felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source 
Adpated to the apparmor.d structure.

Signed-off-by: Mikhail Morfikov <mmorfikov@gmail.com>
This commit is contained in:
Mikhail Morfikov 2021-04-10 08:11:07 +02:00 • committed by Alexandre Pujol
parent c1e2b1d15e
commit 0573b2d996
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
29 changed files with 534 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/apps/atom
View file

@ -120,7 +120,7 @@ profile atom @{exec_path} {
# Failed to adjust OOM score of renderer with pid : Permission denied
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pids}/task/ r,
deny owner @{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
deny owner @{PROC}/@{pid}/loginuid r,

2
apparmor.d/groups/apps/code
View file

@ -99,7 +99,7 @@ profile code @{exec_path} {
# Failed to adjust OOM score of renderer with pid : Permission denied
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pids}/task/ r,
deny owner @{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
deny owner @{PROC}/@{pid}/net/dev r,

2
apparmor.d/groups/apps/discord
View file

@ -82,7 +82,7 @@ profile discord @{exec_path} {
deny @{PROC}/vmstat r,
deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pids}/task/ r,
deny owner @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny @{PROC}/@{pids}/stat r,
deny owner @{PROC}/@{pids}/statm r,
deny @{PROC}/@{pids}/cmdline r,

3
apparmor.d/groups/apps/freetube
View file

@ -73,8 +73,7 @@ profile freetube @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
# @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/task/ r,
deny owner @{PROC}/@{pids}/task/@{tid}/status r,
# @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny @{PROC}/@{pids}/stat r,
deny owner @{PROC}/@{pids}/statm r,
deny owner @{PROC}/@{pid}/cmdline r,

2
apparmor.d/groups/apps/spotify
View file

@ -46,7 +46,7 @@ profile spotify @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
deny owner @{PROC}/@{pids}/task/ r,
deny owner @{PROC}/@{pids}/task/@{tid}/stat r,
deny owner @{PROC}/@{pids}/task/@{tid}/status r,
owner @{PROC}/@{pids}/task/@{tid}/status r,
deny @{PROC}/@{pids}/stat r,
deny owner @{PROC}/@{pid}/cmdline r,
deny owner @{PROC}/@{pids}/oom_score_adj w,

4
apparmor.d/groups/apt/apt-show-versions
View file

@ -6,6 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{BUILD_DIR} = /media/debuilder/
@{exec_path} = /{usr/,}bin/apt-show-versions
profile apt-show-versions @{exec_path} {
include <abstractions/base>
@ -29,6 +31,8 @@ profile apt-show-versions @{exec_path} {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
@{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,
# file_inherit
owner /dev/tty[0-9]* rw,
owner /var/log/cron-apt/temp w,

2
apparmor.d/groups/browsers/brave
View file

@ -140,7 +140,7 @@ profile brave @{exec_path} {
#
deny @{PROC}/@{pids}/cmdline r,
owner @{PROC}/@{pids}/task/ r,
deny @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,

2
apparmor.d/groups/browsers/chromium-chromium
View file

@ -136,7 +136,7 @@ profile chromium-chromium @{exec_path} {
deny owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pids}/task/ r,
deny @{PROC}/@{pids}/task/@{tid}/stat r,
deny @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny owner @{PROC}/@{pid}/limits r,
deny owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/mountinfo r,

2
apparmor.d/groups/browsers/google-chrome-chrome
View file

@ -134,7 +134,7 @@ profile google-chrome-chrome @{exec_path} {
deny owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pid}/task/ r,
deny @{PROC}/@{pids}/task/@{tid}/stat r,
deny @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny owner @{PROC}/@{pid}/limits r,
deny owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/mountinfo r,

2
apparmor.d/groups/browsers/opera
View file

@ -126,7 +126,7 @@ profile opera @{exec_path} {
deny owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pid}/task/ r,
deny @{PROC}/@{pids}/task/@{tid}/stat r,
deny @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/task/@{tid}/status r,
deny owner @{PROC}/@{pid}/limits r,
deny owner @{PROC}/@{pid}/mem r,
owner @{PROC}/@{pid}/mountinfo r,

5
apparmor.d/groups/cron/crontab
View file

@ -23,6 +23,8 @@ profile crontab @{exec_path} {
/{usr/,}bin/sensible-editor rCx -> editor,
/{usr/,}bin/vim.* rCx -> editor,
/etc/cron.{allow,deny} r,
/var/spool/cron/ r,
/var/spool/cron/crontabs/ rw,
owner /var/spool/cron/crontabs/* rw,
@ -53,6 +55,9 @@ profile crontab @{exec_path} {
/tmp/ r,
owner /tmp/crontab.*/crontab rw,
# file_inherit
/etc/cron.{allow,deny} r,
}
include if exists <local/crontab>

81
apparmor.d/groups/systemd/coredumpctl Normal file
View file

@ -0,0 +1,81 @@
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
# Copyright (C) 2021 Mikhail Morfikov
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/coredumpctl
profile coredumpctl @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
signal (send) peer=child-pager,
@{exec_path} mr,
/{usr/,}bin/gdb rCx -> gdb,
/{usr/,}bin/pager rPx -> child-pager,
/{usr/,}bin/less rPx -> child-pager,
/{usr/,}bin/more rPx -> child-pager,
owner /tmp/*.coredump w,
owner /tmp/core.* w,
owner /var/tmp/coredump-* rw,
/var/lib/systemd/coredump/core.*.[0-9]*.[0-9a-f]*.[0-9]*.[0-9]*.zst r,
/{run,var}/log/journal/ r,
/{run,var}/log/journal/[0-9a-f]*/ r,
/{run,var}/log/journal/[0-9a-f]*/user-[0-9a-f]*.journal* r,
/{run,var}/log/journal/[0-9a-f]*/system.journal* r,
/{run,var}/log/journal/[0-9a-f]*/system@[0-9a-f]*.journal* r,
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
profile gdb {
include <abstractions/base>
include <abstractions/python>
ptrace (trace),
/{usr/,}bin/gdb mr,
/{usr/,}bin/iconv rix,
/{usr/,}bin/* r,
/{usr/,}sbin/* r,
@{PROC}/@{pids}/fd/ r,
/etc/inputrc r,
/etc/gdb/** r,
/usr/share/gdb/{,**} r,
/usr/share/glib-2.0/gdb/{,**} r,
/usr/share/gcc-[0-9]*/python/{,**} r,
/usr/share/gcc/** r,
owner /var/tmp/coredump-* rw,
# Silencer
deny /usr/share/** w,
}
include if exists <local/coredumpctl>
}

52
apparmor.d/groups/systemd/systemd-coredump Normal file
View file

@ -0,0 +1,52 @@
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
# Copyright (C) 2021 Mikhail Morfikov
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-coredump
profile systemd-coredump @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/systemd-common>
capability setpcap,
capability setuid,
capability setgid,
capability dac_read_search,
capability sys_ptrace,
# Needed?
deny capability net_admin,
@{exec_path} mr,
/{usr/,}bin/* r,
/{usr/,}sbin/* r,
/usr/libexec/** r,
/etc/systemd/coredump.conf r,
/var/lib/systemd/coredump/ r,
owner /var/lib/systemd/coredump/#[0-9]* rw,
owner /var/lib/systemd/coredump/core.*.[0-9]*.[0-9a-f]*.[0-9]*.[0-9]*.zst rwl -> /var/lib/systemd/coredump/#[0-9]*,
owner @{PROC}/@{pid}/setgroups r,
@{PROC}/@{pids}/comm r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/limits r,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/environ r,
@{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/fdinfo/[0-9]* r,
include if exists <local/systemd-coredump>
}

8
apparmor.d/groups/systemd/systemd-journald
View file

@ -17,6 +17,14 @@ profile systemd-journald @{exec_path} {
capability sys_ptrace,
capability dac_read_search,
capability kill,
capability sys_admin,
capability setuid,
capability setgid,
# For audit logs
capability audit_control,
network netlink raw,
@{exec_path} mr,

1
apparmor.d/groups/systemd/systemd-sysctl
View file

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-sysctl
profile systemd-sysctl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>
# Are these needed?