Update profiles.

2021-09-28 21:53:50 +01:00 · 2021-09-28 21:53:50 +01:00 · b79ffa52c6
commit b79ffa52c6
parent a30fda0ad7
18 changed files with 91 additions and 143 deletions
--- a/apparmor.d/groups/apt/apt
+++ b/apparmor.d/groups/apt/apt
@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only

 abi <abi/3.0>,
@ -9,56 +10,20 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt
 profile apt @{exec_path} flags=(complain) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/apt-common>
+  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>

-  # To remove the following errors:
-  #  W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
-  #     (1: Operation not permitted)
-  #  W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
-  #     (1: Operation not permitted)
-  #  W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed -
-  #     Item::QueueURI (1: Operation not permitted)
-  capability fowner,
-
-  # To remove the following errors:
-  #  W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
-  #  (1: Operation not permitted)
-  #  W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
-  #  (1: Operation not permitted)
  capability chown,
-
-  # The "_apt" user is created by the postinst script of the "apt" package. It's the owner of the
-  # dirs "/var/cache/apt/archives/partial/" and "/var/lib/apt/lists/partial/" . The "_apt" user is
-  # used by APT to download packages, package list, and other things using APT methods as an
-  # unprivileged user/group (_apt/nogroup).
-  #
-  # To remove the following errors:
-  #  E: setgroups 65534 failed - setgroups (1: Operation not permitted)
-  #  E: setegid 65534 failed - setegid (1: Operation not permitted)
-  #  E: seteuid 100 failed - seteuid (1: Operation not permitted)
-  #  E: setgroups 0 failed - setgroups (1: Operation not permitted)
-  capability setuid,
-  capability setgid,
-
-  # To remove the following errors:
-  #  W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease -
-  #     PrepareFiles (13: Permission denied)
-  #  E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied)
-  capability dac_read_search,
-
-  # To remove the following errors:
-  #  E: Failed to fetch https://**.deb  rename failed, Permission denied
-  #     (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb).
-  #  E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
  capability dac_override,
-
-  # Needed? (##FIXME##)
-  capability kill,
+  capability dac_read_search,
+  capability fowner,
  capability fsetid,
-  audit deny capability net_admin,
+  capability kill,
+  capability net_admin,
+  capability setgid,
+  capability setuid,

  signal (send) peer=apt-methods-*,

--- a/apparmor.d/groups/apt/apt-get
+++ b/apparmor.d/groups/apt/apt-get
@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only

 abi <abi/3.0>,
@ -9,55 +10,19 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/apt-get
 profile apt-get @{exec_path} flags=(complain) {
  include <abstractions/base>
-  include <abstractions/consoles>
  include <abstractions/apt-common>
+  include <abstractions/consoles>
  include <abstractions/nameservice-strict>

-  # To remove the following errors:
-  #  W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
-  #     (1: Operation not permitted)
-  #  W: chmod 0700 of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
-  #     (1: Operation not permitted)
-  #  W: chmod 0600 of file /var/lib/apt/lists/deb.debian.org_debian_dists_sid_InRelease failed -
-  #     Item::QueueURI (1: Operation not permitted)
-  capability fowner,
-
-  # To remove the following errors:
-  #  W: chown to _apt:root of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
-  #  (1: Operation not permitted)
-  #  W: chown to _apt:root of directory /var/lib/apt/lists/auxfiles failed - SetupAPTPartialDirectory
-  #  (1: Operation not permitted)
  capability chown,
-
-  # The "_apt" user is created by the postinst script of the "apt" package. It's the owner of the
-  # dirs "/var/cache/apt/archives/partial/" and "/var/lib/apt/lists/partial/" . The "_apt" user is
-  # used by APT to download packages, package list, and other things using APT methods as an
-  # unprivileged user/group (_apt/nogroup).
-  #
-  # To remove the following errors:
-  #  E: setgroups 65534 failed - setgroups (1: Operation not permitted)
-  #  E: setegid 65534 failed - setegid (1: Operation not permitted)
-  #  E: seteuid 100 failed - seteuid (1: Operation not permitted)
-  #  E: setgroups 0 failed - setgroups (1: Operation not permitted)
-  capability setuid,
-  capability setgid,
-
-  # To remove the following errors:
-  #  W: Problem unlinking the file /var/lib/apt/lists/partial/*_InRelease -
-  #     PrepareFiles (13: Permission denied)
-  #  E: Unable to read /var/lib/apt/lists/partial/ - open (13: Permission denied)
-  capability dac_read_search,
-
-  # To remove the following errors:
-  #  E: Failed to fetch https://**.deb  rename failed, Permission denied
-  #     (/var/cache/apt/archives/partial/*.deb -> /var/cache/apt/archives/*.deb).
-  #  E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?
  capability dac_override,
-
-  # Needed? (##FIXME##)
-  capability kill,
+  capability dac_read_search,
+  capability fowner,
  capability fsetid,
-  audit deny capability net_admin,
+  capability kill,
+  capability net_admin,
+  capability setgid,
+  capability setuid,

  signal (send) peer=apt-methods-*,

--- a/apparmor.d/groups/apt/apt-systemd-daily
+++ b/apparmor.d/groups/apt/apt-systemd-daily
@ -1,5 +1,6 @@
 # apparmor.d - Full set of apparmor profiles
 # Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
 # SPDX-License-Identifier: GPL-2.0-only

 abi <abi/3.0>,
@ -10,36 +11,37 @@ include <tunables/global>
 profile apt-systemd-daily @{exec_path} {
  include <abstractions/base>

-  # Needed to remove the following error:
-  # apt.systemd.daily[]: find: ‘/var/cache/apt/archives/partial’: Permission denied
  capability dac_read_search,

  @{exec_path} mrix,
  /{usr/,}bin/{,ba,da}sh rix,

-  /{usr/,}bin/flock      rix,
+  /{usr/,}bin/basename   rix,
  /{usr/,}bin/cmp        rix,
  /{usr/,}bin/cp         rix,
-  /{usr/,}bin/rm         rix,
-  /{usr/,}bin/mv         rix,
-  /{usr/,}bin/savelog    rix,
-  /{usr/,}bin/which{,.debianutils}      rix,
-  /{usr/,}bin/touch      rix,
-  /{usr/,}bin/basename   rix,
-  /{usr/,}bin/dirname    rix,
  /{usr/,}bin/date       rix,
-  /{usr/,}bin/find       rix,
+  /{usr/,}bin/dirname    rix,
  /{usr/,}bin/du         rix,
-  /{usr/,}bin/stat       rix,
+  /{usr/,}bin/env        rix,
+  /{usr/,}bin/find       rix,
+  /{usr/,}bin/flock      rix,
+  /{usr/,}bin/grep       rix,
+  /{usr/,}bin/gzip       rix,
+  /{usr/,}bin/mv         rix,
+  /{usr/,}bin/rm         rix,
+  /{usr/,}bin/savelog    rix,
+  /{usr/,}bin/seq        rix,
  /{usr/,}bin/sort       rix,
+  /{usr/,}bin/stat       rix,
+  /{usr/,}bin/touch      rix,
  /{usr/,}bin/uniq       rix,
  /{usr/,}bin/wc         rix,
-  /{usr/,}bin/seq        rix,
+  /{usr/,}bin/which{,.debianutils}      rix,
  /{usr/,}bin/xargs      rix,
-  /{usr/,}bin/gzip       rix,

-  /{usr/,}bin/apt-config rPx,
-  /{usr/,}bin/apt-get    rPx,
+  /{usr/,}bin/apt-config         rPx,
+  /{usr/,}bin/apt-get            rPx,
+  /{usr/,}bin/unattended-upgrade rPx,

  /etc/default/locale    r,

@ -48,7 +50,7 @@ profile apt-systemd-daily @{exec_path} {
  /var/lib/apt/daily_lock wk,

  /var/lib/apt/extended_states r,
-  /var/lib/apt/periodic/autoclean-stamp w,
+  /var/lib/apt/periodic/* w,

  /var/backups/ r,
  /var/backups/apt.extended_states rw,
--- a/apparmor.d/groups/apt/dpkg
+++ b/apparmor.d/groups/apt/dpkg
@ -38,6 +38,8 @@ profile dpkg @{exec_path} {
  #
  /{usr/,}bin/dpkg-split  rPx,

+  /{usr/,}lib/needrestart/dpkg-status rPx,
+
  /usr/share/debian-security-support/check-support-status.hook rPx,

  /{usr/,}bin/pager       rCx -> diff,
--- a/apparmor.d/groups/gnome/gdm-wayland-session
+++ b/apparmor.d/groups/gnome/gdm-wayland-session
@ -28,8 +28,9 @@ profile gdm-wayland-session @{exec_path} {
  /{usr/,}bin/gnome-session        rix,
  /{usr/,}bin/gsettings            rix,

-  /{usr/,}bin/dbus-run-session     rPx,
  /{usr/,}bin/dbus-daemon          rPx,
+  /{usr/,}bin/dbus-run-session     rPx,
+  /{usr/,}bin/flatpak             rPUx,
  /{usr/,}lib/gnome-session-binary rPx,

  /etc/shells r,
--- a/apparmor.d/groups/systemd/systemd-environment-d-generator
+++ b/apparmor.d/groups/systemd/systemd-environment-d-generator
@ -14,8 +14,10 @@ profile systemd-environment-d-generator @{exec_path} {

  @{exec_path} mr,

-  /{usr/,}bin/gpgconf  rPx,
-  /{usr/,}bin/mawk     rix,
+  /{usr/,}bin/{,ba,da}sh  rix,
+  /{usr/,}bin/flatpak     rPUx,
+  /{usr/,}bin/gpgconf     rPx,
+  /{usr/,}bin/mawk        rix,

  /etc/environment r,

--- a/apparmor.d/groups/systemd/systemd-journald
+++ b/apparmor.d/groups/systemd/systemd-journald
@ -49,6 +49,7 @@ profile systemd-journald @{exec_path} {
  @{run}/udev/data/+scsi:*      r,
  @{run}/udev/data/+bluetooth:* r,
  @{run}/udev/data/+usb-serial:* r,
+  @{run}/udev/data/+platform:intel_pmc_core.[0-9]* r,
  @{run}/udev/data/+platform:iTCO_wdt r,
  @{run}/udev/data/+platform:regulatory.[0-9]* r,
  @{run}/udev/data/+platform:rtsx_pci_sdmmc.[0-9]* r,
--- a/apparmor.d/groups/virt/containerd
+++ b/apparmor.d/groups/virt/containerd
@ -21,8 +21,14 @@ profile containerd @{exec_path} {
  /{usr/,}bin/containerd-shim-runc-v2 rPUx,
  /{usr/,}bin/kmod                    rPx,

+  /etc/cni/{,**} r,
+  /etc/containerd/*.toml r,
+
+  /var/lib/containerd/{,**} rwk,
  /var/lib/docker/containerd/{,**} rwk,
+  @{run}/containerd/{,**} rwk,
  @{run}/docker/containerd/{,**} rwk,
+  /opt/containerd/{,**} rw,

  @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,