31 lines
1.5 KiB
Bash
31 lines
1.5 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
# Restore only profiles already generated by the installed Certbot/core snaps.
|
|
# This does not enable the global AppArmor service or change profile modes.
|
|
[[ $(id -u) == 0 ]] || exit 1
|
|
mode=${1:---load}
|
|
[[ $# -le 1 && ( $mode == --load || $mode == --check ) ]] || exit 2
|
|
[[ $(cat /sys/module/apparmor/parameters/enabled) == Y ]] || exit 3
|
|
directory=/var/lib/snapd/apparmor/profiles
|
|
[[ -d $directory && ! -L $directory && $(stat -c %u "$directory") == 0 ]] || exit 4
|
|
[[ -z $(find "$directory" -maxdepth 0 -perm /022 -print) ]] || exit 4
|
|
[[ -f $directory/snap.certbot.certbot && -f $directory/snap.certbot.renew ]] || exit 5
|
|
shopt -s nullglob
|
|
core=$(readlink -f /snap/core/current)
|
|
[[ $core =~ ^/(var/lib/snapd/)?snap/core/([0-9]+)$ ]] || exit 5
|
|
revision=${BASH_REMATCH[2]}
|
|
profiles=("$directory"/snap.certbot.* "$directory"/snap-update-ns.certbot "$directory/snap-confine.core.$revision")
|
|
(( ${#profiles[@]} >= 4 )) || exit 5
|
|
# Validate every input before loading any profile. Never use complain/disable flags.
|
|
for profile in "${profiles[@]}"; do
|
|
[[ -f $profile && ! -L $profile && $(stat -c %u "$profile") == 0 ]] || exit 6
|
|
[[ -z $(find "$profile" -maxdepth 0 -perm /022 -print) ]] || exit 6
|
|
/usr/sbin/apparmor_parser --skip-kernel-load --skip-cache "$profile"
|
|
done
|
|
if [[ $mode == --load ]]; then
|
|
for profile in "${profiles[@]}"; do
|
|
/usr/sbin/apparmor_parser --replace --skip-cache "$profile"
|
|
done
|
|
fi
|
|
printf 'Certbot/core profiles checked: %s; mode: %s\n' "${#profiles[@]}" "$mode"
|