0c205599ae
- update to AppArmor 3.0.7 - fix setuptools version detection in buildpath.py - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.7 for the detailed upstream changelog - add dnsmasq-cpu-possible.diff: allow reading /sys/devices/system/cpu/possible in dnsmasc//libvirt-leaseshelper profile (boo#1202849) OBS-URL: https://build.opensuse.org/request/show/999637 OBS-URL: https://build.opensuse.org/package/show/security:apparmor/apparmor?expand=0&rev=350
772 lines
24 KiB
RPMSpec
772 lines
24 KiB
RPMSpec
#
|
|
# spec file for package apparmor
|
|
#
|
|
# Copyright (c) 2022 SUSE LLC
|
|
# Copyright (c) 2011-2022 Christian Boltz
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
%if 0%{?usrmerged}
|
|
%define sbindir %_sbindir
|
|
%else
|
|
%define sbindir /sbin
|
|
%endif
|
|
|
|
%if 0%{?suse_version} <= 1500
|
|
# _pamdir isn't defined in 15.x
|
|
%define _pamdir /%{_lib}/security
|
|
%endif
|
|
|
|
# warning - confusing syntax ahead ;-)
|
|
# bcond_with means "disable"
|
|
# bcond_without means "enable"
|
|
%bcond_with tomcat
|
|
%bcond_without pam
|
|
%bcond_without apache
|
|
%bcond_without perl
|
|
%bcond_without python3
|
|
%bcond_without ruby
|
|
%bcond_without precompiled_cache
|
|
|
|
%define CATALINA_HOME /usr/share/tomcat6
|
|
#define APPARMOR_DOC_DIR /usr/share/doc/packages/apparmor-docs/
|
|
#define JNI_SO libJNIChangeHat.so
|
|
%define JAR_FILE changeHatValve.jar
|
|
|
|
Name: apparmor
|
|
Version: 3.0.7
|
|
Release: 0
|
|
Summary: AppArmor userlevel parser utility
|
|
License: GPL-2.0-or-later
|
|
Group: Productivity/Networking/Security
|
|
URL: https://launchpad.net/apparmor
|
|
Source0: apparmor-%{version}.tar.gz
|
|
Source1: apparmor-%{version}.tar.gz.asc
|
|
Source2: %{name}.keyring
|
|
|
|
Source5: update-trans.sh
|
|
Source6: baselibs.conf
|
|
Source7: apparmor-rpmlintrc
|
|
|
|
# enable caching of profiles (= massive performance speedup when loading profiles)
|
|
# and set cache-loc in parser.conf and apparmor.service accordingly
|
|
Patch1: apparmor-enable-profile-cache.diff
|
|
|
|
# include autogenerated profile sniplet for samba shares (bnc#688040) - include rule upstreamed in 3.0.5 (MR 838), now "just" creates the local/ sniplet
|
|
# (technically only needed in Leap 15.x, the samba script in Tumbleweed also works if the local/ sniplet doesn't exist - but dropping the local/ sniplet will move existing autogenerated sniplets to *.rpmsave)
|
|
Patch2: apparmor-samba-include-permissions-for-shares.diff
|
|
|
|
# Ruby 2.0 mkmf prefixes everything with $(DESTDIR), bnc#822277, kkaempf@suse.de
|
|
Patch3: ruby-2_0-mkmf-destdir.patch
|
|
|
|
# bug 906858 - confine lessopen.sh (submitted upstream 2014-12-21)
|
|
Patch4: apparmor-lessopen-profile.patch
|
|
|
|
# workaround for boo#1119937 / lp#1784499 - allow network access for reading files on NFS (proper solution needs kernel fix)
|
|
Patch5: apparmor-lessopen-nfs-workaround.diff
|
|
|
|
# make <apache2.d> include in apache extra profile optional to make openQA happy (boo#1178527)
|
|
Patch6: apache-extra-profile-include-if-exists.diff
|
|
|
|
# add zgrep and xzgrep profile (merged upstream 2022-04-12 https://gitlab.com/apparmor/apparmor/-/merge_requests/870 + merged upstream 2022-04-18 https://gitlab.com/apparmor/apparmor/-/merge_requests/873
|
|
# + merged upstream 2022-06-29 https://gitlab.com/apparmor/apparmor/-/merge_requests/892 - master only)
|
|
Patch9: zgrep-profile-mr870.diff
|
|
|
|
# add missing r permissions for dnsmasc//libvirt-leaseshelper (merged upstream 2022-08-22 https://gitlab.com/apparmor/apparmor/-/merge_requests/905)
|
|
Patch10: dnsmasq.diff
|
|
|
|
# permit php-fpm pid files under run (merged upstream 2022-08-26 https://gitlab.com/apparmor/apparmor/-/merge_requests/914)
|
|
Patch11: profiles-permit-php-fpm-pid-files-directly-under-run.patch
|
|
|
|
# allow reading /sys/devices/system/cpu/possible in dnsmasc//libvirt-leaseshelper (boo#1202849, submitted upstream 2022-08-28 https://gitlab.com/apparmor/apparmor/-/merge_requests/917)
|
|
Patch12: dnsmasq-cpu-possible.diff
|
|
|
|
PreReq: sed
|
|
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
|
%define apparmor_bin_prefix %{?usrmerged:/usr}/lib/apparmor
|
|
BuildRequires: bison
|
|
BuildRequires: dejagnu
|
|
BuildRequires: flex
|
|
BuildRequires: gcc-c++
|
|
BuildRequires: pcre-devel
|
|
BuildRequires: pkg-config
|
|
BuildRequires: python3
|
|
BuildRequires: python3-pyflakes
|
|
BuildRequires: perl(Locale::gettext)
|
|
|
|
BuildRequires: swig
|
|
|
|
%if %{with python3}
|
|
BuildRequires: python-rpm-macros
|
|
BuildRequires: python3-devel
|
|
BuildRequires: python3-notify2
|
|
BuildRequires: python3-psutil
|
|
BuildRequires: python3-setuptools
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
BuildRequires: ruby-devel
|
|
%endif
|
|
|
|
%if %{with apache}
|
|
BuildRequires: apache-rpm-macros
|
|
BuildRequires: apache2-devel
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
BuildRequires: ant
|
|
BuildRequires: java-devel >= 1.6.0
|
|
BuildRequires: tomcat6
|
|
%endif
|
|
|
|
%package parser
|
|
Summary: AppArmor userlevel parser utility
|
|
License: GPL-2.0-or-later
|
|
Group: Productivity/Networking/Security
|
|
Conflicts: apparmor-utils < 3.0
|
|
Obsoletes: libimnxcert < 2.9
|
|
Obsoletes: subdomain-leaf-cert < 2.9
|
|
Obsoletes: subdomain-parser < 2.9
|
|
Obsoletes: subdomain-parser-common < 2.9
|
|
Obsoletes: subdomain-parser-demo < 2.9
|
|
Obsoletes: subdomain_parser < 2.9
|
|
Provides: libimnxcert = %{version}
|
|
Provides: subdomain-leaf-cert = %{version}
|
|
Provides: subdomain-parser = %{version}
|
|
Provides: subdomain-parser-common = %{version}
|
|
Provides: subdomain-parser-demo = %{version}
|
|
Provides: subdomain_parser = %{version}
|
|
Provides: apparmor-parser(CAP_SYSLOG)
|
|
BuildRequires: systemd-rpm-macros
|
|
%{?systemd_ordering}
|
|
|
|
%description parser
|
|
The AppArmor Parser is a userlevel program that is used to load in
|
|
program profiles to the AppArmor Security kernel module.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%package docs
|
|
Summary: AppArmor Documentation package
|
|
License: GPL-2.0-or-later
|
|
Group: Documentation/Other
|
|
BuildArch: noarch
|
|
|
|
%description docs
|
|
This package contains documentation for AppArmor.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%if %{with apache}
|
|
|
|
%package -n apache2-mod_apparmor
|
|
Summary: AppArmor module for apache2
|
|
License: GPL-2.0-or-later
|
|
Group: Productivity/Security
|
|
|
|
%description -n apache2-mod_apparmor
|
|
apache2-modapparmor adds support to apache2 to provide AppArmor
|
|
confinement to individual cgi scripts handled by apache modules like
|
|
mod_php and mod_perl.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
The documentation is in the apparmor-admin_en package.
|
|
|
|
%endif
|
|
|
|
%if %{with perl}
|
|
|
|
%package -n perl-apparmor
|
|
Summary: Perl interface for libapparmor functions
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Development/Libraries/Perl
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: perl = %{perl_version}
|
|
Provides: perl-libapparmor = %{version}
|
|
Obsoletes: perl-libapparmor < 2.5
|
|
|
|
%description -n perl-apparmor
|
|
This package provides the perl interface to AppArmor. It is used for perl
|
|
applications interfacing with AppArmor.
|
|
|
|
%endif
|
|
|
|
%if %{with python3}
|
|
|
|
%package -n python3-apparmor
|
|
Summary: Python 3 interface for libapparmor functions
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Development/Libraries/Python
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: python3
|
|
Requires: python(abi) = %{py3_ver}
|
|
|
|
%description -n python3-apparmor
|
|
This package provides the python interface to AppArmor. It is used for python
|
|
applications interfacing with AppArmor.
|
|
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
|
|
%package -n ruby-apparmor
|
|
Summary: Ruby interface for libapparmor functions
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Development/Languages/Ruby
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: ruby = %(rpm -q --qf '%%{version}' ruby)
|
|
Provides: ruby-libapparmor = %{version}
|
|
Obsoletes: ruby-libapparmor < 2.5
|
|
|
|
%description -n ruby-apparmor
|
|
This package provides the ruby interface to AppArmor. It is used for ruby
|
|
applications interfacing with AppArmor.
|
|
|
|
%endif
|
|
|
|
%package abstractions
|
|
Summary: AppArmor abstractions and directory structure
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Productivity/Security
|
|
Requires: apparmor-parser(CAP_SYSLOG)
|
|
BuildArch: noarch
|
|
|
|
%description abstractions
|
|
AppArmor abstractions (common parts used in various profiles) and
|
|
the /etc/apparmor.d/ directory structure.
|
|
|
|
AppArmor is a file and network mandatory access control mechanism.
|
|
AppArmor confines processes to the resources allowed by the systems
|
|
administrator and can constrain the scope of potential security
|
|
vulnerabilities.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%package profiles
|
|
Summary: AppArmor profiles that are loaded into the apparmor kernel module
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Productivity/Security
|
|
Requires: apparmor-abstractions >= %{version}
|
|
Requires: apparmor-parser(CAP_SYSLOG)
|
|
Obsoletes: subdomain-profiles < 2.9
|
|
Provides: subdomain-profiles = %{version}
|
|
BuildArch: noarch
|
|
|
|
%description profiles
|
|
Base profiles. AppArmor is a file and network mandatory access control
|
|
mechanism. AppArmor confines processes to the resources allowed by the
|
|
systems administrator and can constrain the scope of potential security
|
|
vulnerabilities.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%package utils
|
|
Summary: AppArmor User-Level Utilities Useful for Creating AppArmor Profiles
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Productivity/Security
|
|
Requires: apparmor-parser
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: python3-apparmor = %{version}
|
|
Requires: python3-base
|
|
Requires: python3-notify2
|
|
Requires: python3-psutil
|
|
# aa-unconfined needs ss
|
|
Recommends: iproute2
|
|
BuildArch: noarch
|
|
|
|
%description utils
|
|
This package provides the aa-logprof, aa-genprof, aa-autodep,
|
|
aa-enforce, and aa-complain tools to assist with profile authoring.
|
|
Besides it provides the aa-unconfined server information tool.
|
|
It is part of a suite of tools that used to be named SubDomain.
|
|
|
|
%if %{with tomcat}
|
|
|
|
%package -n tomcat_apparmor
|
|
Summary: Tomcat 6 plugin for AppArmor change_hat
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: System/Libraries
|
|
Requires: libapparmor1 = %{version}
|
|
Requires: tomcat6
|
|
|
|
%description -n tomcat_apparmor
|
|
tomcat_apparmor - is a plugin for Apache Tomcat version 6 that
|
|
provides support for AppArmor change_hat for creating AppArmor
|
|
containers that are bound to discrete elements of processing within the
|
|
Tomcat servlet container. The AppArmor containers, or "hats", can be
|
|
created for individual URL processing or per servlet.
|
|
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%package -n pam_apparmor
|
|
Summary: PAM module for AppArmor change_hat
|
|
License: GPL-2.0-only AND LGPL-2.1-or-later
|
|
Group: Productivity/Security
|
|
BuildRequires: pam-devel
|
|
PreReq: pam
|
|
PreReq: pam-config
|
|
Requires: pam
|
|
Requires: pam-config
|
|
|
|
%description -n pam_apparmor
|
|
The pam_apparmor module provides the means for any PAM applications
|
|
that call pam_open_session() to automatically perform an AppArmor
|
|
change_hat operation in order to switch to a user-specific security
|
|
policy.
|
|
|
|
%endif
|
|
|
|
%description
|
|
The AppArmor Parser is a userlevel program that is used to load in
|
|
program profiles to the AppArmor Security kernel module.
|
|
|
|
This package is part of a suite of tools that used to be named
|
|
SubDomain.
|
|
|
|
%lang_package -n apparmor-utils
|
|
%lang_package -n apparmor-parser
|
|
|
|
%prep
|
|
%setup -q
|
|
|
|
# very loose profile that doesn't even match the apache2 binary path in openSUSE. Move it away instead of confusing people (boo#872984)
|
|
mv -v profiles/apparmor.d/usr.lib.apache2.mpm-prefork.apache2 profiles/apparmor/profiles/extras/
|
|
|
|
%patch1
|
|
%patch2
|
|
%patch3 -p1
|
|
%patch4
|
|
%patch5
|
|
%patch6
|
|
%patch9 -p1
|
|
%patch10 -p1
|
|
%patch11 -p1
|
|
%patch12 -p1
|
|
|
|
%build
|
|
export SUSE_ASNEEDED=0
|
|
|
|
# libapparmor:
|
|
(
|
|
cd ./libraries/libapparmor
|
|
%configure \
|
|
%if %{with perl}
|
|
--with-perl \
|
|
%endif
|
|
%if %{with python3}
|
|
--with-python \
|
|
%else
|
|
--without-python \
|
|
%endif
|
|
%if %{with ruby}
|
|
--with-ruby \
|
|
%else
|
|
--without-ruby \
|
|
%endif
|
|
|
|
make
|
|
)
|
|
|
|
# Utilities:
|
|
make -C utils
|
|
|
|
# binutils
|
|
make -C binutils
|
|
|
|
# parser:
|
|
make -C parser V=1
|
|
|
|
# Apache mod_apparmor:
|
|
%if %{with apache}
|
|
make -C changehat/mod_apparmor
|
|
%endif
|
|
|
|
# PAM AppArmor:
|
|
%if %{with pam}
|
|
make -C changehat/pam_apparmor
|
|
%endif
|
|
|
|
# Profiles:
|
|
make -C profiles
|
|
|
|
%if %{with tomcat}
|
|
make -C changehat/tomcat_apparmor/tomcat_5_5 CATALINA_HOME=%{CATALINA_HOME}
|
|
%endif
|
|
|
|
# pre-build profile cache
|
|
# note that -L only works with an absolute path, therefore prefix it with $(pwd)
|
|
%if %{with precompiled_cache}
|
|
parser/apparmor_parser --config-file $(pwd)/parser/parser.conf --write-cache -QT -L $(pwd)/profiles/cache -I profiles/apparmor.d/ profiles/apparmor.d/
|
|
%endif
|
|
|
|
%check
|
|
make check -C libraries/libapparmor
|
|
make check -C parser
|
|
make check -C binutils
|
|
|
|
# profiles make check fails for the utils (they expect /sbin/apparmor_parser to exist), therefore only do parser-based check
|
|
make -C profiles check-parser
|
|
|
|
# test for a few files that should exist in the cache
|
|
%if %{with precompiled_cache}
|
|
test -f profiles/cache/*/bin.ping
|
|
test -f profiles/cache/*/.features
|
|
%endif
|
|
|
|
make check -C utils PYFLAKES=/usr/bin/pyflakes-%{py3_ver}
|
|
|
|
%install
|
|
# libapparmor: swig bindings only, libapparmor is packaged via libapparmor.spec
|
|
%makeinstall -C libraries/libapparmor/swig
|
|
|
|
# utilities
|
|
%makeinstall -C utils
|
|
test ! -x %{buildroot}/%{_bindir}/aa-easyprof && chmod +x %{buildroot}/%{_bindir}/aa-easyprof # https://bugs.launchpad.net/apparmor/+bug/1366568
|
|
mkdir -p %{buildroot}%{_localstatedir}/log/apparmor
|
|
|
|
# binutils
|
|
%makeinstall -C binutils
|
|
( cd %{buildroot}/%{_sbindir} && ln -s %{_bindir}/aa-exec exec )
|
|
|
|
%makeinstall -C profiles
|
|
|
|
%if %{with precompiled_cache}
|
|
install -d -m 755 %{buildroot}/usr/share/apparmor/cache
|
|
echo -e "\n\n *** WARNING: precompiling cache is known to fail under 'osc build' - use 'osc build --vm-type kvm' instead or skip building the precompiled cache with 'osc build --without precompiled_cache' ***\n\n"
|
|
# ensure cache files are newer than (text) profiles by sleeping a few seconds, and using cp -r which updates the timestamps
|
|
sleep 2
|
|
cp -r profiles/cache/* %{buildroot}/usr/share/apparmor/cache
|
|
test -f %{buildroot}/usr/share/apparmor/cache/*/.features
|
|
test -f %{buildroot}/usr/share/apparmor/cache/*/bin.ping
|
|
%endif
|
|
|
|
%makeinstall SBINDIR="%{buildroot}%{sbindir}" APPARMOR_BIN_PREFIX="%{buildroot}%{apparmor_bin_prefix}" -C parser
|
|
# default cache dir (up to 2.12) is /etc/apparmor.d/cache - not the best location.
|
|
# Use /var/lib/apparmor/cache and make /etc/apparmor.d/cache a symlink to it
|
|
mkdir -p %{buildroot}%{_localstatedir}/lib/apparmor/cache
|
|
( cd %{buildroot}/%{_sysconfdir}/apparmor.d/ && ln -s ../../%{_localstatedir}/lib/apparmor/cache cache )
|
|
# default cache dir (starting with 2.13) is /etc/apparmor.d/cache.d - also not the best location
|
|
# Use /var/cache/apparmor and make /etc/apparmor.d/cache.d a symlink to it
|
|
mkdir -p %{buildroot}%{_localstatedir}/cache/apparmor
|
|
( cd %{buildroot}/%{_sysconfdir}/apparmor.d/ && ln -s ../../%{_localstatedir}/cache/apparmor cache.d )
|
|
|
|
%if %{with apache}
|
|
%makeinstall -C changehat/mod_apparmor
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
%makeinstall -C changehat/pam_apparmor SECDIR=%{buildroot}%{_pamdir}
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
mkdir -p %{buildroot}/%{CATALINA_HOME}
|
|
%makeinstall -C changehat/tomcat_apparmor/tomcat_5_5 CATALINA_HOME=%{buildroot}/%{CATALINA_HOME}
|
|
%endif
|
|
|
|
find %{buildroot} -name .packlist -exec rm -vf {} \;
|
|
find %{buildroot} -name perllocal.pod -exec rm -vf {} \;
|
|
|
|
# Re-create the links to the old names, but only for tools and manpages that had it for historic reasons[tm].
|
|
# Tools and manpages added in >= 2.9 won't get symlinks without aa- prefix
|
|
for file in %{buildroot}%{_prefix}/{sbin,share/man/man[0-9]}/aa-*; do
|
|
d=$(dirname $file)
|
|
f=$(basename $file)
|
|
case "${f#aa-}" in
|
|
audit | autodep | complain | decode | disable | enforce | exec | genprof | logprof | notify | status | unconfined | \
|
|
audit.8* | autodep.8* | complain.8* | disable.8* | easyprof.8* | enforce.8* | exec.1* | genprof.8* | logprof.8* | notify.8 | status.8 | unconfined.8* )
|
|
if [ "${f#aa-}" != "$f" ]; then
|
|
ln -s $f $d/${f#aa-}
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
|
|
mv -f %{buildroot}%{_mandir}/man8/{status.8,apparmor_status.8}
|
|
mv -f %{buildroot}%{_mandir}/man8/{notify.8,apparmor_notify.8}
|
|
rm -f %{buildroot}%{_mandir}/man8/decode.8
|
|
|
|
for pkg in apparmor-utils apparmor-parser aa-binutils; do
|
|
%find_lang $pkg
|
|
done
|
|
|
|
# remove *.la files
|
|
rm -fv %{buildroot}%{_libdir}/libapparmor.la
|
|
|
|
%files docs
|
|
%defattr(-,root,root)
|
|
%doc parser/*.[1-9].html
|
|
%doc utils/vim/apparmor.vim.5.html
|
|
%doc common/apparmor.css
|
|
%doc parser/techdoc.pdf
|
|
# apparmor.vim is included in the vim package. Ideally it should be in a -devel package, but that's overmuch for one file
|
|
%dir %{_datadir}/apparmor
|
|
%{_datadir}/apparmor/apparmor.vim
|
|
|
|
%files parser
|
|
%defattr(-,root,root)
|
|
%license parser/COPYING.GPL
|
|
%doc parser/README
|
|
%{sbindir}/apparmor_parser
|
|
%{_bindir}/aa-enabled
|
|
%{_bindir}/aa-exec
|
|
%{_bindir}/aa-features-abi
|
|
%{_sbindir}/aa-status
|
|
%{_sbindir}/apparmor_status
|
|
%{_sbindir}/status
|
|
%{_sbindir}/aa-teardown
|
|
%{_sbindir}/exec
|
|
%dir %attr(-, root, root) %{_sysconfdir}/apparmor
|
|
%dir %{_sysconfdir}/apparmor.d
|
|
%{_sysconfdir}/apparmor.d/cache
|
|
%{_sysconfdir}/apparmor.d/cache.d
|
|
%{sbindir}/rcapparmor
|
|
%{_unitdir}/apparmor.service
|
|
%config(noreplace) %{_sysconfdir}/apparmor/parser.conf
|
|
%{_localstatedir}/lib/apparmor
|
|
%{_localstatedir}/cache/apparmor
|
|
%dir %attr(-, root, root) %{apparmor_bin_prefix}
|
|
%{apparmor_bin_prefix}/rc.apparmor.functions
|
|
%{apparmor_bin_prefix}/apparmor.systemd
|
|
%{apparmor_bin_prefix}/profile-load
|
|
%doc %{_mandir}/man1/aa-enabled.1.gz
|
|
%doc %{_mandir}/man1/aa-exec.1.gz
|
|
%doc %{_mandir}/man1/aa-features-abi.1.gz
|
|
%doc %{_mandir}/man1/exec.1.gz
|
|
%doc %{_mandir}/man5/apparmor.d.5.gz
|
|
%doc %{_mandir}/man5/apparmor.vim.5.gz
|
|
%doc %{_mandir}/man7/apparmor.7.gz
|
|
%doc %{_mandir}/man7/apparmor_xattrs.7.gz
|
|
%doc %{_mandir}/man8/aa-status.8.gz
|
|
%doc %{_mandir}/man8/aa-teardown.8.gz
|
|
%doc %{_mandir}/man8/apparmor_parser.8.gz
|
|
%doc %{_mandir}/man8/apparmor_status.8.gz
|
|
|
|
%pre parser
|
|
%service_add_pre apparmor.service
|
|
|
|
%files parser-lang -f apparmor-parser.lang -f aa-binutils.lang
|
|
%defattr(-,root,root)
|
|
|
|
%files abstractions
|
|
%defattr(644,root,root,755)
|
|
%dir %{_sysconfdir}/apparmor.d/
|
|
%dir %{_sysconfdir}/apparmor.d/abi
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/abi/3.0
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/abi/kernel-5.4-outoftree-network
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/abi/kernel-5.4-vanilla
|
|
%dir %{_sysconfdir}/apparmor.d/abstractions
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/abstractions/*
|
|
%dir %{_sysconfdir}/apparmor.d/disable
|
|
%dir %{_sysconfdir}/apparmor.d/local
|
|
%dir %{_sysconfdir}/apparmor.d/tunables
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/tunables/*
|
|
|
|
%files profiles
|
|
%defattr(644,root,root,755)
|
|
%dir %{_sysconfdir}/apparmor.d/apache2.d
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/apache2.d/phpsysinfo
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/bin.*
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/sbin.*
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/usr.*
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/lsb_release
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/nvidia_modprobe
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/php-fpm
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-bgqd
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-dcerpcd
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-rpcd
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/samba-rpcd-*
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/zgrep
|
|
%config(noreplace) %{_sysconfdir}/apparmor.d/local/*
|
|
%dir /usr/share/apparmor/
|
|
%if %{with precompiled_cache}
|
|
/usr/share/apparmor/cache/
|
|
%endif
|
|
/usr/share/apparmor/extra-profiles/
|
|
|
|
%files utils
|
|
%defattr(-,root,root)
|
|
%dir %{_sysconfdir}/apparmor
|
|
%config(noreplace) %{_sysconfdir}/apparmor/easyprof.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/logprof.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/notify.conf
|
|
%config(noreplace) %{_sysconfdir}/apparmor/severity.db
|
|
%{_sbindir}/aa-audit
|
|
%{_sbindir}/aa-autodep
|
|
%{_sbindir}/aa-cleanprof
|
|
%{_sbindir}/aa-complain
|
|
%{_sbindir}/aa-decode
|
|
%{_sbindir}/aa-disable
|
|
%{_sbindir}/aa-enforce
|
|
%{_sbindir}/aa-genprof
|
|
%{_sbindir}/aa-logprof
|
|
%{_sbindir}/aa-mergeprof
|
|
%{_sbindir}/aa-notify
|
|
%{_sbindir}/aa-remove-unknown
|
|
%{_sbindir}/aa-unconfined
|
|
%{_sbindir}/audit
|
|
%{_sbindir}/autodep
|
|
%{_sbindir}/complain
|
|
%{_sbindir}/decode
|
|
%{_sbindir}/disable
|
|
%{_sbindir}/enforce
|
|
%{_sbindir}/genprof
|
|
%{_sbindir}/logprof
|
|
%{_sbindir}/notify
|
|
%{_sbindir}/unconfined
|
|
%{_bindir}/aa-easyprof
|
|
%dir %{_datadir}/apparmor
|
|
%{_datadir}/apparmor/easyprof/
|
|
%dir %{_localstatedir}/log/apparmor
|
|
%doc %{_mandir}/man5/logprof.conf.5.gz
|
|
%doc %{_mandir}/man8/apparmor_notify.8.gz
|
|
%doc %{_mandir}/man8/aa-audit.8.gz
|
|
%doc %{_mandir}/man8/aa-autodep.8.gz
|
|
%doc %{_mandir}/man8/aa-cleanprof.8.gz
|
|
%doc %{_mandir}/man8/aa-complain.8.gz
|
|
%doc %{_mandir}/man8/aa-decode.8.gz
|
|
%doc %{_mandir}/man8/aa-disable.8.gz
|
|
%doc %{_mandir}/man8/aa-easyprof.8.gz
|
|
%doc %{_mandir}/man8/aa-enforce.8.gz
|
|
%doc %{_mandir}/man8/aa-genprof.8.gz
|
|
%doc %{_mandir}/man8/aa-logprof.8.gz
|
|
%doc %{_mandir}/man8/aa-mergeprof.8.gz
|
|
%doc %{_mandir}/man8/aa-notify.8.gz
|
|
%doc %{_mandir}/man8/aa-remove-unknown.8.gz
|
|
%doc %{_mandir}/man8/aa-unconfined.8.gz
|
|
%doc %{_mandir}/man8/audit.8.gz
|
|
%doc %{_mandir}/man8/autodep.8.gz
|
|
%doc %{_mandir}/man8/complain.8.gz
|
|
%doc %{_mandir}/man8/disable.8.gz
|
|
%doc %{_mandir}/man8/easyprof.8.gz
|
|
%doc %{_mandir}/man8/enforce.8.gz
|
|
%doc %{_mandir}/man8/genprof.8.gz
|
|
%doc %{_mandir}/man8/logprof.8.gz
|
|
%doc %{_mandir}/man8/unconfined.8.gz
|
|
%doc utils/*.[0-9].html
|
|
%doc common/apparmor.css
|
|
|
|
%files utils-lang -f apparmor-utils.lang
|
|
|
|
%if %{with perl}
|
|
%files -n perl-apparmor
|
|
%defattr(-,root,root)
|
|
%{perl_vendorarch}/auto/LibAppArmor/
|
|
%{perl_vendorarch}/LibAppArmor.pm
|
|
%endif
|
|
|
|
%if %{with python3}
|
|
|
|
%files -n python3-apparmor
|
|
%defattr(-,root,root)
|
|
%{python3_sitearch}/LibAppArmor-%{version}-py*.egg-info
|
|
%dir %{python3_sitearch}/LibAppArmor
|
|
%dir %{python3_sitearch}/LibAppArmor/__pycache__
|
|
%{python3_sitearch}/LibAppArmor/_LibAppArmor.cpython-*.so
|
|
%{python3_sitearch}/LibAppArmor/__pycache__/__init__.cpython-*.pyc
|
|
%{python3_sitearch}/LibAppArmor/__pycache__/LibAppArmor.cpython-*.pyc
|
|
%{python3_sitearch}/LibAppArmor/__init__.py
|
|
%{python3_sitearch}/LibAppArmor/LibAppArmor.py
|
|
%{python3_sitelib}/apparmor/
|
|
%{python3_sitelib}/apparmor-%{version}-py*.egg-info
|
|
%endif
|
|
|
|
%if %{with ruby}
|
|
|
|
%files -n ruby-apparmor
|
|
%defattr(-,root,root)
|
|
%{rb_sitearchdir}/LibAppArmor.so
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%files -n pam_apparmor
|
|
%defattr(444,root,root,755)
|
|
%attr(555,root,root) %{_pamdir}/pam_apparmor.so
|
|
%endif
|
|
|
|
%if %{with tomcat}
|
|
|
|
%files -n tomcat_apparmor
|
|
%defattr(-,root,root)
|
|
%{CATALINA_HOME}/lib/%{JAR_FILE}
|
|
%{_libdir}/libJNI*
|
|
%doc %attr(0644,root,root) changehat/tomcat_apparmor/tomcat_5_5/README.tomcat_apparmor
|
|
%endif
|
|
|
|
%if %{with apache}
|
|
|
|
%files -n apache2-mod_apparmor
|
|
%defattr(-,root,root)
|
|
%{apache_libexecdir}/mod_apparmor.so
|
|
%doc %{_mandir}/man8/mod_apparmor.8.gz
|
|
%endif
|
|
|
|
%post parser
|
|
%service_add_post apparmor.service
|
|
|
|
%preun parser
|
|
%service_del_preun apparmor.service
|
|
|
|
%postun parser
|
|
# don't call try-restart, see bnc#853019
|
|
%if 0%{?suse_version} <= 1500
|
|
export DISABLE_RESTART_ON_UPDATE="yes"
|
|
%service_del_postun apparmor.service
|
|
%else
|
|
%service_del_postun_without_restart apparmor.service
|
|
%endif
|
|
|
|
%posttrans abstractions
|
|
# workaround for bnc#904620#c8 / lp#1392042
|
|
rm -f /var/cache/apparmor/* 2>/dev/null
|
|
#restart_on_update apparmor - but non-broken (bnc#853019)
|
|
systemctl is-active -q apparmor && systemctl reload apparmor ||:
|
|
|
|
%posttrans profiles
|
|
# workaround for bnc#904620#c8 / lp#1392042
|
|
# old cache location up to 2.12
|
|
rm -f /var/lib/apparmor/cache/* 2>/dev/null
|
|
# cache location starting with 2.13
|
|
rm -f /var/cache/apparmor/* 2>/dev/null
|
|
#restart_on_update apparmor - but non-broken (bnc#853019)
|
|
systemctl is-active -q apparmor && systemctl reload apparmor ||:
|
|
|
|
%if %{with tomcat}
|
|
|
|
%post -n tomcat_apparmor -p /sbin/ldconfig
|
|
|
|
%postun -n tomcat_apparmor -p /sbin/ldconfig
|
|
%endif
|
|
|
|
%if %{with pam}
|
|
|
|
%post -n pam_apparmor
|
|
pam-config -a --apparmor
|
|
pam-config --update
|
|
|
|
%postun -n pam_apparmor
|
|
pam-config -d --apparmor
|
|
pam-config --update
|
|
%endif
|
|
|
|
%changelog
|