{"id":19054912,"url":"https://github.com/solus-project/aa-lsm-hook","last_synced_at":"2025-04-24T03:28:41.993Z","repository":{"id":145851334,"uuid":"119711325","full_name":"solus-project/aa-lsm-hook","owner":"solus-project","description":"Distro integration hooks for AppArmor LSM","archived":false,"fork":false,"pushed_at":"2018-10-18T18:03:13.000Z","size":92,"stargazers_count":2,"open_issues_count":1,"forks_count":4,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-18T12:18:06.760Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/solus-project.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-01-31T16:15:12.000Z","updated_at":"2020-03-09T04:08:27.000Z","dependencies_parsed_at":"2023-05-18T11:30:30.976Z","dependency_job_id":null,"html_url":"https://github.com/solus-project/aa-lsm-hook","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solus-project%2Faa-lsm-hook","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solus-project%2Faa-lsm-hook/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solus-project%2Faa-lsm-hook/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/solus-project%2Faa-lsm-hook/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/solus-project","download_url":"https://codeload.github.com/solus-project/aa-lsm-hook/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250554859,"owners_count":21449700,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T23:40:22.542Z","updated_at":"2025-04-24T03:28:41.983Z","avatar_url":"https://github.com/solus-project.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aa-lsm-hook\n\n[![License](https://img.shields.io/badge/License-GPL%202.0-blue.svg)](https://opensource.org/licenses/GPL-2.0)\n\n`aa-lsm-hook` is a simple project to provide distro integration points for the AppArmor LSM. The core goal is to simplify said integration by means of simple binaries that can be called on boot and during package transactions when the apparmor profiles reload. The net result is ahead-of-time compilation for AppArmor profiles (using `apparmor_parser`) and avoiding boot time regressions by loading only from a cache.\n\nIf the cache is invalid or unable to load, it will be recompiled, to ensure that the boot time performance hit is very rare (i.e. kernel or parser ABI changed without cache recompilation using those ABIs).\n\n`aa-lsm-hook` is a [Solus project](https://solus-project.com/)\n\n![logo](https://build.solus-project.com/logo.png)\n\n## What/Why even\n\nThis project was created to provide a reusable AppArmor integration hook for any distribution that wants it. The issue in Solus was the use of legacy bash scripts to\nmanage the lifetime of AppArmor profiles, and massive boot time regressions. With local testing and a working AoT cache we go from 1.3s to around 8ms load on my local\ntest machine.\n\nNote that this project isn't doing any \"magic\". Simply it provides well defined load and compile steps that wrap `apparmor_parser`, with some basic logic for garbage\ncollection and ensuring invalidated caches don't cause failed boots. The focus is on management and boot time.\n\n## Integration\n\nThe `aa-lsm-hook.service` systemd unit should be enabled instead of any provided `apparmor.service` style init. This will ensure our hook is run during early boot,\nwhich will load **only** from the binary cache. Note this requires that a binary cache is actually present, so be sure to compile it ahead of time.\n\nTo integrate the compilation step, you'll need a hook in your package manager/update process to execute `aa-lsm-hook-compile` when the apparmor paths change on\ndisk, i.e. `/etc/apparmor.d`.\n\n## Quirks\n\nCurrently we have a special-case path to compile the `snapd` profiles from `/var/lib/snapd/apparmor/profiles` into the cache if they exist, which ensures the binary\nload step will work properly on boot. Without this quirk/workaround, the snapd AppArmor profiles wouldn't be loaded **until** `snapd` is directly started and causes\nbroken snaps. With this .. quirk, everything works correctly, boot time is not regressed, and snaps work for those that have them.\n\n## Authors\n\nCopyright © 2018 Solus Project\n\n`aa-lsm-hook` is available under the terms of the `GPL-2.0` license.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsolus-project%2Faa-lsm-hook","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsolus-project%2Faa-lsm-hook","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsolus-project%2Faa-lsm-hook/lists"}