override_file package, service_name, profile_name, user: false
        if user
            package_dir = Pathname.new(SYSTEMD_OVERRIDES_DIR) / "user" / package["name"]
            Dir.mkdir package_dir.parent unless Dir.exist? package_dir.parent
        else
            package_dir = Pathname.new(SYSTEMD_OVERRIDES_DIR) / package["name"]
        end
        Dir.mkdir package_dir unless Dir.exist? package_dir

service_dir = package_dir / service_name
        Dir.mkdir service_dir unless Dir.exist? service_dir

profile = generate_service_override_conf profile_name

#puts "[DEBUG] Writing #{service_dir / "#{profile_name}.conf"}"
        File.open(service_dir / "#{profile_name}.conf", "w") do |f|
            f.write profile
        end
    end

private def generate_service_override_conf profile_name
        <<~EOF
            [Service]
            AppArmorProfile=#{profile_name}
        EOF
    end

private def systemd_overrides_changed?
        # First check if there is missing files.

files = Dir.glob "#{SYSTEMD_OVERRIDES_DIR}/**/*", base: Dir.pwd
        files = files.delete_if do |path|
            File.directory? path
        end
        missing_files_command = "tar"
        missing_files_args = %W{ tf #{SYSTEMD_OVERRIDES_TAR}.xz } + files
        #puts "[DEBUG] Executing missing_files_command: “#{missing_files_command}”."

# err: :close == Don’t output command STDERR to generate_spec.rb’s STDERR.
        result = system(missing_files_command, *missing_files_args, err: :close)

#puts "[DEBUG] missing_files_command result:"
        #puts result

if $?.exitstatus == 2
            # A file is missing from overrides archive.
            return true
        end

if $?.exitstatus != 0
            puts "ERROR: Got an exit code from tar that is not handled: #{$?.exitstatus}"
            exit 23
        end

# Then try to compare contents.
        #
        # This is a bit flaky.

compare_command = %{env LANG=C tar --compare --file='#{SYSTEMD_OVERRIDES_TAR}.xz'}
        compare_command = %{#{compare_command} | grep -v 'Uid differs$' | grep -v 'Gid differs$'}
        compare_command = %{#{compare_command} | grep -v 'Mod time differs$'}
        puts "[DEBUG] Executing compare_command: “#{compare_command}”."
        result = `#{compare_command}`
        #puts "[DEBUG] compare_command result:"
        #puts result

# 0 is everything is same, 1 means some files differs.
        unless [0, 1].include? $?.exitstatus
            puts "Failed to execute compare command. Result:"
            puts
            puts result
            exit 22
        end

# If yes, there is no changed content in the archive.
        if result.empty?
            return false
        end

true
    end
end

class GenerateSpec
    INSTALL_RULES_TARGET_LINE = "___INSTALL_RULES_HERE___"
    PACKAGES_TARGET_LINE = "___PACKAGES_HERE___"
    INPUT_FILE = "smar-apparmor-profiles.spec.in"
    OUTPUT_FILE = "smar-apparmor-profiles.spec"

def initialize
        @packages = load_packages
        @systemd_override = SystemdOverride.new
    end

def generate
        install_line_rows = generate_install_lines
        package_rows = generate_package_rows

lines = File.readlines INPUT_FILE

lines.each_with_index do |line, line_index|
            line.strip!

if line == INSTALL_RULES_TARGET_LINE
                # Replace target first to avoid infinite loop.
                lines[line_index] = "## Generated install commands starts."
                lines[line_index+=1] = ""

install_line_rows.each_with_index do |row, row_index|
                    lines.insert((line_index + row_index), row)
                end
            end
        end

# Loop twice so that line indices are correct.
        lines.each_with_index do |line, line_index|
            line.strip!

if line == PACKAGES_TARGET_LINE
                # Replace target first to avoid infinite loop.
                lines[line_index] = "## Generated packages starts."
                lines[line_index+=1] = ""

package_rows.each_with_index do |package, index|
                    #puts "[DEBUG] index: #{index}, package: “#{package}”"
                    lines.insert((line_index + index), package)

# Append newline after package rows.
                    line_index += 1
                    lines.insert((line_index + index), "\n")
                end
            end
        end

File.open OUTPUT_FILE, "w" do |file|
            file.puts lines
        end
    end

def finalize
        @systemd_override.finalize
    end

private def generate_install_lines
        out = []

@packages.each do |package|
            definition = generate_install_line package

out << definition.join("\n")
        end

out
    end

private def generate_install_line package
        #puts "[DEBUG] Generating install line for #{package}"

definition = []
        package["files"]&.each do |file|
            definition << "mv profiles/#{file} %{buildroot}%{_sysconfdir}/apparmor.d"
        end
        package["local"]&.each do |file|
            definition << "mv profiles/local/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/local"
        end
        package["namespaces"]&.each do |file|
            unless File.symlink? file
                definition << "mv namespaces/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/namespaces.d"
            else
                # If a file is a symlink, it should be added manually
                # by the package where it is a symlink to.
                puts "[DEBUG] File #{file} needs to be owned manually (1)."
            end
        end
        package["included_abstractions"]&.each do |file|
            definition << "mv abstractions/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/abstractions"
        end
        package["included_tunables"]&.each do |file|
            definition << "mv tunables/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/tunables"
        end
        package["extra_files"]&.each do |directory, files|
            extra_files_line definition, directory, files
        end
        package["load_profile_by_systemd"]&.each do |service_name, profile_name|
            @systemd_override.install_lines_for_load_profile_by_systemd definition, package, service_name, profile_name
        end

package["in_directory"]&.each do |target, data|
            in_directory_lines definition, target, data, parent_package: package
        end

definition
    end

private def in_directory_lines definition, target, package, parent_package:
        unless package.respond_to? :each_pair
            STDERR.puts "Syntax error in a YAML config."
            STDERR.puts "Package “#{parent_package["name"]}” has invalid content in block “in_directory”:"
            STDERR.puts
            STDERR.puts package.inspect
            STDERR.puts
            STDERR.puts "Maybe you’re missing “files:” keyword to denote a hash?"
            exit 20
        end
        package["files"]&.each do |file|
            definition << "mv profiles/#{target}/#{file} %{buildroot}%{_sysconfdir}/apparmor.d"
        end
        package["local"]&.each do |file|
            definition << "mv profiles/#{target}/local/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/local"
        end
        package["included_abstractions"]&.each do |file|
            definition << "mv abstractions/#{target}/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/abstractions"
        end
        package["included_tunables"]&.each do |file|
            definition << "mv profiles/#{target}/tunables/#{file} %{buildroot}%{_sysconfdir}/apparmor.d/tunables"
        end
        if package["extra_files"]
            extra_files_line definition, "profiles/#{target}", package["extra_files"]
        end
        if package["rpm_scriptlets_symlinks"]
            rpm_scriptlets_symlinks definition, package["rpm_scriptlets_symlinks"]
        end
    end

private def extra_files_line definition, directory, files
        case directory
        when "ssh"
            directory = "profiles/security/ssh"
            files.each do |file|
                destination_dir = File.dirname file
                definition << "mkdir -p '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
                definition << "mv #{directory}/#{file} '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
            end
        when "gcc"
            directory = "profiles/compilation"
            files.each do |file|
                destination_dir = File.dirname file
                definition << "mkdir -p '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
                definition << "mv #{directory}/#{file} '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
            end
        when "shells"
            directory = "profiles/system/shells"
            files.each do |file|
                destination_dir = File.dirname file
                definition << "mkdir -p '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
                definition << "mv #{directory}/#{file} '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
            end
        else
            files.each do |file|
                destination_dir = File.dirname file
                definition << "mkdir -p '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
                definition << "mv #{directory}/#{file} '%{buildroot}%{_sysconfdir}/apparmor.d/#{destination_dir}'"
            end
        end
    end

private def rpm_scriptlets_symlinks definition, files
        files.each do |file|
            rpm_scriptlets_d = "%{buildroot}%{_sysconfdir}/apparmor.d/namespaces.d/rpm-scriptlets.d"
            profile_name = File.basename file

definition << %{ln -t '#{rpm_scriptlets_d}' -s '../../#{profile_name}'}
        end
    end

# Generates the package rows that are inserted to template spec.
    private def generate_package_rows
        out = []

@packages.each do |package|
            definition = <<~EOF
            # #{package["name"]}
            %package -n #{package["name"]}-profiles
            Summary:        AppArmor profiles for #{package["name"]}
            Supplements:    #{package["name"]}
            BuildArch:      noarch
            EOF

package["provides"]&.each do |provided|
                definition += "Provides: #{provided}-profiles\n"
            end

package["abstractions"]&.each do |abstraction|
                definition += "Requires: smar-apparmor-profiles-#{abstraction}-abstractions\n"
            end

package["supplements"]&.each do |supplement|
                definition += "Supplements: #{supplement}\n"
            end

package["requires"]&.each do |required|
                name = "#{required}-profiles"
                name = "smar-apparmor-profiles-common" if required == "common"
                definition += "Requires: #{name}\n"
            end

package["recommends"]&.each do |recommended|
                name = "#{recommended}-profiles"
                name = "smar-apparmor-profiles-common" if recommended == "common"
                definition += "Recommends: #{name}\n"
            end

package["suggests"]&.each do |suggested|
                name = "#{suggested}-profiles"
                name = "smar-apparmor-profiles-common" if suggested == "common"
                definition += "Suggests: #{name}\n"
            end

definition += <<~EOF
            %description -n #{package["name"]}-profiles
            AppArmor profiles for #{package["name"]} from project smar-apparmor-profiles.

%files -n #{package["name"]}-profiles
            EOF

definition = generate_file_rows definition, package

out << definition
        end

out
    end

private def generate_file_rows definition, package
        package["files"]&.each do |file|
            basename = File.basename file
            definition += "%config %{_sysconfdir}/apparmor.d/#{basename}\n"
        end

package["local"]&.each do |file|
            basename = File.basename file
            definition += "%config(noreplace) %{_sysconfdir}/apparmor.d/local/#{basename}\n"
        end

package["namespaces"]&.each do |file|
            unless File.symlink? file
                basename = File.basename file
                definition += "%config %{_sysconfdir}/apparmor.d/namespaces.d/#{basename}\n"
            else
                # If a file is a symlink, it should be added manually
                # by the package where it is a symlink to.
                puts "[DEBUG] File #{file} needs to be owned manually (2)."
            end
        end

package["included_abstractions"]&.each do |file|
            basename = File.basename file
            definition += "%config(noreplace) %{_sysconfdir}/apparmor.d/abstractions/#{basename}\n"
        end

package["included_tunables"]&.each do |file|
            basename = File.basename file
            definition += "%config(noreplace) %{_sysconfdir}/apparmor.d/tunables/#{basename}\n"
        end

package["extra_directories"]&.each do |directory|
            definition += "%dir %{_sysconfdir}/apparmor.d/#{directory}\n"
        end

package["extra_files"]&.each do |directory, files|
            if files.nil?
                file = directory
                definition += "%config %{_sysconfdir}/apparmor.d/#{file}\n"
            else
                files.each do |file|
                    definition += "%config %{_sysconfdir}/apparmor.d/#{file}\n"
                end
            end
        end

package["load_profile_by_systemd"]&.each do |service_name, profile_name|
            if service_name == "system"
                profile_name.each do |service_name, profile_name|
                    definition += "%dir %{_unitdir}/#{service_name}.service.d\n"
                    definition += "%{_unitdir}/#{service_name}.service.d/#{profile_name}.conf\n"
                end

next
            end
            if service_name == "user"
                profile_name.each do |service_name, profile_name|
                    definition += "%dir %{_userunitdir}/#{service_name}.service.d\n"
                    definition += "%{_userunitdir}/#{service_name}.service.d/#{profile_name}.conf\n"
                end

next
            end
            definition += "%dir %{_unitdir}/#{service_name}.service.d\n"
            definition += "%{_unitdir}/#{service_name}.service.d/#{profile_name}.conf\n"
        end

package["rpm_scriptlets_symlinks"]&.each do |file|
            basename = File.basename file
            definition += "%config %{_sysconfdir}/apparmor.d/namespaces.d/rpm-scriptlets.d/#{basename}\n"
        end

package["in_directory"]&.each do |directory, hashes|
            hashes.each do |name, values|
                hash = { name => values }
                definition = generate_file_rows definition, hash
            end
        end

definition
    end

# WARNING: This is not too safe to use, so trust the yaml files.
    private def load_packages
        main = YAML.load_file "main.yaml"

packages = []

main["includes"].each do |file|
            packages += YAML.load_file(file)
        end

packages.sort do |a, b|
            # rpm needs to be first as some other profiles requires
            # namespaces.d/rpm-scriptlets.d/ dir it creates.
            next -1 if a["name"] == "rpm"
            next 1 if b["name"] == "rpm"

a["name"] <=> b["name"]
        end
    end
end

generate_spec = GenerateSpec.new
generate_spec.generate
generate_spec.finalize

Places

File generate_spec.rb of Package smar-apparmor-profiles (Revision 4e34890f6a31f1e0b52b0c28fd50c132)

Places