apparmor: load profiles in parallel

[thypon]

Just a quick mod for parallelizing apparmor profiles on load.

Cc: @Gottox @ericonr @CameronNemo

[ericonr]

How do we encode the dependency on find/xargs?

[ericonr]

nproc https://www.flamingspork.com/blog/2020/11/25/why-you-should-use-nproc-and-not-grep-proc-cpuinfo/

[thypon]

it's all in findutils (xargs and find) which are installed if you have base-system base-minimal or base-chroot. No need to specify anything.

[Gottox]

Allows command injection. I'm not considering this an attack vector, as the files are root writeable, nevertheless, avoid this.

[thypon]

Command injection? You mean shell spawning or in general? I don't see command injection here. I mean, even $APPARMOR without anything else in a shell script it can be a command injection if you don't control the source.

[CameronNemo]

Upstream has optimized code to do this (/usr/lib/apparmor/rc.apparmor.functions parse_profiles()).

Currently we fudge it up with our custom one-by-one loading. Now we are reimplementing?

Can we deprecate the runit "complain" mode and direct users to the aa-complain(8) utility? It would bring us closer to upstream and other distros.

Minimal example of what using the upstream provided code would look like (they make you define log functions):

set -e

test -d /sys/kernel/security/apparmor

AA_FUNCTIONS=/usr/lib/apparmor/rc.apparmor.functions
test -r "$AA_FUNCTIONS"

aa_action() { :; }
aa_log_warning_msg() { :; }
aa_log_failure_msg() { :; }
aa_log_action_start() { :; }
aa_log_action_end() { :; }
aa_log_daemon_msg() { :; }
aa_log_skipped_msg() { :; }
aa_log_end_msg() { :; }

set +e
. "$AA_FUNCTIONS"
apparmor_restart
exit $?

[thypon]

I perfectly agree with @CameronNemo on long term using the upstream version.
For now I just ported from the official script the xargs command so that we can have parallelism with minimal changes.

[Duncaen]

apparmror_parser already parses profiles in parallel, just pass everything to it and forget about the printf.

[Duncaen]

If we patch in our .new- suffix we can just pass the directory and it will be fast and simple.
https://gitlab.com/apparmor/apparmor/-/blob/master/libraries/libapparmor/src/private.c#L65

[thypon]

The last version removes the superfluous logging