Skip to content

apparmor: use "filepath" instead of "path", and fix linting (gosec) #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thaJeztah merged 3 commits into from
Mar 5, 2026
Merged

apparmor: use "filepath" instead of "path", and fix linting (gosec) #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d4ddd8f
apparmor: use filepath for path handling
thaJeztah Feb 19, 2026
8d8cd75
apparmor: fix linting (gosec)
thaJeztah Feb 19, 2026
536f988
apparmor: touch-up comments
thaJeztah Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions apparmor/apparmor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import (
"io"
"os"
"os/exec"
"path"
"path/filepath"
"strings"
"text/template"
)
Expand Down Expand Up @@ -53,7 +53,7 @@ func (p *profileData) generateDefault(out io.Writer) error {

// macroExists checks if the passed macro exists.
func macroExists(m string) bool {
_, err := os.Stat(path.Join(profileDirectory, m))
_, err := os.Stat(filepath.Join(profileDirectory, m))
return err == nil
}

Expand All @@ -63,7 +63,7 @@ func InstallDefault(name string) error {
// Figure out the daemon profile.
daemonProfile := "unconfined"
if currentProfile, err := os.ReadFile("/proc/self/attr/current"); err == nil {
// Normally profiles are suffixed by " (enforcing)" or similar. AppArmor
// Normally profiles are suffixed by " (enforce)" or similar. AppArmor
// profiles cannot contain spaces so this doesn't restrict daemon profile
// names.
if profile, _, _ := strings.Cut(string(currentProfile), " "); profile != "" {
Expand All @@ -72,14 +72,14 @@ func InstallDefault(name string) error {
}

// Install to a temporary directory.
tmpFile, err := os.CreateTemp("", name)
tmpFile, err := os.CreateTemp("", "apparmor-profile-")
Copy link
Copy Markdown
Member Author

@thaJeztah thaJeztah Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think there's a need for the temp-file name to match the profile name; it's just a temporary file we use to load the profile?

if err != nil {
return err
}

defer func() {
_ = tmpFile.Close()
_ = os.Remove(tmpFile.Name())
_ = os.Remove(tmpFile.Name()) // #nosec G703 -- ignore "G703: Path traversal via taint analysis (gosec)"
}()

p := profileData{
Expand Down Expand Up @@ -110,6 +110,9 @@ func isLoaded(name string, fileName string) (bool, error) {

scanner := bufio.NewScanner(file)
for scanner.Scan() {
// Normally profiles are suffixed by " (enforce)" or similar. AppArmor
// profiles cannot contain spaces so this doesn't restrict daemon profile
// names.
if prefix, _, ok := strings.Cut(scanner.Text(), " "); ok && prefix == name {
return true, nil
}
Expand All @@ -126,7 +129,7 @@ func isLoaded(name string, fileName string) (bool, error) {
// replace the profile. The `-K` is necessary to make sure that apparmor_parser
// doesn't try to write to a read-only filesystem.
func loadProfile(profilePath string) error {
c := exec.Command("apparmor_parser", "-Kr", profilePath)
c := exec.Command("apparmor_parser", "-Kr", profilePath) // #nosec G204 G702 -- Ignore "Subprocess launched with variable (gosec)"
c.Dir = ""

if output, err := c.CombinedOutput(); err != nil {
Expand Down
5 changes: 2 additions & 3 deletions apparmor/apparmor_linux_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package apparmor
import (
"errors"
"os"
"path"
"path/filepath"
"strings"
"testing"
Expand Down Expand Up @@ -139,7 +138,7 @@ Discord (unconfined)

func TestIsLoaded(t *testing.T) {
tmpDir := t.TempDir()
profiles := path.Join(tmpDir, "apparmor_profiles")
profiles := filepath.Join(tmpDir, "apparmor_profiles")
if err := os.WriteFile(profiles, []byte(testAppArmorProfiles), 0o644); err != nil {
t.Fatal(err)
}
Expand All @@ -162,7 +161,7 @@ func TestIsLoaded(t *testing.T) {
}
})
t.Run("error", func(t *testing.T) {
_, err := isLoaded("anything", path.Join(tmpDir, "no_such_file"))
_, err := isLoaded("anything", filepath.Join(tmpDir, "no_such_file"))
if err == nil || !errors.Is(err, os.ErrNotExist) {
t.Fatalf("expected error to be os.ErrNotExist, got %v", err)
}
Expand Down
Loading