Merge lp:~thedac/charm-helpers/apparmor into lp:charm-helpers

[David Ames]

Apparmor class for OpenStack charms

The class will validate aa-profile-mode config settings and either set
the profile to enforce, complain or disable mode.

[lp:~thedac/charm-helpers/apparmor]

556. By David Ames on 2016-03-25

Fix call to manually_disable_aa_profile()

557. By David Ames on 2016-03-25

Move mitaka check into base AA class

[Alex Kavanagh (ajkavanagh)]

See my inline comments. They don't alter functionality, but change an appArmorContext.ctxt to a property that is set only once regardless of whether returned in the __call__() or directly by instance.ctxt. However, it's a style thing only.

Otherwise, good to go.

[lp:~thedac/charm-helpers/apparmor]

558. By David Ames on 2016-03-29

Set self.ctxt as a property

[Alex Kavanagh (ajkavanagh)]

Just a tiny inline comment.

[lp:~thedac/charm-helpers/apparmor]

559. By David Ames on 2016-03-30

Use self() rather than self.__call__()

[James Page (james-page)]

review: Needs Fixing

[David Ames (thedac)]

I'll address the comments.

[lp:~thedac/charm-helpers/apparmor]

560. By David Ames on 2016-03-31

Remove python3 setting, add comments for manual disable

[James Page (james-page)]

LGTM but does need a rebase prior to merge - please land away!

review: Approve

[lp:~thedac/charm-helpers/apparmor]

561. By David Ames on 2016-04-04

Merge upstream

[David Ames (thedac)]

Rebased. Merging.

=== modified file 'charmhelpers/contrib/openstack/context.py'
--- charmhelpers/contrib/openstack/context.py	2016-04-01 10:00:31 +0000
+++ charmhelpers/contrib/openstack/context.py	2016-04-04 18:08:06 +0000
@@ -20,7 +20,7 @@
 import re
 import time
 from base64 import b64decode
-from subprocess import check_call
+from subprocess import check_call, CalledProcessError
 
 import six
 import yaml
@@ -45,6 +45,7 @@
     INFO,
     WARNING,
     ERROR,
+    status_set,
 )
 
 from charmhelpers.core.sysctl import create as sysctl_create
@@ -1491,3 +1492,92 @@
     """
     def __call__(self):
         return {'use_internal_endpoints': config('use-internal-endpoints')}
+
+
+class AppArmorContext(OSContextGenerator):
+    """Base class for apparmor contexts."""
+
+    def __init__(self):
+        self._ctxt = None
+        self.aa_profile = None
+        self.aa_utils_packages = ['apparmor-utils']
+
+    @property
+    def ctxt(self):
+        if self._ctxt is not None:
+            return self._ctxt
+        self._ctxt = self._determine_ctxt()
+        return self._ctxt
+
+    def _determine_ctxt(self):
+        """
+        Validate aa-profile-mode settings is disable, enforce, or complain.
+
+        :return ctxt: Dictionary of the apparmor profile or None
+        """
+        if config('aa-profile-mode') in ['disable', 'enforce', 'complain']:
+            ctxt = {'aa-profile-mode': config('aa-profile-mode')}
+        else:
+            ctxt = None
+        return ctxt
+
+    def __call__(self):
+        return self.ctxt
+
+    def install_aa_utils(self):
+        """
+        Install packages required for apparmor configuration.
+        """
+        log("Installing apparmor utils.")
+        ensure_packages(self.aa_utils_packages)
+
+    def manually_disable_aa_profile(self):
+        """
+        Manually disable an apparmor profile.
+
+        If aa-profile-mode is set to disabled (default) this is required as the
+        template has been written but apparmor is yet unaware of the profile
+        and aa-disable aa-profile fails. Without this the profile would kick
+        into enforce mode on the next service restart.
+
+        """
+        profile_path = '/etc/apparmor.d'
+        disable_path = '/etc/apparmor.d/disable'
+        if not os.path.lexists(os.path.join(disable_path, self.aa_profile)):
+            os.symlink(os.path.join(profile_path, self.aa_profile),
+                       os.path.join(disable_path, self.aa_profile))
+
+    def setup_aa_profile(self):
+        """
+        Setup an apparmor profile.
+        The ctxt dictionary will contain the apparmor profile mode and
+        the apparmor profile name.
+        Makes calls out to aa-disable, aa-complain, or aa-enforce to setup
+        the apparmor profile.
+        """
+        self()
+        if not self.ctxt:
+            log("Not enabling apparmor Profile")
+            return
+        self.install_aa_utils()
+        cmd = ['aa-{}'.format(self.ctxt['aa-profile-mode'])]
+        cmd.append(self.ctxt['aa-profile'])
+        log("Setting up the apparmor profile for {} in {} mode."
+            "".format(self.ctxt['aa-profile'], self.ctxt['aa-profile-mode']))
+        try:
+            check_call(cmd)
+        except CalledProcessError as e:
+            # If aa-profile-mode is set to disabled (default) manual
+            # disabling is required as the template has been written but
+            # apparmor is yet unaware of the profile and aa-disable aa-profile
+            # fails. If aa-disable learns to read profile files first this can
+            # be removed.
+            if self.ctxt['aa-profile-mode'] == 'disable':
+                log("Manually disabling the apparmor profile for {}."
+                    "".format(self.ctxt['aa-profile']))
+                self.manually_disable_aa_profile()
+                return
+            status_set('blocked', "Apparmor profile {} failed to be set to {}."
+                                  "".format(self.ctxt['aa-profile'],
+                                            self.ctxt['aa-profile-mode']))
+            raise e

=== modified file 'tests/contrib/openstack/test_os_contexts.py'
--- tests/contrib/openstack/test_os_contexts.py	2016-04-01 10:15:57 +0000
+++ tests/contrib/openstack/test_os_contexts.py	2016-04-04 18:08:06 +0000
@@ -84,6 +84,21 @@
             return None
         return sorted(self.relation_data[relation_id].keys())
 
+
+class FakeAppArmorContext(context.AppArmorContext):
+
+    def __init__(self):
+        super(FakeAppArmorContext, self).__init__()
+        self.aa_profile = 'fake-aa-profile'
+
+    def __call__(self):
+        super(FakeAppArmorContext, self).__call__()
+        if not self.ctxt:
+            return self.ctxt
+        self._ctxt.update({'aa-profile': self.aa_profile})
+        return self.ctxt
+
+
 SHARED_DB_RELATION = {
     'db_host': 'dbserver.local',
     'password': 'foo'
@@ -2892,3 +2907,74 @@
         config = {'use-internal-endpoints': True}
         self.config.side_effect = fake_config(config)
         self.assertTrue(ctxt()['use_internal_endpoints'])
+
+    def test_apparmor_context_call_not_valid(self):
+        ''' Tests for the apparmor context'''
+        mock_aa_object = context.AppArmorContext()
+        # Test with invalid config
+        self.config.return_value = 'NOTVALID'
+        self.assertEquals(mock_aa_object.__call__(), None)
+
+    def test_apparmor_context_call_complain(self):
+        ''' Tests for the apparmor context'''
+        mock_aa_object = context.AppArmorContext()
+        # Test complain mode
+        self.config.return_value = 'complain'
+        self.assertEquals(mock_aa_object.__call__(),
+                          {'aa-profile-mode': 'complain'})
+
+    def test_apparmor_context_call_enforce(self):
+        ''' Tests for the apparmor context'''
+        mock_aa_object = context.AppArmorContext()
+        # Test enforce mode
+        self.config.return_value = 'enforce'
+        self.assertEquals(mock_aa_object.__call__(),
+                          {'aa-profile-mode': 'enforce'})
+
+    def test_apparmor_context_call_disable(self):
+        ''' Tests for the apparmor context'''
+        mock_aa_object = context.AppArmorContext()
+        # Test complain mode
+        self.config.return_value = 'disable'
+        self.assertEquals(mock_aa_object.__call__(),
+                          {'aa-profile-mode': 'disable'})
+
+    def test_apparmor_setup_complain(self):
+        ''' Tests for the apparmor setup'''
+        AA = FakeAppArmorContext()
+        AA.install_aa_utils = MagicMock()
+        AA.manually_disable_aa_profile = MagicMock()
+        # Test complain mode
+        self.config.return_value = 'complain'
+        AA.setup_aa_profile()
+        AA.install_aa_utils.assert_called_with()
+        self.check_call.assert_called_with(['aa-complain', 'fake-aa-profile'])
+        self.assertFalse(AA.manually_disable_aa_profile.called)
+
+    def test_apparmor_setup_enforce(self):
+        ''' Tests for the apparmor setup'''
+        AA = FakeAppArmorContext()
+        AA.install_aa_utils = MagicMock()
+        AA.manually_disable_aa_profile = MagicMock()
+        # Test enforce mode
+        self.config.return_value = 'enforce'
+        AA.setup_aa_profile()
+        self.check_call.assert_called_with(['aa-enforce', 'fake-aa-profile'])
+        self.assertFalse(AA.manually_disable_aa_profile.called)
+
+    def test_apparmor_setup_disable(self):
+        ''' Tests for the apparmor setup'''
+        AA = FakeAppArmorContext()
+        AA.install_aa_utils = MagicMock()
+        AA.manually_disable_aa_profile = MagicMock()
+        # Test disable mode
+        self.config.return_value = 'disable'
+        AA.setup_aa_profile()
+        self.check_call.assert_called_with(['aa-disable', 'fake-aa-profile'])
+        self.assertFalse(AA.manually_disable_aa_profile.called)
+        # Test failed to disable
+        from subprocess import CalledProcessError
+        self.check_call.side_effect = CalledProcessError(0, 0, 0)
+        AA.setup_aa_profile()
+        self.check_call.assert_called_with(['aa-disable', 'fake-aa-profile'])
+        AA.manually_disable_aa_profile.assert_called_with()