# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/cockpit-bridge
profile cockpit-bridge @{exec_path} {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/python>

  capability dac_read_search,
  capability net_admin,
  capability sys_nice,
  capability sys_ptrace,

  network inet dgram,
  network inet stream,
  network inet6 dgram,
  network inet6 stream,
  network netlink raw,

  ptrace read,

  signal send set=term peer=cockpit-bridge//sudo,
  signal send set=term peer=cockpit-pcp,
  signal send set=term peer=dbus-daemon,
  signal send set=term peer=journalctl,
  signal send set=term peer=ssh-agent,
  signal send set=term peer=unconfined,

  @{exec_path} mr,

  @{bin}/cat                  ix,
  @{bin}/date                 ix,
  @{bin}/find                 ix,
  @{bin}/ip                   ix,
  @{bin}/python3.@{int}       ix,
  @{bin}/test                 ix,
  @{bin}/file                 ix,

  @{bin}/chage                Px,
  @{bin}/dmidecode            Px,
  @{bin}/findmnt              Px,
  @{bin}/journalctl           Px,
  @{bin}/last                 Px,
  @{bin}/lastlog              Px,
  @{bin}/lscpu                Px,
  @{bin}/passwd               Px,
  @{bin}/ssh-agent            Px,
  @{bin}/sudo                 Cx -> sudo,
  @{bin}/udevadm              Cx -> udevadm,
  @{bin}/virsh               rPUx,
  @{bin}/virt-install        PUx, # TODO: rPx
  @{lib}/cockpit/cockpit-pcp  Px,
  @{lib}/cockpit/cockpit-ssh  Px,

  # The shell is not confined on purpose.
  @{bin}/@{shells}            Ux,

  /usr/{,local/}share/ r,
  /usr/share/cockpit/{,**} r,
  /usr/share/file/** r,
  /usr/share/iproute2/* r,

  /etc/cockpit/{,**} r,
  /etc/httpd/conf/mime.types r,
  /etc/login.defs r,
  /etc/machine-id r,
  /etc/mime.types r,
  /etc/motd r,
  /etc/shadow r,
  /etc/shells r,

  / r, 
  @{HOME}/ r,

  owner @{user_cache_dirs}/ssh-agent.[0-9A-Z]* rw,
  owner @{user_share_dirs}/ r,

  @{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw,
  @{run}/utmp r,

  @{sys}/class/hwmon/ r,
  @{sys}/class/net/ r,
  @{sys}/devices/**/hwmon@{int}/ r,
  @{sys}/devices/**/hwmon@{int}/{name,temp*} r,
  @{sys}/fs/cgroup/ r,
  @{sys}/fs/cgroup/**/ r,
  @{sys}/fs/cgroup/**/cpu.{stat,weight} r,
  @{sys}/fs/cgroup/**/memory* r,
  @{sys}/kernel/kexec_crash_size r,

        @{PROC}/ r,
        @{PROC}/@{pids}/cgroup r,
        @{PROC}/@{pids}/io r,
        @{PROC}/@{pids}/net/dev r,
        @{PROC}/1/cgroup r,
        @{PROC}/cmdline r,
        @{PROC}/diskstats r,
        @{PROC}/loadavg r,
        @{PROC}/uptime r,
  owner @{PROC}/@{pid}/cmdline r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,

  /dev/ptmx rw,

  profile sudo {
    include <abstractions/base>
    include <abstractions/app/sudo>

    signal (send receive) set=term peer=cockpit-bridge,

    @{bin}/cockpit-bridge Px,
    @{lib}/cockpit/cockpit-askpass Px,

    include if exists <local/cockpit-bridge_sudo>
  }

  profile udevadm {
    include <abstractions/base>
    include <abstractions/app/udevadm>

    include if exists <local/cockpit-bridge_udevadm>
  }

  include if exists <local/cockpit-bridge>
}

# vim:syntax=apparmor
