https://gitlab.com/apparmor/apparmor/merge_requests/230 made rc.apparmor.functions skip XBPS conffile artifacts. So far so good. But the parser was not updated to do so (presumably because the added pattern is not a hard-coded suffix but a regexp so it was not a trivial change).
This creates two issues:
1. Running the parser on the profiles directory, to load profiles in batch and benefit from parallelization, has different behaviour (when XBPS conffile artifacts are present) from loading profiles via rc.apparmor.functions.
2. We're stuck with old cruft from rc.apparmor.functions that cannot be cleaned up anymore. E.g. to make Debian/Ubuntu drop their own profiles loading code in favour of the upstream one (https://bugs.debian.org/870697) I need to start by cleaning up obsolete stuff, e.g. all the code in rc.apparmor.functions that now duplicates the parser's functionality, which includes skipping such special files. This would be easy if we had no code in rc.apparmor.functions that does almost, but not quite, the same thing as what the parser does.
So I propose the following:
1. Short-term, we revert https://gitlab.com/apparmor/apparmor/merge_requests/230, that was merged too hastily IMO: even ignoring the fact that this MR introduced a syntax error, it broke the synchronization between the parser's list of skippable profiles and rc.apparmor.functions', which is a regression. If Void Linux does not care about that synchronization, they can carry the reverted/deleted bits as part of their distro delta.
2. Long-term, whoever wants to support skippable profile patterns and not merely suffixes should do add this support to the parser. Likely the corresponding shell code won't be there anymore anyway.
Thoughts?
parser/ apparmor_ parser. pod and the is_skippable_file function in utils/apparmor/ aa.py also need to be updated for XBPS patterns to be fully implemented in a consistent manner.