Profile cleanup script

[valoq]

As discussed in #986 it would be nice to have the option to install only profiles for applications that are actually installed on the system since loading all profiles available takes significant processing time during boot.

The following script does exactly that by checking if the path listed in the profile file exists on the system: https://gist.github.com/valoq/599056353fe41b8cf948a70170c2f2e0

It checks for alternative path as well and based on my tests it seems to work as expected and creates two files with 1) profiles identified as installed and 2) profiles identified as obsolete.

The obsolete profiles can then simply be removed like this:
sed 's|^|/etc/apparmor.d/|' obsolete_profiles.txt | xargs sudo mv -t /etc/apparmor.d/disable/

I strongly advise to check both files first though, especially on newly installed system where the obsolete list may include applications that are not yet installed.

[curiosityseeker]

Nice work, thanks!

However, shouldn't the obsolete profiles symlinked to /etc/apparmor.d/disable rather than moved? That's what aa-disable does.

I strongly advise to check both files first though, especially on newly installed system where the obsolete list may include applications that are not yet installed.

Yes, that's one concern. Similarly, if you later install new applications, possibly with dependencies which already have a profile, what do you suggest as a workflow to move them back from disable?

[valoq]

The moved directory was just a dummy for me since I simply deleted the obsolete profiles.
When new programs are installed, I guess the best way is to reinstall apparmor.d and run the script again. This is needed from time to time anyway to get the latest updates