Newbie: Using a Profile file

[Bammede]

Hi,

Can I just download some profile files e.g.:

• apparmor.d/profiles-g-l/git
• apparmor.d/groups/freedesktop
• some other
  into '/etc/apparmor.d/' ?

[nobody43]

Most likely it won't work, because files undergo post-processing based on selected profiles and distribution.
If you absolutely need to install manually, you have to:

1. copy all required profiles, abstractions and tunables
2. switch all missing target profiles from rPx to rPUx
3. remove all missing label/peer targets, e.g. if you don't have gnome-shell:
   from ... peer=(name=org.freedesktop.DBus, label=gnome-shell), to ... peer=(name=org.freedesktop.DBus),
   if you don't have xorg:
   from ... peer=(addr="@/tmp/.X11-unix/X[0-9]*", label=xorg), to ... peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
   from ptrace (read) peer=xorg, to ptrace (read),
4. finish with applying comment directives: https://github.com/roddhjav/apparmor.d/blob/main/docs/development/directives.md

@roddhjav
I think all profiles should state in header that manual installation won't work, with a link to documentation.

[roddhjav]

As @nobody43 mentioned you may get some issues.

Basic partial install is supported. See https://apparmor.pujol.io/install/#partial-install:

make
sudo make profile-names...

This should work for git (as long as you check dependencies as mentioned in the doc). However, for profiles that are more integrated into the system, ie: anything in apparmor.d/groups/freedesktop, you may encounter some side issues.

[nobody43]

@roddhjav
Could you explain directives post-processing more thoroughly? What does it do exactly?

[roddhjav]

These are simple tasks that are applied on a profile content when you run make. The full list of directive is documented here: https://apparmor.pujol.io/development/directives/

[beroal]

See also Question #287 “picking profiles”.

[beroal]

I made a simple patch for this package's build script so the package would only contain profiles specified in the configuration file. I can share this patch.

It filters profiles in Makefile. This is less efficient than filtering in the Go code.