feat(selftest): report AppArmor, and ask for docker-default by name

docker-default is what AppArmor is here for - it is the only thing
confining the application container, and dockerd loads it silently or not
at all. The check fails on an LSM that is off, on a missing
docker-default, and on one loaded in complain mode, where it would look
present and confine nothing. Skipped in a container, like subvolumes and
network.

Tests: 43 pass, shellcheck clean. Never run on a booted system.
Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz-work

installer-factory/prepare_iso.sh

@@ -20,11 +20,7 @@ mv "/boot/vmlinuz"-* "${ISO_DIR}/boot/vmlinuz"
 mv "${INITRD_IMAGE}" "${ISO_DIR}/boot/initrd.img"
 
 # Create grub config
-#
-# The installer keeps apparmor=0 while the system image boots with apparmor=1.
-# This image is not the system image: it carries no apparmor package, so there
-# is no profile to load and no apparmor.service to load one. Switching the LSM
-# on here would confine nothing and could only cost an installation.
+# apparmor=0, unlike the system image: this one has no apparmor package.
 cat <<EOF >"${ISO_DIR}/boot/grub/grub.cfg"
 set timeout=0
 set default=0

system/Dockerfile

@@ -90,9 +90,7 @@ RUN sed -i 's/^Components: main$/Components: main non-free-firmware/' /etc/apt/s
   && systemctl disable hv-vss-daemon.service \
   && systemctl enable systemd-timesyncd.service \
   && systemctl enable apparmor.service \
-  ## AppArmor mediates the resolved path, and /var/lib/dhcp below is a \
-  ## symlink into /data - without this rule the stock dhclient profile \
-  ## denies dhclient its own lease file \
+  ## /var/lib/dhcp is a symlink into /data, and AppArmor sees the resolved path \
   && printf "/data/dhcp/ r,\n/data/dhcp/dhclient* lrw,\n" >>/etc/apparmor.d/local/usr.sbin.dhclient \
   && systemctl mask ssh.socket \
   && systemctl mask sshd-keygen.service \

system/Dockerfile.lxc

@@ -16,8 +16,7 @@ RUN echo "Cache buster: v1" \
   ## cuos system dependencies (lxc) \
   busybox-static \
   ## cuos os dependencies \
-  # AppArmor profiles are loaded into the host's kernel, and a container \
-  # cannot load its own. Confining an LXC guest is the host's business. \
+  # A container cannot load profiles - that is the LXC host's business \
   #-apparmor \
   #-btrfs-progs \
   dbus \

system/Dockerfile.orangepi-zero3

@@ -113,9 +113,7 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
   && apt-get clean && rm -rf /var/lib/apt/lists/* \
   && systemctl enable systemd-timesyncd.service \
   && systemctl enable apparmor.service \
-  ## AppArmor mediates the resolved path, and /var/lib/dhcp below is a \
-  ## symlink into /data - without this rule the stock dhclient profile \
-  ## denies dhclient its own lease file \
+  ## /var/lib/dhcp is a symlink into /data, and AppArmor sees the resolved path \
   && printf "/data/dhcp/ r,\n/data/dhcp/dhclient* lrw,\n" >>/etc/apparmor.d/local/usr.sbin.dhclient \
   && systemctl mask ssh.socket \
   && systemctl mask sshd-keygen.service \

system/Dockerfile.rpi-arm32

@@ -152,9 +152,7 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
   && apt-get clean && rm -rf /var/lib/apt/lists/* \
   && systemctl enable systemd-timesyncd.service \
   && systemctl enable apparmor.service \
-  ## AppArmor mediates the resolved path, and /var/lib/dhcp below is a \
-  ## symlink into /data - without this rule the stock dhclient profile \
-  ## denies dhclient its own lease file \
+  ## /var/lib/dhcp is a symlink into /data, and AppArmor sees the resolved path \
   && printf "/data/dhcp/ r,\n/data/dhcp/dhclient* lrw,\n" >>/etc/apparmor.d/local/usr.sbin.dhclient \
   && systemctl mask ssh.socket \
   && systemctl mask sshd-keygen.service \

system/Dockerfile.rpi-arm64

@@ -133,9 +133,7 @@ RUN apt-get update && apt-get install --no-install-recommends -y \
   && apt-get clean && rm -rf /var/lib/apt/lists/* \
   && systemctl enable systemd-timesyncd.service \
   && systemctl enable apparmor.service \
-  ## AppArmor mediates the resolved path, and /var/lib/dhcp below is a \
-  ## symlink into /data - without this rule the stock dhclient profile \
-  ## denies dhclient its own lease file \
+  ## /var/lib/dhcp is a symlink into /data, and AppArmor sees the resolved path \
   && printf "/data/dhcp/ r,\n/data/dhcp/dhclient* lrw,\n" >>/etc/apparmor.d/local/usr.sbin.dhclient \
   && systemctl mask ssh.socket \
   && systemctl mask sshd-keygen.service \

system/cuos/selftest.sh

@@ -80,6 +80,15 @@ listening_on() {
   ss -ltn 2>/dev/null | grep -qE "[:.]$1[[:space:]]"
 }
 
+apparmor_enabled() {
+  [[ "$(cat /sys/module/apparmor/parameters/enabled 2>/dev/null)" == "Y" ]]
+}
+
+# "<profile> (<mode>)" per line, for every profile loaded into the kernel.
+apparmor_profiles() {
+  cat /sys/kernel/security/apparmor/profiles 2>/dev/null
+}
+
 # How many cuos journal entries of priority error or worse this boot produced.
 journal_errors() {
   journalctl -t cuos -b -p 3 --no-pager -o cat 2>/dev/null | grep -c . || true
@@ -177,6 +186,35 @@ check_docker() {
   failed "docker" "docker is not responding"
 }
 
+# docker-default is the only thing confining the application container, and
+# both ways of losing it - the LSM off, or dockerd never loading the profile -
+# are silent. So it is asked for by name.
+check_apparmor() {
+  if is_container; then
+    skipped "apparmor" "profiles belong to the host's kernel; a container loads none of its own"
+    return
+  fi
+  if ! apparmor_enabled; then
+    failed "apparmor" "the kernel has AppArmor off - check apparmor=1 on the command line"
+    return
+  fi
+
+  local profiles count mode
+  profiles="$(apparmor_profiles)"
+  count="$(grep -c . <<<"${profiles}")"
+  mode="$(sed -n 's/^docker-default (\(.*\))$/\1/p' <<<"${profiles}")"
+
+  if [[ -z "${mode}" ]]; then
+    failed "apparmor" "dockerd loaded no docker-default; profiles in the kernel: ${count}"
+    return
+  fi
+  if [[ "${mode}" != "enforce" ]]; then
+    failed "apparmor" "docker-default is in ${mode} mode, so it confines nothing"
+    return
+  fi
+  ok "apparmor" "${count} profiles loaded, docker-default enforcing"
+}
+
 check_app() {
   local status
   status="$(container_state "${APP_CONTAINER}")"
@@ -278,6 +316,7 @@ selftest() {
   check_subvolumes
   check_state
   check_docker
+  check_apparmor
   check_app
   check_network
   check_hostname

system/cuos/selftest.test.sh

@@ -33,6 +33,10 @@ MOCK_DOCKER_OK=0
 MOCK_APP_STATE="running"
 MOCK_LISTENING=0
 MOCK_JOURNAL_ERRORS=0
+MOCK_APPARMOR_ENABLED=0
+MOCK_APPARMOR_PROFILES="docker-default (enforce)
+/usr/sbin/dhclient (enforce)
+unix-chkpwd (enforce)"
 
 virt_type() { echo "${MOCK_VIRT}"; }
 subvolumes() { echo "${MOCK_SUBVOLUMES}"; }
@@ -42,6 +46,8 @@ docker_ok() { return "${MOCK_DOCKER_OK}"; }
 container_state() { echo "${MOCK_APP_STATE}"; }
 listening_on() { return "${MOCK_LISTENING}"; }
 journal_errors() { echo "${MOCK_JOURNAL_ERRORS}"; }
+apparmor_enabled() { return "${MOCK_APPARMOR_ENABLED}"; }
+apparmor_profiles() { echo "${MOCK_APPARMOR_PROFILES}"; }
 
 # A healthy system, which each test then breaks in exactly one way.
 reset_system() {
@@ -56,6 +62,10 @@ reset_system() {
   MOCK_APP_STATE="running"
   MOCK_LISTENING=0
   MOCK_JOURNAL_ERRORS=0
+  MOCK_APPARMOR_ENABLED=0
+  MOCK_APPARMOR_PROFILES="docker-default (enforce)
+/usr/sbin/dhclient (enforce)
+unix-chkpwd (enforce)"
 
   cat >"${CONFIG_PATH}" <<'EOF'
 {
@@ -151,6 +161,36 @@ expect "state: anything but running fails" "failed" status_of state is_updating
 break_docker() { MOCK_DOCKER_OK=1; }
 expect "docker: an unresponsive daemon fails" "failed" status_of docker break_docker
 
+lsm_off() { MOCK_APPARMOR_ENABLED=1; }
+expect "apparmor: a kernel with the LSM off fails" "failed" status_of apparmor lsm_off
+expect "apparmor: the failure names the command line" \
+  "the kernel has AppArmor off - check apparmor=1 on the command line" \
+  detail_of apparmor lsm_off
+
+no_docker_default() { MOCK_APPARMOR_PROFILES="/usr/sbin/dhclient (enforce)"; }
+expect "apparmor: enabled but no docker-default fails" "failed" status_of \
+  apparmor no_docker_default
+expect "apparmor: the failure counts what did load" \
+  "dockerd loaded no docker-default; profiles in the kernel: 1" detail_of \
+  apparmor no_docker_default
+
+complaining() { MOCK_APPARMOR_PROFILES="docker-default (complain)"; }
+expect "apparmor: a complaining docker-default fails" "failed" status_of \
+  apparmor complaining
+expect "apparmor: and says it confines nothing" \
+  "docker-default is in complain mode, so it confines nothing" detail_of \
+  apparmor complaining
+
+# "docker-default-something" is a different profile, not this one.
+similar_name() { MOCK_APPARMOR_PROFILES="docker-default-old (enforce)"; }
+expect "apparmor: a profile merely starting with the name does not count" \
+  "failed" status_of apparmor similar_name
+
+expect "apparmor: a healthy system reports the count" \
+  "3 profiles loaded, docker-default enforcing" detail_of apparmor nothing
+expect "apparmor: skipped in a container" "skipped" status_of apparmor \
+  be_a_container
+
 app_exited() { MOCK_APP_STATE="exited"; }
 expect "app: a stopped application fails" "failed" status_of app app_exited
 app_missing() { MOCK_APP_STATE=""; }
@@ -193,7 +233,7 @@ expect "a skipped check does not" "true" overall be_a_container
 check_count() {
   report nothing | jq -r '.checks | length'
 }
-expect "every check reports" "11" check_count
+expect "every check reports" "12" check_count
 
 summary_adds_up() {
   report nothing | jq -r '