profile rule deduplication of apparmor-profile-sdwdate and apparmor-profile-timesync by creating an sdwdate AppArmor abstraction file

[phabricator-migrator]

Information

ID: 152
PHID: PHID-TASK-5ilxvkcp4f6yo74xbdce
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

https://github.com/Whonix/apparmor-profile-sdwdate and
https://github.com/Whonix/apparmor-profile-timesync
currently share a lot profile rules.

When making changes to sdwdate or timesync, most times both profiles need to be modified. This is often forgotten and error prone.

Would be better if most of these profile rules were inside a shared sdwdate AppArmor abstractions file.

Comments

---

troubadour

2015-02-16 17:13:39 UTC

Something that could have been done, but has been postponed several times. As there are other tasks in the pipeline, it’s not high priority. First, what do we call the file? abstractions/sdwdate sounds good.

---

Patrick

2015-02-16 20:27:52 UTC

Yes.

---

troubadour

2015-02-18 05:17:26 UTC

The name became abstractions/whonix, the reason being that it’s used by the three Whonix specific profiles, sdwdate, timesync and whonixcheck.

The repositories are updated with the trimmed profiles. abstractions/whonix is added to apparmor-profile-anondist, which seems its natural place.

---

Patrick

2015-02-18 08:11:04 UTC

That I find a bad idea. Because sdwdate, timesync is are standalone packages, supposed to enter official Debian repository one day. Mixing them with whonix-anything entails unrelated packages.

---

troubadour

2015-02-19 20:50:44 UTC

I was not aware of that. Let’s rename it sdwate.

Perhaps we should keep the AppArmor discussion in the forum. It looks like there in an audience from outside Whonix, and it’s sort of buried in all the tasks here in Phabricator.

---

Patrick

2015-02-19 21:07:56 UTC

Let’s rename it sdwate.

sdwdate

Perhaps we should keep the AppArmor discussion in the forum. It looks like there in an audience from outside Whonix, and it’s sort of buried in all the tasks here in Phabricator.

I don’t mind either way. It’s just stuff in the forums is getting lost and forgotten in long threads.

---

Would whonixcheck depend on sdwdate then? That would not be as worse, but also non-ideal.

---

troubadour

2015-02-19 21:26:15 UTC

Yes. it would. But is that a concern? We have this abstraction available, why not use it for any profile requiring the whole or part of it. It would become an issue only if sdwdate is ported to another language.

---

Patrick

2015-02-19 21:40:57 UTC

Yes. Situations were one likes to use whonixcheck, but not sdwdate. It would introduce a new, strange dependency. whonixcheck would depend on sdwdate. That seems strange, unprofessional, hard to sell. Or were one wants to temporarily remove sdwdate for whatever use/test case and notices, that this would also remove whonixcheck.

---

troubadour

2015-02-19 21:56:48 UTC

Ok. Then I’ll revert the change in whonixcheck profile. Have pushed the name change in apparmor-profile-anondist.

---

Patrick

2015-02-19 22:06:39 UTC

I am afraid, apparmor-profile-anondist is also the wrong place. Because then sdwdate, a generic package, would depend on an anondist/Whonix specific package, apparmor-profile-anondist. The latter is a Debian non-policy-conform package. (Because diverting /etc/apparmor.d/abstractions/base.)

/etc/apparmor.d/abstractions/sdwdate belongs into package apparmor-profile-sdwdate (or into sdwdate when we merge a few apparmor-profile-* packages into their corresponding application packages).

---

troubadour

2015-02-19 23:41:15 UTC

Makes sense. Will make the changes.

---

troubadour

2015-02-21 20:32:06 UTC

Done. The abstraction is in apparmor-profile-sdwdate/etc/apparmor.d/abstractions

apparmor-profile-anondist is updated.

---

Patrick

2015-02-22 18:21:29 UTC

Added small fix on top of apparmor-profile-sdwdate. Otherwise works fine at first sight. Will naturally test more by running it in the following days.

Can you also update apparmor-profile-timesync please?

---

Patrick

2016-06-27 17:00:23 UTC

timesync and apparmor-profile-timesync were deprecated so this task in invalid.