From 6583a7bfb232a356cb7eee1232cf4fb9d5eab95c Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sat, 4 Sep 2021 13:59:45 +0100 Subject: [PATCH] Update profiles. --- apparmor.d/groups/bus/ibus-dconf | 4 ++-- apparmor.d/groups/bus/ibus-engine-simple | 4 ++-- apparmor.d/groups/bus/ibus-extension-gtk3 | 2 +- apparmor.d/groups/bus/ibus-portal | 4 ++-- apparmor.d/groups/bus/ibus-x11 | 4 ++-- apparmor.d/groups/gnome/gnome-control-center | 1 + apparmor.d/groups/gnome/gnome-shell | 4 ++-- apparmor.d/groups/gnome/tracker-extract | 1 + apparmor.d/groups/gpg/gpg | 2 ++ .../groups/gvfs/gvfs-udisks2-volume-monitor | 2 +- apparmor.d/groups/network/openvpn | 14 +------------ apparmor.d/groups/pacman/paccache | 2 +- apparmor.d/groups/pacman/pacman | 1 + apparmor.d/groups/pacman/pacman-hook-dconf | 6 ++++++ apparmor.d/groups/pacman/pacman-hook-depmod | 4 ++++ apparmor.d/groups/pacman/pacman-hook-dkms | 6 ++++++ apparmor.d/groups/pacman/pacman-hook-gio | 9 ++++++++- .../pacman/pacman-hook-mkinitcpio-install | 4 ++++ apparmor.d/groups/pacman/pacman-hook-perl | 3 +++ apparmor.d/groups/pacman/pacman-hook-systemd | 18 ++++++++--------- .../groups/systemd/systemd-ask-password | 20 +++++++++++++++++++ apparmor.d/profiles-a-l/browserpass | 1 + apparmor.d/profiles-a-l/gio-querymodules | 1 + apparmor.d/profiles-a-l/kmod | 5 +++-- apparmor.d/profiles-m-z/run-parts | 1 + apparmor.d/profiles-m-z/update-initramfs | 5 +++-- 26 files changed, 88 insertions(+), 40 deletions(-) create mode 100644 apparmor.d/groups/systemd/systemd-ask-password diff --git a/apparmor.d/groups/bus/ibus-dconf b/apparmor.d/groups/bus/ibus-dconf index bb755ca5f..a4fe0cffd 100644 --- a/apparmor.d/groups/bus/ibus-dconf +++ b/apparmor.d/groups/bus/ibus-dconf @@ -20,8 +20,8 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) { /etc/dconf/db/ibus r, /var/lib/dbus/machine-id r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, - /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, + /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, include owner @{run}/user/@{uid}/dconf/ rw, diff --git a/apparmor.d/groups/bus/ibus-engine-simple b/apparmor.d/groups/bus/ibus-engine-simple index e1b551fd7..55db40247 100644 --- a/apparmor.d/groups/bus/ibus-engine-simple +++ b/apparmor.d/groups/bus/ibus-engine-simple @@ -16,8 +16,8 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) { /var/lib/dbus/machine-id r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, - /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, + /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/bus/ibus-extension-gtk3 b/apparmor.d/groups/bus/ibus-extension-gtk3 index 0711605b7..46d110a35 100644 --- a/apparmor.d/groups/bus/ibus-extension-gtk3 +++ b/apparmor.d/groups/bus/ibus-extension-gtk3 @@ -30,7 +30,7 @@ profile ibus-extension-gtk3 @{exec_path} { /var/lib/dbus/machine-id r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, include owner @{run}/user/@{uid}/dconf/ rw, diff --git a/apparmor.d/groups/bus/ibus-portal b/apparmor.d/groups/bus/ibus-portal index c1069f1af..c2e768d41 100644 --- a/apparmor.d/groups/bus/ibus-portal +++ b/apparmor.d/groups/bus/ibus-portal @@ -20,8 +20,8 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) { /usr/share/locale/locale.alias r, /var/lib/dbus/machine-id r, - /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, owner /dev/tty[0-9]* rw, /dev/null rw, diff --git a/apparmor.d/groups/bus/ibus-x11 b/apparmor.d/groups/bus/ibus-x11 index af1a8b068..12c2fbe0a 100644 --- a/apparmor.d/groups/bus/ibus-x11 +++ b/apparmor.d/groups/bus/ibus-x11 @@ -20,8 +20,8 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) { /var/lib/dbus/machine-id r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, - /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, + /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 096172796..4d7f9619d 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -81,6 +81,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* @{run}/udev/data/c235:[0-9]* r, @{run}/udev/data/c236:[0-9]* r, + @{run}/udev/data/c510:[0-9]* r, @{run}/udev/data/n[0-9]* r, @{sys}/bus/ r, diff --git a/apparmor.d/groups/gnome/gnome-shell b/apparmor.d/groups/gnome/gnome-shell index cf4ba3623..19c8d5218 100644 --- a/apparmor.d/groups/gnome/gnome-shell +++ b/apparmor.d/groups/gnome/gnome-shell @@ -69,9 +69,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) { owner @{user_config_dirs}/.goutputstream{,*} rw, owner @{user_config_dirs}/ibus/* r, - owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, owner @{user_config_dirs}/monitors.xml{,~} rwl, - /var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r, + /var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r, owner @{user_share_dirs}/backgrounds/{,**} rw, owner @{user_share_dirs}/gnome-shell/{,**} rw, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 008a086df..c6d7eadaf 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -40,6 +40,7 @@ profile tracker-extract @{exec_path} { @{run}/udev/data/c235:* r, @{run}/udev/data/c236:* r, + @{run}/udev/data/c510:* r, /dev/video[0-9]* rw, diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg index 5fda539ea..d75931dac 100644 --- a/apparmor.d/groups/gpg/gpg +++ b/apparmor.d/groups/gpg/gpg @@ -14,6 +14,8 @@ profile gpg @{exec_path} { include include + network netlink raw, + @{exec_path} mrix, /{usr/,}bin/gpgconf rPx, diff --git a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor index 1acf578bb..bde2960b9 100644 --- a/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor +++ b/apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor @@ -36,7 +36,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} { # Mount points @{MOUNTS}/*/ r, - @{MOUNTS}/*/*/ r, + @{MOUNTS}/*/**/ r, @{HOME}/*/*/ r, @{HOME}/*/*/**/ r, @{HOME}/bluetooth/ r, diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn index d4bde168b..0f45c1fc1 100644 --- a/apparmor.d/groups/network/openvpn +++ b/apparmor.d/groups/network/openvpn @@ -65,7 +65,7 @@ profile openvpn @{exec_path} { @{run}/NetworkManager/nm-openvpn-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, /{usr/,}bin/ip rix, - /{usr/,}bin/systemd-ask-password rCx -> systemd-ask-password, + /{usr/,}bin/systemd-ask-password rPx, /{usr/,}lib/nm-openvpn-service-openvpn-helper rPx, /etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn, /etc/openvpn/update-resolv-conf{,.sh} rCx -> update-resolv, @@ -74,18 +74,6 @@ profile openvpn @{exec_path} { owner @{PROC}/@{pid}/net/route r, - - profile systemd-ask-password { - include - include - - /{usr/,}bin/systemd-ask-password mr, - - @{PROC}/filesystems r, - owner @{PROC}/@{pid}/stat r, - - } - profile update-resolv { include include diff --git a/apparmor.d/groups/pacman/paccache b/apparmor.d/groups/pacman/paccache index a480e8e09..2dd92c43d 100644 --- a/apparmor.d/groups/pacman/paccache +++ b/apparmor.d/groups/pacman/paccache @@ -20,7 +20,7 @@ profile paccache @{exec_path} { /{usr/,}bin/cat rix, /{usr/,}bin/gawk rix, /{usr/,}bin/gettext rix, - /{usr/,}bin/pacman rPUx, + /{usr/,}bin/pacman rPx, /{usr/,}bin/pacman-conf rPx, /{usr/,}bin/pacsort rix, /{usr/,}bin/rm rix, diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman index 0ebc5d203..56e3e0991 100644 --- a/apparmor.d/groups/pacman/pacman +++ b/apparmor.d/groups/pacman/pacman @@ -55,6 +55,7 @@ profile pacman @{exec_path} { /{usr/,}bin/install-info rPx, /{usr/,}bin/killall rPx, /{usr/,}bin/pacdiff rPx, + /{usr/,}bin/pacman-key rPx, /{usr/,}bin/sysctl rPx, /{usr/,}bin/systemctl rPx -> child-systemctl, /{usr/,}bin/update-ca-trust rPx, diff --git a/apparmor.d/groups/pacman/pacman-hook-dconf b/apparmor.d/groups/pacman/pacman-hook-dconf index 45f68e705..9fe6d2922 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dconf +++ b/apparmor.d/groups/pacman/pacman-hook-dconf @@ -18,5 +18,11 @@ profile pacman-hook-dconf @{exec_path} { /etc/dconf/db/{,**} rw, + /dev/tty rw, + + # Inherit Silencer + deny network inet6 stream, + deny network inet stream, + include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/pacman/pacman-hook-depmod b/apparmor.d/groups/pacman/pacman-hook-depmod index 583624119..aaa32a1ea 100644 --- a/apparmor.d/groups/pacman/pacman-hook-depmod +++ b/apparmor.d/groups/pacman/pacman-hook-depmod @@ -15,5 +15,9 @@ profile pacman-hook-depmod @{exec_path} { /{usr/,}bin/bash rix, /{usr/,}bin/depmod rPx, + # Inherit Silencer + deny network inet6 stream, + deny network inet stream, + include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/pacman/pacman-hook-dkms b/apparmor.d/groups/pacman/pacman-hook-dkms index 412ee4d95..094ea635e 100644 --- a/apparmor.d/groups/pacman/pacman-hook-dkms +++ b/apparmor.d/groups/pacman/pacman-hook-dkms @@ -12,5 +12,11 @@ profile pacman-hook-dkms @{exec_path} { @{exec_path} mr, + /{usr/,}bin/kmod rPx, + + # Inherit Silencer + deny network inet6 stream, + deny network inet stream, + include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/pacman/pacman-hook-gio b/apparmor.d/groups/pacman/pacman-hook-gio index 93bb3aba4..9be7037ff 100644 --- a/apparmor.d/groups/pacman/pacman-hook-gio +++ b/apparmor.d/groups/pacman/pacman-hook-gio @@ -16,7 +16,14 @@ profile pacman-hook-gio @{exec_path} { /{usr/,}bin/rmdir rix, /{usr/,}bin/gio-querymodules rPx, - /{usr/,}lib/gio/modules/{,**} rw, + /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw, + /{usr/,}lib/gtk-{3,4}.0/**/*/ rw, + + /dev/tty rw, + + # Inherit Silencer + deny network inet6 stream, + deny network inet stream, include if exists } \ No newline at end of file diff --git a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install index aca89e4ca..1923bbd54 100644 --- a/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install +++ b/apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install @@ -13,6 +13,8 @@ profile pacman-hook-mkinitcpio-install @{exec_path} { capability dac_read_search, capability mknod, + unix (receive) type=stream, + @{exec_path} mr, /{usr/,}bin/bash rix, @@ -25,7 +27,9 @@ profile pacman-hook-mkinitcpio-install @{exec_path} { /usr/share/mkinitcpio/*.preset r, /etc/mkinitcpio.d/{,**} r, + /etc/mkinitcpio.d/*.preset rw, + / r, owner /boot/vmlinuz-* rw, /dev/tty rw, diff --git a/apparmor.d/groups/pacman/pacman-hook-perl b/apparmor.d/groups/pacman/pacman-hook-perl index 3f8a7ae12..b18a60058 100644 --- a/apparmor.d/groups/pacman/pacman-hook-perl +++ b/apparmor.d/groups/pacman/pacman-hook-perl @@ -10,6 +10,9 @@ include profile pacman-hook-perl @{exec_path} { include + capability dac_read_search, + capability mknod, + @{exec_path} mr, /{usr/,}bin/perl rix, diff --git a/apparmor.d/groups/pacman/pacman-hook-systemd b/apparmor.d/groups/pacman/pacman-hook-systemd index 4c8ae2e70..d77fb4497 100644 --- a/apparmor.d/groups/pacman/pacman-hook-systemd +++ b/apparmor.d/groups/pacman/pacman-hook-systemd @@ -17,15 +17,15 @@ profile pacman-hook-systemd @{exec_path} { /{usr/,}bin/bash rix, /{usr/,}bin/touch rix, - /{usr/,}bin/journalctl rPx, - /{usr/,}bin/systemctl rPx -> child-systemctl, - /{usr/,}bin/systemd-binfmt rPx, - /{usr/,}bin/systemd-detect-virt rPx, - /{usr/,}bin/systemd-hwdb rPx, - /{usr/,}bin/systemd-sysctl rPx, - /{usr/,}bin/systemd-sysusers rPx, - /{usr/,}bin/systemd-tmpfiles rPx, - /{usr/,}bin/udevadm rPx, + /{usr/,}bin/journalctl rPx, + /{usr/,}bin/systemctl rPx -> child-systemctl, + /{usr/,}bin/systemd-binfmt rPx, + /{usr/,}bin/systemd-detect-virt rPx, + /{usr/,}bin/systemd-hwdb rPx, + /{usr/,}bin/systemd-sysusers rPx, + /{usr/,}bin/systemd-tmpfiles rPx, + /{usr/,}bin/udevadm rPx, + /{usr/,}lib/systemd/systemd-sysctl rPx, /usr/ rw, diff --git a/apparmor.d/groups/systemd/systemd-ask-password b/apparmor.d/groups/systemd/systemd-ask-password new file mode 100644 index 000000000..2031d276b --- /dev/null +++ b/apparmor.d/groups/systemd/systemd-ask-password @@ -0,0 +1,20 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2021 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/systemd-ask-password +profile systemd-ask-password @{exec_path} { + include + include + + @{exec_path} mr, + + @{PROC}/filesystems r, + owner @{PROC}/@{pid}/stat r, + + include if exists +} diff --git a/apparmor.d/profiles-a-l/browserpass b/apparmor.d/profiles-a-l/browserpass index 44b3dc394..c1a67ae1e 100644 --- a/apparmor.d/profiles-a-l/browserpass +++ b/apparmor.d/profiles-a-l/browserpass @@ -23,6 +23,7 @@ profile browserpass @{exec_path} flags=(attach_disconnected) { owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/scriptCache-*.bin r, owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/startupCache.*.little r, owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/safebrowsing-updating/google[0-9]/goog-phish-proto-[0-9]*.vlpset rw, + owner /tmp/mozilla-temp-[0-9]* r, @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, diff --git a/apparmor.d/profiles-a-l/gio-querymodules b/apparmor.d/profiles-a-l/gio-querymodules index b01e0e3e2..9e5a12a3c 100644 --- a/apparmor.d/profiles-a-l/gio-querymodules +++ b/apparmor.d/profiles-a-l/gio-querymodules @@ -14,6 +14,7 @@ profile gio-querymodules @{exec_path} { @{exec_path} mr, /{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w, + /{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} w, include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-a-l/kmod b/apparmor.d/profiles-a-l/kmod index f555fa61e..2edbd730c 100644 --- a/apparmor.d/profiles-a-l/kmod +++ b/apparmor.d/profiles-a-l/kmod @@ -24,6 +24,9 @@ profile kmod @{exec_path} { # than to standard error. capability syslog, + # Needed for static-nodes + capability dac_override, + unix (receive) type=stream, @{exec_path} mr, @@ -45,8 +48,6 @@ profile kmod @{exec_path} { # Initframs owner /tmp/mkinitcpio.*/{,**} rw, - # Needed for static-nodes - #capability dac_override, #owner @{PROC}/@{pid}/fd/1 w, # For local kernel build diff --git a/apparmor.d/profiles-m-z/run-parts b/apparmor.d/profiles-m-z/run-parts index d8e5a02fc..011fa7157 100644 --- a/apparmor.d/profiles-m-z/run-parts +++ b/apparmor.d/profiles-m-z/run-parts @@ -25,6 +25,7 @@ profile run-parts @{exec_path} { /etc/kernel/postinst.d/apt-auto-removal rCx -> kernel-pre-post, /etc/kernel/postinst.d/dkms rCx -> kernel-pre-post, /etc/kernel/postinst.d/initramfs-tools rCx -> kernel-pre-post, + /etc/kernel/postinst.d/unattended-upgrades rCx -> kernel-pre-post, /etc/kernel/postinst.d/zz-update-grub rCx -> kernel-pre-post, /etc/kernel/postrm.d/ r, diff --git a/apparmor.d/profiles-m-z/update-initramfs b/apparmor.d/profiles-m-z/update-initramfs index 4cd6945e2..c9c5480d1 100644 --- a/apparmor.d/profiles-m-z/update-initramfs +++ b/apparmor.d/profiles-m-z/update-initramfs @@ -19,13 +19,14 @@ profile update-initramfs @{exec_path} { /{usr/,}sbin/ r, + /{usr/,}bin/cat rix, + /{usr/,}bin/gawk rix, /{usr/,}bin/getopt rix, /{usr/,}bin/ischroot rix, - /{usr/,}bin/gawk rix, /{usr/,}bin/ln rix, + /{usr/,}bin/mawk rix, /{usr/,}bin/mv rix, /{usr/,}bin/rm rix, - /{usr/,}bin/cat rix, /{usr/,}bin/sha1sum rix, /{usr/,}bin/sync rix, /{usr/,}bin/uname rix,