This pr is not good enough in terms or merging profiles.
Multiple dirs is working fine.
Multiple matches is not, it is more difficult than what I expected.
Sorting files in lexical order does not make sense because onion-grater stops at the first, even it make in reverse, the first match could not be enough for all cases.
If for example the a file containing hosts: '*' is matched, every host will only use that file, and no other even if it contains hosts: '*' in the other files.
The same apply even if hosts are specified such as hosts: '10.137.0.15' and the host match, it will not use any other file even if the host could match, it stops at the first file.
Unfortunately this is not done already on the onion-grater side because it was not written with that in mind.
What could be better done is transforming onion-grater-merger to separate files per hosts.
Lets take for example these files:
- a.yml - hosts: ‘10.10.10.10’
- b.yml - hosts: ‘*’
- c.yml - hosts ‘10.10.5.5’, ‘10.10.10.10’
The file b needs to be merged to all profiles.
The file a needs to be merged to the c profile
The file c needs to receive all profiles that either have all hosts or the matching hosts.
But this is just one aspect, the hosts, Tails uses apparmor-profiles and users, which lead to all sort of combinations of the qualifiers apparmor-profiles, users, hosts.
This means that there need to be a good way to merge in memory per the qualifiers, which gets more difficult with more qualifiers.
Lets take a bigger example know.
- a.yml
- apparmor-profiles:
- ‘/usr/bin/onionshare’
- ‘/usr/bin/onionshare-gui’
- users:
- ‘amnesia’
- ‘user’
- hosts:
- ‘10.10.10.10’
- ‘10.10.5.5’
- apparmor-profiles:
The three qualifiers are lists, they can hold multiple values. And this is only one profile, if you have to merge them in a way that it always results well.
From my tests, this was accepted by onion-grater:
- apparmor-profiles:
- '/usr/bin/onionshare'
users:
- 'amnesia'
hosts:
- '*'
it matched only the hosts.