Overview

Misconfigured AppArmor profiles is one of the most effective ways to break someone's system. This section present the various tests applied to the profiles as well as their current stage of deployment.

Current

  • Build: just complain

    • Build the profiles for all supported distributions.
    • All CI jobs validate the profiles syntax and ensure they can be safely loaded into a kernel.
    • Ensure the profile entry point (@{exec_path}) is defined.

  • Checks: just check checks basic style of profiles:

    • Ensure apparmor.d header & licence
    • Ensure 2 spaces indentation
    • Ensure local include for profile and subprofiles
    • Ensure abi 4 is used
    • Ensure modern profile naming
    • Ensure vim:syntax=apparmor

  • Integration Tests: just test-run <dist> <flavor>

    • Run simple CLI commands to ensure no logs are raised.
    • Uses the bats test system.
    • Run in the Github Action as well as in all local test VM.

Plan

For more complex software suite, more integration tests need to be done. The plan is to run existing integration suite from these very software in an environment with apparmor.d profiles.