1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
//go:build linux
// +build linux
package preflight
import (
"errors"
"fmt"
"os"
"path/filepath"
"strings"
"github.com/crc-org/crc/v2/pkg/crc/constants"
crcos "github.com/crc-org/crc/v2/pkg/os"
)
var ubuntuPreflightChecks = []Check{
{
configKeySuffix: "check-apparmor-profile-setup",
checkDescription: "Checking if AppArmor is configured",
check: checkAppArmorExceptionIsPresent(os.ReadFile),
fixDescription: "Updating AppArmor configuration",
fix: addAppArmorExceptionForQcowDisks(os.ReadFile, crcos.WriteToFileAsRoot),
cleanupDescription: "Cleaning up AppArmor configuration",
cleanup: removeAppArmorExceptionForQcowDisks(os.ReadFile, crcos.WriteToFileAsRoot),
labels: labels{Os: Linux, Distro: UbuntuLike},
},
}
const (
appArmorTemplate = "/etc/apparmor.d/libvirt/TEMPLATE.qemu"
appArmorHeader = "profile LIBVIRT_TEMPLATE flags=(attach_disconnected) {"
)
type reader func(filename string) ([]byte, error)
type writer func(reason, content, filepath string, mode os.FileMode) error
// Verify the line is present in AppArmor template
func checkAppArmorExceptionIsPresent(reader reader) func() error {
return func() error {
template, err := reader(appArmorTemplate)
if err != nil {
return err
}
if !strings.Contains(string(template), expectedLines()) {
return errors.New("AppArmor profile not configured")
}
return nil
}
}
// Add the exception `cacheDir/*/crc*.qcow2 rk` in AppArmor template
func addAppArmorExceptionForQcowDisks(reader reader, writer writer) func() error {
return replaceInAppArmorTemplate(reader, writer, appArmorHeader, expectedLines())
}
// Eventually remove the exception in AppArmor template
func removeAppArmorExceptionForQcowDisks(reader reader, writer writer) func() error {
return replaceInAppArmorTemplate(reader, writer, expectedLines(), appArmorHeader)
}
// Search for the string `before` in the AppArmor template and replace it with `after` string.
func replaceInAppArmorTemplate(reader reader, writer writer, before string, after string) func() error {
return func() error {
template, err := reader(appArmorTemplate)
if err != nil {
return err
}
if !strings.Contains(string(template), before) {
return fmt.Errorf("unexpected AppArmor template file %s, cannot configure it automatically", appArmorTemplate)
}
content := strings.Replace(string(template), before, after, 1)
return writer("Updating AppArmor configuration", content, appArmorTemplate, 0644)
}
}
func expectedLines() string {
line := fmt.Sprintf(" %s rk,", filepath.Join(constants.MachineCacheDir, "*", "crc*.qcow2"))
return fmt.Sprintf("%s\n%s\n", appArmorHeader, line)
}
|
