Merge lp:~canonical-platform-qa/qakit/appamor-utilities into lp:qakit

[Heber Parrucci]

adding apparmor utilities to update profiles with given rules.
update_profile: to update an apparmor profile/s
restore_profiles: to get back the original ones loaded in the system.
are_rules_present: to check if certain rules are present in a given profile.

Change contains utilities to update apparmor profiles with given rules.

We will need this to be able to run automated tests against snaps applications. The idea is that the tests call this in their setup before running the tests.

Utilities:
update_profile, are_rules_present, restore_profiles

[Santiago Baldassin (sbaldassin)]

Code looks good to me

review: Approve

[lp:~canonical-platform-qa/qakit/appamor-utilities]

200. By Heber Parrucci on 2016-10-26

merge from trunk

=== added directory 'qakit/apparmor'
=== added file 'qakit/apparmor/__init__.py'
--- qakit/apparmor/__init__.py	1970-01-01 00:00:00 +0000
+++ qakit/apparmor/__init__.py	2016-10-26 18:00:51 +0000
@@ -0,0 +1,18 @@
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+#
+# Apparmor Utils
+# Copyright (C) 2016 Canonical
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
 
=== added file 'qakit/apparmor/apparmor_utils.py'
--- qakit/apparmor/apparmor_utils.py	1970-01-01 00:00:00 +0000
+++ qakit/apparmor/apparmor_utils.py	2016-10-26 18:00:51 +0000
@@ -0,0 +1,128 @@
+# -*- Mode: Python; coding: utf-8; indent-tabs-mode: nil; tab-width: 4 -*-
+#
+# Apparmor Utils
+# Copyright (C) 2016 Canonical
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import os
+
+PROFILES_DIR = '/var/lib/snapd/apparmor/profiles'
+BACKUP_DIR = '/tmp/profiles_bkp'
+APPARMOR_PARSER_CMD = 'apparmor_parser -r'
+
+
+def update_profile(rules,
+                   profiles=None,
+                   profiles_dir=PROFILES_DIR,
+                   password=None):
+    """Update apparmor's profile/s with given rules file,
+    it concatenates the rules to the original profile.
+    Before updating the profile/s it does a backup of the original
+    one so they can be restored later by calling to function:
+    restore_profiles()
+    :param rules: a string that represents the rules to add
+    :param profiles: the profile name list to add
+    the rules for.
+    If None, all the profiles will be updated.
+    If one profile already has the given rules,
+    it will not be backed-up or updated.
+    :param profiles_dir: directory path that contains apparmor profiles
+    :param password: the password to execute the commands as superuser,
+    if it is not provided,
+    it will be read from the environment variable PASSWORD,
+    if none of them are set, it will fail.
+    """
+    assert password or os.environ.get('PASSWORD'), \
+        'You either need to provide the password as ' \
+        'parameter or set the environment variable PASSWORD'
+    password = password or os.environ.get('PASSWORD')
+    found_profiles = os.listdir(profiles_dir)
+    if profiles:
+        found_profiles = [p for p in profiles if p in found_profiles]
+    __ensure_backup_dir()
+    for profile in found_profiles:
+        if not are_rules_present(rules, profile):
+            profile_full_path = os.path.join(profiles_dir, profile)
+            # backup up original profile to restore later
+            __run_with_sudo('cp %s %s' % (profile_full_path,
+                                          os.path.join(BACKUP_DIR,
+                                                       profile)),
+                            password)
+            original_rules = open(profile_full_path, mode='r').read()
+            with open('/tmp/%s.tmp' % profile, 'w') as temp:
+                # write to tmp file: original rules + new ones
+                temp.write(original_rules.rstrip('}\n'))
+                temp.write('\n\n')
+                temp.write(rules)
+
+            # replace original profile with the updated one
+            __run_with_sudo('mv %s %s' % ('/tmp/%s.tmp' % profile,
+                                          profile_full_path), password)
+            # refresh appamor profile
+            __run_with_sudo('%s %s' % (APPARMOR_PARSER_CMD,
+                                       profile_full_path),
+                            password)
+
+
+def are_rules_present(rules, profile_name, profiles_dir=PROFILES_DIR):
+    """Check in the apparmor profile if the given rules are present
+    :param rules: a string that represents the rules to check
+    :param profiles_dir: directory path that contains apparmor profiles
+    :param profile_name: the profile name to check
+    :return True if the rules rules are present in the given profile,
+    False otherwise
+    """
+    with open(os.path.join(profiles_dir, profile_name), mode='r') as p:
+        return p.read().find(rules) > 0
+
+
+def restore_profiles(profiles=None, profiles_dir=PROFILES_DIR, password=None):
+    """Restore the already backed-up profile/s
+    If there are no profiles backed-up, it will do nothing
+    :param profiles: the profiles name list to restore.
+    If None, it will restore all the profiles present in the backup directory
+    :param profiles_dir: directory path that contains apparmor profiles
+    :param password: the password to execute the commands as superuser,
+    if it is not provided,
+    it will be read from the environment variable PASSWORD,
+    if none of them are set, it will fail.
+    """
+    assert password or os.environ.get('PASSWORD'), \
+        'You either need to provide the password as ' \
+        'parameter or set the environment variable PASSWORD'
+    password = password or os.environ.get('PASSWORD')
+    found_profiles = os.listdir(profiles_dir)
+    if profiles:
+        found_profiles = [p for p in profiles if p in found_profiles]
+    for bkp in found_profiles:
+        if bkp in os.listdir(BACKUP_DIR):
+            # restore profile
+            __run_with_sudo('mv %s %s' % (os.path.join(BACKUP_DIR, bkp),
+                                          os.path.join(profiles_dir, bkp)),
+                            password)
+            # refresh appamor profile
+            __run_with_sudo('%s %s' % (APPARMOR_PARSER_CMD,
+                                       os.path.join(profiles_dir, bkp)),
+                            password)
+
+
+def __ensure_backup_dir():
+    if not os.path.exists(BACKUP_DIR):
+        os.makedirs(BACKUP_DIR)
+
+
+def __run_with_sudo(command, password):
+    return os.system('echo %s|sudo -S %s 2>/dev/null' % (password, command))