felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): rewrite the apt stack of profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-18 23:16:35 +02:00
parent b2afeee510
commit 905f523c90
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 78 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/apt/apt
View file

@ -85,7 +85,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
@{bin}/etckeeper rPx,
@{bin}/localepurge rPx,
@{bin}/ps rPx,
@{bin}/snap rPUx,
@{bin}/snap rPx,
@{bin}/systemctl rCx -> systemctl,
@{bin}/update-command-not-found rPx,
@{lib}/cnf-update-db rPx,
@ -138,6 +138,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/var/log/apt/{,**} rw,
/var/log/ubuntu-advantage-apt-hook.log w,
@{efi}/ r,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,

39
apparmor.d/groups/apt/apt-listchanges
View file

@ -14,7 +14,7 @@ profile apt-listchanges @{exec_path} {
include <abstractions/python>
include <abstractions/nameservice-strict>
#capability sys_tty_config,
capability dac_read_search,
@{exec_path} r,
@{python_path} r,
@ -26,11 +26,11 @@ profile apt-listchanges @{exec_path} {
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-deb rpx,
#
@{pager_path} rCx -> pager,
# Send results using email
@{bin}/exim4 rPx,
@{bin}/dpkg-deb px,
@{pager_path} Cx -> pager,
@{bin}/dpkg Px -> child-dpkg,
@{bin}/exim4 Px, # Send results using email
/usr/share/apt-listchanges/{,**} r,
@ -50,31 +50,12 @@ profile apt-listchanges @{exec_path} {
/var/cache/apt/archives/ r,
owner @{PROC}/@{pid}/fd/ r,
/tmp/ r,
owner @{tmp}/* rw,
owner @{tmp}/apt-listchanges*/ rw,
owner @{tmp}/apt-listchanges*/**/ rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/changelog.Debian*.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/NEWS.Debian.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog.gz rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/changelog_to_file rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/changelog/simple_changelog rw,
owner @{tmp}/apt-listchanges*/*/*/*/*/*/*-local/debian/changelog rw,
# The following is needed when apt-listchanges uses debcconf GUI frontends.
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
capability dac_read_search,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/hostname rix,
owner @{PROC}/@{pid}/mounts r,
@{HOME}/.Xauthority r,
owner @{tmp}/@{word8} rw,
owner @{tmp}/apt-listchanges@{word8}/ rw,
owner @{tmp}/apt-listchanges@{word8}/** rw,
owner @{PROC}/@{pid}/fd/ r,
profile pager {
include <abstractions/base>

16
apparmor.d/groups/apt/debsums
View file

@ -12,28 +12,20 @@ profile debsums @{exec_path} {
include <abstractions/base>
include <abstractions/perl>
# Needed to read files owned by other users than root.
capability dac_read_search,
@{exec_path} r,
@{sh_path} rix,
@{bin}/{m,g,}awk rix,
@{bin}/{m,g,}awk ix,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-query rpx,
@{bin}/dpkg-query px,
#
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/dpkg-divert rPx -> child-dpkg-divert,
/etc/dpkg/dpkg.cfg.d/{,*} r,
/etc/dpkg/dpkg.cfg r,
/etc/locale.nopurge r,
/var/lib/dpkg/info/* r,
@{bin}/dpkg Px -> child-dpkg,
@{bin}/dpkg-divert Px -> child-dpkg-divert,
# For shell pwd
/ r,

27
apparmor.d/groups/apt/dpkg
View file

@ -22,24 +22,23 @@ profile dpkg @{exec_path} {
@{exec_path} mr,
@{sh_path} rix,
@{bin}/cat rix,
@{bin}/deb-systemd-helper rix,
@{bin}/deb-systemd-invoke rix,
@{bin}/rm rix,
@{bin}/cat ix,
@{bin}/deb-systemd-helper Px,
@{bin}/deb-systemd-invoke Px,
@{bin}/rm ix,
@{bin}/dpkg-deb rpx,
@{bin}/dpkg-query rpx,
@{bin}/dpkg-split rpx,
@{bin}/systemctl rCx -> systemctl,
@{lib}/needrestart/dpkg-status rPx,
/usr/share/debian-security-support/check-support-status.hook rPx,
@{pager_path} rPx -> child-pager,
@{bin}/dpkg-deb px,
@{bin}/dpkg-query px,
@{bin}/dpkg-split px,
@{bin}/systemctl Cx -> systemctl,
@{lib}/needrestart/dpkg-status Px,
@{pager_path} Px -> child-pager,
/usr/share/debian-security-support/check-support-status.hook Px,
# Package maintainer's scripts
/var/lib/dpkg/info/*.@{dpkg_script_ext} rPUx,
/var/lib/dpkg/info/*.@{dpkg_script_ext} Px,
/var/lib/dpkg/info/*.control r,
/var/lib/dpkg/tmp.ci/@{dpkg_script_ext} rPUx,
/var/lib/dpkg/tmp.ci/@{dpkg_script_ext} Px,
# For shell pwd
/root/ r,

64
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -11,35 +11,36 @@ include <tunables/global>
profile dpkg-preconfigure @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl>
include <abstractions/nameservice-strict>
#capability sys_tty_config,
include <abstractions/perl>
include <abstractions/ssl_certs>
@{exec_path} r,
@{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/{,g,m}awk rix,
@{bin}/cat rix,
@{bin}/debconf-escape rix,
@{bin}/dialog rix,
@{bin}/expr rix,
@{bin}/locale rix,
@{bin}/readlink rix,
@{bin}/sed rix,
@{bin}/sort rix,
@{bin}/stty rix,
@{bin}/tr rix,
@{bin}/head rix,
@{bin}/readlink rix,
@{bin}/realpath rix,
@{bin}/{,e}grep ix,
@{bin}/{,g,m}awk ix,
@{bin}/cat ix,
@{bin}/debconf-escape Px,
@{bin}/dialog ix,
@{bin}/expr ix,
@{bin}/find ix,
@{bin}/head ix,
@{bin}/locale ix,
@{bin}/readlink ix,
@{bin}/readlink ix,
@{bin}/realpath ix,
@{bin}/sed ix,
@{bin}/sort ix,
@{bin}/stty ix,
@{bin}/tr ix,
@{bin}/uniq ix,
@{bin}/findmnt rPx,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/apt-extracttemplates rPx,
@{bin}/whiptail rPx,
@{lib}/apt/apt-extracttemplates rPx,
@{bin}/apt-extracttemplates Px,
@{bin}/dpkg Px -> child-dpkg,
@{bin}/findmnt Px,
@{bin}/whiptail Px,
@{lib}/apt/apt-extracttemplates Px,
/usr/share/debconf/confmodule r,
/usr/share/dictionaries-common/{,*} r,
@ -59,9 +60,6 @@ profile dpkg-preconfigure @{exec_path} {
/var/cache/debconf/tmp.ci/ w,
owner @{tmp}/*.template.* rw,
owner @{tmp}/*.config.* rwPUx,
/var/lib/dbus/machine-id r,
owner /var/cache/debconf/ rw,
owner /var/cache/debconf/{config,passwords,templates}.dat{,-old,-new} rwk,
@ -73,22 +71,14 @@ profile dpkg-preconfigure @{exec_path} {
owner /var/cache/dictionaries-common/flag-wordlist-new w,
owner /var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
owner @{tmp}/*.template.* rw,
owner @{tmp}/*.config.* rwPUx,
@{run}/user/@{uid}/.mutter-Xwaylandauth.@{rand6} r,
@{run}/user/@{uid}/pk-debconf-socket rw,
owner @{PROC}/@{pid}/fd/ r,
# The following is needed when dpkg-preconfigure uses debcconf GUI frontends.
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
capability dac_read_search,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/hostname rix,
@{HOME}/.Xauthority r,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/dpkg-preconfigure>
}

18
apparmor.d/groups/apt/dpkg-statoverride Normal file
View file

@ -0,0 +1,18 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/dpkg-statoverride
profile dpkg-statoverride @{exec_path} flags=(complain) {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/dpkg-statoverride>
}
# vim:syntax=apparmor