felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite debconf & add debconf-frontend.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:31:03 +02:00
parent 390cc27ab8
commit 49155625a5
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
12 changed files with 92 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/apt/aptitude
View file

@ -169,7 +169,7 @@ profile aptitude @{exec_path} flags=(complain) {
profile pager {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/app/pager>
owner @{tmp}/aptitude-*.@{pid}:*/aptitude-download-* rw,

32
apparmor.d/groups/apt/debconf-apt-progress
View file

@ -10,42 +10,12 @@ include <tunables/global>
@{exec_path} = @{bin}/debconf-apt-progress
profile debconf-apt-progress @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/perl>
include <abstractions/common/debconf>
@{exec_path} r,
@{bin}/apt-get rPx,
# Think what to do about this (#FIXME#)
/usr/share/debconf/frontend rPx,
#/usr/share/debconf/frontend rCx -> frontend,
profile frontend flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict>
/usr/share/debconf/frontend r,
@{bin}/debconf-apt-progress rPx,
@{sh_path} rix,
@{bin}/stty rix,
@{bin}/locale rix,
# The following is needed when debconf uses dialog/whiptail frontend.
@{bin}/whiptail rPx,
/etc/debconf.conf r,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
/usr/share/debconf/templates/adequate.templates r,
/etc/shadow r,
include if exists <local/debconf-apt-progress_frontend>
}
include if exists <local/debconf-apt-progress>
}

75
apparmor.d/groups/apt/debconf-frontend Normal file
View file

@ -0,0 +1,75 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/debconf/frontend
profile debconf-frontend @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/common/debconf>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
capability dac_read_search,
@{exec_path} r,
@{sh_path} rix,
@{bin}/hostname ix,
@{bin}/locale ix,
@{bin}/lsb_release Px -> lsb_release,
@{bin}/stty ix,
@{sbin}/update-secureboot-policy Px,
# debconf apps
@{bin}/adequate Px,
@{bin}/debconf-apt-progress Px,
@{bin}/linux-check-removal Px,
@{bin}/ucf Px,
@{bin}/whiptail Px,
@{sbin}/aspell-autobuildhash Px,
@{sbin}/pam-auth-update Px,
@{lib}/tasksel/tasksel-debconf Px -> tasksel,
/usr/share/debian-security-support/check-support-status.hook Px,
# Grub
@{lib}/grub/grub-multi-install Px,
/usr/share/grub/grub-check-signatures Px,
# Package maintainer's scripts
/var/lib/dpkg/info/*.@{dpkg_script_ext} Px,
/var/lib/dpkg/info/*.control r,
/var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px,
# DKMS scipts
@{lib}/dkms/common.postinst rPUx,
@{lib}/dkms/dkms-* rPUx,
@{lib}/dkms/dkms_* rPUx,
/usr/share/debconf/{,**} r,
/etc/inputrc r,
/etc/shadow r,
owner /var/cache/debconf/* rwk,
owner @{tmp}/file* w,
owner @{tmp}/tmp.@{rand10} rw,
owner @{tmp}/updateppds.@{rand6} rw,
@{HOME}/.Xauthority r,
@{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/debconf-frontend>
}
# vim:syntax=apparmor

2
apparmor.d/groups/apt/dpkg-script-apparmor
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/apparmor*
profile dpkg-script-apparmor @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/consoles>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-script-linux
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/linux*
profile dpkg-script-linux @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-script-systemd
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/info/systemd*
profile dpkg-script-systemd @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/consoles>
@{exec_path} mrix,

2
apparmor.d/groups/apt/dpkg-scripts
View file

@ -9,7 +9,7 @@ include <tunables/global>
@{exec_path} = /var/lib/dpkg/**
profile dpkg-scripts @{exec_path} {
include <abstractions/base>
include <abstractions/app/debconf>
include <abstractions/common/debconf>
include <abstractions/disks-read>
capability chown,

10
apparmor.d/groups/grub/grub-check-signatures
View file

@ -9,18 +9,14 @@ include <tunables/global>
@{exec_path} = /usr/share/grub/grub-check-signatures
profile grub-check-signatures @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/common/debconf>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}//mktemp rix,
@{bin}//od rix,
/usr/share/debconf/frontend rPx,
/usr/share/debconf/confmodule r,
@{bin}/mktemp rix,
@{bin}/od rix,
owner @{tmp}/tmp.@{rand10}/ rw,

2
apparmor.d/groups/grub/grub-multi-install
View file

@ -24,7 +24,7 @@ profile grub-multi-install @{exec_path} {
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/udevadm rPx,
/usr/share/debconf/frontend rPx,
/usr/share/debconf/frontend rix,
/usr/lib/terminfo/x/xterm-256color r,
/usr/share/debconf/confmodule r,

133
apparmor.d/profiles-a-f/frontend
View file

@ -1,133 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = /usr/share/debconf/frontend
profile frontend @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/perl>
capability dac_read_search,
@{exec_path} r,
@{bin}/perl r,
@{sh_path} rix,
@{bin}/hostname rix,
@{bin}/locale rix,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/stty rix,
@{sbin}/update-secureboot-policy rPx,
# debconf apps
@{bin}/adequate rPx,
@{sbin}/aspell-autobuildhash rPx,
@{bin}/debconf-apt-progress rPx,
@{bin}/linux-check-removal rPx,
@{sbin}/pam-auth-update rPx,
@{bin}/ucf rPx,
@{bin}/whiptail rPx,
@{lib}/tasksel/tasksel-debconf rPx -> tasksel,
/usr/share/debian-security-support/check-support-status.hook rPx,
# Grub
@{lib}/grub/grub-multi-install rPx,
/usr/share/grub/grub-check-signatures rPx,
# Run the package maintainer's scripts
# What to do with it? Maintainer scripts can use lots of tools. (#FIXME#)
#/var/lib/dpkg/info/*.{config,templates} rPUx,
#/var/lib/dpkg/info/*.{preinst,postinst} rPUx,
#/var/lib/dpkg/info/*.{prerm,postrm} rPUx,
/var/lib/dpkg/info/*.control r,
#/var/lib/dpkg/tmp.ci/{config,templates} rPUx,
#/var/lib/dpkg/tmp.ci/{preinst,postinst} rPUx,
#/var/lib/dpkg/tmp.ci/{prerm,postrm} rPUx,
/var/lib/dpkg/tmp.ci/control r,
/var/lib/dpkg/info/*.{config,templates} rCx -> scripts,
/var/lib/dpkg/info/*.{preinst,postinst} rCx -> scripts,
/var/lib/dpkg/info/*.{prerm,postrm} rCx -> scripts,
/var/lib/dpkg/tmp.ci/{config,templates} rCx -> scripts,
/var/lib/dpkg/tmp.ci/{preinst,postinst} rCx -> scripts,
/var/lib/dpkg/tmp.ci/{prerm,postrm} rCx -> scripts,
# DKMS scipts
# What to do with it? (#FIXME#)
@{lib}/dkms/common.postinst rPUx,
@{lib}/dkms/dkms-* rPUx,
@{lib}/dkms/dkms_* rPUx,
/usr/share/debconf/{,**} r,
/etc/debconf.conf r,
/etc/inputrc r,
/etc/shadow r,
owner /var/cache/debconf/* rwk,
owner @{tmp}/file* w,
owner @{tmp}/tmp.@{rand10} rw,
owner @{tmp}/updateppds.@{rand6} rw,
@{HOME}/.Xauthority r,
@{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/mounts r,
profile scripts flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
/var/lib/dpkg/info/*.config r,
/var/lib/dpkg/info/*.{preinst,postinst} r,
/var/lib/dpkg/info/*.{prerm,postrm} r,
/var/lib/dpkg/tmp.ci/config r,
/var/lib/dpkg/tmp.ci/{preinst,postinst} r,
/var/lib/dpkg/tmp.ci/{prerm,postrm} r,
/ r,
@{bin}/ r,
@{bin}/* rPUx,
@{lib}/ r,
@{lib}/** rPUx,
/usr/share/ r,
/usr/share/** rPUx,
/etc/init.d/ r,
/etc/init.d/* rPUx,
/etc/ r,
/etc/** rw,
/var/ r,
/var/** rw,
@{sys}/ r,
@{sys}/**/ r,
@{run}/ r,
@{run}/** rw,
/tmp/ r,
owner @{tmp}/** rw,
include if exists <local/frontend_scripts>
}
include if exists <local/frontend>
}
# vim:syntax=apparmor

49
apparmor.d/profiles-s-z/tasksel
View file

@ -10,32 +10,24 @@ include <tunables/global>
@{exec_path} = @{bin}/tasksel
profile tasksel @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/perl>
include <abstractions/common/debconf>
@{exec_path} r,
@{sh_path} rix,
@{bin}/tempfile rix,
@{lib}/tasksel/tasksel-debconf rix,
@{lib}/tasksel/tests/* rCx -> tasksel-tests,
# Think what to do about this (#FIXME#)
/usr/share/debconf/frontend rPx,
#/usr/share/debconf/frontend rCx -> frontend,
@{lib}/tasksel/tests/* Cx -> tasksel-tests,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-query rpx,
@{bin}/dpkg-query px,
#
@{bin}/apt-cache rPx,
@{bin}/apt-cache Px,
@{bin}/debconf-apt-progress Px,
@{bin}/debconf-apt-progress rPx,
/usr/share/tasksel/** r,
/usr/share/debconf/confmodule r,
/usr/share/tasksel/{,**} r,
owner @{tmp}/file* w,
@ -48,35 +40,6 @@ profile tasksel @{exec_path} flags=(complain) {
include if exists <local/tasksel_tasksel-tests>
}
profile frontend flags=(complain) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict>
/usr/share/debconf/frontend r,
@{bin}/tasksel rPx,
@{sh_path} rix,
@{bin}/stty rix,
@{bin}/locale rix,
# The following is needed when debconf uses dialog/whiptail frontend.
@{bin}/whiptail rPx,
owner @{tmp}/file* w,
/usr/share/debconf/confmodule r,
/etc/debconf.conf r,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-new,-old} rwk,
/usr/share/debconf/templates/adequate.templates r,
/etc/shadow r,
include if exists <local/tasksel_frontend>
}
include if exists <local/tasksel>
}

5
apparmor.d/profiles-s-z/update-secureboot-policy
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{sbin}/update-secureboot-policy
profile update-secureboot-policy @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/common/debconf>
@{exec_path} rm,
@ -23,12 +23,9 @@ profile update-secureboot-policy @{exec_path} {
@{bin}/sort rix,
@{bin}/touch rix,
@{bin}/wc rix,
/usr/share/debconf/frontend rPx,
/ r,
/usr/share/debconf/confmodule r,
/var/lib/dkms/ r,
/var/lib/shim-signed/dkms-list rw,