update apparmor profiles

Co-authored-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Alexandre Pujol <alexandre@pujol.io>
2022-02-27 01:22:35 +00:00 · 2022-02-27 01:22:35 +00:00 · d701e39939
commit d701e39939
parent b0690c0e55
201 changed files with 540 additions and 608 deletions
--- a/apparmor.d/profiles-a-f/amarok
+++ b/apparmor.d/profiles-a-f/amarok
@ -46,7 +46,6 @@ profile amarok @{exec_path} {
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
  include <abstractions/devices-usb>
-  include <abstractions/deny-root-dir-access>

  ptrace (trace) peer=@{profile_name},

--- a/apparmor.d/profiles-a-f/anki
+++ b/apparmor.d/profiles-a-f/anki
@ -25,7 +25,6 @@ profile anki @{exec_path} {
  include <abstractions/trash>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>

  signal (send) set=(term, kill) peer=anki//mpv,

--- a/apparmor.d/profiles-a-f/anyremote
+++ b/apparmor.d/profiles-a-f/anyremote
@ -11,7 +11,6 @@ profile anyremote @{exec_path} {
  include <abstractions/base>
  include <abstractions/consoles>
  include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>

  signal (receive) set=(int, term, kill),
  signal (send) set=(term, kill),
--- a/apparmor.d/profiles-a-f/appimage-beyond-all-reason
+++ b/apparmor.d/profiles-a-f/appimage-beyond-all-reason
@ -22,18 +22,10 @@ profile appimage-beyond-all-reason @{exec_path} {
  include <abstractions/mesa>
  include <abstractions/ssl_certs>
  include <abstractions/audio>
+  include <abstractions/chromium-common>

  capability sys_ptrace,

-  # For kernel unprivileged user namespaces
-  capability sys_admin,
-  capability sys_chroot,
-  capability setuid,
-  capability setgid,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
-
  network netlink raw,
  network inet dgram,
  network inet6 dgram,
@ -51,20 +43,13 @@ profile appimage-beyond-all-reason @{exec_path} {

  mount fstype={fuse,fuse.*} -> /tmp/.mount_Beyond*/,

-    /var/tmp/ r,
-	    /tmp/ r,
-	    /tmp/.mount_Beyond*/  rw,
-	    /tmp/.mount_Beyond*/beyond-all-reason rix,
-	    /tmp/.mount_Beyond*/AppRun rix,
-	    /tmp/.mount_Beyond*/bin/* rix,
-	    /tmp/.mount_Beyond*/resources/app.asar.unpacked/node_modules/** rix,
-	    /tmp/.mount_Beyond*/**  r,
-	    /tmp/.mount_Beyond*/**.so{,.[0-9]*} mr,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie rw,
-  owner /tmp/.org.chromium.Chromium.*/SS rw,
-  owner /tmp/.org.chromium.Chromium.*/*.png rw,
-  owner /tmp/.org.chromium.Chromium.* rw,
+  /tmp/.mount_Beyond*/  rw,
+  /tmp/.mount_Beyond*/beyond-all-reason rix,
+  /tmp/.mount_Beyond*/AppRun rix,
+  /tmp/.mount_Beyond*/bin/* rix,
+  /tmp/.mount_Beyond*/resources/app.asar.unpacked/node_modules/** rix,
+  /tmp/.mount_Beyond*/**  r,
+  /tmp/.mount_Beyond*/**.so{,.[0-9]*} mr,

  owner @{user_config_dirs}/Beyond-All-Reason/ rw,
  owner @{user_config_dirs}/Beyond-All-Reason/** rwk,
@ -76,12 +61,6 @@ profile appimage-beyond-all-reason @{exec_path} {
  owner @{HOME}/.spring/ rw,
  owner @{HOME}/.spring/** rw,

-  owner @{HOME}/.pki/ rw,
-  owner @{HOME}/.pki/nssdb/ rw,
-  owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
-  owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
-
             @{PROC}/ r,
       owner @{PROC}/@{pid}/fd/ r,
  deny owner @{PROC}/@{pid}/cmdline r,
@ -94,8 +73,6 @@ profile appimage-beyond-all-reason @{exec_path} {
             @{PROC}sys/fs/inotify/max_user_watches r,
             @{PROC}/sys/kernel/yama/ptrace_scope r,

-  owner /dev/shm/.org.chromium.Chromium.* rw,
-
  @{sys}/bus/pci/devices/ r,
  @{sys}/devices/pci[0-9]*/**/class r,
  @{sys}/devices/virtual/tty/tty0/active r,
--- a/apparmor.d/profiles-a-f/arandr
+++ b/apparmor.d/profiles-a-f/arandr
@ -16,7 +16,6 @@ profile arandr @{exec_path} {
  include <abstractions/python>
  include <abstractions/user-download-strict>
  include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} r,
  /{usr/,}bin/python3.[0-9]* r,
--- a/apparmor.d/profiles-a-f/atril
+++ b/apparmor.d/profiles-a-f/atril
@ -0,0 +1,96 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# Ebooks extensions
+# pdf, epub, djvu
+@{atril_ext}   = [pP][dD][fF]
+@{atril_ext}  += [eE][pP][uU][bB]
+@{atril_ext}  += [dD][jJ][vV][uU]
+
+# PNG preview
+@{atril_ext}  += [pP][nN][gG]
+
+@{exec_path} = /{usr/,}bin/atril{,-*}
+profile atril @{exec_path} {
+  include <abstractions/base>
+  include <abstractions/gtk>
+  include <abstractions/fonts>
+  include <abstractions/fontconfig-cache-read>
+  include <abstractions/freedesktop.org>
+  include <abstractions/user-download-strict>
+  include <abstractions/private-files-strict>
+  include <abstractions/nameservice-strict>
+
+  network netlink raw,
+
+  @{exec_path} mr,
+
+  /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitNetworkProcess rix,
+  /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess rix,
+
+  # Which media files atril should be able to open
+        / r,
+        /home/ r,
+  owner @{HOME}/ r,
+  owner @{HOME}/**/ r,
+        @{MOUNTS}/ r,
+  owner @{MOUNTS}/**/ r,
+        /tmp/ r,
+        /tmp/mozilla_*/ r,
+  owner /{home,media,tmp}/**.@{atril_ext} rw,
+
+  /usr/share/atril/{,**} r,
+
+  /usr/share/glib-2.0/schemas/gschemas.compiled r,
+
+  include <abstractions/dconf>
+  owner @{run}/user/@{uid}/dconf/ rw,
+  owner @{run}/user/@{uid}/dconf/user rw,
+
+       owner @{PROC}/@{pid}/mountinfo r,
+       owner @{PROC}/@{pid}/mounts r,
+       owner @{PROC}/@{pid}/statm r,
+  deny owner @{PROC}/@{pid}/cmdline r,
+       owner @{PROC}/@{pid}/cgroup r,
+             @{PROC}/zoneinfo r,
+
+  /sys/firmware/acpi/pm_profile r,
+  /sys/devices/virtual/dmi/id/chassis_type r,
+  /sys/fs/cgroup/** r,
+
+  /etc/fstab r,
+
+  /usr/share/poppler/** r,
+
+  owner @{user_config_dirs}/atril/ rw,
+  owner @{user_config_dirs}/atril/* rw,
+
+  owner @{user_cache_dirs}/atril/ rw,
+  owner @{user_cache_dirs}/atril/** rw,
+
+  owner @{user_share_dirs}/gvfs-metadata/home r,
+  owner @{user_share_dirs}/gvfs-metadata/home-*.log r,
+
+  owner /tmp/gtkprint_* rw,
+  owner /tmp/atril-@{pid}/ rw,
+  owner /tmp/atril-@{pid}/*/ rw,
+  owner /tmp/atril-@{pid}/*/mimetype rw,
+  owner /tmp/atril-@{pid}/*/META-INF/ rw,
+  owner /tmp/atril-@{pid}/*/META-INF/container.xml rw,
+  owner /tmp/atril-@{pid}/*/index_split_[0-9]*.html rw,
+  owner /tmp/atril-@{pid}/*/page_styles.css rw,
+  owner /tmp/atril-@{pid}/*/titlepage.xhtml rw,
+  owner /tmp/atril-@{pid}/*/stylesheet.css rw,
+  owner /tmp/atril-@{pid}/*/images/ rw,
+  owner /tmp/atril-@{pid}/*/images/*.jpg rw,
+  owner /tmp/atril-@{pid}/*/toc.ncx rw,
+  owner /tmp/atril-@{pid}/*/content.opf rw,
+  owner /tmp/atril-@{pid}/*/META-INF/calibre_bookmarks.txt rw,
+
+  include if exists <local/atril>
+}
--- a/apparmor.d/profiles-a-f/atrild
+++ b/apparmor.d/profiles-a-f/atrild
@ -0,0 +1,22 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2022 Mikhail Morfikov
+# SPDX-License-Identifier: GPL-2.0-only
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+# Ebooks extensions
+# pdf, epub, djvu
+@{qpdfview_ext}   = [pP][dD][fF]
+@{qpdfview_ext}  += [eE][pP][uU][bB]
+@{qpdfview_ext}  += [dD][jJ][vV][uU]
+
+@{exec_path} = /{usr/,}lib/atril/atrild
+profile atrild @{exec_path} {
+  include <abstractions/base>
+
+  @{exec_path} mr,
+
+  include if exists <local/atrild>
+}
--- a/apparmor.d/profiles-a-f/birdtray
+++ b/apparmor.d/profiles-a-f/birdtray
@ -20,7 +20,6 @@ profile birdtray @{exec_path} {
  include <abstractions/nameservice-strict>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>

  network inet dgram,
  network inet6 dgram,
@ -71,7 +70,6 @@ profile birdtray @{exec_path} {

  # file_inherit
  owner /dev/tty[0-9]* rw,
-  owner @{HOME}/.xsession-errors w,


  profile open {
--- a/apparmor.d/profiles-a-f/cawbird
+++ b/apparmor.d/profiles-a-f/cawbird
@ -18,7 +18,6 @@ profile cawbird @{exec_path} {
  include <abstractions/enchant>
  include <abstractions/audio>
  include <abstractions/gstreamer>
-  include <abstractions/deny-root-dir-access>

  network inet dgram,
  network inet6 dgram,
--- a/apparmor.d/profiles-a-f/claws-mail
+++ b/apparmor.d/profiles-a-f/claws-mail
@ -19,7 +19,6 @@ profile claws-mail @{exec_path} flags=(complain) {
  include <abstractions/audio>
  include <abstractions/thumbnails-cache-read>
  include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

@ -66,9 +65,6 @@ profile claws-mail @{exec_path} flags=(complain) {
  /usr/share/sounds/freedesktop/stereo/*.oga r,
  /usr/share/publicsuffix/*.dafsa r,

-  # file_inherit
-  owner @{HOME}/.xsession-errors w,
-

  profile gpg {
    include <abstractions/base>
--- a/apparmor.d/profiles-a-f/compton
+++ b/apparmor.d/profiles-a-f/compton
@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/compton
 profile compton @{exec_path} {
  include <abstractions/base>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

--- a/apparmor.d/profiles-a-f/conky
+++ b/apparmor.d/profiles-a-f/conky
@ -16,7 +16,6 @@ profile conky @{exec_path} {
  include <abstractions/nameservice-strict>
  include <abstractions/openssl>
  include <abstractions/ssl_certs>
-  include <abstractions/deny-root-dir-access>

  # To get the external IP address
  # For samba share mounts
@ -157,8 +156,11 @@ profile conky @{exec_path} {
    include <abstractions/openssl>
    include <abstractions/ssl_certs>

-    network inet,
-    network inet6,
+    network inet dgram,
+    network inet6 dgram,
+    network inet stream,
+    network inet6 stream,
+    network netlink raw,

    /{usr/,}bin/wget mr,
    /{usr/,}bin/curl mr,
--- a/apparmor.d/profiles-a-f/convertall
+++ b/apparmor.d/profiles-a-f/convertall
@ -19,7 +19,6 @@ profile convertall @{exec_path} {
  include <abstractions/python>
  include <abstractions/qt5-compose-cache-write>
  include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} r,
  /{usr/,}bin/{,ba,da}sh     rix,
--- a/apparmor.d/profiles-a-f/deltachat-desktop
+++ b/apparmor.d/profiles-a-f/deltachat-desktop
@ -23,14 +23,7 @@ profile deltachat-desktop @{exec_path} {
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
  include <abstractions/user-download-strict>
-
-  # The following rules are needed only when the kernel.unprivileged_userns_clone option is set
-  # to "1".
-  capability sys_admin,
-  capability sys_chroot,
-  owner @{PROC}/@{pid}/setgroups w,
-  owner @{PROC}/@{pid}/gid_map w,
-  owner @{PROC}/@{pid}/uid_map w,
+  include <abstractions/chromium-common>

  network inet dgram,
  network inet6 dgram,
@ -59,13 +52,6 @@ profile deltachat-desktop @{exec_path} {

  /usr/share/glib-2.0/schemas/gschemas.compiled r,

-        /var/tmp/ r,
-        /tmp/ r,
-  owner /tmp/.org.chromium.Chromium.*/ rw,
-  owner /tmp/.org.chromium.Chromium.*/SingletonCookie w,
-  owner /tmp/.org.chromium.Chromium.*/SS w,
-  owner /tmp/.org.chromium.Chromium.*/*.png rw,
-  owner /tmp/.org.chromium.Chromium.* rw,
  owner /tmp/[0-9a-f]*/ rw,
  owner /tmp/[0-9a-f]*/db.sqlite-blobs/ rw,
  owner /tmp/[0-9a-f]*/db.sqlite rwk,
@ -85,8 +71,6 @@ profile deltachat-desktop @{exec_path} {
             @{PROC}/sys/fs/inotify/max_user_watches r,

        /dev/ r,
-        /dev/shm/ r,
-  owner /dev/shm/.org.chromium.Chromium.* rw,

  # (#FIXME#)
  deny @{sys}/bus/pci/devices/ r,
--- a/apparmor.d/profiles-a-f/dhclient-script
+++ b/apparmor.d/profiles-a-f/dhclient-script
@ -57,8 +57,7 @@ profile dhclient-script @{exec_path} {
  /{usr/,}bin/ip        rix,

  # For loadbalance
-  /etc/iproute2/rt_tables r,
-  /etc/iproute2/rt_tables.d/{,*} r,
+  /etc/iproute2/** r,
  owner @{PROC}/@{pid}/loginuid r,

  # For updating the /etc/resolv.conf file
@ -91,7 +90,7 @@ profile dhclient-script @{exec_path} {
  @{run}/chrony-dhcp/ rw,

  # file_inherit
-  /var/lib/dhcp/dhclient.leases r,
+  /var/lib/dhcp/*.leases r,


  profile run-parts {
@ -102,7 +101,7 @@ profile dhclient-script @{exec_path} {
    /etc/dhcp/dhclient-{enter,exit}-hooks.d/ r,

    # file_inherit
-    owner /var/lib/dhcp/dhclient.leases r,
+    /var/lib/dhcp/*.leases r,

  }

--- a/apparmor.d/profiles-a-f/engrampa
+++ b/apparmor.d/profiles-a-f/engrampa
@ -16,7 +16,6 @@ profile engrampa @{exec_path} {
  include <abstractions/nameservice-strict>
  include <abstractions/user-download-strict>
  include <abstractions/thumbnails-cache-read>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

@ -75,6 +74,8 @@ profile engrampa @{exec_path} {

  /usr/share/glib-2.0/schemas/gschemas.compiled r,

+  /etc/magic r,
+
  owner @{PROC}/@{pid}/cgroup r,
  owner @{PROC}/@{pid}/fd/ r,
        @{PROC}/@{pid}/mountinfo r,
--- a/apparmor.d/profiles-a-f/evince
+++ b/apparmor.d/profiles-a-f/evince
@ -10,7 +10,6 @@ include <tunables/global>
 profile evince @{exec_path} {
  include <abstractions/base>
  include <abstractions/dconf>
-  include <abstractions/deny-root-dir-access>
  include <abstractions/gnome>
  include <abstractions/openssl>
  include <abstractions/user-download-strict>
--- a/apparmor.d/profiles-a-f/execute-dcut
+++ b/apparmor.d/profiles-a-f/execute-dcut
@ -10,7 +10,6 @@ include <tunables/global>
 profile execute-dcut @{exec_path} flags=(complain) {
  include <abstractions/base>
  include <abstractions/python>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} r,
  /{usr/,}bin/python3.[0-9]* r,
--- a/apparmor.d/profiles-a-f/execute-dput
+++ b/apparmor.d/profiles-a-f/execute-dput
@ -11,7 +11,6 @@ profile execute-dput @{exec_path} flags=(complain) {
  include <abstractions/base>
  include <abstractions/python>
  include <abstractions/nameservice-strict>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} r,
  /{usr/,}bin/python3.[0-9]* r,
--- a/apparmor.d/profiles-a-f/ffmpeg
+++ b/apparmor.d/profiles-a-f/ffmpeg
@ -45,13 +45,13 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/ffmpeg
 profile ffmpeg @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dri-common>
  include <abstractions/audio>
  include <abstractions/nameservice-strict>
  include <abstractions/ssl_certs>
  include <abstractions/user-download-strict>
  include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>

  network inet dgram,
  network inet6 dgram,
--- a/apparmor.d/profiles-a-f/ffplay
+++ b/apparmor.d/profiles-a-f/ffplay
@ -45,7 +45,6 @@ profile ffplay @{exec_path} {
  include <abstractions/audio>
  include <abstractions/user-download-strict>
  include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

--- a/apparmor.d/profiles-a-f/ffprobe
+++ b/apparmor.d/profiles-a-f/ffprobe
@ -40,10 +40,10 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/ffprobe
 profile ffprobe @{exec_path} {
  include <abstractions/base>
+  include <abstractions/consoles>
  include <abstractions/dri-common>
  include <abstractions/user-download-strict>
  include <abstractions/private-files-strict>
-  include <abstractions/deny-root-dir-access>

  @{exec_path} mr,

--- a/apparmor.d/profiles-a-f/fusermount
+++ b/apparmor.d/profiles-a-f/fusermount
@ -29,7 +29,7 @@ profile fusermount @{exec_path} {
  mount fstype={fuse,fuse.*} -> @{HOME}/.cache/**/,
  mount fstype={fuse,fuse.*} -> @{MOUNTS}/*/,
  mount fstype={fuse,fuse.*} -> @{MOUNTS}/*/*/,
-  mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/doc/,
+  mount fstype={fuse,fuse.*} -> @{run}/user/@{uid}/*/,

  umount @{HOME}/*/,
  umount @{HOME}/*/*/,
@ -37,8 +37,7 @@ profile fusermount @{exec_path} {
  umount @{MOUNTS}/*/,
  umount @{MOUNTS}/*/*/,
  umount /tmp/.mount_*/,
-  umount @{run}/user/@{uid}/doc/,
-  umount @{run}/user/@{uid}/gvfs/,
+  umount @{run}/user/@{uid}/*/,

  /etc/fuse.conf r,
  /etc/machine-id r,