add apparmor support in parser

Cargo.toml

@@ -44,6 +44,10 @@ default = []
 # on the system you are building sudo for (e.g. Debian, Fedora, but not Arch)
 pam-login = []
 
+# this enables the setting of APPARMOR_PROFILE in /etc/sudoers; this is disabled
+# by default and is only used on Ubuntu
+apparmor = []
+
 # enable detailed logging (use for development only) to /tmp
 # this will compromise the security of sudo-rs somewhat
 dev = []

src/sudoers/ast.rs

@@ -103,6 +103,8 @@ pub struct Tag {
     pub(super) authenticate: Authenticate,
     pub(super) cwd: Option<ChDir>,
     pub(super) env: EnvironmentControl,
+    #[cfg(feature = "apparmor")]
+    pub(super) apparmor_profile: Option<String>,
 }
 
 impl Tag {
@@ -418,11 +420,24 @@ impl Parse for MetaOrTag {
             "ROLE" | "TYPE" => unrecoverable!(
                 pos = start_pos,
                 stream,
-                "role based access control is not yet supported by sudo-rs"
+                "SELinux role based access control is not yet supported by sudo-rs"
             ),
 
+            #[cfg(feature = "apparmor")]
+            "APPARMOR_PROFILE" => {
+                expect_syntax('=', stream)?;
+                let StringParameter(profile) = expect_nonterminal(stream)?;
+                Box::new(move |tag| tag.apparmor_profile = Some(profile.clone()))
+            }
+
             "ALL" => return make(MetaOrTag(All)),
-            alias => return make(MetaOrTag(Alias(alias.to_string()))),
+            alias => {
+                if is_syntax('=', stream)? {
+                    unrecoverable!(pos = start_pos, stream, "unsupported modifier '{}'", alias);
+                } else {
+                    return make(MetaOrTag(Alias(alias.to_string())));
+                }
+            }
         };
 
         make(MetaOrTag(Only(result)))

src/sudoers/policy.rs

@@ -29,6 +29,9 @@ pub struct Authentication {
     pub allowed_attempts: u16,
     pub prior_validity: Duration,
     pub pwfeedback: bool,
+    #[cfg(feature = "apparmor")]
+    #[expect(dead_code)] // TODO: this attribute should be removed
+    pub apparmor_profile: Option<String>,
 }
 
 impl super::Settings {
@@ -45,6 +48,8 @@ impl super::Settings {
             } else {
                 AuthenticatingUser::InvokingUser
             },
+            #[cfg(feature = "apparmor")]
+            apparmor_profile: tag.apparmor_profile.clone(),
         }
     }
 }

src/sudoers/test/mod.rs

@@ -250,6 +250,10 @@ fn permission_test() {
     pass!(["a\\,b ALL=ALL"], "a,b" => request! { root, root }, "server"; "/bin/foo");
     pass!(["\"a,b\" ALL=ALL"], "a,b" => request! { root, root }, "server"; "/bin/foo");
     pass!(["\"a\\b\" ALL=ALL"], "a\\b" => request! { root, root }, "server"; "/bin/foo");
+
+    // apparmor
+    #[cfg(feature = "apparmor")]
+    pass!(["ALL ALL=(ALL:ALL) APPARMOR_PROFILE=unconfined ALL"], "user" => root(), "server"; "/bin/bar" => [apparmor_profile: Some("unconfined".to_string())]);
 }
 
 #[test]