parser vs. rc.apparmor.function: inconsistent handling of XBPS conffile artifacts

[intrigeri]

https://gitlab.com/apparmor/apparmor/merge_requests/230 made rc.apparmor.functions skip XBPS conffile artifacts. So far so good. But the parser was not updated to do so (presumably because the added pattern is not a hard-coded suffix but a regexp so it was not a trivial change).

This creates two issues:

1. Running the parser on the profiles directory, to load profiles in batch and benefit from parallelization, has different behaviour (when XBPS conffile artifacts are present) from loading profiles via rc.apparmor.functions.

2. We're stuck with old cruft from rc.apparmor.functions that cannot be cleaned up anymore. E.g. to make Debian/Ubuntu drop their own profiles loading code in favour of the upstream one (https://bugs.debian.org/870697) I need to start by cleaning up obsolete stuff, e.g. all the code in rc.apparmor.functions that now duplicates the parser's functionality, which includes skipping such special files. This would be easy if we had no code in rc.apparmor.functions that does almost, but not quite, the same thing as what the parser does.

So I propose the following:

1. Short-term, we revert https://gitlab.com/apparmor/apparmor/merge_requests/230, that was merged too hastily IMO: even ignoring the fact that this MR introduced a syntax error, it broke the synchronization between the parser's list of skippable profiles and rc.apparmor.functions', which is a regression. If Void Linux does not care about that synchronization, they can carry the reverted/deleted bits as part of their distro delta.

2. Long-term, whoever wants to support skippable profile patterns and not merely suffixes should do add this support to the parser. Likely the corresponding shell code won't be there anymore anyway.

Thoughts?

[intrigeri (intrigeri)]

parser/apparmor_parser.pod and the is_skippable_file function in utils/apparmor/aa.py also need to be updated for XBPS patterns to be fully implemented in a consistent manner.

[intrigeri (intrigeri)]

> E.g. to make Debian/Ubuntu drop their own profiles loading code in favour of the upstream one (https://bugs.debian.org/870697) I need to start by cleaning up obsolete stuff, e.g. all the code in rc.apparmor.functions that now duplicates the parser's functionality, which includes skipping such special files. This would be easy if we had no code in rc.apparmor.functions that does almost, but not quite, the same thing as what the parser does.

Scratch that, due to #1377338 we need the shell version anyway :/
So this bug is actually not blocking my work.

[Christian Boltz (cboltz)]

I agree that (from upstream POV) keeping everything in sync is worth more than skipping Void Linux backup files, so if I see a merge request that comments out that section and adds a "TODO: get parser and tools in sync, see lp#1800644 for details", I'll probably accept it ;-)

Another (admittedly evil) way is to ignore this issue for now, wait until Void ships that code to their users, and then open a bugreport in the Void bugtracker that "apparmor_parser -r /etc/apparmor.d/" loads an outdated profile from the backup file *eg*