[packages/apparmor-parser] Rel 2; let /etc/sysconfig/apparmor set ADDITIONAL_PROFILE_DIR; fix tmp cache leak

[arekm]

commit 303d8a419e76f49f64b1ff987787e6acd34953f8
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Sep 9 08:49:27 2026 +0200

    Rel 2; let /etc/sysconfig/apparmor set ADDITIONAL_PROFILE_DIR; fix tmp cache leak

 apparmor-parser-cache-tmp-leak.patch | 12 ++++++++++++
 apparmor-parser-sysconfig.patch      | 14 ++++++++++++++
 apparmor-parser.spec                 | 11 +++++++++--
 apparmor-parser.sysconfig            |  4 ++++
 4 files changed, 39 insertions(+), 2 deletions(-)
---
diff --git a/apparmor-parser.spec b/apparmor-parser.spec
index eb2e90b..2cb9b1d 100644
--- a/apparmor-parser.spec
+++ b/apparmor-parser.spec
@@ -7,17 +7,20 @@ Summary:	AppArmor userlevel parser utility
 Summary(pl.UTF-8):	Narzędzie przestrzeni użytkownika do przetwarzania AppArmor
 Name:		apparmor-parser
 Version:	4.1.8
-Release:	1
+Release:	2
 Epoch:		1
 License:	GPL v2
 Group:		Applications/System
 Source0:	https://gitlab.com/apparmor/apparmor/-/archive/v%{version}/apparmor-v%{version}.tar.gz
 # Source0-md5:	f2bba43c1631b7a3db6bd106d5a6fb33
 Source1:	%{name}.init
+Source2:	%{name}.sysconfig
 Patch0:		%{name}-pld.patch
 # Drop when upstream does cache rebuild based on hash and not on mtime
 Patch1:		%{name}-cache-rebuild.patch
 Patch2:		cap.patch
+Patch3:		%{name}-cache-tmp-leak.patch
+Patch4:		%{name}-sysconfig.patch
 URL:		https://wiki.apparmor.net/
 BuildRequires:	bison
 BuildRequires:	flex
@@ -59,6 +62,8 @@ SubDomain.
 %patch -P0 -p1
 %patch -P1 -p1
 %patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
 
 # avoid unnecessary rebuilding on install
 %{__sed} -i -e '/^\.PHONY: af_names.h/d' parser/Makefile
@@ -81,7 +86,7 @@ SubDomain.
 
 %install
 rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT{/etc/rc.d/init.d,/lib/apparmor,/var/cache/apparmor}
+install -d $RPM_BUILD_ROOT{/etc/rc.d/init.d,/etc/sysconfig,/lib/apparmor,/var/cache/apparmor}
 
 %{__make} -C parser install \
 	DESTDIR=$RPM_BUILD_ROOT \
@@ -90,6 +95,7 @@ install -d $RPM_BUILD_ROOT{/etc/rc.d/init.d,/lib/apparmor,/var/cache/apparmor}
 	USE_SYSTEM=1
 
 install %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/apparmor
+cp -p %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/apparmor
 
 %find_lang %{name}
 
@@ -111,6 +117,7 @@ fi
 %attr(755,root,root) %{_sbindir}/aa-teardown
 %dir %{_sysconfdir}/apparmor
 %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/apparmor/parser.conf
+%config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/apparmor
 %attr(754,root,root) /etc/rc.d/init.d/apparmor
 %{systemdunitdir}/apparmor.service
 %dir /lib/apparmor
diff --git a/apparmor-parser-cache-tmp-leak.patch b/apparmor-parser-cache-tmp-leak.patch
new file mode 100644
index 0000000..d1f1693
--- /dev/null
+++ b/apparmor-parser-cache-tmp-leak.patch
@@ -0,0 +1,12 @@
+# every failed profile load leaves its mkstemp() file behind in the cache dir
+--- a/parser/parser_main.c	2026-09-08 13:32:53.612894499 +0200
++++ b/parser/parser_main.c	2026-09-08 13:36:23.802289323 +0200
+@@ -1270,6 +1270,8 @@ int process_profile(int option, aa_kerne
+ 		} else {
+ 			install_cache(cachetmpname, writecachename);
+ 		}
++	} else if (cachetmpname) {
++		unlink(cachetmpname);
+ 	}
+ out:
+ 	/* cleanup */
diff --git a/apparmor-parser-sysconfig.patch b/apparmor-parser-sysconfig.patch
new file mode 100644
index 0000000..998fcbc
--- /dev/null
+++ b/apparmor-parser-sysconfig.patch
@@ -0,0 +1,14 @@
+# let /etc/sysconfig/apparmor set ADDITIONAL_PROFILE_DIR (upstream hardcodes it empty);
+# a second profile dir is loaded only after the first one is fully in the kernel,
+# so hats kept in separate files can be loaded in parallel without racing their parent,
+# https://gitlab.com/apparmor/apparmor/-/issues/147
+--- a/parser/rc.apparmor.functions	2026-09-08 22:40:00.729659059 +0200
++++ b/parser/rc.apparmor.functions	2026-09-08 22:40:00.801020131 +0200
+@@ -47,6 +47,7 @@ fi
+ # Eg. snapd policy might need this on some systems if loading policy
+ #     during early boot if not using the snapd unit file
+ ADDITIONAL_PROFILE_DIR=
++[ ! -f /etc/sysconfig/apparmor ] || . /etc/sysconfig/apparmor
+ if [ -n "$ADDITIONAL_PROFILE_DIR" ] && [ -d "$ADDITIONAL_PROFILE_DIR" ]; then
+ 	PROFILE_DIRS="$PROFILE_DIRS $ADDITIONAL_PROFILE_DIR"
+ fi
diff --git a/apparmor-parser.sysconfig b/apparmor-parser.sysconfig
new file mode 100644
index 0000000..ff5f6f0
--- /dev/null
+++ b/apparmor-parser.sysconfig
@@ -0,0 +1,4 @@
+# Profiles from this directory are loaded after /etc/apparmor.d, once everything
+# from there is in the kernel; use it for profiles that depend on the standard ones
+# (e.g. hats kept in files of their own).
+#ADDITIONAL_PROFILE_DIR=
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/apparmor-parser.git/commitdiff/303d8a419e76f49f64b1ff987787e6acd34953f8