felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite the apt stack of profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:16:35 +02:00
parent b2afeee510
commit 905f523c90
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 78 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/apt/apt
View file

@ -85,7 +85,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
@{bin}/etckeeper rPx, @{bin}/etckeeper rPx,
@{bin}/localepurge rPx, @{bin}/localepurge rPx,
@{bin}/ps rPx, @{bin}/ps rPx,
@{bin}/snap rPUx, @{bin}/snap rPx,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{bin}/update-command-not-found rPx, @{bin}/update-command-not-found rPx,
@{lib}/cnf-update-db rPx, @{lib}/cnf-update-db rPx,
@ -138,6 +138,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/var/log/apt/{,**} rw, /var/log/apt/{,**} rw,
/var/log/ubuntu-advantage-apt-hook.log w, /var/log/ubuntu-advantage-apt-hook.log w,
@{efi}/ r,
# For package building # For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**, @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

39
apparmor.d/groups/apt/apt-listchanges
View file

@ -14,7 +14,7 @@ profile apt-listchanges @{exec_path} {
include <abstractions/python> include <abstractions/python>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
#capability sys_tty_config, capability dac_read_search,
@{exec_path} r, @{exec_path} r,
@{python_path} r, @{python_path} r,
@ -26,11 +26,11 @@ profile apt-listchanges @{exec_path} {
# Do not strip env to avoid errors like the following: # Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored. # shared object file): ignored.
@{bin}/dpkg-deb rpx, @{bin}/dpkg-deb px,
#
@{pager_path} rCx -> pager, @{pager_path} Cx -> pager,
# Send results using email @{bin}/dpkg Px -> child-dpkg,
@{bin}/exim4 rPx, @{bin}/exim4 Px, # Send results using email
/usr/share/apt-listchanges/{,**} r, /usr/share/apt-listchanges/{,**} r,
@ -50,31 +50,12 @@ profile apt-listchanges @{exec_path} {
/var/cache/apt/archives/ r, /var/cache/apt/archives/ r,
owner @{PROC}/@{pid}/fd/ r,
/tmp/ r, /tmp/ r,
owner @{tmp}/* rw, owner @{tmp}/@{word8} rw,
owner @{tmp}/apt-listchanges*/ rw, owner @{tmp}/apt-listchanges@{word8}/ rw,
owner @{tmp}/apt-listchanges*/**/ rw, owner @{tmp}/apt-listchanges@{word8}/** rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
# The following is needed when apt-listchanges uses debcconf GUI frontends.
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
capability dac_read_search,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/hostname rix,
owner @{PROC}/@{pid}/mounts r,
@{HOME}/.Xauthority r,
owner @{PROC}/@{pid}/fd/ r,
profile pager { profile pager {
include <abstractions/base> include <abstractions/base>

16
apparmor.d/groups/apt/debsums
View file

@ -12,28 +12,20 @@ profile debsums @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/perl> include <abstractions/perl>
# Needed to read files owned by other users than root.
capability dac_read_search, capability dac_read_search,
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{m,g,}awk rix, @{bin}/{m,g,}awk ix,
# Do not strip env to avoid errors like the following: # Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored. # shared object file): ignored.
@{bin}/dpkg-query rpx, @{bin}/dpkg-query px,
# #
@{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg Px -> child-dpkg,
@{bin}/dpkg-divert rPx -> child-dpkg-divert, @{bin}/dpkg-divert Px -> child-dpkg-divert,
/etc/dpkg/dpkg.cfg.d/{,*} r,
/etc/dpkg/dpkg.cfg r,
/etc/locale.nopurge r,
/var/lib/dpkg/info/* r,
# For shell pwd # For shell pwd
/ r, / r,

27
apparmor.d/groups/apt/dpkg
View file

@ -22,24 +22,23 @@ profile dpkg @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/cat rix, @{bin}/cat ix,
@{bin}/deb-systemd-helper rix, @{bin}/deb-systemd-helper Px,
@{bin}/deb-systemd-invoke rix, @{bin}/deb-systemd-invoke Px,
@{bin}/rm rix, @{bin}/rm ix,
@{bin}/dpkg-deb rpx, @{bin}/dpkg-deb px,
@{bin}/dpkg-query rpx, @{bin}/dpkg-query px,
@{bin}/dpkg-split rpx, @{bin}/dpkg-split px,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl Cx -> systemctl,
@{lib}/needrestart/dpkg-status rPx, @{lib}/needrestart/dpkg-status Px,
/usr/share/debian-security-support/check-support-status.hook rPx, @{pager_path} Px -> child-pager,
/usr/share/debian-security-support/check-support-status.hook Px,
@{pager_path} rPx -> child-pager,
# Package maintainer's scripts # Package maintainer's scripts
/var/lib/dpkg/info/*.@{dpkg_script_ext} rPUx, /var/lib/dpkg/info/*.@{dpkg_script_ext} Px,
/var/lib/dpkg/info/*.control r, /var/lib/dpkg/info/*.control r,
/var/lib/dpkg/tmp.ci/@{dpkg_script_ext} rPUx, /var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px,
# For shell pwd # For shell pwd
/root/ r, /root/ r,

64
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -11,35 +11,36 @@ include <tunables/global>
profile dpkg-preconfigure @{exec_path} { profile dpkg-preconfigure @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/perl>
#capability sys_tty_config, include <abstractions/ssl_certs>
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep ix,
@{bin}/{,g,m}awk rix, @{bin}/{,g,m}awk ix,
@{bin}/cat rix, @{bin}/cat ix,
@{bin}/debconf-escape rix, @{bin}/debconf-escape Px,
@{bin}/dialog rix, @{bin}/dialog ix,
@{bin}/expr rix, @{bin}/expr ix,
@{bin}/locale rix, @{bin}/find ix,
@{bin}/readlink rix, @{bin}/head ix,
@{bin}/sed rix, @{bin}/locale ix,
@{bin}/sort rix, @{bin}/readlink ix,
@{bin}/stty rix, @{bin}/readlink ix,
@{bin}/tr rix, @{bin}/realpath ix,
@{bin}/head rix, @{bin}/sed ix,
@{bin}/readlink rix, @{bin}/sort ix,
@{bin}/realpath rix, @{bin}/stty ix,
@{bin}/tr ix,
@{bin}/uniq ix,
@{bin}/findmnt rPx, @{bin}/apt-extracttemplates Px,
@{bin}/dpkg rPx -> child-dpkg, @{bin}/dpkg Px -> child-dpkg,
@{bin}/apt-extracttemplates rPx, @{bin}/findmnt Px,
@{bin}/whiptail rPx, @{bin}/whiptail Px,
@{lib}/apt/apt-extracttemplates rPx, @{lib}/apt/apt-extracttemplates Px,
/usr/share/debconf/confmodule r, /usr/share/debconf/confmodule r,
/usr/share/dictionaries-common/{,*} r, /usr/share/dictionaries-common/{,*} r,
@ -59,9 +60,6 @@ profile dpkg-preconfigure @{exec_path} {
/var/cache/debconf/tmp.ci/ w, /var/cache/debconf/tmp.ci/ w,
owner @{tmp}/*.template.* rw,
owner @{tmp}/*.config.* rwPUx,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
owner /var/cache/debconf/ rw, owner /var/cache/debconf/ rw,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk, owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
@ -73,22 +71,14 @@ profile dpkg-preconfigure @{exec_path} {
owner /var/cache/dictionaries-common/flag-wordlist-new w, owner /var/cache/dictionaries-common/flag-wordlist-new w,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw, owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
owner @{tmp}/*.template.* rw,
owner @{tmp}/*.config.* rwPUx,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r, @{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
@{run}/user/@{uid}/pk-debconf-socket rw, @{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
# The following is needed when dpkg-preconfigure uses debcconf GUI frontends.
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
capability dac_read_search,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/hostname rix,
@{HOME}/.Xauthority r,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/dpkg-preconfigure> include if exists <local/dpkg-preconfigure>
} }

18
apparmor.d/groups/apt/dpkg-statoverride Normal file
View file

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/dpkg-statoverride
profile dpkg-statoverride @{exec_path} flags=(complain) {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/dpkg-statoverride>
}
# vim:syntax=apparmor