Merge pull request #2 from madaidan/patch-1

Fix AppArmor when not in live mode
Kicksecure · Sep 12, 2019 · 4093614 · 4093614
2 parents 80370f4 + a8c19b3
commit 4093614
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/etc/apparmor.d/tunables/home.d/live-mode b/etc/apparmor.d/tunables/home.d/live-mode
@@ -2,7 +2,7 @@
 ## Copyright (C) 2018 Algernon <33966997+Algernon-01@users.noreply.github.com>
 ## See the file COPYING for copying conditions.
 
-@{HOMEDIRS}+=/rw/home/
+# @{HOMEDIRS}+=/rw/home/
 alias / -> /rw/,
 alias /var/lib/ -> /rw/var/lib/,
 alias /var/lib/tor/ -> /rw/var/lib/tor/,
diff --git a/lib/systemd/system/live-mode-apparmor.service b/lib/systemd/system/live-mode-apparmor.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Fix AppArmor for live mode
+
+[Service]
+Type=oneshot
+ExecStart=/usr/lib/live-mode-apparmor
+
+[Install]
+WantedBy=multi-user.target
diff --git a/usr/lib/live-mode-apparmor b/usr/lib/live-mode-apparmor
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+## AppArmor profiles in live mode need the following line to work
+## but because of a bug in AppArmor, this breaks reloading profiles
+## so it is only enabled in live mode.
+
+if grep "boot=live" /proc/cmdline; then
+  sed -i 's/# @{HOMEDIRS}+=\/rw\/home/@{HOMEDIRS}+=\/rw\/home/' /etc/apparmor.d/tunables/home.d/live-mode
+fi