/usr/bin/dh_apparmor

#!/usr/bin/perl -w

=head1 NAME

dh_apparmor - reload AppArmor profile and create local include

=cut

use strict;
use Debian::Debhelper::Dh_Lib;

=head1 SYNOPSIS

B<dh_apparmor> [B<--manifest=>I<manifestfile>] B<--profile-name=>I<profilename>

=head1 DESCRIPTION

dh_apparmor is a debhelper program that will create/remove the
/etc/apparmor.d/local/<profilename> include file in maintainer scripts. It
also reloads the specified AppArmor profile in postinst using:

=over 4

apparmor_parser -r -W -T /etc/apparmor.d/<profilename>

=back

By using '-W -T' we ensure that any abstraction updates are also pulled in.

=head1 OPTIONS

=over 4

=item B<--profile-name=><profilename>

Specify the profile name. Eg:

dh_apparmor --profile-name=bin.foo
dh_apparmor --profile-name=bin.foo -p foo

=back

=over 4

=item B<--manifest=><manifestfile>

Optionally specify a manifest file. When specified, a profile is generated by
calling B<aa-easyprof(8)> with the specified manifest file and putting the
resulting profile in debian/apparmor/<profilename>. Eg, if there is a valid
manifest in debian/manifest.json, then the following command will create
debian/apparmor/bin.bar for the 'bar' package (you will need to clean this up
via override_dh_clean or similar).

dh_apparmor --manifest=manifest.json --profile-name=bin.bar -p bar

Because not all build environments support the apparmor kernel interface,
B<aa-easyprof(8)> is called with the --no-verify option. Use of this option
requires that apparmor-easyprof is installed.


=back

=head1 NOTES

When using modern dh packaging techniques, dh_apparmor can be added to the
override_dh_install section of the rules file. Note that for packages that
have multiple binary packages, you will want to pass '-p<package name>' to
dh_apparmor, otherwise dh_apparmor will add AppArmor reload commands for all
packages rather than just the one that ships the profile.

In addition, you will have to install the profile itself in /etc/apparmor.d.
Eg, in the above manifest file example if you are using dh_install you would
add to debian/bar.install:

=over 4

debian/apparmor/bin.bar etc/apparmor.d

=back

=cut

# Placeholder replaced at package build time.
#
# Recent versions of debhelper extract that version and include it in
# the maintscripts snippets generated by dh_apparmor. These versions
# will be extracted by lintian in the tag
# debhelper-autoscript-in-maintainer-scripts, which enables us to
# find packages that were built with a particular version of
# dh_apparmor.
#
our $VERSION = "2.12-4ubuntu5";

init(options => {
	"profile-name=s" => \$dh{PROFILE_NAME},
	"manifest-file=s" => \$dh{AA_MANIFEST},
});

my $aa_dir = "debian/apparmor";

foreach my $package (@{$dh{DOPACKAGES}}) {
	if (! $dh{PROFILE_NAME}) {
		error("Must specify --profile-name for $package");
        }
        my $pname = $dh{PROFILE_NAME};
	autoscript($package,"postinst","postinst-apparmor","s/#PROFILE#/$pname/");
	autoscript($package,"postrm","postrm-apparmor","s/#PROFILE#/$pname/");

	if ($dh{AA_MANIFEST}) {
		unless (-e "debian/$dh{AA_MANIFEST}") {
			error("Could not find debian/$dh{AA_MANIFEST}");
		}
		unless (-x "/usr/bin/aa-easyprof") {
			error("Could not find aa-easyprof");
		}
		if (! -d "$aa_dir") {
			mkdir("$aa_dir");
		}
		my $profile_fn = "$aa_dir/$dh{PROFILE_NAME}";
		if (-e "$profile_fn") {
			warning("Regenerating $profile_fn");
			unlink("$profile_fn");
		}
		my $tmpdir = tmpdir($package);
		my $tmp = "$tmpdir/$dh{PROFILE_NAME}.aa-easyprof.tmp";
		complex_doit("aa-easyprof --no-verify --manifest=debian/$dh{AA_MANIFEST} > $tmp");
		rename("$tmp", "$profile_fn");
	}
}


=head1 SEE ALSO

L<debhelper(7)> L<aa-easyprof(8)>

This program is a part of debhelper.

=head1 AUTHOR

Jamie Strandboge <jamie@canonical.com>

=cut
dh-apparmor 2.12-4ubuntu5 / usr / bin / dh_apparmor
