felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(abs): improve chromium common.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-13 01:11:18 +02:00
parent cd6bb7bd52
commit 84f3f947cb
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
1 changed files with 14 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

21
apparmor.d/abstractions/common/chromium
View file

@ -17,9 +17,14 @@
userns, userns,
# Required for dropping into PID namespace. Keep in mind that until the
# process drops this capability it can escape confinement, but once it
# drops CAP_SYS_ADMIN we are ok.
capability sys_admin,
# All of these are for sanely dropping from root and chrooting
capability setgid, # If kernel.unprivileged_userns_clone = 1 capability setgid, # If kernel.unprivileged_userns_clone = 1
capability setuid, # If kernel.unprivileged_userns_clone = 1 capability setuid, # If kernel.unprivileged_userns_clone = 1
capability sys_admin,
capability sys_chroot, capability sys_chroot,
capability sys_ptrace, capability sys_ptrace,
@ -33,20 +38,22 @@
owner @{tmp}/.@{domain}.@{rand6} rw, owner @{tmp}/.@{domain}.@{rand6} rw,
owner @{tmp}/.@{domain}.@{rand6}/ rw, owner @{tmp}/.@{domain}.@{rand6}/ rw,
owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie w, owner @{tmp}/.@{domain}.@{rand6}/SingletonCookie rw,
owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket w, owner @{tmp}/.@{domain}.@{rand6}/SingletonSocket rw,
owner @{tmp}/scoped_dir@{rand6}/ rw, owner @{tmp}/scoped_dir@{rand6}/ rw,
owner @{tmp}/scoped_dir@{rand6}/SingletonCookie w, owner @{tmp}/scoped_dir@{rand6}/SingletonCookie rw,
owner @{tmp}/scoped_dir@{rand6}/SingletonSocket w, owner @{tmp}/scoped_dir@{rand6}/SingletonSocket rw,
owner @{tmp}/scoped_dir@{rand6}/SS w, owner @{tmp}/scoped_dir@{rand6}/SS rw,
/dev/shm/ r, /dev/shm/ r,
owner /dev/shm/.@{domain}.@{rand6} rw, owner /dev/shm/.@{domain}.@{rand6} rw,
@{sys}/devices/system/cpu/kernel_max r, @{sys}/devices/system/cpu/kernel_max r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
# Allow getting the manufacturer and model of the computer where chromium is currently running.
@{sys}/devices/virtual/dmi/id/product_name r, @{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/sys_vendor r, @{sys}/devices/virtual/dmi/id/sys_vendor r,
@{sys}/devices/virtual/tty/tty@{int}/active r,
# If kernel.unprivileged_userns_clone = 1 # If kernel.unprivileged_userns_clone = 1
owner @{PROC}/@{pid}/setgroups w, owner @{PROC}/@{pid}/setgroups w,