mkosi/mkosi.tools.conf/mkosi.conf.d/debian-ubuntu.conf

@@ -12,6 +12,7 @@ PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/debian-ubuntu/mkosi.prep
 Packages=
         clang-tools
         gh
+        iwyu
         lcov
         mypy
         shellcheck

mkosi/mkosi.tools.conf/mkosi.conf.d/fedora.conf

@@ -5,6 +5,7 @@ Distribution=fedora
 
 [Content]
 Packages=
+        iwyu
         lcov
         gh
         ruff

mkosi/mkosi.tools.conf/mkosi.conf.d/opensuse.conf

@@ -11,6 +11,7 @@ PrepareScripts=%D/mkosi/mkosi.images/build/mkosi.conf.d/opensuse/mkosi.prepare
 Packages=
         clang-tools
         gh
+        include-what-you-use
         lcov
         mypy
         python3-ruff

src/basic/virt.c

@@ -830,7 +830,7 @@ int running_in_chroot(void) {
                         return -ENOSYS;
         }
         if (r < 0)
-                return log_debug_errno(r, "Failed to check if /proc/1/root and / are the same inode: %m");
+                return r;
 
         return r == 0;
 }

src/core/apparmor-setup.c

@@ -20,10 +20,16 @@ int mac_apparmor_setup(void) {
         int r;
 
         if (!mac_apparmor_use()) {
-                log_debug("Skipping AppArmor initialization: not supported by the kernel, is disabled or libapparmor is not installed.");
+                log_debug("Skipping AppArmor initialization: not supported by the kernel or disabled.");
                 return 0;
         }
 
+        r = dlopen_libapparmor();
+        if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
+                return 0;
+        if (r < 0)
+                return log_error_errno(r, "Failed to load libapparmor: %m");
+
         /* To honor LSM stacking, check per-LSM subdirectory first, and then the generic one as fallback. */
         FOREACH_STRING(current_file, "/proc/self/attr/apparmor/current", "/proc/self/attr/current") {
                 r = read_one_line_file(current_file, &current_profile);

src/core/exec-invoke.c

@@ -5751,7 +5751,12 @@ int exec_invoke(
                 use_smack = mac_smack_use();
 #endif
 #if HAVE_APPARMOR
-                use_apparmor = mac_apparmor_use();
+                if (mac_apparmor_use()) {
+                        r = dlopen_libapparmor();
+                        if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r))
+                                log_warning_errno(r, "Failed to load libapparmor, ignoring: %m");
+                        use_apparmor = r >= 0;
+                }
 #endif
         }
 

src/shared/apparmor-util.c

@@ -5,7 +5,6 @@
 #include "alloc-util.h"
 #include "apparmor-util.h"
 #include "fileio.h"
-#include "log.h"
 #include "parse-util.h"
 
 #if HAVE_APPARMOR
@@ -39,31 +38,18 @@ int dlopen_libapparmor(void) {
                         DLSYM_ARG(aa_policy_cache_replace_all),
                         DLSYM_ARG(aa_policy_cache_unref));
 }
+#endif
 
 bool mac_apparmor_use(void) {
         static int cached_use = -1;
-        int r;
-
-        if (cached_use >= 0)
-                return cached_use;
 
+        if (cached_use < 0) {
                 _cleanup_free_ char *p = NULL;
-        r = read_one_line_file("/sys/module/apparmor/parameters/enabled", &p);
-        if (r < 0) {
-                if (r != -ENOENT)
-                        log_debug_errno(r, "Failed to read /sys/module/apparmor/parameters/enabled, assuming AppArmor is not available: %m");
-                return (cached_use = false);
+
+                cached_use =
+                        read_one_line_file("/sys/module/apparmor/parameters/enabled", &p) >= 0 &&
+                        parse_boolean(p) > 0;
         }
 
-        r = parse_boolean(p);
-        if (r < 0)
-                log_debug_errno(r, "Failed to parse /sys/module/apparmor/parameters/enabled, assuming AppArmor is not available: %m");
-        if (r <= 0)
-                return (cached_use = false);
-
-        if (dlopen_libapparmor() < 0)
-                return (cached_use = false);
-
-        return (cached_use = true);
+        return cached_use;
 }
-#endif

src/shared/apparmor-util.h

@@ -21,12 +21,10 @@ DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(aa_features*, sym_aa_features_unref, aa_
 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(aa_policy_cache*, sym_aa_policy_cache_unref, aa_policy_cache_unrefp, NULL);
 
 int dlopen_libapparmor(void);
-bool mac_apparmor_use(void);
 #else
 static inline int dlopen_libapparmor(void) {
         return -EOPNOTSUPP;
 }
-static inline bool mac_apparmor_use(void) {
-        return false;
-}
 #endif
+
+bool mac_apparmor_use(void);