Merge branch '6071-secondary-zones-dir' into 'develop'

Marius Burkard · Marius Burkard · commit db0c54095006 · 2022-03-21T10:44:57.000Z
Add function to configure AppArmor (needed to allow use of /etc/bind for zone files) (#6701)

Closes #6071

See merge request ispconfig/ispconfig3!1582
diff --git a/install/dist/conf/centos52.conf.php b/install/dist/conf/centos52.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos53.conf.php b/install/dist/conf/centos53.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos70.conf.php b/install/dist/conf/centos70.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos72.conf.php b/install/dist/conf/centos72.conf.php
@@ -224,4 +224,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos80.conf.php b/install/dist/conf/centos80.conf.php
@@ -224,4 +224,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian100.conf.php b/install/dist/conf/debian100.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian110.conf.php b/install/dist/conf/debian110.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian40.conf.php b/install/dist/conf/debian40.conf.php
@@ -229,4 +229,7 @@
 $conf['openvz']['installed'] = false;
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian60.conf.php b/install/dist/conf/debian60.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian90.conf.php b/install/dist/conf/debian90.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debiantesting.conf.php b/install/dist/conf/debiantesting.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora32.conf.php b/install/dist/conf/fedora32.conf.php
@@ -226,4 +226,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora33.conf.php b/install/dist/conf/fedora33.conf.php
@@ -226,4 +226,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora9.conf.php b/install/dist/conf/fedora9.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/gentoo.conf.php b/install/dist/conf/gentoo.conf.php
@@ -238,4 +238,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/opensuse110.conf.php b/install/dist/conf/opensuse110.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/opensuse112.conf.php b/install/dist/conf/opensuse112.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1604.conf.php b/install/dist/conf/ubuntu1604.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1710.conf.php b/install/dist/conf/ubuntu1710.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1804.conf.php b/install/dist/conf/ubuntu1804.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu2004.conf.php b/install/dist/conf/ubuntu2004.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/install.php b/install/install.php
@@ -500,6 +500,12 @@
 	swriteln('Configuring OpenVZ');
 }
 
+// Configure AppArmor
+if($conf['apparmor']['installed']){
+  swriteln('Configuring AppArmor');
+  $inst->configure_apparmor();
+}
+
 if($install_mode == 'standard' || strtolower($inst->simple_query('Configure Firewall Server', array('y', 'n'), 'y','configure_firewall')) == 'y') {
 	//* Check for Firewall
 	if(!$conf['ufw']['installed'] && !$conf['firewall']['installed']) {
diff --git a/install/lib/installer_base.lib.php b/install/lib/installer_base.lib.php
@@ -226,6 +226,7 @@ public function find_installed_apps() {
 		if(is_installed('named') || is_installed('bind') || is_installed('bind9')) $conf['bind']['installed'] = true;
 		if(is_installed('squid')) $conf['squid']['installed'] = true;
 		if(is_installed('nginx')) $conf['nginx']['installed'] = true;
+		if(is_installed('apparmor_status')) $conf['apparmor']['installed'] = true;
 		if(is_installed('iptables') && is_installed('ufw')) {
 			$conf['ufw']['installed'] = true;
 		} elseif(is_installed('iptables')) {
@@ -2478,6 +2479,13 @@ public function configure_squid()
 		exec('chown root:root '.$conf["squid"]["config_dir"].'/'.$configfile);
 	}
 
+	public function configure_apparmor() {
+		$configfile = 'apparmor_usr.sbin.named';
+		if(is_file('/etc/apparmor.d/local/usr.sbin.named')) copy('/etc/apparmor.d/local/usr.sbin.named', '/etc/apparmor.d/local/usr.sbin.named~');
+		$content = rf("tpl/".$configfile.".master");
+		wf('/etc/apparmor.d/local/usr.sbin.named', $content);
+	}
+
 	public function configure_ufw_firewall()
 	{
 		if($this->is_update == false) {
diff --git a/install/tpl/apparmor_usr.sbin.named b/install/tpl/apparmor_usr.sbin.named
@@ -0,0 +1,2 @@
+/etc/bind/slave/** lrw,
+/etc/bind/slave/ rw,
diff --git a/install/update.php b/install/update.php
@@ -512,6 +512,12 @@
 	$inst->configure_xmpp('dont-create-certs');
 	}
 
+  // Configure AppArmor
+  if($conf['apparmor']['installed']){
+    swriteln('Configuring AppArmor');
+    $inst->configure_apparmor();
+  }
+
 	if($conf['services']['firewall'] && $inst->reconfigure_app('Firewall', $reconfigure_services_answer)) {
 		if($conf['ufw']['installed'] == true) {
 			//* Configure Ubuntu Firewall
