felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): add the fusermount abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-06 15:30:10 +02:00
parent 9aaf109383
commit 1009de7e6c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
15 changed files with 67 additions and 179 deletions
Download patch file Download diff file Expand all files Collapse all files

28
apparmor.d/abstractions/app/fusermount Normal file
View file

@ -0,0 +1,28 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# LOGPROF-SUGGEST: no
# Minimal set of rules for fusermount subprofiles. Path to mount/unmount should
# be defined in the calling profile.
abi <abi/4.0>,
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability dac_override,
capability dac_read_search,
capability sys_admin, # To mount anything
@{bin}/fusermount{,3} mr,
@{etc_ro}/fuse{,3}.conf r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <abstractions/app/fusermount.d>
# vim:syntax=apparmor

13
apparmor.d/groups/bluetooth/obexautofs
View file

@ -36,20 +36,13 @@ profile obexautofs @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability sys_admin,
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/, mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/,
mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/*/, mount fstype={fuse,fuse.obexautofs} -> @{HOME}/*/*/,
@{bin}/fusermount{,3} mr, umount @{HOME}/*/,
umount @{HOME}/*/*/,
/etc/fuse.conf r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/obexautofs_fusermount> include if exists <local/obexautofs_fusermount>
} }

15
apparmor.d/groups/bluetooth/obexfs
View file

@ -27,26 +27,17 @@ profile obexfs @{exec_path} {
/dev/fuse rw, /dev/fuse rw,
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
# To mount anything:
capability sys_admin,
network bluetooth stream, network bluetooth stream,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
/dev/fuse rw,
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/, mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/*/, mount fstype={fuse,fuse.obexfs} -> @{HOME}/*/*/,
@{PROC}/@{pid}/mounts r, umount @{HOME}/*/,
umount @{HOME}/*/*/,
include if exists <local/obexfs_fusermount> include if exists <local/obexfs_fusermount>
} }

13
apparmor.d/groups/flatpak/flatpak
View file

@ -144,22 +144,11 @@ profile flatpak @{exec_path} flags=(attach_disconnected,mediate_deleted,complain
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/app/fusermount>
include <abstractions/nameservice-strict>
capability sys_admin,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/flatpak_fusermount> include if exists <local/flatpak_fusermount>
} }

16
apparmor.d/groups/freedesktop/xdg-document-portal
View file

@ -63,10 +63,11 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
profile fusermount flags=(attach_disconnected) { profile fusermount flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability sys_admin,
capability dac_read_search, capability dac_read_search,
capability dac_override,
capability setuid,
mount options=(rw, rprivate) -> /, mount options=(rw, rprivate) -> /,
mount options=(rw, rbind) @{run}/user/@{uid}/ -> /, mount options=(rw, rbind) @{run}/user/@{uid}/ -> /,
@ -76,16 +77,13 @@ profile xdg-document-portal @{exec_path} flags=(attach_disconnected) {
unix (send receive) type=stream peer=(label=xdg-document-portal), unix (send receive) type=stream peer=(label=xdg-document-portal),
@{bin}/fusermount{,3} mr, @{bin}/mount rix,
@{bin}/umount rix,
/etc/fuse{,3}.conf r,
owner @{run}/user/@{uid}/doc/ rw, owner @{run}/user/@{uid}/doc/ rw,
@{PROC}/@{pids}/mounts r, @{run}/mount/utab r,
@{run}/mount/utab.* rwk,
/dev/fuse rw,
@{att}/dev/tty@{int} rw,
include if exists <local/xdg-document-portal_fusermount> include if exists <local/xdg-document-portal_fusermount>
} }

12
apparmor.d/groups/gnome/gnome-software
View file

@ -164,21 +164,11 @@ profile gnome-software @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability sys_admin,
mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/, mount fstype=fuse.revokefs-fuse options=(rw, nosuid, nodev) -> /var/tmp/flatpak-cache-*/*/,
umount /var/tmp/flatpak-cache-*/*/, umount /var/tmp/flatpak-cache-*/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/gnome-software_fusermount> include if exists <local/gnome-software_fusermount>
} }

15
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -40,24 +40,17 @@ profile gvfsd-fuse @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability dac_read_search, capability setuid,
capability sys_admin, # To mount anything
mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/, mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/gvfs/,
umount @{run}/user/@{uid}/**/, umount @{run}/user/@{uid}/**/,
unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse), unix (send,receive) type=stream addr=none peer=(label=gvfsd-fuse),
@{bin}/fusermount{,3} mr, @{bin}/mount rix,
@{bin}/umount rix,
/etc/fuse{,3}.conf r,
/etc/machine-id r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/gvfsd-fuse_fusermount> include if exists <local/gvfsd-fuse_fusermount>
} }

12
apparmor.d/groups/ssh/sshfs
View file

@ -31,9 +31,7 @@ profile sshfs @{exec_path} flags=(complain) {
profile fusermount flags=(complain) { profile fusermount flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability sys_admin,
mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/, mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/*/, mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/*/,
@ -51,14 +49,6 @@ profile sshfs @{exec_path} flags=(complain) {
unix (connect, send, receive) type=stream peer=(label="sshfs",addr=none), unix (connect, send, receive) type=stream peer=(label="sshfs",addr=none),
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/sshfs_fusermount> include if exists <local/sshfs_fusermount>
} }

20
apparmor.d/profiles-a-f/archivemount
View file

@ -24,33 +24,19 @@ profile archivemount @{exec_path} {
owner @{HOME}/*/ r, owner @{HOME}/*/ r,
owner @{HOME}/*/*/ r, owner @{HOME}/*/*/ r,
mount fstype=fuse.archivemount -> @{HOME}/*/,
mount fstype=fuse.archivemount -> @{HOME}/*/*/,
/dev/fuse rw,
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
# To mount anything:
capability sys_admin,
@{bin}/fusermount{,3} mr,
mount fstype={fuse,fuse.archivemount} -> @{HOME}/*/, mount fstype={fuse,fuse.archivemount} -> @{HOME}/*/,
mount fstype={fuse,fuse.archivemount} -> @{HOME}/*/*/, mount fstype={fuse,fuse.archivemount} -> @{HOME}/*/*/,
/dev/fuse rw, umount @{HOME}/*/,
umount @{HOME}/*/*/,
/etc/fuse.conf r,
owner @{HOME}/ r,
/**.{tar,tar.gz,zip} r, /**.{tar,tar.gz,zip} r,
/**.{TAR,TAR.GZ,ZIP} r, /**.{TAR,TAR.GZ,ZIP} r,
@{PROC}/@{pid}/mounts r,
include if exists <local/archivemount_fusermount> include if exists <local/archivemount_fusermount>
} }

13
apparmor.d/profiles-a-f/borg
View file

@ -95,10 +95,7 @@ profile borg @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/app/fusermount>
include <abstractions/nameservice-strict>
capability sys_admin,
mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/, mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/,
mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/*/, mount fstype=fuse options=(ro nosuid nodev) borgfs -> @{MOUNTS}/*/,
@ -106,17 +103,9 @@ profile borg @{exec_path} {
umount @{MOUNTS}/, umount @{MOUNTS}/,
umount @{MOUNTS}/*/, umount @{MOUNTS}/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{MOUNTS}/ r, @{MOUNTS}/ r,
@{MOUNTS}/*/ r, @{MOUNTS}/*/ r,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/borg_fusermount> include if exists <local/borg_fusermount>
} }

20
apparmor.d/profiles-a-f/fuseiso
View file

@ -36,27 +36,17 @@ profile fuseiso @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
# To mount anything:
capability sys_admin,
capability dac_read_search,
mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/, mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/,
mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/*/, mount fstype={fuse,fuse.fuseiso} -> @{HOME}/*/*/,
mount fstype={fuse,fuse.fuseiso} -> @{user_cache_dirs}/**/, mount fstype={fuse,fuse.fuseiso} -> @{user_cache_dirs}/**/,
@{bin}/fusermount{,3} mr, umount @{HOME}/*/,
umount @{HOME}/*/*/,
umount @{user_cache_dirs}/**/,
/etc/fuse.conf r, owner @{user_img_dirs}/{,**} r, # Image files to be mounted
# Image files to be mounted
owner @{user_img_dirs}/{,**} r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/fuseiso_fusermount> include if exists <local/fuseiso_fusermount>
} }

10
apparmor.d/profiles-a-f/fusermount
View file

@ -10,10 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/fusermount{,3} @{exec_path} = @{bin}/fusermount{,3}
profile fusermount @{exec_path} { profile fusermount @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability dac_read_search,
capability sys_admin,
# Be able to mount ISO images # Be able to mount ISO images
mount fstype={fuse,fuse.*} -> @{HOME}/*/, mount fstype={fuse,fuse.*} -> @{HOME}/*/,
@ -36,7 +33,6 @@ profile fusermount @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/etc/fuse.conf r,
/etc/machine-id r, /etc/machine-id r,
/var/tmp/flatpak-cache-*/*/ r, /var/tmp/flatpak-cache-*/*/ r,
@ -51,10 +47,6 @@ profile fusermount @{exec_path} {
@{run}/user/@{uid}/doc/ r, @{run}/user/@{uid}/doc/ r,
@{PROC}/@{pid}/mounts r,
/dev/fuse rw,
include if exists <local/fusermount> include if exists <local/fusermount>
} }

31
apparmor.d/profiles-g-l/jmtpfs
View file

@ -18,8 +18,7 @@ profile jmtpfs @{exec_path} {
@{bin}/fusermount{,3} rCx -> fusermount, @{bin}/fusermount{,3} rCx -> fusermount,
owner @{tmp}/tmp* rw, /etc/magic r,
owner @{tmp}/#@{int} rw,
# Mount points # Mount points
owner @{HOME}/*/ r, owner @{HOME}/*/ r,
@ -27,36 +26,20 @@ profile jmtpfs @{exec_path} {
owner @{user_cache_dirs}/*/mtp{,-@{int}}/ rw, owner @{user_cache_dirs}/*/mtp{,-@{int}}/ rw,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/, owner @{tmp}/tmp* rw,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/*/, owner @{tmp}/#@{int} rw,
mount fstype={fuse,fuse.jmtpfs} -> @{user_cache_dirs}/*/*/,
/etc/magic r,
/dev/fuse rw,
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
# To mount anything:
capability sys_admin,
#
capability dac_read_search,
@{bin}/fusermount{,3} mr,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/, mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/*/, mount fstype={fuse,fuse.jmtpfs} -> @{HOME}/*/*/,
mount fstype={fuse,fuse.jmtpfs} -> @{user_cache_dirs}/*/*/, mount fstype={fuse,fuse.jmtpfs} -> @{user_cache_dirs}/*/*/,
/etc/fuse.conf r, umount @{HOME}/*/,
umount @{HOME}/*/*/,
/dev/fuse rw, umount @{user_cache_dirs}/*/*/,
@{PROC}/@{pid}/mounts r,
include if exists <local/jmtpfs_fusermount> include if exists <local/jmtpfs_fusermount>
} }

13
apparmor.d/profiles-s-z/s3fs
View file

@ -38,10 +38,7 @@ profile s3fs @{exec_path} {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/app/fusermount>
capability dac_read_search,
capability sys_admin,
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -52,19 +49,11 @@ profile s3fs @{exec_path} {
umount @{MOUNTS}/, umount @{MOUNTS}/,
umount @{MOUNTS}/*/, umount @{MOUNTS}/*/,
@{bin}/fusermount{,3} mr,
/etc/fuse.conf r,
@{MOUNTS}/ r, @{MOUNTS}/ r,
@{MOUNTS}/*/ r, @{MOUNTS}/*/ r,
owner @{tmp}/s3fstmp.* rw, owner @{tmp}/s3fstmp.* rw,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
include if exists <local/s3fs_fusermount> include if exists <local/s3fs_fusermount>
} }

15
apparmor.d/profiles-s-z/wechat-appimage
View file

@ -69,27 +69,14 @@ profile wechat-appimage @{exec_path} flags=(attach_disconnected) {
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/app/fusermount>
include <abstractions/nameservice-strict>
capability dac_override,
capability dac_read_search,
capability sys_admin,
mount fstype=fuse.wechat-appimage.AppImage options=(ro nodev nosuid) -> @{tmp}/.mount_wechat@{word6}/, mount fstype=fuse.wechat-appimage.AppImage options=(ro nodev nosuid) -> @{tmp}/.mount_wechat@{word6}/,
umount @{tmp}/.mount_wechat@{word6}/, umount @{tmp}/.mount_wechat@{word6}/,
@{bin}/fusermount{,3} mr,
@{lib_dirs}/wechat-appimage.AppImage r, @{lib_dirs}/wechat-appimage.AppImage r,
@{PROC}/@{pid}/mounts r,
/etc/fuse.conf r,
/dev/fuse rw,
include if exists <local/wechat-appimage_fusermount> include if exists <local/wechat-appimage_fusermount>
} }