You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
157 lines
3.7 KiB
Bash
157 lines
3.7 KiB
Bash
#!/bin/sh
|
|
# ----------------------------------------------------------------------
|
|
# Copyright (c) 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
|
|
# NOVELL (All rights reserved)
|
|
# Copyright (c) 2008, 2009 Canonical, Ltd.
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
# License published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, contact Novell, Inc.
|
|
# ----------------------------------------------------------------------
|
|
# Authors:
|
|
# Steve Beattie <steve.beattie@canonical.com>
|
|
# Kees Cook <kees@ubuntu.com>
|
|
#
|
|
# /etc/init.d/apparmor
|
|
#
|
|
# Note: "Required-Start: $local_fs" implies that the cache may not be available
|
|
# yet when /var is on a remote filesystem. The worst consequence this should
|
|
# have is slowing down the boot.
|
|
#
|
|
### BEGIN INIT INFO
|
|
# Provides: apparmor
|
|
# Required-Start: $local_fs
|
|
# Required-Stop: umountfs
|
|
# Default-Start: S
|
|
# Default-Stop:
|
|
# Short-Description: AppArmor initialization
|
|
# Description: AppArmor init script. This script loads all AppArmor profiles.
|
|
### END INIT INFO
|
|
|
|
APPARMOR_FUNCTIONS=/lib/apparmor/rc.apparmor.functions
|
|
|
|
# Functions needed by rc.apparmor.functions
|
|
|
|
. /lib/lsb/init-functions
|
|
|
|
aa_action() {
|
|
STRING=$1
|
|
shift
|
|
$*
|
|
rc=$?
|
|
if [ $rc -eq 0 ] ; then
|
|
aa_log_success_msg $"$STRING "
|
|
else
|
|
aa_log_failure_msg $"$STRING "
|
|
fi
|
|
return $rc
|
|
}
|
|
|
|
aa_log_action_start() {
|
|
log_action_begin_msg $@
|
|
}
|
|
|
|
aa_log_action_end() {
|
|
log_action_end_msg $@
|
|
}
|
|
|
|
aa_log_success_msg() {
|
|
log_success_msg $@
|
|
}
|
|
|
|
aa_log_warning_msg() {
|
|
log_warning_msg $@
|
|
}
|
|
|
|
aa_log_failure_msg() {
|
|
log_failure_msg $@
|
|
}
|
|
|
|
aa_log_skipped_msg() {
|
|
if [ -n "$1" ]; then
|
|
log_warning_msg "${1}: Skipped."
|
|
fi
|
|
}
|
|
|
|
aa_log_daemon_msg() {
|
|
log_daemon_msg $@
|
|
}
|
|
|
|
aa_log_end_msg() {
|
|
log_end_msg $@
|
|
}
|
|
|
|
# Source AppArmor function library
|
|
if [ -f "${APPARMOR_FUNCTIONS}" ]; then
|
|
. ${APPARMOR_FUNCTIONS}
|
|
else
|
|
aa_log_failure_msg "Unable to find AppArmor initscript functions"
|
|
exit 1
|
|
fi
|
|
|
|
usage() {
|
|
echo "Usage: $0 {start|stop|restart|reload|force-reload|status}"
|
|
}
|
|
|
|
test -x ${PARSER} || exit 0 # by debian policy
|
|
# LSM is built-in, so it is either there or not enabled for this boot
|
|
test -d /sys/module/apparmor || exit 0
|
|
|
|
# do not perform start/stop/reload actions when running from liveCD
|
|
test -d /rofs/etc/apparmor.d && exit 0
|
|
|
|
rc=255
|
|
case "$1" in
|
|
start)
|
|
if [ -x /usr/bin/systemd-detect-virt ] && \
|
|
systemd-detect-virt --quiet --container && \
|
|
! is_container_with_internal_policy; then
|
|
aa_log_daemon_msg "Not starting AppArmor in container"
|
|
aa_log_end_msg 0
|
|
exit 0
|
|
fi
|
|
apparmor_start
|
|
rc=$?
|
|
;;
|
|
restart|reload|force-reload)
|
|
if [ -x /usr/bin/systemd-detect-virt ] && \
|
|
systemd-detect-virt --quiet --container && \
|
|
! is_container_with_internal_policy; then
|
|
aa_log_daemon_msg "Not starting AppArmor in container"
|
|
aa_log_end_msg 0
|
|
exit 0
|
|
fi
|
|
apparmor_restart
|
|
rc=$?
|
|
;;
|
|
stop)
|
|
aa_log_daemon_msg "Leaving AppArmor profiles loaded"
|
|
cat >&2 <<EOM
|
|
No profiles have been unloaded.
|
|
|
|
Unloading profiles will leave already running processes permanently
|
|
unconfined, which can lead to unexpected situations.
|
|
|
|
To set a process to complain mode, use the command line tool
|
|
'aa-complain'. To really tear down all profiles, run 'aa-teardown'."
|
|
EOM
|
|
;;
|
|
status)
|
|
apparmor_status
|
|
rc=$?
|
|
;;
|
|
*)
|
|
usage
|
|
rc=1
|
|
;;
|
|
esac
|
|
exit $rc
|