From 2282128cbddc1017740071b8058c54bf7868e90c Mon Sep 17 00:00:00 2001
From: Alexandre Pujol <alexandre@pujol.io>
Date: Sat, 31 May 2025 13:43:57 +0200
Subject: [PATCH] feat(fsp): setup RBAC mapping in auth enabled profiles.

---
 apparmor.d/groups/ssh/sshd    | 15 ++++++++-------
 apparmor.d/groups/utils/chfn  |  1 +
 apparmor.d/groups/utils/chsh  |  1 +
 apparmor.d/groups/utils/login |  3 ++-
 apparmor.d/groups/utils/su    |  5 +++--
 apparmor.d/mappings/sudo/base | 30 ++++++++++++++++++++++++++++++
 6 files changed, 45 insertions(+), 10 deletions(-)
 create mode 100644 apparmor.d/mappings/sudo/base

diff --git a/apparmor.d/groups/ssh/sshd b/apparmor.d/groups/ssh/sshd
index 4b99aafd6..cc12a9eec 100644
--- a/apparmor.d/groups/ssh/sshd
+++ b/apparmor.d/groups/ssh/sshd
@@ -25,6 +25,7 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
   include <abstractions/nameservice-strict>
   include <abstractions/ssl_certs>
   include <abstractions/wutmp>
+  include <mappings/sshd> #aa:only RBAC
 
   capability audit_write,
   capability chown,
@@ -60,13 +61,13 @@ profile sshd @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mrix,
 
-  @{bin}/@{shells}                  rUx,
-  @{bin}/false                      rix,
-  @{sbin}/nologin                   rPx,
-  @{bin}/passwd                     rPx,
-  @{lib}/{openssh,ssh}/sftp-server  rPx,
-  @{lib}/{openssh,ssh}/sshd-auth    rPx,
-  @{lib}/{openssh,ssh}/sshd-session rix,
+  @{bin}/@{shells}                   Ux, #aa:exclude RBAC
+  @{bin}/false                       ix,
+  @{sbin}/nologin                    Px,
+  @{bin}/passwd                      Px,
+  @{lib}/{openssh,ssh}/sftp-server   Px,
+  @{lib}/{openssh,ssh}/sshd-auth     Px,
+  @{lib}/{openssh,ssh}/sshd-session  ix,
 
   @{etc_ro}/environment r,
   @{etc_ro}/security/limits.d/{,*.conf} r,
diff --git a/apparmor.d/groups/utils/chfn b/apparmor.d/groups/utils/chfn
index 45b50c7ad..824d92bf4 100644
--- a/apparmor.d/groups/utils/chfn
+++ b/apparmor.d/groups/utils/chfn
@@ -15,6 +15,7 @@ profile chfn @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
+  include <mappings/shadow>  #aa:only RBAC
 
   capability audit_write,
   capability chown,
diff --git a/apparmor.d/groups/utils/chsh b/apparmor.d/groups/utils/chsh
index e3581be31..a630a7733 100644
--- a/apparmor.d/groups/utils/chsh
+++ b/apparmor.d/groups/utils/chsh
@@ -15,6 +15,7 @@ profile chsh @{exec_path} {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
+  include <mappings/shadow> #aa:only RBAC
 
   capability audit_write,
   capability chown,
diff --git a/apparmor.d/groups/utils/login b/apparmor.d/groups/utils/login
index 6227f4fc5..c35001498 100644
--- a/apparmor.d/groups/utils/login
+++ b/apparmor.d/groups/utils/login
@@ -14,6 +14,7 @@ profile login @{exec_path} flags=(attach_disconnected) {
   include <abstractions/consoles>
   include <abstractions/nameservice-strict>
   include <abstractions/wutmp>
+  include <mappings/login>  #aa:only RBAC
 
   capability audit_write,
   capability chown,
@@ -38,7 +39,7 @@ profile login @{exec_path} flags=(attach_disconnected) {
 
   @{exec_path} mr,
 
-  @{shells_path}     rUx,
+  @{shells_path}     Ux, #aa:exclude RBAC
 
   @{etc_ro}/environment r,
   @{etc_ro}/security/group.conf r,
diff --git a/apparmor.d/groups/utils/su b/apparmor.d/groups/utils/su
index 81e299d23..c4e83ddfa 100644
--- a/apparmor.d/groups/utils/su
+++ b/apparmor.d/groups/utils/su
@@ -12,6 +12,7 @@ profile su @{exec_path} {
   include <abstractions/base>
   include <abstractions/app-launcher-root>
   include <abstractions/app/sudo>
+  include <mappings/su>  #aa:only RBAC
 
   capability chown,  # pseudo-terminal
 
@@ -21,8 +22,8 @@ profile su @{exec_path} {
 
   @{exec_path} mr,
 
-  @{bin}/@{shells}     rUx,
-  @{sbin}/nologin      rPx,
+  @{bin}/@{shells}     Ux, #aa:exclude RBAC
+  @{sbin}/nologin      Px,
 
   @{etc_ro}/default/su r,
   /etc/default/locale r,
diff --git a/apparmor.d/mappings/sudo/base b/apparmor.d/mappings/sudo/base
new file mode 100644
index 000000000..95e395501
--- /dev/null
+++ b/apparmor.d/mappings/sudo/base
@@ -0,0 +1,30 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# It is used by su/sudo to run pre login scripts (as root) such as the motd.
+# After the login, Apparmor libpam will transition to the roles defined in
+# other files under <mappings/sudo>
+
+  @{shells_path} rCx -> shell,
+
+  profile shell flags=(attach_disconnected) {
+    include <abstractions/base>
+    include <abstractions/consoles>
+    include <abstractions/shells>
+
+    @{shells_path}    rix,
+    @{bin}/env        rix,
+    @{bin}/run-parts  rix, #aa:only apt
+
+    #aa:only apt
+    /etc/update-motd.d/ r,
+    /etc/update-motd.d/*                            rPx,
+    /usr/share/landscape/landscape-sysinfo.wrapper  rPx,
+
+    @{run}/motd.dynamic.new rw,  #aa:only apt
+
+    include if exists <local/mappings/sudo/shell>
+  }
+
+# vim:syntax=apparmor