update apparmor profiles
This commit is contained in:
Mikhail Morfikov
Alexandre Pujol
parent
efda369670
commit
2a6b2bd189
70 changed files with 221 additions and 144 deletions
|
|
@ -52,7 +52,7 @@ profile android-studio @{exec_path} {
|
|||
|
||||
/{usr/,}bin/python3.[0-9]* rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
|
|
|
|||
|
|
@ -44,8 +44,8 @@ profile code @{exec_path} {
|
|||
#/{usr/,}bin/{,e}grep rix,
|
||||
#/{usr/,}bin/id rix,
|
||||
#/{usr/,}bin/readlink rix,
|
||||
#/{usr/,}bin/which rix,
|
||||
#/{usr/,}{s,}bin/ifconfig rix,
|
||||
#/{usr/,}bin/which{,.debianutils} rix,
|
||||
#/{usr/,}sbin/ifconfig rix,
|
||||
|
||||
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
||||
|
||||
|
|
|
|||
|
|
@ -113,6 +113,8 @@ profile freetube @{exec_path} {
|
|||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/mpv rPx,
|
||||
/{usr/,}bin/vlc rPx,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
|
@ -135,6 +137,8 @@ profile freetube @{exec_path} {
|
|||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/mpv rPx,
|
||||
/{usr/,}bin/vlc rPx,
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ profile telegram-desktop @{exec_path} {
|
|||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
|
|
@ -77,9 +77,13 @@ profile telegram-desktop @{exec_path} {
|
|||
|
||||
/usr/share/hwdata/pnp.ids r,
|
||||
|
||||
owner @{HOME}/.config/qt5ct/{,**} r,
|
||||
/usr/share/qt5ct/** r,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/smplayer rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
|
||||
|
|
@ -106,6 +110,7 @@ profile telegram-desktop @{exec_path} {
|
|||
/{usr/,}lib/firefox/firefox rPx,
|
||||
/{usr/,}bin/smplayer rPx,
|
||||
/{usr/,}bin/qpdfview rPx,
|
||||
/{usr/,}bin/viewnior rPUx,
|
||||
/{usr/,}bin/geany rPx,
|
||||
|
||||
# file_inherit
|
||||
|
|
|
|||
|
|
@ -56,7 +56,7 @@ profile thunderbird @{exec_path} {
|
|||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/tr rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
|
||||
/{usr/,}bin/ps rPx,
|
||||
/{usr/,}bin/dig rix,
|
||||
|
|
|
|||
|
|
@ -158,7 +158,7 @@ profile vlc @{exec_path} {
|
|||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/xset rix,
|
||||
/{usr/,}bin/xautolock rix,
|
||||
/{usr/,}bin/dbus-send rix,
|
||||
|
|
|
|||
|
|
@ -127,7 +127,7 @@ profile apt @{exec_path} flags=(complain) {
|
|||
/{usr/,}bin/sensible-editor mr,
|
||||
/{usr/,}bin/vim.* mrix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
|
||||
owner @{HOME}/.selected_editor r,
|
||||
|
||||
|
|
|
|||
|
|
@ -29,6 +29,8 @@ profile apt-forktracer @{exec_path} {
|
|||
/var/lib/apt/lists/ r,
|
||||
/var/lib/apt/lists/*_InRelease r,
|
||||
|
||||
/var/cache/apt/pkgcache.bin{,.*} rw,
|
||||
|
||||
/usr/share/distro-info/debian.csv r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -136,7 +136,7 @@ profile apt-get @{exec_path} flags=(complain) {
|
|||
/{usr/,}bin/sensible-pager mr,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/less rix,
|
||||
|
||||
owner @{HOME}/.less* rw,
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ profile apt-listchanges @{exec_path} {
|
|||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/less rix,
|
||||
|
||||
owner @{HOME}/.less* rw,
|
||||
|
|
|
|||
|
|
@ -45,6 +45,8 @@ profile apt-methods-gpgv @{exec_path} {
|
|||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/sort rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/gawk rix,
|
||||
/{usr/,}bin/base64 rix,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
|
|
@ -78,7 +80,10 @@ profile apt-methods-gpgv @{exec_path} {
|
|||
|
||||
# Local keyring storage
|
||||
/etc/keyrings/ r,
|
||||
/etc/keyrings/*.gpg r,
|
||||
/etc/keyrings/*.{gpg,asc} r,
|
||||
|
||||
# Extrepo keyring storage
|
||||
/var/lib/extrepo/keys/*.{gpg,asc} r,
|
||||
|
||||
# For package building
|
||||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ profile apt-systemd-daily @{exec_path} {
|
|||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
/{usr/,}bin/savelog rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
|
|
|
|||
|
|
@ -174,7 +174,7 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
/{usr/,}bin/sensible-pager mr,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/less rix,
|
||||
|
||||
owner @{HOME}/.less* rw,
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ profile aptitude-create-state-bundle @{exec_path} {
|
|||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/tar rix,
|
||||
/{usr/,}bin/bzip2 rix,
|
||||
/{usr/,}bin/gzip rix,
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ profile cron-apt-compat @{exec_path} {
|
|||
/{usr/,}bin/dd rix,
|
||||
/{usr/,}bin/cksum rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/sleep rix,
|
||||
|
||||
include if exists <local/cron-apt-compat>
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ profile cron-apt-xapian-index @{exec_path} {
|
|||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
|
||||
/{usr/,}bin/nice rix,
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ profile cron-aptitude @{exec_path} {
|
|||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ profile cron-popularity-contest @{exec_path} {
|
|||
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/mv rix,
|
||||
|
|
|
|||
|
|
@ -92,9 +92,12 @@ profile reportbug @{exec_path} {
|
|||
@{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
owner /tmp/reportbug-*-[0-9]*-@{pid}-* rw,
|
||||
owner /tmp/[a-z0-9]* rw,
|
||||
owner /tmp/* rw,
|
||||
owner /var/tmp/*.bug{,~} rw,
|
||||
|
||||
owner @{HOME}/draftbugreports/ r,
|
||||
owner @{HOME}/draftbugreports/reportbug-* rw,
|
||||
|
||||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
|
|
@ -114,7 +117,8 @@ profile reportbug @{exec_path} {
|
|||
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
|
||||
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
||||
|
||||
owner /tmp/reportbug-*-{signed,unsigned}-[0-9]*-[0-9]*-* rw,
|
||||
owner /tmp/reportbug-*-{signed,unsigned}-* rw,
|
||||
owner @{HOME}/draftbugreports/reportbug-*-{signed,unsigned}-* rw,
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ profile brave-browser @{exec_path} {
|
|||
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ profile google-chrome-google-chrome @{exec_path} {
|
|||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/mkdir rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ profile opera @{exec_path} {
|
|||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
|
||||
@{OPERA_INSTALLDIR}/opera_sandbox rPx,
|
||||
@{OPERA_INSTALLDIR}/opera_crashreporter rPx,
|
||||
|
|
|
|||
|
|
@ -1,15 +1,17 @@
|
|||
include <tunables/global>
|
||||
include <tunables/torbrowser>
|
||||
#include <tunables/global>
|
||||
#include <tunables/torbrowser>
|
||||
|
||||
@{torbrowser_firefox_executable} = /home/*/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/firefox.real
|
||||
|
||||
profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
||||
include <abstractions/audio>
|
||||
include <abstractions/gnome>
|
||||
#include <abstractions/audio>
|
||||
#include <abstractions/gnome>
|
||||
#include <abstractions/ibus>
|
||||
#include if exists <abstractions/vulkan>
|
||||
|
||||
# Uncomment the following lines if you want to give the Tor Browser read-write
|
||||
# access to most of your personal files.
|
||||
# include <abstractions/user-download>
|
||||
# #include <abstractions/user-download>
|
||||
# @{HOME}/ r,
|
||||
|
||||
# Audio support
|
||||
|
|
@ -36,6 +38,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
/dev/ r,
|
||||
/dev/shm/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/environ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
|
@ -90,6 +93,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
/usr/share/gnome/applications/ r,
|
||||
/usr/share/gnome/applications/kde4/ r,
|
||||
/usr/share/poppler/cMap/ r,
|
||||
/etc/xdg/mimeapps.list r,
|
||||
|
||||
# Distribution homepage
|
||||
/usr/share/homepage/ r,
|
||||
|
|
@ -99,6 +103,7 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
/sys/devices/system/cpu/present r,
|
||||
/sys/devices/system/node/ r,
|
||||
/sys/devices/system/node/node[0-9]*/meminfo r,
|
||||
/sys/fs/cgroup/cpu,cpuacct/{,user.slice/}cpu.cfs_quota_us r,
|
||||
deny /sys/devices/virtual/block/*/uevent r,
|
||||
|
||||
# Should use abstractions/gstreamer instead once merged upstream
|
||||
|
|
@ -111,6 +116,9 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
owner /{dev,run}/shm/org.chromium.* rw,
|
||||
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, # for Chromium IPC
|
||||
|
||||
# Required for Wayland display protocol support
|
||||
owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
|
||||
|
||||
# Deny access to DRM nodes, that's granted by the X abstraction, which is
|
||||
# sourced by the gnome abstraction, that we include.
|
||||
deny /dev/dri/** rwklx,
|
||||
|
|
@ -126,7 +134,6 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
deny /sys/devices/system/cpu/*/cache/index[0-9]*/size r,
|
||||
deny /run/user/[0-9]*/dconf/user rw,
|
||||
deny /usr/bin/lsb_release x,
|
||||
deny capability sys_admin,
|
||||
|
||||
# Silence denial logs about PulseAudio
|
||||
deny /etc/pulse/client.conf r,
|
||||
|
|
@ -143,10 +150,16 @@ profile torbrowser_firefox @{torbrowser_firefox_executable} {
|
|||
/sys/class/ r,
|
||||
/sys/bus/ r,
|
||||
/sys/class/hidraw/ r,
|
||||
/run/udev/data/c24{7,9}:* r,
|
||||
/run/udev/data/c24{5,7,9}:* r,
|
||||
/dev/hidraw* rw,
|
||||
# Yubikey NEO also needs this:
|
||||
/sys/devices/**/hidraw/hidraw*/uevent r,
|
||||
|
||||
include if exists <local/torbrowser.Browser.firefox>
|
||||
# Needed for Firefox sandboxing via unprivileged user namespaces
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
owner @{PROC}/@{pid}/{gid,uid}_map w,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
|
||||
#include if exists <local/torbrowser.Browser.firefox>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -45,10 +45,10 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/oom_score_adj rw,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
@{sys}/module/apparmor/parameters/enabled r,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,19 @@ include <tunables/global>
|
|||
@{exec_path} = /etc/cron.daily/exim4-base
|
||||
profile cron-exim4-base @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
capability audit_write,
|
||||
capability sys_ptrace,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
@ -25,12 +36,21 @@ profile cron-exim4-base @{exec_path} {
|
|||
/{usr/,}sbin/eximstats rix,
|
||||
|
||||
/{usr/,}sbin/exim4 rPx,
|
||||
/{usr/,}sbin/exim_tidydb rix,
|
||||
|
||||
/{usr/,}sbin/start-stop-daemon rix,
|
||||
/{usr/,}sbin/runuser rix,
|
||||
|
||||
/etc/default/exim4 r,
|
||||
|
||||
/var/spool/exim4/db/ r,
|
||||
/var/spool/exim4/db/* rwk,
|
||||
|
||||
@{PROC}/ r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/1/limits r,
|
||||
|
||||
/etc/security/limits.d/ r,
|
||||
|
||||
include if exists <local/cron-exim4-base>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile cron-mlocate @{exec_path} {
|
|||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/true rix,
|
||||
/{usr/,}bin/flock rix,
|
||||
/{usr/,}bin/nocache rix,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile cron-plocate @{exec_path} {
|
|||
@{exec_path} r,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/true rix,
|
||||
/{usr/,}bin/flock rix,
|
||||
/{usr/,}bin/nocache rix,
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ profile crontab @{exec_path} {
|
|||
/{usr/,}bin/sensible-editor mr,
|
||||
/{usr/,}bin/vim.* mrix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
|
||||
owner @{HOME}/.selected_editor r,
|
||||
|
||||
|
|
|
|||
|
|
@ -68,6 +68,10 @@ profile gpg @{exec_path} {
|
|||
owner /tmp/.#lk0x[0-9a-f]*.*.@{pid}x rwl -> /tmp/.#lk0x[0-9a-f]*.*.@{pid},
|
||||
owner @{run}/user/@{uid}/gnupg/d.*/ rw,
|
||||
|
||||
# APT upstream/user keyrings
|
||||
/usr/share/keyrings/*.{gpg,asc} r,
|
||||
/etc/keyrings/*.{gpg,asc} r,
|
||||
|
||||
# Verify files
|
||||
owner @{HOME}/** r,
|
||||
owner @{MOUNTS}/*/** r,
|
||||
|
|
|
|||
|
|
@ -86,7 +86,7 @@ profile openvpn @{exec_path} {
|
|||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/which{,.debianutils} rix,
|
||||
/{usr/,}bin/ip rix,
|
||||
/{usr/,}{s,}bin/xtables-nft-multi rix,
|
||||
|
||||
|
|
|
|||
|
|
@ -25,6 +25,7 @@ profile systemd-hostnamed @{exec_path} {
|
|||
@{sys}/devices/virtual/dmi/id/uevent r,
|
||||
|
||||
@{run}/udev/data/+dmi:id r,
|
||||
@{sys}/firmware/dmi/entries/*/raw r,
|
||||
|
||||
/etc/hostname rw,
|
||||
/etc/.#hostname* rw,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue