Package: debhelper
Version: 8.9.11
Severity: normal
Tags: patch
User: [email protected]
Usertags: origin-ubuntu precise
Now that the apparmor package is in Debian, it would be handy to have
dh_apparmor in Debian as well (it has been carried in Ubuntu for a while).
This helper does the various bits of logic to rotate an apparmor profile
into the right place on install, and to remove various bits on removal.
Once this is in, the existing packages in Debian that carry AppArmor
profiles can start using it and clean up their maintainer scripts a bit.
Thanks!
-Kees
--
Kees Cook @debian.org
diff -Nru debhelper-8.9.11.old/autoscripts/postinst-apparmor debhelper-8.9.11/autoscripts/postinst-apparmor
--- debhelper-8.9.11.old/autoscripts/postinst-apparmor 1969-12-31 16:00:00.000000000 -0800
+++ debhelper-8.9.11/autoscripts/postinst-apparmor 2011-11-23 14:36:35.000000000 -0800
@@ -0,0 +1,23 @@
+if [ "$1" = "configure" ]; then
+ APP_PROFILE=/etc/apparmor.d/#PROFILE#
+ if [ -f "$APP_PROFILE" ]; then
+ # Add the local/ include
+ LOCAL_APP_PROFILE=/etc/apparmor.d/local/#PROFILE#
+
+ test -e "$LOCAL_APP_PROFILE" || {
+ tmp=`mktemp`
+ cat <<EOM > "$tmp"
+# Site-specific additions and overrides for #PROFILE#.
+# For more details, please see /etc/apparmor.d/local/README.
+EOM
+ mkdir `dirname $LOCAL_APP_PROFILE` 2>/dev/null || true
+ mv -f "$tmp" "$LOCAL_APP_PROFILE"
+ chmod 644 "$LOCAL_APP_PROFILE"
+ }
+
+ # Reload the profile, including any abstraction updates
+ if aa-status --enabled 2>/dev/null; then
+ apparmor_parser -r -T -W "$APP_PROFILE" || true
+ fi
+ fi
+fi
diff -Nru debhelper-8.9.11.old/autoscripts/postrm-apparmor debhelper-8.9.11/autoscripts/postrm-apparmor
--- debhelper-8.9.11.old/autoscripts/postrm-apparmor 1969-12-31 16:00:00.000000000 -0800
+++ debhelper-8.9.11/autoscripts/postrm-apparmor 2011-11-23 14:36:35.000000000 -0800
@@ -0,0 +1,6 @@
+if [ "$1" = "purge" ]; then
+ rm -f "/etc/apparmor.d/disable/#PROFILE#" || true
+ rm -f "/etc/apparmor.d/force-complain/#PROFILE#" || true
+ rm -f "/etc/apparmor.d/local/#PROFILE#" || true
+ rmdir /etc/apparmor.d/local 2>/dev/null || true
+fi
diff -Nru debhelper-8.9.11.old/dh_apparmor debhelper-8.9.11/dh_apparmor
--- debhelper-8.9.11.old/dh_apparmor 1969-12-31 16:00:00.000000000 -0800
+++ debhelper-8.9.11/dh_apparmor 2011-11-23 14:31:10.000000000 -0800
@@ -0,0 +1,72 @@
+#!/usr/bin/perl -w
+
+=head1 NAME
+
+dh_apparmor - reload AppArmor profile and create local include
+
+=cut
+
+use strict;
+use Debian::Debhelper::Dh_Lib;
+
+=head1 SYNOPSIS
+
+B<dh_apparmor> B<--profile-name=>I<profilename>
+
+=head1 DESCRIPTION
+
+dh_apparmor is a debhelper program that will create/remove the
+/etc/apparmor.d/local/<profilename> include file in maintainer scripts. It
+also reloads the specified AppArmor profile in postinst using:
+
+=over 4
+
+apparmor_parser -r -W -T /etc/apparmor.d/<profilename>
+
+=back
+
+By using '-W -T' we ensure that any abstraction updates are also pulled in.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<--profile-name=><profilename>
+
+Specify the profile name.
+
+=back
+
+=head1 NOTES
+
+Note that for packages that have multiple binary packages, you will want to
+pass '-p<package name>' to dh_apparmor, otherwise dh_apparmor will add
+AppArmor reload commands for all packages rather than just the one that
+ships the profile.
+
+=cut
+
+init(options => {
+ "profile-name=s" => \$dh{PROFILE_NAME},
+});
+
+foreach my $package (@{$dh{DOPACKAGES}}) {
+ if (! $dh{PROFILE_NAME}) {
+ error("Must specify --profile-name");
+ }
+ my $pname = $dh{PROFILE_NAME};
+ autoscript($package,"postinst","postinst-apparmor","s/#PROFILE#/$pname/");
+ autoscript($package,"postrm","postrm-apparmor","s/#PROFILE#/$pname/");
+}
+
+=head1 SEE ALSO
+
+L<debhelper>
+
+This program is a part of debhelper.
+
+=head1 AUTHOR
+
+Jamie Strandboge <[email protected]>
+
+=cut
