felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source
This commit is contained in:
Mikhail Morfikov 2021-08-18 11:05:43 +02:00 • committed by Alexandre Pujol
parent fb63699153
commit 9eecac80a2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
44 changed files with 520 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

40
apparmor.d/groups/apps/signal-desktop
View file

@ -8,7 +8,8 @@ include <tunables/global>
@{SIGNAL_INSTALLDIR} = "/opt/Signal{, Beta}"
@{SIGNAL_HOMEDIR} = "@{user_config_dirs}/Signal{, Beta}"
@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta}
#@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta} # (#FIXME#)
@{exec_path} = "/opt/Signal{, Beta}/signal-desktop{,-beta}" # (#FIXME#)
profile signal-desktop @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -22,14 +23,36 @@ profile signal-desktop @{exec_path} {
include <abstractions/nameservice-strict>
include <abstractions/deny-root-dir-access>
@{exec_path} mr,
# Needed?
deny capability sys_ptrace,
# Signal installation dir
# The following rules are needed only when the kernel.unprivileged_userns_clone option is set
# to "1".
capability sys_admin,
capability sys_chroot,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/uid_map w,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
network netlink raw,
@{exec_path} mrix,
# Signal installation dir (#FIXME#)
@{SIGNAL_INSTALLDIR}/ r,
@{SIGNAL_INSTALLDIR}/** r,
@{SIGNAL_INSTALLDIR}/libnode.so mr,
@{SIGNAL_INSTALLDIR}/libffmpeg.so mr,
@{SIGNAL_INSTALLDIR}/{swiftshader/,}libGLESv2.so mr,
@{SIGNAL_INSTALLDIR}/{swiftshader/,}libEGL.so mr,
@{SIGNAL_INSTALLDIR}/chrome-sandbox rPx,
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.node mr,
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.so mr,
@{SIGNAL_INSTALLDIR}/resources/app.asar.unpacked/node_modules/**.so.[0-9]* mr,
# Signal home dirs
@{SIGNAL_HOMEDIR}/ rw,
@ -42,13 +65,17 @@ profile signal-desktop @{exec_path} {
# Signal wants the /tmp/ dir to be mounted with the "exec" flag. If this is not acceptable in
# your system, use the TMPDIR variable to set some other tmp dir.
/tmp/ r,
owner /tmp/.org.chromium.Chromium.* mrw,
owner /tmp/.org.chromium.Chromium.*/ rw,
owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
owner /tmp/.org.chromium.Chromium.*/SS w,
owner /tmp/.org.chromium.Chromium.* rw,
/var/tmp/ r,
owner @{SIGNAL_HOMEDIR}/tmp/.org.chromium.Chromium.* mrw,
@{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r,
@{sys}/devices/pci[0-9]*/**/{irq,vendor,device} r,
@{sys}/devices/virtual/tty/tty[0-9]/active r,
@{sys}/fs/cgroup/** r,
@{PROC}/ r,
owner @{PROC}/@{pid}/fd/ r,
@ -56,6 +83,10 @@ profile signal-desktop @{exec_path} {
owner @{PROC}/@{pids}/task/ r,
owner @{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pids}/stat r,
owner @{PROC}/@{pids}/statm r,
deny owner @{PROC}/@{pid}/cmdline r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/sys/fs/inotify/max_user_watches r,
@{PROC}/vmstat r,
deny /dev/shm/ r,
@ -64,6 +95,7 @@ profile signal-desktop @{exec_path} {
/var/lib/dbus/machine-id r,
/etc/machine-id r,
# No new privs
/{usr/,}bin/xdg-settings rPUx,
/{usr/,}bin/getconf rix,

5
apparmor.d/groups/apps/signal-desktop-chrome-sandbox
View file

@ -9,14 +9,15 @@ include <tunables/global>
@{SIGNAL_INSTALLDIR} = "/opt/Signal{, Beta}"
@{SIGNAL_HOMEDIR} = "@{user_config_dirs}/Signal{, Beta}"
@{exec_path} = @{SIGNAL_INSTALLDIR}/signal-desktop{,-beta}
#@{exec_path} = @{SIGNAL_INSTALLDIR}/chrome-sandbox # (#FIXME#)
@{exec_path} = "/opt/Signal{, Beta}/chrome-sandbox"
profile signal-desktop-chrome-sandbox @{exec_path} {
include <abstractions/base>
include <abstractions/deny-root-dir-access>
@{exec_path} mr,
@{SIGNAL_INSTALLDIR}/signal-desktop rPx,
@{SIGNAL_INSTALLDIR}/signal-desktop{,-beta} rPx,
include if exists <local/signal-desktop-chrome-sandbox>
}

2
apparmor.d/groups/apps/thunderbird
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# Copyright (C) 2015-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
# Useful info:
# http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird

8
apparmor.d/groups/apps/usr.lib.libreoffice.program.oosplash
View file

@ -12,11 +12,11 @@
#
# ------------------------------------------------------------------
include <tunables/global>
#include <tunables/global>
profile libreoffice-oopslash /usr/lib/libreoffice/program/oosplash flags=(complain) {
include <abstractions/base>
include <abstractions/X>
profile libreoffice-oosplash /usr/lib/libreoffice/program/oosplash flags=(complain) {
#include <abstractions/base>
#include <abstractions/X>
/etc/libreoffice/ r,
/etc/libreoffice/** r,

2
apparmor.d/groups/apps/usr.lib.libreoffice.program.soffice.bin
View file

@ -2,6 +2,7 @@
#
# Copyright (C) 2016 Canonical Ltd.
# Copyright (C) 2018 Software in the Public Interest, Inc.
# Copyright (C) 2021 Google LLC
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
@ -223,6 +224,7 @@ profile libreoffice-soffice /usr/lib/libreoffice/program/soffice.bin flags=(comp
owner @{HOME}/@{XDG_GPG_DIR}/* r,
owner @{HOME}/@{XDG_GPG_DIR}/random_seed rk,
owner @{HOME}/@{XDG_GPG_DIR}/tofu.db rwk,
}
# probably should become a subprofile like gpg above, but then it doesn't

4
apparmor.d/groups/apps/vlc
View file

@ -90,6 +90,10 @@ profile vlc @{exec_path} {
owner @{MOUNTS}/**/ r,
owner /{home,media}/**.@{vlc_ext} rw,
# For SMB shares
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**/ r,
owner @{run}/user/@{uid}/gvfs/smb-share:server=*,share=**.@{vlc_ext} r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,

40
apparmor.d/groups/apt/apt-forktracer Normal file
View file

@ -0,0 +1,40 @@
# vim:syntax=apparmor
# ------------------------------------------------------------------
#
# Copyright (C) 2021 Mikhail Morfikov
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of version 2 of the GNU General Public
# License published by the Free Software Foundation.
#
# ------------------------------------------------------------------
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-forktracer
profile apt-forktracer @{exec_path} {
include <abstractions/base>
include <abstractions/python>
include <abstractions/apt-common>
@{exec_path} mr,
/{usr/,}bin/ r,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/usr/share/apt-forktracer/{,**} r,
/var/lib/apt/lists/ r,
/var/lib/apt/lists/*_InRelease r,
/usr/share/distro-info/debian.csv r,
owner @{PROC}/@{pid}/fd/ r,
/var/lib/dbus/machine-id r,
/etc/machine-id r,
include if exists <local/apt-forktracer>
}

1
apparmor.d/groups/apt/apt-key
View file

@ -59,6 +59,7 @@ profile apt-key @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/ssl_certs>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,

4
apparmor.d/groups/apt/apt-methods-gpgv
View file

@ -78,6 +78,10 @@ profile apt-methods-gpgv @{exec_path} {
@{PROC}/@{pid}/fd/ r,
# Local keyring storage
/etc/keyrings/ r,
/etc/keyrings/*.gpg r,
# For package building
@{BUILD_DIR}/** rwkl -> @{BUILD_DIR}/**,

2
apparmor.d/groups/apt/usr.sbin.apt-cacher-ng
View file

@ -20,7 +20,7 @@ profile apt-cacher-ng /usr/sbin/apt-cacher-ng flags=(complain) {
/var/lib/apt-cacher-ng/** r,
/{,var/}run/apt-cacher-ng/* rw,
@{APT_CACHER_NG_CACHE_DIR}/ r,
@{APT_CACHER_NG_CACHE_DIR}/** rw,
@{APT_CACHER_NG_CACHE_DIR}/** rwl,
/var/log/apt-cacher-ng/ r,
/var/log/apt-cacher-ng/* rw,
/{,var/}run/systemd/notify w,

4
apparmor.d/groups/browsers/firefox
View file

@ -130,6 +130,10 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
/etc/mime.types r,
/etc/mailcap r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
# Set default browser
/{usr/,}bin/update-mime-database rPx,
owner @{user_config_dirs}/ r,

2
apparmor.d/groups/bus/dbus-daemon
View file

@ -65,7 +65,7 @@ profile dbus-daemon @{exec_path} flags=(attach_disconnected) {
/dev/dri/card[0-9]* rw,
/dev/input/event[0-9]* rw,
/tmp/dbus-[0-9a-zA-Z]* rw,
owner /tmp/dbus-[0-9a-zA-Z]* rw,
# file_inherit
/dev/tty[0-9]* rw,

1
apparmor.d/groups/cron/cron
View file

@ -79,6 +79,7 @@ profile cron @{exec_path} {
/etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs rPx,
/etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions rPx,
/etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/checksecurity rPUx,
/etc/cron.{hourly,daily,weekly,monthly}/debtags rPx,
/etc/cron.{hourly,daily,weekly,monthly}/exim4-base rPx,
/etc/cron.{hourly,daily,weekly,monthly}/logrotate rPx,

3
apparmor.d/groups/desktop/bluetoothd
View file

@ -34,8 +34,11 @@ profile bluetoothd @{exec_path} {
@{run}/sdp rw,
@{run}/udev/data/+hid:* r,
@{sys}/devices/virtual/dmi/id/chassis_type r,
@{sys}/devices/platform/**/rfkill/**/name r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/uevent r,
/var/lib/bluetooth/{,**} rw,

2
apparmor.d/groups/ssh/ssh
View file

@ -28,7 +28,7 @@ profile ssh @{exec_path} {
owner @{HOME}/@{XDG_SSH_DIR}/ r,
owner @{HOME}/@{XDG_SSH_DIR}/config r,
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts rw,
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/config r,

1
apparmor.d/groups/systemd/systemd-coredump
View file

@ -26,6 +26,7 @@ profile systemd-coredump @{exec_path} flags=(attach_disconnected complain) {
/{usr/,}bin/* r,
/{usr/,}sbin/* r,
@{libexec}/** r,
/opt/** r,
/etc/systemd/coredump.conf r,

3
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -18,6 +18,9 @@ profile systemd-timesyncd @{exec_path} {
capability sys_time,
network inet dgram,
network inet6 dgram,
@{exec_path} mr,
/etc/adjtime r,

6
apparmor.d/groups/systemd/systemd-udevd
View file

@ -36,11 +36,15 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/perl rix,
/{usr/,}bin/chgrp rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/setfacl rix,
/{usr/,}bin/logger rix,
/{usr/,}bin/nohup rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/readlink rix,
/{usr/,}{s,}bin/* rPUx,
@ -48,6 +52,8 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
/{usr/,}lib/systemd/systemd-* rPUx,
/{usr/,}lib/crda/* rPUx,
/{usr,/}lib/pm-utils/power.d/* rPUx,
/usr/share/hplip/config_usb_printer.py rPUx,
/etc/console-setup/*.sh rPUx,