feat(fsp): remove the default profiles.
This commit is contained in:
Alexandre Pujol
parent
217448d09a
commit
4ffbf84a00
5 changed files with 0 additions and 260 deletions
|
|
@ -1,56 +0,0 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
|
||||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
|
||||||
|
|
||||||
# Default profile for bwrap.
|
|
||||||
|
|
||||||
abi <abi/4.0>,
|
|
||||||
|
|
||||||
include <tunables/global>
|
|
||||||
|
|
||||||
@{exec_path} = @{bin}/bwrap
|
|
||||||
profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|
||||||
include <abstractions/base>
|
|
||||||
include <abstractions/common/bwrap>
|
|
||||||
include <abstractions/common/app>
|
|
||||||
include <abstractions/dbus>
|
|
||||||
include <abstractions/fontconfig-cache-write>
|
|
||||||
|
|
||||||
capability dac_override,
|
|
||||||
capability dac_read_search,
|
|
||||||
capability sys_resource,
|
|
||||||
|
|
||||||
network inet dgram,
|
|
||||||
network inet6 dgram,
|
|
||||||
network inet stream,
|
|
||||||
network inet6 stream,
|
|
||||||
|
|
||||||
ptrace peer=bwrap//&bwrap-app,
|
|
||||||
|
|
||||||
signal peer=bwrap//&bwrap-app,
|
|
||||||
signal (receive) set=(kill),
|
|
||||||
|
|
||||||
@{bin}/** rm,
|
|
||||||
@{lib}/** rm,
|
|
||||||
/opt/*/** rm,
|
|
||||||
/usr/share/*/* rm,
|
|
||||||
|
|
||||||
@{bin}/** Px -> bwrap//&bwrap-app,
|
|
||||||
@{bin}/xdg-dbus-proxy Px -> bwrap//&xdg-dbus-proxy,
|
|
||||||
# @{lib}/** Px -> bwrap//&bwrap-app,
|
|
||||||
/opt/*/** Px -> bwrap//&bwrap-app,
|
|
||||||
/usr/share/*/* Px -> bwrap//&bwrap-app,
|
|
||||||
|
|
||||||
/usr/.ref rk,
|
|
||||||
|
|
||||||
/bindfile@{rand6} rw,
|
|
||||||
|
|
||||||
owner /var/cache/ w,
|
|
||||||
|
|
||||||
owner @{run}/ld-so-cache-dir/* rw,
|
|
||||||
|
|
||||||
include if exists <usr/bwrap.d>
|
|
||||||
include if exists <local/bwrap>
|
|
||||||
}
|
|
||||||
|
|
||||||
# vim:syntax=apparmor
|
|
||||||
|
|
@ -1,36 +0,0 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
|
||||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
|
||||||
|
|
||||||
# Default profile for user sandboxed application
|
|
||||||
|
|
||||||
abi <abi/4.0>,
|
|
||||||
|
|
||||||
include <tunables/global>
|
|
||||||
|
|
||||||
profile bwrap-app flags=(attach_disconnected,mediate_deleted) {
|
|
||||||
include <abstractions/base>
|
|
||||||
include <abstractions/common/app>
|
|
||||||
|
|
||||||
network inet dgram,
|
|
||||||
network inet6 dgram,
|
|
||||||
network inet stream,
|
|
||||||
network inet6 stream,
|
|
||||||
network netlink raw,
|
|
||||||
|
|
||||||
ptrace peer=bwrap//&bwrap-app,
|
|
||||||
|
|
||||||
signal peer=bwrap//&bwrap-app,
|
|
||||||
|
|
||||||
@{bin}/** rmix,
|
|
||||||
@{lib}/** rmix,
|
|
||||||
/opt/*/** rmix,
|
|
||||||
/usr/share/*/* rmix,
|
|
||||||
|
|
||||||
owner /var/cache/ w,
|
|
||||||
|
|
||||||
include if exists <usr/bwrap-app.d>
|
|
||||||
include if exists <local/bwrap-app>
|
|
||||||
}
|
|
||||||
|
|
||||||
# vim:syntax=apparmor
|
|
||||||
|
|
@ -1,122 +0,0 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
|
||||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
|
||||||
|
|
||||||
# Default profile for unconfined programs
|
|
||||||
|
|
||||||
abi <abi/4.0>,
|
|
||||||
|
|
||||||
include <tunables/global>
|
|
||||||
|
|
||||||
@{exec_path} = /**
|
|
||||||
profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
|
||||||
include <abstractions/base>
|
|
||||||
include <abstractions/audio-client>
|
|
||||||
include <abstractions/consoles>
|
|
||||||
include <abstractions/dbus-session>
|
|
||||||
include <abstractions/dconf-write>
|
|
||||||
include <abstractions/desktop>
|
|
||||||
include <abstractions/devices-usb>
|
|
||||||
include <abstractions/graphics>
|
|
||||||
include <abstractions/nameservice-strict>
|
|
||||||
include <abstractions/p11-kit>
|
|
||||||
include <abstractions/shells>
|
|
||||||
include <abstractions/ssl_certs>
|
|
||||||
include <abstractions/video>
|
|
||||||
|
|
||||||
capability dac_override,
|
|
||||||
capability dac_read_search,
|
|
||||||
|
|
||||||
network inet dgram,
|
|
||||||
network inet6 dgram,
|
|
||||||
network inet stream,
|
|
||||||
network inet6 stream,
|
|
||||||
network netlink dgram,
|
|
||||||
network netlink raw,
|
|
||||||
|
|
||||||
signal receive set=hup,
|
|
||||||
|
|
||||||
@{bin}/bwrap rPx -> bwrap,
|
|
||||||
@{bin}/pipewire-pulse rPx -> systemd//&pipewire-pulse,
|
|
||||||
@{bin}/pulseaudio rPx -> systemd//&pulseaudio,
|
|
||||||
@{bin}/su rPx -> default-sudo,
|
|
||||||
@{bin}/sudo rPx -> default-sudo,
|
|
||||||
@{bin}/systemctl rix,
|
|
||||||
@{coreutils_path} rix,
|
|
||||||
@{shells_path} rix,
|
|
||||||
|
|
||||||
@{pager_path} rPx -> child-pager,
|
|
||||||
|
|
||||||
# @{open_path} rPx -> child-open,
|
|
||||||
|
|
||||||
audit @{bin}/** Pix,
|
|
||||||
audit @{lib}/** Pix,
|
|
||||||
audit /opt/*/** Pix,
|
|
||||||
audit /usr/share/*/* Pix,
|
|
||||||
|
|
||||||
@{bin}/{,**} r,
|
|
||||||
@{lib}/{,**} r,
|
|
||||||
/usr/share/** r,
|
|
||||||
|
|
||||||
/etc/xdg/** r,
|
|
||||||
|
|
||||||
# Full access to user's data
|
|
||||||
/ r,
|
|
||||||
/*/ r,
|
|
||||||
@{MOUNTDIRS}/ r,
|
|
||||||
@{MOUNTS}/ r,
|
|
||||||
@{MOUNTS}/** rwl,
|
|
||||||
owner @{HOME}/{,**} rwlk,
|
|
||||||
owner @{run}/user/@{uid}/{,**} rw,
|
|
||||||
owner @{tmp}/{,**} rwk,
|
|
||||||
owner @{run}/user/@{uid}/{,**} rwlk,
|
|
||||||
|
|
||||||
@{run}/motd.dynamic.new rw,
|
|
||||||
|
|
||||||
@{run}/udev/data/+input:input@{int} r, # for mouse, keyboard, touchpad
|
|
||||||
|
|
||||||
@{run}/udev/data/c13:@{int} r, # for /dev/input/*
|
|
||||||
|
|
||||||
@{sys}/ r,
|
|
||||||
@{sys}/bus/ r,
|
|
||||||
@{sys}/bus/pci/devices/ r,
|
|
||||||
@{sys}/class/ r,
|
|
||||||
@{sys}/class/drm/ r,
|
|
||||||
@{sys}/class/hidraw/ r,
|
|
||||||
@{sys}/class/input/ r,
|
|
||||||
@{sys}/class/power_supply/ r,
|
|
||||||
@{sys}/devices/**/input@{int}/ r,
|
|
||||||
@{sys}/devices/**/input@{int}/capabilities/* r,
|
|
||||||
@{sys}/devices/**/input/input@{int}/ r,
|
|
||||||
@{sys}/devices/**/uevent r,
|
|
||||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
|
||||||
@{sys}/firmware/acpi/pm_profile r,
|
|
||||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
|
|
||||||
|
|
||||||
@{PROC}/cmdline r,
|
|
||||||
@{PROC}/sys/kernel/seccomp/actions_avail r,
|
|
||||||
@{PROC}/zoneinfo r,
|
|
||||||
owner @{PROC}/@{pid}/cgroup r,
|
|
||||||
owner @{PROC}/@{pid}/gid_map w,
|
|
||||||
owner @{PROC}/@{pid}/limits r,
|
|
||||||
owner @{PROC}/@{pid}/loginuid r,
|
|
||||||
owner @{PROC}/@{pid}/mem r,
|
|
||||||
owner @{PROC}/@{pid}/mountinfo r,
|
|
||||||
owner @{PROC}/@{pid}/mounts r,
|
|
||||||
owner @{PROC}/@{pid}/oom_{,score_}adj rw,
|
|
||||||
owner @{PROC}/@{pid}/stat r,
|
|
||||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
|
||||||
owner @{PROC}/@{pids}/cmdline r,
|
|
||||||
owner @{PROC}/@{pids}/environ r,
|
|
||||||
owner @{PROC}/@{pids}/task/ r,
|
|
||||||
|
|
||||||
/dev/ r,
|
|
||||||
/dev/ptmx rwk,
|
|
||||||
/dev/tty rwk,
|
|
||||||
owner /dev/tty@{int} rw,
|
|
||||||
|
|
||||||
include if exists <usr/default.d>
|
|
||||||
include if exists <local/default>
|
|
||||||
}
|
|
||||||
|
|
||||||
# vim:syntax=apparmor
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
# apparmor.d - Full set of apparmor profiles
|
|
||||||
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
||||||
# SPDX-License-Identifier: GPL-2.0-only
|
|
||||||
|
|
||||||
abi <abi/4.0>,
|
|
||||||
|
|
||||||
include <tunables/global>
|
|
||||||
|
|
||||||
profile default-sudo {
|
|
||||||
include <abstractions/base>
|
|
||||||
include <abstractions/app/sudo>
|
|
||||||
|
|
||||||
capability chown,
|
|
||||||
capability mknod,
|
|
||||||
capability sys_ptrace,
|
|
||||||
|
|
||||||
network inet dgram,
|
|
||||||
network inet6 dgram,
|
|
||||||
|
|
||||||
ptrace (read),
|
|
||||||
|
|
||||||
@{bin}/su mr,
|
|
||||||
|
|
||||||
@{bin}/** Px,
|
|
||||||
@{lib}/** Px,
|
|
||||||
/opt/*/** Px,
|
|
||||||
|
|
||||||
/var/db/sudo/lectured/ r,
|
|
||||||
/var/lib/extrausers/shadow r,
|
|
||||||
/var/lib/sudo/lectured/ r,
|
|
||||||
owner /var/db/sudo/lectured/@{uid} rw,
|
|
||||||
owner /var/lib/sudo/lectured/* rw,
|
|
||||||
|
|
||||||
owner @{HOME}/.sudo_as_admin_successful rw,
|
|
||||||
|
|
||||||
@{run}/ r,
|
|
||||||
@{run}/systemd/sessions/* r,
|
|
||||||
|
|
||||||
include if exists <local/default-sudo>
|
|
||||||
}
|
|
||||||
|
|
||||||
# vim:syntax=apparmor
|
|
||||||
|
|
@ -1,10 +1,6 @@
|
||||||
# Common profile flags definition for all distributions
|
# Common profile flags definition for all distributions
|
||||||
# File format: one profile by line using the format: '<profile> <flags>'
|
# File format: one profile by line using the format: '<profile> <flags>'
|
||||||
|
|
||||||
bwrap attach_disconnected,mediate_deleted,complain
|
|
||||||
bwrap-app attach_disconnected,mediate_deleted,complain
|
|
||||||
default attach_disconnected,mediate_deleted,complain
|
|
||||||
default-sudo attach_disconnected,complain
|
|
||||||
systemd attach_disconnected,mediate_deleted,complain
|
systemd attach_disconnected,mediate_deleted,complain
|
||||||
systemd-service attach_disconnected,complain
|
systemd-service attach_disconnected,complain
|
||||||
systemd-user attach_disconnected,mediate_deleted,complain
|
systemd-user attach_disconnected,mediate_deleted,complain
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue