DRAFT: Split the profiles in multiple packages.

Makefile

@@ -7,7 +7,8 @@ DESTDIR ?= /
 BUILD ?= .build
 PKGDEST ?= ${PWD}/.pkg
 PKGNAME := apparmor.d
-PROFILES = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*)))
+PROFILE = $(filter-out dpkg,$(notdir $(wildcard ${BUILD}/apparmor.d/*)))
+PROFILES = profiles-apparmor.d profiles-other $(patsubst dists/packages/%,profiles-%,$(basename $(wildcard dists/packages/*.conf)))
 
 .PHONY: all
 all: build
@@ -26,32 +27,53 @@ enforce: build
 full: build
 	@./${BUILD}/prebuild --complain --full
 
+.PHONY: packages
+packages: clean build
+	@./${BUILD}/prebuild --complain --packages 
+
+# Install apparmor.d
 .PHONY: install
-install:
+install: install-bin install-share install-systemd profiles-apparmor.d
+
+# Install apparmor.d.base
+.PHONY: install-base
+install-base: install-bin install-share install-systemd profiles-base
+
+.PHONY: install-bin
+install-bin:
 	@install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log
+
+.PHONY: install-share
+install-share:
 	@for file in $(shell find "${BUILD}/share" -type f -not -name "*.md" -printf "%P\n"); do \
 		install -Dm0644 "${BUILD}/share/$${file}" "${DESTDIR}/usr/share/$${file}"; \
 	done;
-	@for file in $(shell find "${BUILD}/apparmor.d" -type f -printf "%P\n"); do \
-		install -Dm0644 "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \
-	done;
-	@for file in $(shell find "${BUILD}/apparmor.d" -type l -printf "%P\n"); do \
-		mkdir -p "${DESTDIR}/etc/apparmor.d/disable"; \
-		cp -d "${BUILD}/apparmor.d/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \
-	done;
+
+.PHONY: install-systemd
+install-systemd:
 	@for file in ${BUILD}/systemd/system/*; do \
-		service="$$(basename "$$file")"; \
+		service="$$(basename "$${file}")"; \
 		install -Dm0644 "$${file}" "${DESTDIR}/usr/lib/systemd/system/$${service}.d/apparmor.conf"; \
 	done;
 	@for file in ${BUILD}/systemd/user/*; do \
-		service="$$(basename "$$file")"; \
+		service="$$(basename "$${file}")"; \
 		install -Dm0644 "$${file}" "${DESTDIR}/usr/lib/systemd/user/$${service}.d/apparmor.conf"; \
 	done
 
-
+# Install all profiles for a given (sub)package
 .PHONY: $(PROFILES)
 $(PROFILES):
-	@install -Dm0755 ${BUILD}/aa-log ${DESTDIR}/usr/bin/aa-log
+	@for file in $(shell find "${BUILD}/$(patsubst profiles-%,%,$@)" -type f -printf "%P\n"); do \
+		install -Dm0644 "${BUILD}/$(patsubst profiles-%,%,$@)/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \
+	done;
+	@for file in $(shell find "${BUILD}/$(patsubst profiles-%,%,$@)" -type l -printf "%P\n"); do \
+		mkdir -p "${DESTDIR}/etc/apparmor.d/disable"; \
+		cp -d "${BUILD}/$(patsubst profiles-%,%,$@)/$${file}" "${DESTDIR}/etc/apparmor.d/$${file}"; \
+	done;
+
+# Partial install (not recommended)
+.PHONY: $(PROFILE)
+$(PROFILE): install-bin
 	@for file in $(shell find ${BUILD}/apparmor.d/abstractions/ -type f -printf "%P\n"); do \
 		install -Dm0644 "${BUILD}/apparmor.d/abstractions/$${file}" "${DESTDIR}/etc/apparmor.d/abstractions/$${file}"; \
 	done;

PKGBUILD

@@ -3,19 +3,23 @@
 
 # Warning: for development only, use https://aur.archlinux.org/packages/apparmor.d-git for production use.
 
-pkgname=apparmor.d
-pkgver=0.001
+pkgbase=apparmor.d
+pkgname=(
+  apparmor.d apparmor.d.base
+  apparmor.d.other
+)
+pkgver=0.0001
 pkgrel=1
-pkgdesc="Full set of apparmor profiles"
-arch=("x86_64")
-url="https://github.com/roddhjav/$pkgname"
+pkgdesc="Full set of apparmor profiles (base)"
+arch=("any")
+url="https://github.com/roddhjav/apparmor.d"
 license=('GPL2')
 depends=('apparmor')
 makedepends=('go' 'git' 'rsync')
-conflicts=("$pkgname-git")
+conflicts=("$pkgbase-git" "$pkgbase")
 
 pkgver() {
-  cd "$srcdir/$pkgname"
+  cd "$srcdir/$pkgbase"
   echo "0.$(git rev-list --count HEAD)"
 }
 
@@ -24,16 +28,33 @@ prepare() {
 }
 
 build() {
-  cd "$srcdir/$pkgname"
+  cd "$srcdir/$pkgbase"
   export CGO_CPPFLAGS="${CPPFLAGS}"
   export CGO_CFLAGS="${CFLAGS}"
   export CGO_CXXFLAGS="${CXXFLAGS}"
   export CGO_LDFLAGS="${LDFLAGS}"
   export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
-  make DISTRIBUTION=arch
+  make BUILD=.buid.all DISTRIBUTION=arch
+  make packages DISTRIBUTION=arch
 }
 
-package() {
-  cd "$srcdir/$pkgname"
-  make install DESTDIR="$pkgdir"
+package_apparmor.d() {
+  pkgdesc="Full set of apparmor profiles"
+  arch=("$CARCH")
+  conflicts=("${pkgname[@]:1}")
+  cd "$srcdir/$pkgbase"
+  make install BUILD=.buid.all DESTDIR="$pkgdir"
+}
+
+package_apparmor.d.base() {
+  arch=("$CARCH")
+  cd "$srcdir/$pkgbase"
+  make install-base DESTDIR="$pkgdir"
+}
+
+package_apparmor.d.other() {
+  pkgdesc="Full set of apparmor profiles (other)"
+  depends=(apparmor.d.base)
+  cd "$srcdir/$pkgbase"
+  make profiles-other DESTDIR="$pkgdir"
 }

cmd/prebuild/main.go

@@ -37,8 +37,6 @@ func init() {
 
 	// Compatibility with AppArmor 3
 	switch prebuild.Distribution {
-	case "arch":
-
 	case "ubuntu":
 		if !slices.Contains([]string{"noble"}, prebuild.Release["VERSION_CODENAME"]) {
 			prebuild.ABI = 3

dists/ignore/arch.ignore

@@ -4,9 +4,6 @@ apparmor.d/groups/apt
 # Ubuntu specific definition 
 apparmor.d/groups/ubuntu
 
-# OpenSUSE specific definition
-apparmor.d/groups/suse
-
 # Whonix specific definition
 apparmor.d/groups/whonix
 apparmor.d/tunables/home.d/whonix

dists/ignore/debian.ignore

@@ -5,9 +5,6 @@ share/libalpm
 # Ubuntu specific definition 
 apparmor.d/groups/ubuntu
 
-# OpenSUSE specific definition
-apparmor.d/groups/suse
-
 # Whonix specific definition
 apparmor.d/groups/whonix
 apparmor.d/abstractions/base.anondist

dists/ignore/ubuntu.ignore

@@ -2,9 +2,6 @@
 apparmor.d/groups/pacman
 share/libalpm
 
-# OpenSUSE specific definition
-apparmor.d/groups/suse
-
 # Whonix specific definition
 apparmor.d/groups/whonix
 apparmor.d/tunables/home.d/whonix

dists/ignore/whonix.ignore

@@ -2,9 +2,6 @@
 apparmor.d/groups/pacman
 share/libalpm
 
-# OpenSUSE specific definition
-apparmor.d/groups/suse
-
 # Whonix does not have them
 apparmor.d/groups/pacman
 apparmor.d/groups/ubuntu

dists/packages/base.conf

@@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2024 Alexandre Pujol <[email protected]>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal core with tunables, abstractions, and dependencies of other profiles 
+
+mode=enforce
+
+tunables
+
+abstractions
+!abstractions/app/chromium
+!abstractions/app/firefox
+
+groups/children
+!groups/children/user_confined
+!groups/children/user_default
+!groups/children/user_unconfined
+
+groups/bus
+profiles-s-z/unix-chkpwd
+profiles-m-r/pam-tmpdir-helper

pkg/prebuild/builder/core.go

@@ -6,6 +6,8 @@ package builder
 
 import (
 	"fmt"
+	"slices"
+	"strings"
 
 	"github.com/roddhjav/apparmor.d/pkg/paths"
 	"github.com/roddhjav/apparmor.d/pkg/prebuild"
@@ -33,21 +35,34 @@ type Option struct {
 
 func NewOption(file *paths.Path) *Option {
 	return &Option{
-		Name: file.Base(),
+		Name: strings.TrimSuffix(file.Base(), ".apparmor.d"),
 		File: file,
 	}
 }
 
 func Register(names ...string) {
 	for _, name := range names {
 		if b, present := Builders[name]; present {
-			Builds = append(Builds, b)
+			if !slices.Contains(Builds, b) {
+				Builds = append(Builds, b)
+			}
 		} else {
 			panic(fmt.Sprintf("Unknown builder: %s", name))
 		}
 	}
 }
 
+func Unregister(names ...string) {
+	for _, name := range names {
+		for i, b := range Builds {
+			if b.Name() == name {
+				Builds = slices.Delete(Builds, i, i+1)
+				break
+			}
+		}
+	}
+}
+
 func RegisterBuilder(d Builder) {
 	Builders[d.Name()] = d
 }