# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/apt @{bin}/apt-get @{bin}/aptd
profile apt @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/common/apt>
  include <abstractions/bus-system>
  include <abstractions/bus/org.freedesktop.login1>
  include <abstractions/bus/org.freedesktop.PackageKit>
  include <abstractions/bus/org.freedesktop.PolicyKit1>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/python>
  include <abstractions/ssl_certs>

  capability chown,
  capability dac_override,
  capability dac_read_search,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_admin,
  capability setgid,
  capability setuid,
  capability sys_nice,
  capability sys_ptrace,

  signal (send) peer=apt-methods-*,

  unix bind type=stream addr=@@{udbus}/bus/apt-get/system,
  unix bind type=stream addr=@@{udbus}/bus/apt/system,

  unix (send, receive) type=stream peer=(label=apt-esm-json-hook),
  unix (send, receive) type=stream peer=(label=snapd),

  #aa:dbus own bus=system name=org.debian.apt

  dbus send bus=system path=/org/freedesktop/DBus/Bus
       interface=org.freedesktop.DBus
       member={GetConnectionUnixProcessID,GetConnectionUnixUser}
       peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),

  dbus send bus=system
       interface=org.freedesktop.DBus.Introspectable
       member=Introspect
       peer=(name="{:*,org.freedesktop.DBus}"),

  @{exec_path} mr,

  @{bin}/ r,

  @{sh_path}        rix,
  @{bin}/{,e}grep   rix,
  @{bin}/echo       rix,
  @{bin}/gdbus      rix,
  @{bin}/id         rix,
  @{bin}/ischroot   rix,
  @{bin}/test       rix,
  @{bin}/touch      rix,

  @{bin}/adequate                        rPx,
  @{bin}/appstreamcli                    rPx,
  @{bin}/apt-listbugs                    rPx,
  @{bin}/apt-listchanges                 rPx,
  @{bin}/apt-show-versions               rPx,
  @{bin}/debtags                         rPx,
  @{bin}/df                              rPx,
  @{bin}/dmesg                           rPx,
  @{bin}/dpkg                            rPx,
  @{bin}/dpkg-preconfigure               rPx,
  @{bin}/dpkg-source                     rcx -> dpkg-source,
  @{bin}/etckeeper                       rPx,
  @{bin}/localepurge                     rPx,
  @{bin}/ps                              rPx,
  @{bin}/snap                           rPUx,
  @{bin}/systemctl                       rCx ->  systemctl,
  @{bin}/update-command-not-found        rPx,
  @{lib}/cnf-update-db                   rPx,
  @{lib}/needrestart/apt-pinvoke         rPx,
  @{lib}/zsys-system-autosnapshot        rPx,

  # For building the source after the download process is finished (apt-get source --compile)
  @{bin}/dpkg-buildpackage               rPUx,

  # Methods to use to download packages from the net
  @{lib}/apt/methods/*                   rPx,

  # Ubuntu specificities
  @{lib}/ubuntu-advantage/apt-esm-hook                  rPx,
  @{lib}/ubuntu-advantage/apt-esm-json-hook             rPx,
  @{lib}/ubuntu-release-upgrader/do-partial-upgrade     rPx,
  @{lib}/update-notifier/update-motd-updates-available  rPx,
  /usr/share/command-not-found/cnf-update-db            rPx,
  /usr/share/language-tools/language-options            rPx,

  # For editing the sources.list file
  @{editor_path} rCx -> editor,

  # For changelogs
  @{pager_path}  rCx -> pager,

  #aa:only whonix
  @{lib}/uwt/uwtwrapper rix,

  /usr/share/xml/iso-codes/{,**} r,
  /usr/share/language-selector/data/pkg_depends r,

  /etc/apt/sources.list rwk,
  /etc/machine-id r,
  /var/lib/dbus/machine-id r,

  /var/cache/apt/ rw,
  /var/cache/apt/** rwk,

  /var/crash/{,*.@{uid}.crash} rw,

  /var/lib/apt/extended_states{,.*} rw,
  /var/lib/apt/lists/{,**} rw,
  /var/lib/apt/lists/lock rwk,
  /var/lib/apt/periodic/update-success-stamp rw,
  /var/lib/dpkg/** r,
  /var/lib/dpkg/lock{,-frontend} rwk,
  /var/lib/update-notifier/dpkg-run-stamp rw,

  /var/log/apt/{,**} rw,
  /var/log/ubuntu-advantage-apt-hook.log w,

  # For package building
  @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

        /tmp/ r,
        /tmp/apt-changelog-*/ w,
        /tmp/apt-changelog-*/*.changelog w,
  owner @{tmp}/apt-changelog-*/.apt-acquire-privs-test.* rw,
  owner @{tmp}/apt-dpkg-install-*/ rw,
  owner @{tmp}/apt-dpkg-install-*/@{int}-*.deb w,
  owner @{tmp}/apt.conf.* rw,
  owner @{tmp}/apt.data.* rw,

  @{att}/@{run}/systemd/inhibit/@{int}.ref rw,

        @{PROC}/@{pids}/cmdline r,
        @{PROC}/@{pids}/mountinfo r,
  owner @{PROC}/@{pid}/fd/ r,
  owner @{PROC}/@{pid}/mounts r,

  /dev/ptmx rw,

  profile editor flags=(complain) {
    include <abstractions/base>
    include <abstractions/app/editor>

    /etc/apt/sources.list rw,

    include if exists <local/apt_editor>
  }

  profile pager {
    include <abstractions/base>
    include <abstractions/consoles>

    capability dac_read_search,

    @{bin}/                      r,
    @{sh_path}                   rix,
    @{pager_path}               rmix,
    @{bin}/which{,.debianutils}  rix,

    /root/ r,  # For shell pwd

    owner @{HOME}/.less* rw,

    owner @{tmp}/apt-changelog-*/ r,
    owner @{tmp}/apt-changelog-*/*.changelog r,

    include if exists <local/apt_pager>
  }

  profile dpkg-source flags=(complain) {
    include <abstractions/base>
    include <abstractions/nameservice-strict>
    include <abstractions/perl>

    @{bin}/dpkg-source mr,
    @{bin}/perl r,

    @{bin}/bunzip2 rix,
    @{bin}/chmod   rix,
    @{bin}/gunzip  rix,
    @{bin}/gzip    rix,
    @{bin}/patch   rix,
    @{bin}/rm      rix,
    @{bin}/tar     rix,
    @{bin}/xz      rix,

    /etc/dpkg/origins/debian r,

               owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
               owner @{HOME}/**      rwkl -> @{HOME}/**,
    audit deny owner @{HOME}/.*     mrwkl,
    audit deny owner @{HOME}/.*/     rw,
    audit deny owner @{HOME}/.*/**  mrwkl,

    include if exists <local/apt_dpkg-source>
  }

  profile systemctl {
    include <abstractions/base>
    include <abstractions/app/systemctl>

    capability net_admin,
    capability sys_resource,

    signal (send) set=(cont, term) peer=systemd-tty-ask-password-agent,

    @{bin}/systemd-tty-ask-password-agent rPx,

    owner @{run}/systemd/ask-password-block/{,*} rw,
    owner @{run}/systemd/ask-password/ rw,

    /dev/kmsg w,

    include if exists <local/apt_systemctl>
  }

  include if exists <local/apt>
}


# vim:syntax=apparmor
