script to add a hat to a profile

[Christian Boltz]

I'm using a script to add hats for each vhost in my apache profile (attached for reference).

This works, but it uses some ugly sed tricks (for example, it removes ^}$ from the profile) to work. This also means that it might break a manually edited profile if someone removed the whitespace in front of } of a hat.

It would be much better to have an aa-addhat script that can add a hat with a given ruleset to a profile and "understands" the profile language (like logprof/genprof do) so that it doesn't need to do sed tricks ;-)

The syntax {c,sh}ould be something like

aa-addhat /usr/sbin/httpd2-prefork vhost_foo " #include <abstractions/vhost_foo>
    /home/www/foo/httpdocs/uploads/** rw,"

(yes, the last parameter can be multiline)

[Lutz-Peter Hooge (lphooge)]

Here is my solution, not a general tool for adding hats to profiles, but specifically for generating hats from apache-vhosts and also adding small config snippets that can be included in the corresponding vhosts.

php-cli is needed for the script, but if you need this you probably have that installed anyway

[Christian Boltz (cboltz)]

A nicer method to do this is to create a profile with the hat you want to add, for example:

# cat /tmp/hat-to-add

/foo {
    ^hat_to_add {
        ...
    }
}

and then use
    aa-mergeprof /tmp/hat-to-add
to merge it into the existing profile in /etc/apparmor.d.