Accepting request 580982 from security:apparmor

OBS-URL: https://build.opensuse.org/request/show/580982
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apparmor-rpm-macros?expand=0&rev=4

apparmor-rpm-macros.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Wed Feb 28 06:37:37 UTC 2018 - tbechtold@suse.com
+
+- Check if apparmor is active before reloading a profile (bsc#1083226)
+  Otherwise a package using the %apparmor_reload macro in %post
+  automatically enables the profile even if apparmor itself is
+  not active.
+
 -------------------------------------------------------------------
 Sat Aug 26 19:08:14 UTC 2017 - suse-beta@cboltz.de
 

apparmor-rpm-macros.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package apparmor-rpm-macros
 #
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -20,7 +20,7 @@ Name:           apparmor-rpm-macros
 Version:        1.0
 Release:        0
 Summary:        RPM macros used to setup apparmor profiles
-License:        LGPL-2.1+
+License:        LGPL-2.1-or-later
 Group:          Development/Tools/Other
 Url:            https://bugs.launchpad.net/apparmor
 Source:         macros.apparmor

macros.apparmor

@@ -1,5 +1,7 @@
 %apparmor_reload()\
 	if [ "$YAST_IS_RUNNING" != "instsys" ]; then\
-		/sbin/apparmor_parser -r -T -W %{?*} &> /dev/null || :\
+		if /usr/bin/systemctl is-active --quiet apparmor.service; then\
+			/sbin/apparmor_parser -r -T -W %{?*} &> /dev/null || :\
+		fi\
 	fi\
 %{nil}