feat(profile): update & enable profiles in the apps group.

see #471
2024-09-09 19:40:42 +01:00 · 2024-09-09 19:40:42 +01:00 · d4e380ad46
commit d4e380ad46
parent 2af1d06f18
12 changed files with 115 additions and 70 deletions
--- a/apparmor.d/profiles-a-f/calibre
+++ b/apparmor.d/profiles-a-f/calibre
@ -0,0 +1,129 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path}  = @{bin}/calibre{,-*} @{bin}/calibredb @{bin}/ebook{,-*}
+@{exec_path} += @{bin}/fetch-ebook-metadata
+@{exec_path} += @{bin}/lrs2lrf @{bin}/lrf2lrs @{bin}/lrfviewer @{bin}/web2disk
+profile calibre @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/bus-accessibility>
+  include <abstractions/bus-session>
+  include <abstractions/bus/org.a11y>
+  include <abstractions/bus/org.gtk.vfs.MountTracker>
+  include <abstractions/bus/org.freedesktop.UDisks2>
+  include <abstractions/bus/org.kde.StatusNotifierWatcher>
+  include <abstractions/desktop>
+  include <abstractions/devices-usb>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/graphics>
+  include <abstractions/gstreamer>
+  include <abstractions/nameservice-strict>
+  include <abstractions/python>
+  include <abstractions/qt5-compose-cache-write>
+  include <abstractions/qt5-settings-write>
+  include <abstractions/qt5-shader-cache>
+  include <abstractions/ssl_certs>
+  include <abstractions/thumbnails-cache-read>
+  include <abstractions/trash-strict>
+  include <abstractions/user-download-strict>
+
+  capability sys_ptrace,
+
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  unix (send, receive) type=stream peer=(addr=none, label=xorg),
+  unix (bind, listen)  type=stream addr="@*-calibre-gui.socket",
+  unix (bind)          type=stream addr="@calibre-*",
+
+  @{exec_path} mrix,
+
+  @{sh_path}              rix,
+  @{python_path}          rix,
+  @{bin}/file             rix,
+  @{bin}/ldconfig{,.real} rix,
+  @{bin}/uname            rix,
+  @{lib}/{,@{multiarch}/}qt{5,6}{,/libexec/}QtWebEngineProcess rix,
+
+  @{bin}/pdftoppm        rPUx, # (#FIXME#)
+  @{bin}/pdfinfo         rPUx,
+  @{bin}/pdftohtml       rPUx,
+
+  @{open_path}            rPx -> child-open,
+
+  /usr/share/calibre/{,**} r,
+
+  /etc/fstab r,
+  /etc/inputrc r,
+  /etc/magic r,
+  /etc/mime.types r,
+
+  owner @{HOME}/ r,
+  owner "@{HOME}/Calibre Library/{,**}" rw,
+  owner "@{HOME}/Calibre Library/metadata.db" rwk,
+  owner @{user_documents_dirs}/{,**} rwl,
+  owner @{user_books_dirs}/{,**} rwl,
+  owner @{user_torrents_dirs}/{,**} rwl,
+  owner @{user_work_dirs}/{,**} rwl,
+
+  owner @{user_config_dirs}/calibre/ rw,
+  owner @{user_config_dirs}/calibre/** rwk,
+
+  owner @{user_share_dirs}/calibre-ebook.com/ rw,
+  owner @{user_share_dirs}/calibre-ebook.com/** rwk,
+
+  owner @{user_cache_dirs}/calibre/ rw,
+  owner @{user_cache_dirs}/calibre/** rwkl -> @{user_cache_dirs}/calibre/**,
+
+  owner @{tmp}/calibre_*_tmp_*/{,**} rw,
+  owner @{tmp}/calibre-*/{,**} rw,
+  owner @{tmp}/@{int}-*/ rw,
+  owner @{tmp}/@{int}-*/** rwl,
+
+  owner /dev/shm/#@{int} rw,
+
+  @{sys}/devices/@{pci}/irq r,
+
+        @{PROC}/ r,
+        @{PROC}/@{pids}/net/route r,
+        @{PROC}/sys/fs/inotify/max_user_watches r,
+        @{PROC}/sys/kernel/yama/ptrace_scope r,
+        @{PROC}/vmstat r,
+  owner @{PROC}/@{pid}/cmdline r,
+  owner @{PROC}/@{pid}/comm r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+       owner @{PROC}/@{pid}/stat{,m} r,
+       owner @{PROC}/@{pid}/stat{,m} r,
+       owner @{PROC}/@{pid}/comm r,
+  owner @{PROC}/@{pid}/stat{,m} r,
+       owner @{PROC}/@{pid}/comm r,
+  owner @{PROC}/@{pid}/task/ r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+       owner @{PROC}/@{pid}/task/@{tid}/status r,
+       owner @{PROC}/@{pid}/task/@{tid}/status r,
+       owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+  deny owner @{PROC}/@{pid}/cmdline r,
+  deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+  deny       @{PROC}/sys/kernel/random/boot_id r,
+  owner @{PROC}/@{pid}/task/@{tid}/status r,
+       owner @{PROC}/@{pid}/task/@{tid}/comm rw,
+  deny owner @{PROC}/@{pid}/cmdline r,
+  deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+  deny       @{PROC}/sys/kernel/random/boot_id r,
+
+  owner /dev/tty@{int} rw,
+
+  include if exists <local/calibre>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/discord
+++ b/apparmor.d/profiles-a-f/discord
@ -0,0 +1,57 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{name} = discord
+@{lib_dirs} = /usr/share/@{name} /opt/@{name}
+@{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb
+@{cache_dirs} = @{user_cache_dirs}/@{name}
+
+@{exec_path} = @{bin}/discord{,-ptb} @{lib_dirs}/Discord{,PTB} 
+profile discord @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/audio-client>
+  include <abstractions/bus-session>
+  include <abstractions/bus/org.freedesktop.ScreenSaver>
+  include <abstractions/bus/org.kde.StatusNotifierWatcher>
+  include <abstractions/common/electron>
+  include <abstractions/thumbnails-cache-read>
+  include <abstractions/user-download-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  @{exec_path} mrix,
+  @{sh_path}    rix,
+  @{bin}/lsb_release rPx -> lsb_release,
+
+  @{lib_dirs}/chrome-sandbox rix,
+  @{lib_dirs}/chrome_crashpad_handler rix,
+
+  @{open_path}         rPx -> child-open-strict,
+
+  owner @{user_videos_dirs}/{,**} rwl,
+  owner @{user_pictures_dirs}/{,**} rwl,
+
+  owner @{tmp}/net-export/ rw,
+  owner @{tmp}/discord.sock rw,
+  owner "@{tmp}/Discord Crashes/" rw,
+
+  audit owner @{config_dirs}/*/modules/** rm,
+
+  owner @{run}/user/@{uid}/discord-ipc-@{int} rw,
+
+  owner @{PROC}/@{pid}/task/@{tid}/comm r,
+
+  include if exists <local/discord>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/discord-chrome-sandbox
+++ b/apparmor.d/profiles-a-f/discord-chrome-sandbox
@ -0,0 +1,35 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2020-2021 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{name} = discord
+@{lib_dirs} = /usr/share/@{name} /opt/@{name} 
+@{config_dirs} = @{user_config_dirs}/@{name} @{user_config_dirs}/discordptb
+@{cache_dirs} = @{user_cache_dirs}/@{name}
+
+@{exec_path} = @{lib_dirs}/chrome-sandbox
+profile discord-chrome-sandbox @{exec_path} {
+  include <abstractions/base>
+
+  #capability setgid,
+  #capability setuid,
+  capability sys_admin,
+  capability sys_chroot,
+  capability sys_resource,
+
+  @{exec_path} mr,
+
+  @{lib_dirs}/Discord rpx,
+
+             @{PROC}/@{pids}/ r,
+  deny owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+
+  include if exists <local/discord-chrome-sandbox>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/dropbox
+++ b/apparmor.d/profiles-a-f/dropbox
@ -0,0 +1,88 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2015-2020 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{name} = dropbox
+@{config_dirs}=@{HOME}/.@{name}/
+@{share_dirs}=@{HOME}/Dropbox*/
+@{demon_dirs}=@{HOME}/.dropbox-dist/
+
+@{exec_path} = @{bin}/dropbox
+profile dropbox @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/bus-session>
+  include <abstractions/bus/org.freedesktop.Notifications>
+  include <abstractions/bus/org.kde.StatusNotifierWatcher>
+  include <abstractions/desktop>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/nameservice-strict>
+  include <abstractions/python>
+  include <abstractions/qt5-settings-write>
+  include <abstractions/ssl_certs>
+
+  @{exec_path} mr,
+
+  @{bin}/ r,
+  @{sh_path}        rix,
+  @{bin}/readlink   rix,
+  @{bin}/dirname    rix,
+  @{bin}/uname      rix,
+  @{bin}/ldconfig   rix,
+  @{bin}/python3.@{int}             rix,
+  @{lib}/llvm-[0-9]*/bin/clang      rix,
+  @{bin}/{,@{multiarch}-}gcc-[0-9]* rix,
+  @{bin}/{,@{multiarch}-}objdump    rix,
+
+  @{open_path}                      rPx -> child-open-strict,
+  @{bin}/lsb_release                rPx -> lsb_release,
+
+  owner @{HOME}/ r,
+  owner @{config_dirs}/ rw,
+  owner @{config_dirs}/** rwk,
+
+  owner @{share_dirs}/ rw,
+  owner @{share_dirs}/{,**} rw,
+
+  # Dropbox proprietary demon files
+  owner @{demon_dirs}/{,**} rw,
+  owner @{demon_dirs}/dropboxd rwix,
+  owner @{demon_dirs}/dropbox-lnx.*/dropbox rwix,
+  owner @{demon_dirs}/dropbox-lnx.*/dropboxd rwix,
+  owner @{demon_dirs}/dropbox-lnx.*/dropbox_py3 rwix,
+  owner @{demon_dirs}/dropbox-lnx.*/wmctrl rwix,
+  owner @{demon_dirs}/dropbox-lnx.*/*.so* mrw,
+  owner @{demon_dirs}/dropbox-lnx.*/plugins/platforms/*.so mrw,
+
+  # Dropbox first tries the /tmp/ dir, and if it's denied it uses the /var/tmp/ dir instead
+  owner @{tmp}/dropbox-antifreeze-* rw,
+  owner @{tmp}/#@{int} rw,
+  owner /var/tmp/etilqs_@{hex16} rw,
+
+  @{run}/systemd/users/@{uid} r,
+
+        @{PROC}/@{pid}/cmdline r,
+        @{PROC}/@{pid}/net/tcp{,6} r,
+        @{PROC}/@{pid}/net/udp{,6} r,
+        @{PROC}/vmstat r,
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/fdinfo/* r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
+  owner @{PROC}/@{pid}/oom_{,score_}adj rw,
+  owner @{PROC}/@{pid}/stat r,
+  owner @{PROC}/@{pid}/task/ r,
+  owner @{PROC}/@{pid}/task/@{tid}/comm r,
+  owner @{PROC}/@{pid}/task/@{tid}/stat r,
+
+  deny @{sys}/module/apparmor/parameters/enabled r,
+  deny @{user_config_dirs}/autostart/dropbox.desktop rw,
+
+  include if exists <local/dropbox>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/filezilla
+++ b/apparmor.d/profiles-a-f/filezilla
@ -0,0 +1,73 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2018-2021 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{exec_path} = @{bin}/filezilla
+profile filezilla @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/bus-session>
+  include <abstractions/bus/org.freedesktop.Notifications>
+  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/desktop>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/nameservice-strict>
+  include <abstractions/p11-kit>
+  include <abstractions/ssl_certs>
+  include <abstractions/user-download-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink dgram,
+  network netlink raw,
+
+  signal (send) set=(term, kill) peer=fzsftp,
+
+  @{exec_path} mr,
+
+  @{sh_path}         rix,
+  @{bin}/uname       rix,
+
+  @{bin}/fzsftp      rPx,  # When using SFTP protocol
+  @{bin}/lsb_release rPx -> lsb_release,
+
+  /usr/share/filezilla/{,**} r,
+
+  /etc/fstab r,
+
+  / r,
+  /*/ r,
+  /*/*/ r,
+
+  # FTP share folder
+  owner @{MOUNTS}/ftp/ r,
+  owner @{MOUNTS}/ftp/** rw,
+
+  owner @{HOME}/ r,
+  owner @{user_config_dirs}/filezilla/ rw,
+  owner @{user_config_dirs}/filezilla/* rwk,
+
+  owner @{user_cache_dirs}/filezilla/ rw,
+  owner @{user_cache_dirs}/filezilla/default_*.png rw,
+
+        /tmp/ r,
+  owner @{tmp}/fz[0-9]temp-@{int}/ rw,
+  owner @{tmp}/fz[0-9]temp-@{int}/fz*-lockfile rwk,
+  owner @{tmp}/fz[0-9]temp-@{int}/empty_file_* rw,
+
+  owner @{PROC}/@{pid}/fd/ r,
+  owner @{PROC}/@{pid}/mountinfo r,
+  owner @{PROC}/@{pid}/mounts r,
+
+  owner /dev/tty@{int} rw,
+
+  include if exists <local/filezilla>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/freetube
+++ b/apparmor.d/profiles-a-f/freetube
@ -0,0 +1,49 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{name} = {F,f}reetube{,-vue}
+@{lib_dirs} = @{lib}/@{name} /opt/@{name} 
+@{config_dirs} = @{user_config_dirs}/@{name}
+@{cache_dirs} = @{user_cache_dirs}/@{name}
+
+@{exec_path} = @{bin}/@{name} @{lib_dirs}/@{name}
+profile freetube @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/audio-client>
+  include <abstractions/bus/org.freedesktop.ScreenSaver>
+  include <abstractions/bus/org.gnome.SessionManager>
+  include <abstractions/common/electron>
+  include <abstractions/consoles>
+  include <abstractions/thumbnails-cache-read>
+  include <abstractions/user-download-strict>
+
+  network inet dgram,
+  network inet6 dgram,
+  network inet stream,
+  network inet6 stream,
+  network netlink raw,
+
+  #aa:dbus own bus=session name=org.mpris.MediaPlayer2.freetube path=/org/mpris/MediaPlayer2
+
+  @{exec_path} mrix,
+
+  @{open_path}         rPx -> child-open-strict,
+
+  /etc/fstab r,
+  /etc/machine-id r,
+  /var/lib/dbus/machine-id r,
+
+  owner @{run}/user/@{uid}/ r,
+
+  owner /dev/tty@{int} rw,
+
+  include if exists <local/freetube>
+}
+
+# vim:syntax=apparmor
--- a/apparmor.d/profiles-a-f/freetube-chrome-sandbox
+++ b/apparmor.d/profiles-a-f/freetube-chrome-sandbox
@ -0,0 +1,35 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2019-2021 Mikhail Morfikov
+# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+@{name} = {F,f}reetube{,-vue}
+@{lib_dirs} = @{lib}/@{name} /opt/@{name} 
+
+@{exec_path} = @{lib_dirs}/chrome-sandbox
+profile freetube-chrome-sandbox @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/consoles>
+
+  capability sys_admin,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+
+  @{exec_path} mr,
+
+  # Has to be lower "P"
+  @{lib_dirs}/@{name} rpx,
+
+             @{PROC}/@{pids}/ r,
+       owner @{PROC}/@{pid}/oom_{,score_}adj r,
+  deny owner @{PROC}/@{pid}/oom_{,score_}adj w,
+
+  include if exists <local/freetube-chrome-sandbox>
+}
+
+# vim:syntax=apparmor