boxlite 0.9.3

//! AppArmor profile generation for bundled bwrap.
//!
//! On Ubuntu 23.10+ with `kernel.apparmor_restrict_unprivileged_userns=1`,
//! each binary that needs user namespaces must have an AppArmor profile with
//! `allow userns`. System bwrap at `/usr/bin/bwrap` ships with this profile,
//! but our bundled bwrap at a custom path does not.
//!
//! This module generates a profile for the bundled bwrap path, mirroring
//! Ubuntu's `/etc/apparmor.d/bwrap-userns-restrict`.

use std::path::{Path, PathBuf};

/// Generate an AppArmor profile for a bwrap binary at the given path.
///
/// Mirrors Ubuntu's `/etc/apparmor.d/bwrap-userns-restrict` but with:
/// - The bundled bwrap's absolute path (instead of `/usr/bin/bwrap`)
/// - Unique profile names (`boxlite_bwrap` / `boxlite_unpriv_bwrap`)
///   to avoid collision with the system's `bwrap` profile
///
/// The profile grants `allow userns` which is required on systems with
/// `kernel.apparmor_restrict_unprivileged_userns=1`.
pub(crate) fn generate_bwrap_profile(bwrap_path: &Path) -> String {
    let abs_path = bwrap_path
        .canonicalize()
        .unwrap_or_else(|_| bwrap_path.to_path_buf());

    format!(
        r#"# Auto-generated by BoxLite for bundled bwrap.
# Load with: sudo apparmor_parser -r <this_file>
# Remove with: sudo apparmor_parser -R <this_file>

abi <abi/4.0>,

include <tunables/global>

profile boxlite_bwrap {path} flags=(attach_disconnected,mediate_deleted) {{
  allow capability,
  allow file rwlkm /{{**,}},
  allow network,
  allow unix,
  allow ptrace,
  allow signal,
  allow mqueue,
  allow io_uring,
  allow userns,
  allow mount,
  allow umount,
  allow pivot_root,
  allow dbus,

  # Stacked child profile for no-new-privs (bwrap uses PR_SET_NO_NEW_PRIVS)
  allow pix /** -> &boxlite_bwrap//&boxlite_unpriv_bwrap,
}}

# Child profile strips capabilities within the user namespace
profile boxlite_unpriv_bwrap flags=(attach_disconnected,mediate_deleted) {{
  allow file rwlkm /{{**,}},
  allow network,
  allow unix,
  allow ptrace,
  allow signal,
  allow mqueue,
  allow io_uring,
  allow userns,
  allow mount,
  allow umount,
  allow pivot_root,
  allow dbus,

  allow pix /** -> &boxlite_unpriv_bwrap,

  audit deny capability,
}}
"#,
        path = abs_path.display()
    )
}

/// Write the generated AppArmor profile to `{apparmor_dir}/boxlite-bwrap`.
///
/// The caller provides the output directory. Creates it if needed.
/// Returns the path to the written file, which the caller can include
/// in diagnostics for `sudo apparmor_parser -r`.
pub(crate) fn write_bwrap_profile(
    bwrap_path: &Path,
    apparmor_dir: &Path,
) -> Result<PathBuf, String> {
    std::fs::create_dir_all(apparmor_dir).map_err(|e| {
        format!(
            "failed to create AppArmor profile directory {}: {}",
            apparmor_dir.display(),
            e
        )
    })?;

    let profile_path = apparmor_dir.join("boxlite-bwrap");
    let profile_content = generate_bwrap_profile(bwrap_path);

    std::fs::write(&profile_path, &profile_content).map_err(|e| {
        format!(
            "failed to write AppArmor profile to {}: {}",
            profile_path.display(),
            e
        )
    })?;

    tracing::info!(
        profile_path = %profile_path.display(),
        bwrap_path = %bwrap_path.display(),
        "Generated AppArmor profile for bundled bwrap"
    );

    Ok(profile_path)
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_generate_bwrap_profile_contains_path() {
        let profile = generate_bwrap_profile(Path::new("/opt/boxlite/bin/bwrap"));
        assert!(profile.contains("/opt/boxlite/bin/bwrap"));
        assert!(profile.contains("profile boxlite_bwrap"));
        assert!(profile.contains("allow userns"));
    }

    #[test]
    fn test_generate_bwrap_profile_unique_names() {
        let profile = generate_bwrap_profile(Path::new("/usr/local/bin/bwrap"));
        // Should use boxlite_ prefix, not clash with system "bwrap" profile
        assert!(profile.contains("boxlite_bwrap"));
        assert!(profile.contains("boxlite_unpriv_bwrap"));
        assert!(profile.contains("audit deny capability"));
    }

    #[test]
    fn test_generate_bwrap_profile_valid_syntax() {
        let profile = generate_bwrap_profile(Path::new("/tmp/test-bwrap"));
        // Verify required AppArmor syntax elements
        assert!(profile.contains("abi <abi/4.0>"));
        assert!(profile.contains("include <tunables/global>"));
        assert!(profile.contains("flags=(attach_disconnected,mediate_deleted)"));
        assert!(profile.contains("allow pix /** -> &boxlite_bwrap//&boxlite_unpriv_bwrap"));
    }
}