felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): rewrite user-read/user-write.

Browse source 
See #307
This commit is contained in:
Alexandre Pujol 2024-03-28 16:47:40 +00:00
parent b089a4d2c5
commit 2fc2394bad
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
18 changed files with 96 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/app/chromium
View file

@ -26,7 +26,7 @@
include <abstractions/thumbnails-cache-read>
include <abstractions/uim>
include <abstractions/user-download-strict>
include <abstractions/user-read>
include <abstractions/user-read-strict>
include <abstractions/video>
# userns,

27
apparmor.d/abstractions/user-read
View file

@ -2,29 +2,12 @@
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
# Warning: This abstraction gives unrestricted read access on all non hidden user directories.
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{user_books_dirs}/{,**} r,
owner @{user_documents_dirs}/{,**} r,
owner @{user_download_dirs}/{,**} r,
owner @{user_games_dirs}/{,**} r,
owner @{user_music_dirs}/{,**} r,
owner @{user_pictures_dirs}/{,**} r,
owner @{user_projects_dirs}/{,**} r,
owner @{user_publicshare_dirs}/{,**} r,
owner @{user_sync_dirs}/{,**} r,
owner @{user_templates_dirs}/{,**} r,
owner @{user_torrents_dirs}/{,**} r,
owner @{user_videos_dirs}/{,**} r,
owner @{user_vm_dirs}/{,**} r,
owner @{user_work_dirs}/{,**} r,
owner @{HOME}/[^.]** r,
owner @{MOUNTS}/[^.]** r,
include if exists <abstractions/user-read.d>

33
apparmor.d/abstractions/user-read-strict Normal file
View file

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{user_books_dirs}/{,**} r,
owner @{user_documents_dirs}/{,**} r,
owner @{user_download_dirs}/{,**} r,
owner @{user_games_dirs}/{,**} r,
owner @{user_music_dirs}/{,**} r,
owner @{user_pictures_dirs}/{,**} r,
owner @{user_projects_dirs}/{,**} r,
owner @{user_publicshare_dirs}/{,**} r,
owner @{user_sync_dirs}/{,**} r,
owner @{user_templates_dirs}/{,**} r,
owner @{user_torrents_dirs}/{,**} r,
owner @{user_videos_dirs}/{,**} r,
owner @{user_vm_dirs}/{,**} r,
owner @{user_work_dirs}/{,**} r,
include if exists <abstractions/user-read-strict.d>

33
apparmor.d/abstractions/user-write-strict Normal file
View file

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# This abstraction gives write only access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} wl,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} wl,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} wl,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} wl,
owner @{user_books_dirs}/{,**} wl,
owner @{user_documents_dirs}/{,**} wl,
owner @{user_download_dirs}/{,**} wl,
owner @{user_games_dirs}/{,**} wl,
owner @{user_music_dirs}/{,**} wl,
owner @{user_pictures_dirs}/{,**} wl,
owner @{user_projects_dirs}/{,**} wl,
owner @{user_publicshare_dirs}/{,**} wl,
owner @{user_sync_dirs}/{,**} wl,
owner @{user_templates_dirs}/{,**} wl,
owner @{user_torrents_dirs}/{,**} wl,
owner @{user_videos_dirs}/{,**} wl,
owner @{user_vm_dirs}/{,**} wl,
owner @{user_work_dirs}/{,**} wl,
include if exists <abstractions/user-write-strict.d>

17
apparmor.d/abstractions/user-write.d/complete
View file

@ -2,15 +2,10 @@
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} rwl,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} rwl,
# Warning: This abstraction gives unrestricted write access on all non hidden user directories.
owner @{user_books_dirs}/{,**} rwl,
owner @{user_documents_dirs}/{,**} rwl,
owner @{user_games_dirs}/{,**} rwl,
owner @{user_music_dirs}/{,**} rwl,
owner @{user_pictures_dirs}/{,**} rwl,
owner @{user_projects_dirs}/{,**} rwl,
owner @{user_videos_dirs}/{,**} rwl,
owner @{user_vm_dirs}/{,**} rwl,
owner @{user_work_dirs}/{,**} rwl,
owner @{HOME}/ r,
owner @{MOUNTS}/ r,
owner @{HOME}/[^.]** wl,
owner @{MOUNTS}/[^.]** wl,