#!/bin/bash
set -euo pipefail
# Restore only profiles already generated by the installed Certbot/core snaps.
# This does not enable the global AppArmor service or change profile modes.
[[ $(id -u) == 0 ]] || exit 1
mode=${1:---load}
[[ $# -le 1 && ( $mode == --load || $mode == --check ) ]] || exit 2
[[ $(cat /sys/module/apparmor/parameters/enabled) == Y ]] || exit 3
directory=/var/lib/snapd/apparmor/profiles
[[ -d $directory && ! -L $directory && $(stat -c %u "$directory") == 0 ]] || exit 4
[[ -z $(find "$directory" -maxdepth 0 -perm /022 -print) ]] || exit 4
[[ -f $directory/snap.certbot.certbot && -f $directory/snap.certbot.renew ]] || exit 5
shopt -s nullglob
profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory"/snap-confine.core.*)
(( ${#profiles[@]} >= 4 )) || exit 5
# Validate every input before loading any profile. Never use complain/disable flags.
for profile in "${profiles[@]}"; do
    [[ -f $profile && ! -L $profile && $(stat -c %u "$profile") == 0 ]] || exit 6
    [[ -z $(find "$profile" -maxdepth 0 -perm /022 -print) ]] || exit 6
    /usr/sbin/apparmor_parser --skip-kernel-load --skip-cache "$profile"
done
if [[ $mode == --load ]]; then
    for profile in "${profiles[@]}"; do
        /usr/sbin/apparmor_parser --replace --skip-cache "$profile"
    done
fi
printf 'Certbot/core profiles checked: %s; mode: %s\n' "${#profiles[@]}" "$mode"