Add aa-install to manage profiles

.github/workflows/main.yml

@@ -2,12 +2,15 @@ name: Ubuntu
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions:
+  contents: read
+
 jobs:
   check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install linter dependencies
         run: |
@@ -24,28 +27,33 @@ jobs:
     strategy:
       matrix:
         include:
-          - os: ubuntu-24.04
+          - os: ubuntu-26.04
             mode: default
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Install Build dependencies
         run: |
           sudo apt-get update -q
           sudo apt-get install -y \
-            devscripts debhelper config-package-dev \
+            devscripts debhelper \
             auditd apparmor-profiles apparmor-utils
           pipx install rust-just
           echo "$HOME/.local/bin" >> $GITHUB_PATH
-          sudo rm /etc/apparmor.d/usr.lib.snapd.snap-confine.real
+          sudo rm -f /etc/apparmor.d/usr.lib.snapd.snap-confine.real
 
       - name: Build the apparmor.d package
         run: |
           just build-dpkg
 
       - name: Install apparmor.d
-        run: sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true
+        run: |
+            sudo dpkg --install .pkg/apparmor.d*.deb || true
+            sudo aa-install --install --all
+
+      - name: Show the installation status
+        run: sudo aa-install --status
 
       - name: Reload AppArmor
         run: |
@@ -63,29 +71,29 @@ jobs:
       - name: Show Number of loaded profile
         run: sudo aa-status --profiled
 
-      - name: Cache the build package
-        if: matrix.mode == 'default' && matrix.os == 'ubuntu-24.04'
-        uses: actions/cache/save@v4
+      - name: Cache the build packages
+        if: matrix.mode == 'default' && matrix.os == 'ubuntu-26.04'
+        uses: actions/cache/save@v6
         with:
-          path: .pkg/apparmor.d_*_amd64.deb
-          key: ${{ matrix.os }}-${{ matrix.mode }}-${{ hashFiles('.pkg/apparmor.d_*_amd64.deb') }}
+          path: .pkg/apparmor.d*.deb
+          key: ${{ matrix.os }}-${{ matrix.mode }}-${{ hashFiles('.pkg/apparmor.d*.deb') }}
 
   tests:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs: build
     if: github.ref_name == 'dev' || github.event_name == 'workflow_dispatch'
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
-      - name: Restore the cached build package
-        uses: actions/cache/restore@v4
+      - name: Restore the cached build packages
+        uses: actions/cache/restore@v6
         with:
           fail-on-cache-miss: true
-          path: .pkg/apparmor.d_*_amd64.deb
-          key: ubuntu-24.04-default-${{ hashFiles('.pkg/apparmor.d_*_amd64.deb') }}
+          path: .pkg/apparmor.d*.deb
+          key: ubuntu-26.04-default-${{ hashFiles('.pkg/apparmor.d*.deb') }}
           restore-keys: |
-            ubuntu-24.04-default-
+            ubuntu-26.04-default-
 
       - name: Install Tests dependencies
         run: |
@@ -98,7 +106,8 @@ jobs:
 
       - name: Install apparmor.d
         run: |
-          sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true
+          sudo dpkg --install .pkg/apparmor.d*.deb || true
+          sudo aa-install --install --all
           sudo systemctl restart apparmor.service
           sudo systemctl daemon-reload
           systemctl --user daemon-reload

.gitlab-ci.yml

@@ -23,7 +23,7 @@ bash:
     - shellcheck --shell=bash
         PKGBUILD dists/*.sh tests/check.sh
         tests/packer/*.sh tests/packer/src/aa-update
-        tests/autopkgtest/autopkgtest.sh debian/common.postinst debian/common.postrm
+        tests/autopkgtest/autopkgtest.sh debian/apparmor.d.postinst debian/apparmor.d.postrm
 
 golangci-lint:
   stage: lint
@@ -142,7 +142,7 @@ preprocess-debian:
   script:
     - apt-get update -q
     - apt-get install -y apparmor apparmor-profiles
-    - dpkg --install $PKGDEST/${PKGNAME}_*
+    - dpkg --install $PKGDEST/${PKGNAME}*.deb
     - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null
 
 preprocess-ubuntu:
@@ -153,7 +153,7 @@ preprocess-ubuntu:
   script:
     - apt-get update -q
     - apt-get install -y apparmor apparmor-profiles
-    - dpkg --install $PKGDEST/${PKGNAME}_*
+    - dpkg --install $PKGDEST/${PKGNAME}*.deb
     - apparmor_parser --preprocess /etc/apparmor.d 1> /dev/null
 
 preprocess-opensuse:

Justfile

@@ -92,6 +92,7 @@ help:
 # Build the go programs
 [group('build')]
 build:
+	@go build -o {{build}}/ ./cmd/aa-install
 	@go build -o {{build}}/ ./cmd/aa-log
 	@go build -o {{build}}/ ./cmd/aa-mode
 	@go build -o {{build}}/ ./cmd/prebuild
@@ -150,6 +151,7 @@ install-base:
 install-tools:
 	#!/usr/bin/env bash
 	set -eu -o pipefail
+	install -Dm0755 {{build}}/aa-install {{destdir}}/usr/bin/aa-install
 	install -Dm0755 {{build}}/aa-log {{destdir}}/usr/bin/aa-log
 	install -Dm0755 {{build}}/aa-mode {{destdir}}/usr/bin/aa-mode
 	mapfile -t share < <(find "{{build}}/share" -type f -not -name "*.md" -not -name "*aa-flatpak*" -printf "%P\n")
@@ -168,18 +170,12 @@ install-aa-flatpak:
 
 # Install prebuilt profiles
 [group('install')]
-install-prebuilt:
+install-prebuilt: _install-fixup
 	#!/usr/bin/env bash
 	set -eu -o pipefail
 	mapfile -t aa < <(find "{{build}}/apparmor.d" -type f -not -path "*/abstractions/*" -not -path "*/tunables/*" -printf "%P\n")
 	for file in "${aa[@]}"; do
-		#install -Dm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/usr/share/apparmor.d/$file"
-		install -Dm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file"
-	done
-	mapfile -t links < <(find "{{build}}/apparmor.d" -type l -printf "%P\n")
-	for file in "${links[@]}"; do
-		mkdir -p "{{destdir}}/etc/apparmor.d/disable"
-		cp -d "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file"
+		install -Dm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/usr/share/apparmor.d/$file"
 	done
 	for file in "{{build}}/systemd/system/"*; do
 		service="$(basename "$file")"
@@ -190,20 +186,22 @@ install-prebuilt:
 		install -Dm0644 "$file" "{{destdir}}/usr/lib/systemd/user/$service.d/apparmor.conf"
 	done
 
+# Ensure profiles compatibility with upstream
+[group('install')]
+_install-fixup:
+	# The hostname profile fully conflicts with apparmor.d and must be disabled
+	@mkdir -p "{{destdir}}/etc/apparmor.d/disable"
+	@ln -sf ../hostname "{{destdir}}/etc/apparmor.d/disable/hostname"
+
 # Install prebuild profiles
 [group('install')]
-install: install-tools
+install: install-tools _install-fixup
 	#!/usr/bin/env bash
 	set -eu -o pipefail
 	mapfile -t aa < <(find "{{build}}/apparmor.d" -type f -printf "%P\n")
 	for file in "${aa[@]}"; do
 		install -Dm0644 "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file"
 	done
-	mapfile -t links < <(find "{{build}}/apparmor.d" -type l -printf "%P\n")
-	for file in "${links[@]}"; do
-		mkdir -p "{{destdir}}/etc/apparmor.d/disable"
-		cp -d "{{build}}/apparmor.d/$file" "{{destdir}}/etc/apparmor.d/$file"
-	done
 	for file in "{{build}}/systemd/system/"*; do
 		service="$(basename "$file")"
 		install -Dm0644 "$file" "{{destdir}}/usr/lib/systemd/system/$service.d/apparmor.conf"
@@ -295,22 +293,26 @@ build-rpm: (_ensure_pkgdest)
 # Build & install apparmor.d on Arch based systems
 [group('packages')]
 pkg: build-pkg
-	@sudo pacman -U --noconfirm \
-		{{pkgdest}}/{{pkgname}}-`just version`*.pkg.tar* \
-		{{pkgdest}}/{{pkgname}}-base-`just version`*.pkg.tar* \
-		{{pkgdest}}/{{pkgname}}-tools-`just version`*.pkg.tar*
+	#!/usr/bin/env bash
+	shopt -s extglob
+	sudo pacman -U --noconfirm \
+		{{pkgdest}}/{{pkgname}}?(-base|-tools)-$(just version)*.pkg.tar!(*.sig)
 
 # Build & install apparmor.d on Debian based systems
 [group('packages')]
-dpkg name="": build-dpkg
+dpkg: build-dpkg
 	@sudo dpkg -i  \
-		{{pkgdest}}/{{pkgname}}{{ if name != "" { "." + name } else { "" } }}_`just version`*.deb
+		{{pkgdest}}/{{pkgname}}_`just version`*.deb \
+		{{pkgdest}}/{{pkgname}}-base_`just version`*.deb \
+		{{pkgdest}}/{{pkgname}}-tools_`just version`*.deb
 
 # Build & install apparmor.d on OpenSUSE based systems
 [group('packages')]
 rpm: build-rpm
 	@sudo rpm -ivh --force \
-		{{pkgdest}}/{{pkgname}}-`just version`*.rpm
+		{{pkgdest}}/{{pkgname}}-`just version`-*.rpm \
+		{{pkgdest}}/{{pkgname}}-base-`just version`-*.rpm \
+		{{pkgdest}}/{{pkgname}}-tools-`just version`-*.rpm
 
 # Run the linters
 [group('linter')]
@@ -321,7 +323,7 @@ lint:
 	shellcheck --shell=bash \
 		PKGBUILD dists/*.sh tests/check.sh \
 		tests/packer/*.sh tests/packer/src/aa-update \
-		tests/autopkgtest/autopkgtest.sh debian/common.postinst debian/common.postrm
+		tests/autopkgtest/autopkgtest.sh debian/apparmor.d.postinst debian/apparmor.d.postrm
 
 # Run style checks on the profiles
 [group('linter')]
@@ -331,6 +333,7 @@ check:
 # Generate the man pages
 [group('docs')]
 man:
+	@pandoc -t man -s -o share/man/man1/aa-install.1 share/man/man1/aa-install.md
 	@pandoc -t man -s -o share/man/man1/aa-mode.1 share/man/man1/aa-mode.md
 	@pandoc -t man -s -o share/man/man8/aa-log.8 share/man/man8/aa-log.md
 
@@ -352,8 +355,9 @@ serve:
 # Remove all build artifacts
 clean:
 	@rm -rf \
-		debian/.debhelper debian/debhelper* debian/*.debhelper debian/{{pkgname}}* \
-		debian/*.substvars debian/*.debhelper debian/files \
+		debian/.debhelper debian/debhelper* debian/*.debhelper debian/{{pkgname}}/ \
+		debian/{{pkgname}}-base/ debian/{{pkgname}}-tools/ \
+		debian/*.substvars debian/*.debhelper debian/*.debhelper.log debian/files \
 		{{pkgdest}}/{{pkgname}}* {{pkgdest}}/ubuntu {{pkgdest}}/debian \
 		{{pkgdest}}/archlinux {{pkgdest}}/opensuse \
 		{{build}} coverage.out .logs/autopkgtest/ site .cache

PKGBUILD

@@ -30,8 +30,7 @@ build() {
   export GOPATH="${srcdir}"
   export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw -tags=dev"
   export DISTRIBUTION=arch
-  just complain
-#   just prebuild
+  just prebuild
   # just build-aa-flatpak
 }
 

apparmor.d/abstractions/audio-client

@@ -48,6 +48,7 @@
   owner @{HOME}/.pulse-cookie rwk,
 
   owner @{user_cache_dirs}/event-sound-cache.tdb.@{hex32}.@{multiarch} rwk,  # libcanberra
+  owner @{user_cache_dirs}/event-sound-cache.tdb.*.@{multiarch} rwk, # TODO: hostname
 
   owner @{user_config_dirs}/pulse/ rw,
   owner @{user_config_dirs}/pulse/client.conf r,

apparmor.d/abstractions/common/electron

@@ -33,6 +33,8 @@
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
 
+  unix (send receive) type=seqpacket peer=(label=@{name}//crashpad_handler),
+
   @{bin}/xdg-mime rix,
   @{bin}/xdg-settings rix,
 

apparmor.d/abstractions/ibus-strict

@@ -6,6 +6,12 @@
 
   abi <abi/5.0>,
 
+  owner @{desktop_config_dirs}/ibus/bus/ r,
+  owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-@{int} r,
+  owner @{desktop_config_dirs}/ibus/bus/@{hex32}-unix-wayland-@{int} r,
+  owner @{desktop_config_dirs}/ibus/bus/machine-id-unix-@{int} r,
+  owner @{desktop_config_dirs}/ibus/bus/machine-id-unix-wayland-@{int} r,
+
   owner @{user_cache_dirs}/ibus/dbus-@{rand8} rw,
 
   owner @{user_config_dirs}/ibus/ r,

apparmor.d/abstractions/journal-read

@@ -0,0 +1,21 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2026 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Read only access to journalctl binary log files
+
+  abi <abi/5.0>,
+
+  /etc/machine-id r,
+  /var/lib/dbus/machine-id r,
+
+  /{run,var}/log/journal/ r,
+  /{run,var}/log/journal/system.journal r,
+  /{run,var}/log/journal/system@@{hex16}-@{hex16}.journal~ r,
+  /{run,var}/log/journal/system@@{hex32}-@{hex16}-@{hex16}.journal r,
+  /{run,var}/log/journal/user-@{uid}.journal r,
+  /{run,var}/log/journal/user-@{uid}@@{hex16}-@{hex16}.journal~ r,
+
+  include if exists <abstractions/journal-read.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/nss

@@ -15,6 +15,12 @@
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
   owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
 
+  owner @{user_share_dirs}/pki/ rw,
+  owner @{user_share_dirs}/pki/nssdb/ rw,
+  owner @{user_share_dirs}/pki/nssdb/pkcs11.txt rw,
+  owner @{user_share_dirs}/pki/nssdb/{cert9,key4}.db rwk,
+  owner @{user_share_dirs}/pki/nssdb/{cert9,key4}.db-journal rw,
+
   include if exists <abstractions/nss.d>
 
 # vim:syntax=apparmor

apparmor.d/abstractions/python.d/complete

@@ -16,9 +16,9 @@
 
   #aa:only apparmor>=4.1
   # Normal python run do not need to update pycache files. It is done by pycompile.
-  audit @{lib}/@{python_name}/{,**/}__pycache__/ w,
-  audit @{lib}/@{python_name}/{,**/}__pycache__/**.pyc w,
-  audit @{lib}/@{python_name}/{,**/}__pycache__/**.pyc.@{u64} w,
+  @{lib}/@{python_name}/{,**/}__pycache__/ w,
+  @{lib}/@{python_name}/{,**/}__pycache__/**.pyc w,
+  @{lib}/@{python_name}/{,**/}__pycache__/**.pyc.@{u64} w,
 
   #aa:only test
   owner /tmp/pytest-of-user/ rw,