diff --git a/tests/testdata/full.aa b/tests/testdata/full.aa new file mode 100644 index 000000000..a0909c05a --- /dev/null +++ b/tests/testdata/full.aa @@ -0,0 +1,110 @@ +# Simple test profile with all rules used + +abi , + +alias /mnt/usr -> /usr, + +include # optional: a comment +include if exists "/etc/apparmor.d/global/dummy space" + +@{name}=torbrowser "tor browser" +@{lib_dirs} = @{lib}/@{name} /opt/@{name} # another comment +@{config_dirs} = @{HOME}/.mozilla/ +@{cache_dirs}=@{user_cache_dirs}/mozilla/ + +alias /mnt/{,usr.sbin.}mount.cifs -> /sbin/mount.cifs, + +@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name} +profile foo @{exec_path} xattrs=(security.tagged=allowed) flags=(complain attach_disconnected) { + include + include + include "/etc/apparmor.d/abstractions/dummy space" + + all, + + set rlimit nproc <= 200, + + userns, + + capability dac_read_search, + capability dac_override, + + network inet stream, + network netlink raw, + + mount /{,**}, + mount options=(rw rbind) /tmp/newroot/ -> /tmp/newroot/, + mount options=(rw silent rprivate) -> /oldroot/, + mount fstype=devpts options=(rw nosuid noexec) devpts -> /newroot/dev/pts/, + + remount /newroot/{,**}, + + umount @{run}/user/@{uid}/, + + pivot_root oldroot=/tmp/oldroot/ /tmp/, + + change_profile -> libvirt-@{uuid}, + + mqueue r type=posix /, + + io_uring sqpoll label=foo, + + signal (receive) set=(cont,term,winch) peer=at-spi-bus-launcher, + + ptrace (read) peer=nautilus, + + unix (send receive) type=stream addr="@/tmp/.ICE[0-9]-unix/19 5" peer=(label=gnome-shell, addr=none), + + dbus bind bus=session name=org.gnome.*, + dbus receive bus=system path=/org/freedesktop/DBus + interface=org.freedesktop.DBus + member=AddMatch + peer=(name=:1.3, label=power-profiles-daemon), + + # A comment! before a paragraph of rules + "/opt/Mullvad VPN/resources/*.so*" mr, + "/opt/Mullvad VPN/resources/*" r, + "/opt/Mullvad VPN/resources/openvpn" rix, + /usr/share/gnome-shell/extensions/ding@rastersoft.com/{,*/}ding.js rPx, + /opt/intel/oneapi/compiler/*/linux/lib/*.so./* rm, + + owner @{user_config_dirs}/powerdevilrc{,.@{rand6}} rwl -> @{user_config_dirs}/#@{int}, + link @{user_config_dirs}/kiorc -> @{user_config_dirs}/#@{int}, + + @{run}/udev/data/+pci:* r, + + @{sys}/devices/@{pci}/class r, + + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + + ^action { + include + include if exists + } + + profile systemctl { + include + include + + capability net_admin, + + include if exists + } + + profile sudo { + include + include + + @{sh_path} rix, + + include if exists + } + + include if exists +} + +profile foo2 { + include + + include if exists +} diff --git a/tests/testdata/logs/audit.log b/tests/testdata/logs/audit.log index f616e0eec..0680d2a7a 100644 --- a/tests/testdata/logs/audit.log +++ b/tests/testdata/logs/audit.log @@ -35,3 +35,22 @@ type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_perm Sep 6 11:23:47 xubuntu-lts kernel: [ 31.024982] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_method_call" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.Accounts" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon" Sep 6 11:26:12 xubuntu-lts kernel: [ 175.272924] audit: type=1107 audit(1111111111.111:1111): pid=1567 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="ALLOWED" operation="dbus_signal" bus="system" path="/org/freedesktop/Accounts/User1000" interface="org.freedesktop.Accounts.User" member="Changed" name=":1.6" mask="receive" pid=1693 label="lightdm" peer_pid=1559 peer_label="accounts-daemon" type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="link" class="file" profile="akonadi_maildispatcher_agent" name="/home/bob/.config/akonadi/agent_config_akonadi_maildispatcher_agent.CmJRGE" pid=19277 comm="akonadi_maildis" requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000 target="/home/bob/.config/akonadi/#3029891" FSUID="user" OUID="user" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="ptrace" class="ptrace" profile="xdg-document-portal" pid=4515 comm="pool-/usr/lib/x" requested_mask="read" denied_mask="read" peer="nautilus" +type=AVC msg=audit(1689957950.207:1952): apparmor="DENIED" operation="file_inherit" class="net" profile="nvidia_modprobe" pid=5139 comm="nvidia-modprobe" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive" +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1111111111.111:1111): apparmor="ALLOWED" operation="open" class="file" profile="gsettings" name="/var/lib/gdm3/greeter-dconf-defaults" pid=2477 comm="gsettings" requested_mask="r" denied_mask="r" fsuid=131 ouid=131 +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(11111111111.111:111): apparmor="ALLOWED" operation="connect" class="net" profile="gsettings" pid=2477 comm=64636F6E6620776F726B6572 family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send receive connect" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon" +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1693): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon" +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1694): apparmor="ALLOWED" operation="file_perm" class="net" profile="gsettings" pid=2446 comm="dbus-daemon" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr="@/tmp/dbus-AaKMpxzC4k" peer="dbus-daemon" +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1695): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131 +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689714302.008:1696): apparmor="ALLOWED" operation="mkdir" class="file" profile="gnome-keyring-daemon" name="/var/lib/gdm3/.local/share/" pid=2478 comm="gnome-keyring-d" requested_mask="c" denied_mask="c" fsuid=131 ouid=131 +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3384): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald" +Nov 11 11:11:11 ubuntu kernel: [ 11.111111] audit: type=1400 audit(1689779263.198:3385): apparmor="DENIED" operation="ptrace" class="ptrace" profile="snap-update-ns.firefox" pid=1948 comm="systemd-journal" requested_mask="readby" denied_mask="readby" peer="systemd-journald" +Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323577] audit: type=1400 audit(1689779263.106:3379): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=12 capname="net_admin" +Jul 19 15:07:43 aa-ubuntu-desktop kernel: [ 160.323584] audit: type=1400 audit(1689779263.106:3380): apparmor="DENIED" operation="capable" class="cap" profile="/snap/snapd/19457/usr/lib/snapd/snap-confine" pid=3915 comm="snap-confine" capability=38 capname="perfmon" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="file_inherit" class="net" profile="firefox-vaapitest" pid=5120 comm="vaapitest" family="netlink" sock_type="raw" protocol=0 requested_mask="send receive" denied_mask="send receive" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="/usr/lib/kauth/backlighthelper" pid=2632 comm="backlighthelper" capability=12 capname="net_admin" +profile="sddm-greeter" operation="setsockopt" class="net" comm="sddm-greeter" family="netlink" sock_type="raw" protocol=15 requested_mask="setopt" denied_mask="setopt" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" profile="xorg" pid=16195 comm="Xorg.bin" capability=17 capname="sys_rawio" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="getattr" class="file" profile="pacman//null-/usr/share/code-features/patch.py" name="/etc/ld.so.preload" pid=18817 comm="patch.py" requested_mask="r" denied_mask="r" fsuid=0 ouid=0FSUID="root" OUID="root" +type=AVC msg=audit(1111111111.111:1111): apparmor="ALLOWED" operation="capable" class="cap" info="optional: no audit" error=-1 profile="pacman" comm="killall" capability=19 capname="sys_ptrace" + diff --git a/tests/testdata/string.aa b/tests/testdata/string.aa index 2ec5d3a6a..25065ce35 100644 --- a/tests/testdata/string.aa +++ b/tests/testdata/string.aa @@ -19,7 +19,7 @@ profile foo @{exec_path} xattrs=(security.tagged=allowed) flags=(complain attach network inet stream, network inet6 stream, - mount fstype=fuse.portal options=(rw rbind) @{run}/user/@{uid}/ -> /, # failed perms check + mount fstype=fuse.portal options=(rw rbind) @{run}/user/@{uid}/ -> /, # failed perms check umount @{run}/user/@{uid}/,