0xdeadbad · December 18, 2024 13:27 · mmustolih · Jun 5, 2024 · 0xdeadbad · Jun 5, 2024
diff --git a/00-unity-sandbox-error-ubuntu24.04.md b/00-unity-sandbox-error-ubuntu24.04.md
diff --git a/01-apparmor-addrule.sh b/01-apparmor-addrule.sh
 #!/usr/bin/env bash

 set -e

 if [ "$EUID" -ne 0 ]
  then echo "Please run as root / with sudo"
  exit
 fi


 if [[ -z "${1+x}" ]]; then
    >&2 echo "you need to pass the executable file/path as the first argument"
    exit 1
 fi

 if [[ -n "${2+x}" ]]; then
    pathchk --portability "$2"
    _APPARMOR_FILEDEST="/etc/apparmor.d/$2"
 fi

 _FILENAME="$1"

 pathchk --portability "$_FILENAME" && (which "$_FILENAME" > /dev/null || >&2 echo "could not locate path of $_FILENAME") || exit 1

 _FILEPATH="$(which "$_FILENAME")"
 FILEPATH="$(realpath "$_FILEPATH")"
 FILE_BASENAME="$(basename "$FILEPATH")"

 FILEPATH_SANITIZED="${FILEPATH// /\\ /}"
 FILE_BASENAME_SANITIZED="${FILE_BASENAME// /\\ /}"

 if [[ -z "${2+x}" ]]; then
    _APPARMOR_FILEDEST="/etc/apparmor.d/$FILE_BASENAME"
 fi

 pathchk --portability "$_APPARMOR_FILEDEST"

 APPARMOR_FILEPATH="$_APPARMOR_FILEDEST"

 if [[ -f "$APPARMOR_FILEPATH" ]]; then
    >&2 echo "apparmor file $APPARMOR_FILEPATH already exists"
    >&2 echo "please check the file $APPARMOR_FILEPATH and ONLY delete it if you are sure it has something incorrect or doesn't belong to another apparmor rule"
    >&2 echo "this script won't overwrite the destination file $APPARMOR_FILEPATH for security purposes, you should do it manually"
    >&2 echo "as an alternative you can provide a second argument as the destination apparmor file"

    exit 1
 fi

 envsubst '$FILEPATH_SANITIZED,$FILE_BASENAME_SANITIZED' <<EOT > "$APPARMOR_FILEPATH"
 abi <abi/4.0>,
 include <tunables/global>

 profile $FILE_BASENAME_SANITIZED $FILEPATH_SANITIZED flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/$FILE_BASENAME_SANITIZED>
 }
 EOT
	#!/usr/bin/env bash

	set -e

	if [ "$EUID" -ne 0 ]
	then echo "Please run as root / with sudo"
	exit
	fi


	if [[ -z "${1+x}" ]]; then
	>&2 echo "you need to pass the executable file/path as the first argument"
	exit 1
	fi

	if [[ -n "${2+x}" ]]; then
	pathchk --portability "$2"
	_APPARMOR_FILEDEST="/etc/apparmor.d/$2"
	fi

	_FILENAME="$1"

	pathchk --portability "$_FILENAME" && (which "$_FILENAME" > /dev/null \|\| >&2 echo "could not locate path of $_FILENAME") \|\| exit 1

	_FILEPATH="$(which "$_FILENAME")"
	FILEPATH="$(realpath "$_FILEPATH")"
	FILE_BASENAME="$(basename "$FILEPATH")"

	FILEPATH_SANITIZED="${FILEPATH// /\\ /}"
	FILE_BASENAME_SANITIZED="${FILE_BASENAME// /\\ /}"

	if [[ -z "${2+x}" ]]; then
	_APPARMOR_FILEDEST="/etc/apparmor.d/$FILE_BASENAME"
	fi

	pathchk --portability "$_APPARMOR_FILEDEST"

	APPARMOR_FILEPATH="$_APPARMOR_FILEDEST"

	if [[ -f "$APPARMOR_FILEPATH" ]]; then
	>&2 echo "apparmor file $APPARMOR_FILEPATH already exists"
	>&2 echo "please check the file $APPARMOR_FILEPATH and ONLY delete it if you are sure it has something incorrect or doesn't belong to another apparmor rule"
	>&2 echo "this script won't overwrite the destination file $APPARMOR_FILEPATH for security purposes, you should do it manually"
	>&2 echo "as an alternative you can provide a second argument as the destination apparmor file"

	exit 1
	fi

	envsubst '$FILEPATH_SANITIZED,$FILE_BASENAME_SANITIZED' <<EOT > "$APPARMOR_FILEPATH"
	abi <abi/4.0>,
	include <tunables/global>

	profile $FILE_BASENAME_SANITIZED $FILEPATH_SANITIZED flags=(unconfined) {
	userns,

	# Site-specific additions and overrides. See local/README for details.
	include if exists <local/$FILE_BASENAME_SANITIZED>
	}
	EOT