#!/bin/sh
# apparmor-profile-load
#
# Helper for loading an AppArmor profile in pre-start scripts.

[ -z "$1" ]                  && exit 1 # require a profile name

# do not load in a container
[ -x /bin/running-in-container ] && /bin/running-in-container >/dev/null 2>&1 && exit 0

[ -d /rofs/etc/apparmor.d ]  && exit 0 # do not load if running liveCD

profile=/etc/apparmor.d/"$1"
[ -e "$profile" ]            || exit 0 # skip when missing profile

module=/sys/module/apparmor
[ -d $module ]               || exit 0 # do not load without AppArmor in kernel

[ -x /sbin/apparmor_parser ] || exit 0 # do not load without parser

aafs=/sys/kernel/security/apparmor
[ -d $aafs ]                 || exit 0 # do not load if unmounted
[ -w $aafs/.load ]           || exit 1 # fail if cannot load profiles

params=$module/parameters
[ -r $params/enabled ]       || exit 0 # do not load if missing
read enabled < $params/enabled || exit 1 # if this fails, something went wrong
[ "$enabled" = "Y" ]         || exit 0 # do not load if disabled

/sbin/apparmor_parser -r -W "$profile" || exit 0 # LP: #1058356