From 5938079dfd23cccfd2086b6bb67469335c8ae5ba Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Aug 2023 10:22:05 +0200 Subject: [PATCH 1/5] fix: missing "startplasma-wayland" profile, but "sddm" tries to transition to it. #188 --- apparmor.d/groups/kde/sddm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/kde/sddm b/apparmor.d/groups/kde/sddm index 299276135..1558a32f2 100644 --- a/apparmor.d/groups/kde/sddm +++ b/apparmor.d/groups/kde/sddm @@ -65,7 +65,7 @@ profile sddm @{exec_path} flags=(attach_disconnected,mediate_deleted) { @{bin}/dbus-update-activation-environment rCx -> dbus, @{bin}/gnome-keyring-daemon rPx, @{bin}/kwalletd5 rPx, - @{bin}/startplasma-wayland rPx, + @{bin}/startplasma-wayland rPUx, @{bin}/startplasma-x11 rPx, @{bin}/systemctl rPx -> child-systemctl, @{bin}/xrdb rPx, From cdc10fdb3152f0b2085e51521e1a35b2a4ca7962 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Aug 2023 16:06:17 +0200 Subject: [PATCH 2/5] feat(profiles): general update. See #134 --- .../groups/akonadi/akonadi_indexing_agent | 2 +- apparmor.d/groups/browsers/firefox | 10 ++++-- apparmor.d/groups/freedesktop/pulseaudio | 4 +++ apparmor.d/groups/freedesktop/xdg-settings | 1 + apparmor.d/groups/freedesktop/xrdb | 1 + apparmor.d/groups/freedesktop/xset | 1 + apparmor.d/groups/freedesktop/xsetroot | 2 +- apparmor.d/groups/kde/kactivitymanagerd | 3 ++ apparmor.d/groups/kde/kalendarac | 1 + apparmor.d/groups/kde/kcminit | 3 +- apparmor.d/groups/kde/kded5 | 31 +++++++++++++------ apparmor.d/groups/kde/kioslave5 | 3 ++ apparmor.d/groups/kde/kscreenlocker-greet | 1 + apparmor.d/groups/kde/plasmashell | 2 +- apparmor.d/groups/kde/xembedsniproxy | 1 + apparmor.d/profiles-a-f/aa-notify | 8 ++++- apparmor.d/profiles-a-f/agetty | 2 ++ apparmor.d/profiles-a-f/augenrules | 1 + apparmor.d/profiles-g-l/kmod | 1 + apparmor.d/profiles-m-r/os-prober | 2 ++ 20 files changed, 64 insertions(+), 16 deletions(-) diff --git a/apparmor.d/groups/akonadi/akonadi_indexing_agent b/apparmor.d/groups/akonadi/akonadi_indexing_agent index 968e255e3..98b33eca3 100644 --- a/apparmor.d/groups/akonadi/akonadi_indexing_agent +++ b/apparmor.d/groups/akonadi/akonadi_indexing_agent @@ -35,7 +35,7 @@ profile akonadi_indexing_agent @{exec_path} { owner @{user_config_dirs}/akonadi_indexing_agentrc r, owner @{user_config_dirs}/akonadi/#[0-9]* rw, - owner @{user_config_dirs}/akonadi/agent_config_akonadi_indexing_agent{,.*} rwlk, + owner @{user_config_dirs}/akonadi/agent_config_akonadi_indexing_agent* rwlk, owner @{user_config_dirs}/akonadi/akonadiconnectionrc r, owner @{user_config_dirs}/kdedefaults/kdeglobals r, owner @{user_config_dirs}/kdedefaults/kwinrc r, diff --git a/apparmor.d/groups/browsers/firefox b/apparmor.d/groups/browsers/firefox index 15274eabd..c154d3ad7 100644 --- a/apparmor.d/groups/browsers/firefox +++ b/apparmor.d/groups/browsers/firefox @@ -130,6 +130,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{bin}/{,ba,da}sh rix, @{bin}/basename rix, + @{bin}/expr rix, @{firefox_lib_dirs}/{,**} r, @{firefox_lib_dirs}/*.so mr, @@ -212,13 +213,16 @@ profile firefox @{exec_path} flags=(attach_disconnected) { /tmp/ r, /var/tmp/ r, + owner /tmp/@{firefox_name}/ rw, + owner /tmp/@{firefox_name}/* rwk, owner /tmp/* rw, owner /tmp/firefox_*/ rw, owner /tmp/firefox_*/* rwk, - owner /tmp/@{firefox_name}/ rw, - owner /tmp/@{firefox_name}/* rwk, owner /tmp/mozilla_*/ rw, owner /tmp/mozilla_*/* rw, + owner /tmp/MozillaBackgroundTask-*-removeDirectory/ rw, + owner /tmp/MozillaBackgroundTask-*-removeDirectory/** rwk, + owner /tmp/Mozillato-be-removed-cachePurge-* k, owner /tmp/Temp-*/ rw, @{run}/mount/utab r, @@ -240,6 +244,8 @@ profile firefox @{exec_path} flags=(attach_disconnected) { @{sys}/devices/system/cpu/present r, @{sys}/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us r, + owner @{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/background.slice/*/cpu.max r, + @{PROC}/@{pid}/net/arp r, @{PROC}/@{pid}/net/if_inet6 r, @{PROC}/@{pid}/net/route r, diff --git a/apparmor.d/groups/freedesktop/pulseaudio b/apparmor.d/groups/freedesktop/pulseaudio index fc5b27021..41551698e 100644 --- a/apparmor.d/groups/freedesktop/pulseaudio +++ b/apparmor.d/groups/freedesktop/pulseaudio @@ -173,8 +173,12 @@ profile pulseaudio @{exec_path} { @{run}/systemd/users/@{uid} r, + @{run}/udev/data/+pci* r, @{run}/udev/data/+sound:card[0-9]* r, # For sound @{run}/udev/data/c116:[0-9]* r, # for ALSA + @{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254 + @{run}/udev/data/c24[0-9]:[0-9]* r, + @{run}/udev/data/c25[0-4]:[0-9]* r, @{sys}/class/sound/ r, @{sys}/devices/**/sound/**/{uevent,pcm_class} r, diff --git a/apparmor.d/groups/freedesktop/xdg-settings b/apparmor.d/groups/freedesktop/xdg-settings index 59b0214c0..4153c11eb 100644 --- a/apparmor.d/groups/freedesktop/xdg-settings +++ b/apparmor.d/groups/freedesktop/xdg-settings @@ -30,6 +30,7 @@ profile xdg-settings @{exec_path} { @{bin}/dbus-launch rCx -> dbus, @{bin}/dbus-send rCx -> dbus, + @{bin}/kreadconfig5 rPx, @{bin}/xdg-mime rPx, @{bin}/xprop rPx, diff --git a/apparmor.d/groups/freedesktop/xrdb b/apparmor.d/groups/freedesktop/xrdb index fa6a86db0..73c87be0f 100644 --- a/apparmor.d/groups/freedesktop/xrdb +++ b/apparmor.d/groups/freedesktop/xrdb @@ -40,6 +40,7 @@ profile xrdb @{exec_path} { owner /tmp/xauth-[0-9]*-_[0-9] r, @{run}/sddm/\{@{uuid}\} r, + @{run}/sddm/xauth_?????? r, # file_inherit owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/freedesktop/xset b/apparmor.d/groups/freedesktop/xset index d428daf4a..5f2e0ba77 100644 --- a/apparmor.d/groups/freedesktop/xset +++ b/apparmor.d/groups/freedesktop/xset @@ -16,6 +16,7 @@ profile xset @{exec_path} { owner @{HOME}/.Xauthority r, @{run}/sddm/\{@{uuid}\} r, + @{run}/sddm/xauth_?????? r, # file_inherit owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/freedesktop/xsetroot b/apparmor.d/groups/freedesktop/xsetroot index 599aa865e..6915528ab 100644 --- a/apparmor.d/groups/freedesktop/xsetroot +++ b/apparmor.d/groups/freedesktop/xsetroot @@ -24,8 +24,8 @@ profile xsetroot @{exec_path} { owner @{user_share_dirs}/sddm/xorg-session.log w, @{run}/sddm/\{@{uuid}\} r, - @{run}/user/@{uid}/xauth_* rl, @{run}/sddm/xauth_?????? r, + @{run}/user/@{uid}/xauth_* rl, include if exists } diff --git a/apparmor.d/groups/kde/kactivitymanagerd b/apparmor.d/groups/kde/kactivitymanagerd index 758c5aaa2..bf037b1bb 100644 --- a/apparmor.d/groups/kde/kactivitymanagerd +++ b/apparmor.d/groups/kde/kactivitymanagerd @@ -9,6 +9,8 @@ include @{exec_path} = @{lib}/kactivitymanagerd profile kactivitymanagerd @{exec_path} { include + include + include include include @@ -26,6 +28,7 @@ profile kactivitymanagerd @{exec_path} { owner @{user_config_dirs}/kactivitymanagerdrc.lock rwk, owner @{user_share_dirs}/kactivitymanagerd/{,**} rwlk, + owner @{user_share_dirs}/RecentDocuments/*.desktop w, @{PROC}/sys/kernel/core_pattern r, @{PROC}/sys/kernel/random/boot_id r, diff --git a/apparmor.d/groups/kde/kalendarac b/apparmor.d/groups/kde/kalendarac index 10b2e29cf..e403a1add 100644 --- a/apparmor.d/groups/kde/kalendarac +++ b/apparmor.d/groups/kde/kalendarac @@ -11,6 +11,7 @@ profile kalendarac @{exec_path} { include include include + include include include include diff --git a/apparmor.d/groups/kde/kcminit b/apparmor.d/groups/kde/kcminit index 4064a7b3a..eb37c0050 100644 --- a/apparmor.d/groups/kde/kcminit +++ b/apparmor.d/groups/kde/kcminit @@ -15,7 +15,8 @@ profile kcminit @{exec_path} { @{exec_path} mr, - @{bin}/xrdb rPx, + @{bin}/xrdb rPx, + @{bin}/xsetroot rPx, /usr/share/icu/[0-9]*.[0-9]*/*.dat r, /usr/share/hwdata/pnp.ids r, diff --git a/apparmor.d/groups/kde/kded5 b/apparmor.d/groups/kde/kded5 index a687db53e..d2773365b 100644 --- a/apparmor.d/groups/kde/kded5 +++ b/apparmor.d/groups/kde/kded5 @@ -13,6 +13,7 @@ profile kded5 @{exec_path} { include include include + include include include include @@ -38,22 +39,23 @@ profile kded5 @{exec_path} { @{exec_path} mr, - @{lib}/kf5/kconf_update rPx, - @{lib}/utempter/utempter rPx, @{bin}/kcminit rPx, @{bin}/pgrep rCx -> pgrep, @{bin}/setxkbmap rix, @{bin}/xsettingsd rPx, + @{lib}/kf5/kconf_update rPx, + @{lib}/utempter/utempter rPx, /usr/share/hwdata/*.ids r, /usr/share/icu/[0-9]*.[0-9]*/*.dat r, + /usr/share/kconf_update/ r, /usr/share/kded5/{,**} r, + /usr/share/kf5/kcookiejar/* r, /usr/share/khotkeys/{,**} r, /usr/share/knotifications5/{,**} r, /usr/share/kservices5/{,**} r, /usr/share/kservicetypes5/{,**} r, /usr/share/mime/ r, - /usr/share/kconf_update/ r, /etc/fstab r, /etc/machine-id r, @@ -74,28 +76,39 @@ profile kded5 @{exec_path} { owner @{user_config_dirs}/gtk-{3,4}.0/{,**} rwl, owner @{user_config_dirs}/kcminputrc r, owner @{user_config_dirs}/kconf_updaterc r, - owner @{user_config_dirs}/kded5rc* rwl, + owner @{user_config_dirs}/kcookiejarrc r, + owner @{user_config_dirs}/kdebugrc r, owner @{user_config_dirs}/kded5rc.lock rwk, + owner @{user_config_dirs}/kded5rc* rwl, owner @{user_config_dirs}/kdedefaults/{,**} r, owner @{user_config_dirs}/kdeglobals r, owner @{user_config_dirs}/khotkeysrc.lock rwk, owner @{user_config_dirs}/khotkeysrc* rwl, + owner @{user_config_dirs}/kioslaverc r, owner @{user_config_dirs}/ktimezonedrc r, - owner @{user_config_dirs}/kwinrc* rwl, owner @{user_config_dirs}/kwinrc.lock rwk, + owner @{user_config_dirs}/kwinrc* rwl, owner @{user_config_dirs}/kxkbrc r, owner @{user_config_dirs}/libaccounts-glib/ rw, owner @{user_config_dirs}/libaccounts-glib/accounts.db{,-shm,-wal,-journal} rwk, + owner @{user_config_dirs}/menus/ r, + owner @{user_config_dirs}/menus/applications-merged/ r, + owner @{user_config_dirs}/plasma-nm r, + owner @{user_config_dirs}/touchpadrc r, owner @{user_config_dirs}/xsettingsd/{,**} rw, owner @{user_share_dirs}/icc/{,edid-*} r, - owner @{user_share_dirs}/kded5/{,**} r, - owner @{user_share_dirs}/kscreen/{,**} rw, + owner @{user_share_dirs}/kcookiejar/#*[0-9] rw, + owner @{user_share_dirs}/kcookiejar/cookies rw, + owner @{user_share_dirs}/kcookiejar/cookies.?????? rwlk, + owner @{user_share_dirs}/kded5/{,**} rw, + owner @{user_share_dirs}/kscreen/{,**} rwl, owner @{user_share_dirs}/ktp/cache.db rwk, - owner @{user_share_dirs}/kcookiejar/#@{hex}* rw, - owner @{user_share_dirs}/kcookiejar/cookies.* rwkl, + owner @{user_share_dirs}/remoteview/ r, + owner @{user_share_dirs}/services5/{,**} r, owner @{run}/user/@{uid}/#[0-9]* rw, + owner @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/kded5*kioworker.socket rwl, owner /tmp/plasma-csd-generator.??????/{,**} rw, diff --git a/apparmor.d/groups/kde/kioslave5 b/apparmor.d/groups/kde/kioslave5 index 7c0bbd7d7..db924953f 100644 --- a/apparmor.d/groups/kde/kioslave5 +++ b/apparmor.d/groups/kde/kioslave5 @@ -16,6 +16,7 @@ profile kioslave5 @{exec_path} { include include include + include include network inet dgram, @@ -23,7 +24,9 @@ profile kioslave5 @{exec_path} { network inet stream, network inet6 stream, network netlink raw, + network netlink dgram, + signal (receive) set=term peer=firefox-kmozillahelper, signal (receive) set=term peer=plasmashell, @{exec_path} mr, diff --git a/apparmor.d/groups/kde/kscreenlocker-greet b/apparmor.d/groups/kde/kscreenlocker-greet index ac67f910d..163c1bdae 100644 --- a/apparmor.d/groups/kde/kscreenlocker-greet +++ b/apparmor.d/groups/kde/kscreenlocker-greet @@ -96,6 +96,7 @@ profile kscreenlocker-greet @{exec_path} { @{sys}/devices/system/node/node[0-9]*/meminfo r, @{PROC}/@{pid}/cmdline r, + @{PROC}/@{pid}/loginuid r, @{PROC}/@{pid}/mounts r, @{PROC}/sys/kernel/core_pattern r, owner @{PROC}/@{pid}/loginuid r, diff --git a/apparmor.d/groups/kde/plasmashell b/apparmor.d/groups/kde/plasmashell index 0cb5edddb..de46ca6c4 100644 --- a/apparmor.d/groups/kde/plasmashell +++ b/apparmor.d/groups/kde/plasmashell @@ -145,10 +145,10 @@ profile plasmashell @{exec_path} flags=(mediate_deleted) { owner @{user_share_dirs}/plasma/plasmoids/{,**} r, owner @{user_share_dirs}/user-places.xbel r, + @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/#[0-9]* rw, owner @{run}/user/@{uid}/kdesud_:1 w, owner @{run}/user/@{uid}/plasmashell??????.[0-9].kioworker.socket rwl, - owner @{run}/user/@{uid}/gvfs/ r, owner @{run}/user/@{uid}/pulse/ rw, @{sys}/bus/ r, diff --git a/apparmor.d/groups/kde/xembedsniproxy b/apparmor.d/groups/kde/xembedsniproxy index f1aebfa34..94fe08149 100644 --- a/apparmor.d/groups/kde/xembedsniproxy +++ b/apparmor.d/groups/kde/xembedsniproxy @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/xembedsniproxy profile xembedsniproxy @{exec_path} { include + include include include diff --git a/apparmor.d/profiles-a-f/aa-notify b/apparmor.d/profiles-a-f/aa-notify index 81cb167e5..0eeb04e57 100644 --- a/apparmor.d/profiles-a-f/aa-notify +++ b/apparmor.d/profiles-a-f/aa-notify @@ -13,6 +13,8 @@ profile aa-notify @{exec_path} { include include + capability setgid, + capability setuid, capability sys_ptrace, ptrace (read), @@ -24,10 +26,14 @@ profile aa-notify @{exec_path} { /etc/apparmor/*.conf r, /etc/inputrc r, - /usr/share/terminfo/x/xterm-256color r, + /usr/etc/inputrc.keys r, /usr/share/terminfo/d/dumb r, + /usr/share/terminfo/x/xterm r, + /usr/share/terminfo/x/xterm-256color r, + /var/log/audit/audit.log r, + owner @{HOME}/.inputrc r, owner @{HOME}/.terminfo/[0-9]*/dumb r, owner /tmp/[a-z0-9]* rw, diff --git a/apparmor.d/profiles-a-f/agetty b/apparmor.d/profiles-a-f/agetty index 76a3789cf..441f77f03 100644 --- a/apparmor.d/profiles-a-f/agetty +++ b/apparmor.d/profiles-a-f/agetty @@ -31,7 +31,9 @@ profile agetty @{exec_path} { /{etc,run,lib,usr/lib}/issue.d/{,*} r, /etc/inittab r, /etc/login.defs r, + /etc/login.defs.d/ r, /etc/os-release r, + /usr/etc/login.defs r, @{run}/resolvconf/resolv.conf r, owner @{run}/agetty.reload rw, diff --git a/apparmor.d/profiles-a-f/augenrules b/apparmor.d/profiles-a-f/augenrules index fad941a03..6f864fdd1 100644 --- a/apparmor.d/profiles-a-f/augenrules +++ b/apparmor.d/profiles-a-f/augenrules @@ -14,6 +14,7 @@ profile augenrules @{exec_path} { @{exec_path} mr, @{bin}/auditctl rPx, + @{bin}/cat rix, @{bin}/chmod rix, @{bin}/cmp rix, @{bin}/cp rix, diff --git a/apparmor.d/profiles-g-l/kmod b/apparmor.d/profiles-g-l/kmod index 90be8c594..423f57e1c 100644 --- a/apparmor.d/profiles-g-l/kmod +++ b/apparmor.d/profiles-g-l/kmod @@ -42,6 +42,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) { /usr/src/*/*.ko r, /var/lib/dkms/**/module/*.ko r, /var/lib/dpkg/triggers/* r, + /var/lib/ebtables/lock r, /var/tmp/dracut.*/{,**} rw, owner /boot/System.map-* r, owner /tmp/mkinitcpio.*/{,**} rw, diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober index a8627231d..2db33cf78 100644 --- a/apparmor.d/profiles-m-r/os-prober +++ b/apparmor.d/profiles-m-r/os-prober @@ -21,6 +21,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{bin}/{,ba,da}sh rix, @{bin}/{e,f,}grep rix, @{bin}/blkid rPx, + @{bin}/cat rix, @{bin}/cut rix, @{bin}/dmraid rPUx, @{bin}/find rix, @@ -34,6 +35,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) { @{bin}/lvm rPx, @{bin}/mkdir rix, @{bin}/mktemp rix, + @{bin}/multipath rPUx, @{bin}/readlink rix, @{bin}/rm rix, @{bin}/rmdir rix, From 1cac6715dbb500f32458966547122287afd685d5 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Aug 2023 16:30:38 +0200 Subject: [PATCH 3/5] feat(profiles): general update. --- apparmor.d/groups/browsers/firefox-crashreporter | 3 +++ apparmor.d/groups/browsers/firefox-minidump-analyzer | 1 + apparmor.d/groups/freedesktop/iio-sensor-proxy | 4 ++++ apparmor.d/groups/freedesktop/pipewire | 2 ++ apparmor.d/groups/freedesktop/update-mime-database | 1 + apparmor.d/groups/freedesktop/upowerd | 5 +++-- apparmor.d/groups/gnome/gnome-control-center | 1 + apparmor.d/groups/gnome/gsd-print-notifications | 1 + apparmor.d/groups/gnome/tracker-extract | 4 ++++ apparmor.d/groups/network/tailscaled | 3 +++ apparmor.d/groups/systemd/systemd-backlight | 1 + apparmor.d/groups/systemd/systemd-sysusers | 1 + apparmor.d/groups/virt/cockpit-bridge | 3 +++ apparmor.d/groups/virt/libvirtd | 1 + apparmor.d/profiles-a-f/cupsd | 3 ++- apparmor.d/profiles-a-f/dkms | 2 ++ apparmor.d/profiles-a-f/findmnt | 2 ++ apparmor.d/profiles-g-l/gssproxy | 2 ++ apparmor.d/profiles-m-r/nfsdcld | 9 +++++++++ apparmor.d/profiles-m-r/nvtop | 4 +++- apparmor.d/profiles-m-r/pass | 3 ++- apparmor.d/profiles-s-z/scrcpy | 9 +++++++++ apparmor.d/profiles-s-z/who | 2 ++ apparmor.d/profiles-s-z/wireplumber | 2 ++ 24 files changed, 64 insertions(+), 5 deletions(-) diff --git a/apparmor.d/groups/browsers/firefox-crashreporter b/apparmor.d/groups/browsers/firefox-crashreporter index 076c235c5..651be4340 100644 --- a/apparmor.d/groups/browsers/firefox-crashreporter +++ b/apparmor.d/groups/browsers/firefox-crashreporter @@ -41,8 +41,11 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) { owner "@{firefox_config_dirs}/firefox/Crash Reports/{,**}" rw, owner @{firefox_config_dirs}/*.*/crashes/{,**} rw, + owner @{firefox_config_dirs}/*.*/crashes/events/@{uuid} rw, owner @{firefox_config_dirs}/*.*/extensions/*.xpi r, owner @{firefox_config_dirs}/*.*/minidumps/{,**} rw, + owner @{firefox_config_dirs}/*.*/minidumps//@{uuid}.{dmp,extra} r, + owner @{firefox_config_dirs}/*.*/storage/default/* r, owner @{firefox_cache_dirs}/firefox/*.*/** r, diff --git a/apparmor.d/groups/browsers/firefox-minidump-analyzer b/apparmor.d/groups/browsers/firefox-minidump-analyzer index 7b81a0f45..1b00c9743 100644 --- a/apparmor.d/groups/browsers/firefox-minidump-analyzer +++ b/apparmor.d/groups/browsers/firefox-minidump-analyzer @@ -30,6 +30,7 @@ profile firefox-minidump-analyzer @{exec_path} { owner @{firefox_config_dirs}/*.*/extensions/*.xpi r, owner @{firefox_config_dirs}/*.*/minidumps/ rw, owner @{firefox_config_dirs}/*.*/minidumps/@{uuid}.{dmp,extra} rw, + owner @{firefox_config_dirs}/*.*/storage/default/* r, owner @{firefox_cache_dirs}/firefox/*.*/startupCache/*Cache* r, diff --git a/apparmor.d/groups/freedesktop/iio-sensor-proxy b/apparmor.d/groups/freedesktop/iio-sensor-proxy index 0840a0d6c..aceb5cc37 100644 --- a/apparmor.d/groups/freedesktop/iio-sensor-proxy +++ b/apparmor.d/groups/freedesktop/iio-sensor-proxy @@ -23,9 +23,13 @@ profile iio-sensor-proxy @{exec_path} { @{sys}/bus/ r, @{sys}/bus/iio/devices/ r, + @{sys}/bus/platform/devices/ r, @{sys}/class/ r, + @{sys}/class/input/ r, @{sys}/devices/**/uevent r, + @{sys}/devices/pci[0-9]*/**/ r, @{sys}/devices/pci[0-9]*/**/iio:*/** rw, + @{sys}/devices/pci[0-9]*/**/name r, /dev/iio:* r, diff --git a/apparmor.d/groups/freedesktop/pipewire b/apparmor.d/groups/freedesktop/pipewire index 9ea1267a9..0878438da 100644 --- a/apparmor.d/groups/freedesktop/pipewire +++ b/apparmor.d/groups/freedesktop/pipewire @@ -80,6 +80,8 @@ profile pipewire @{exec_path} flags=(attach_disconnected) { @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{idVendor,idProduct,removable,uevent} r, @{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name,bios_vendor} r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + /dev/media[0-9]* rw, include if exists diff --git a/apparmor.d/groups/freedesktop/update-mime-database b/apparmor.d/groups/freedesktop/update-mime-database index e81fa9092..fbda9c4e7 100644 --- a/apparmor.d/groups/freedesktop/update-mime-database +++ b/apparmor.d/groups/freedesktop/update-mime-database @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/update-mime-database profile update-mime-database @{exec_path} { include + include include capability dac_override, diff --git a/apparmor.d/groups/freedesktop/upowerd b/apparmor.d/groups/freedesktop/upowerd index 09e0dbeeb..dd79608db 100644 --- a/apparmor.d/groups/freedesktop/upowerd +++ b/apparmor.d/groups/freedesktop/upowerd @@ -54,9 +54,10 @@ profile upowerd @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/+pci* r, @{run}/udev/data/+platform* r, @{run}/udev/data/+power_supply* r, - @{run}/udev/data/+sound:card[0-9]* r, # For sound + @{run}/udev/data/+sound:card[0-9]* r, # for sound + @{run}/udev/data/c10:[0-9]* r, # for non-serial mice, misc features + @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* @{run}/udev/data/c116:[0-9]* r, # for ALSA - @{run}/udev/data/c13:[0-9]* r, # for /dev/input/* @{run}/systemd/inhibit/[0-9]*.ref rw, diff --git a/apparmor.d/groups/gnome/gnome-control-center b/apparmor.d/groups/gnome/gnome-control-center index 2623aedc8..67159e3e0 100644 --- a/apparmor.d/groups/gnome/gnome-control-center +++ b/apparmor.d/groups/gnome/gnome-control-center @@ -81,6 +81,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) { @{bin}/software-properties-gtk rPx, @{bin}/usermod rPx, @{lib}/@{multiarch}/webkit2gtk-{3,4}.0/WebKitNetworkProcess rix, + @{lib}/cups/backend/snmp rPx, @{lib}/gnome-control-center-goa-helper rPx, @{lib}/gnome-control-center-print-renderer rPx, @{lib}/webkit2gtk-{3,4}.0/WebKitNetworkProcess rix, diff --git a/apparmor.d/groups/gnome/gsd-print-notifications b/apparmor.d/groups/gnome/gsd-print-notifications index ee94a2c10..c31e1eef1 100644 --- a/apparmor.d/groups/gnome/gsd-print-notifications +++ b/apparmor.d/groups/gnome/gsd-print-notifications @@ -84,6 +84,7 @@ profile gsd-print-notifications @{exec_path} flags=(attach_disconnected) { @{run}/cups/cups.sock rw, + owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/fd/ r, owner /dev/tty[0-9]* rw, diff --git a/apparmor.d/groups/gnome/tracker-extract b/apparmor.d/groups/gnome/tracker-extract index 07b909f83..a130cf57c 100644 --- a/apparmor.d/groups/gnome/tracker-extract +++ b/apparmor.d/groups/gnome/tracker-extract @@ -109,6 +109,10 @@ profile tracker-extract @{exec_path} flags=(attach_disconnected) { @{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254 @{run}/udev/data/c24[0-9]:[0-9]* r, @{run}/udev/data/c25[0-4]:[0-9]* r, + @{run}/udev/data/c3[0-9]*:[0-9]* r, # For dynamic assignment range 384 to 511 + @{run}/udev/data/c4[0-9]*:[0-9]* r, + @{run}/udev/data/c5[0-9]*:[0-9]* r, + @{run}/mount/utab r, owner @{PROC}/@{pid}/fd/ r, diff --git a/apparmor.d/groups/network/tailscaled b/apparmor.d/groups/network/tailscaled index c6d720845..eaf06cb90 100644 --- a/apparmor.d/groups/network/tailscaled +++ b/apparmor.d/groups/network/tailscaled @@ -76,6 +76,9 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) { @{bin}/systemctl mr, + @{PROC}/ r, + @{PROC}/@{pid}/fd/ r, + /dev/net/tun rw, } diff --git a/apparmor.d/groups/systemd/systemd-backlight b/apparmor.d/groups/systemd/systemd-backlight index 56e527d1f..22cbf0615 100644 --- a/apparmor.d/groups/systemd/systemd-backlight +++ b/apparmor.d/groups/systemd/systemd-backlight @@ -28,6 +28,7 @@ profile systemd-backlight @{exec_path} { @{sys}/class/backlight/ r, @{sys}/devices/pci[0-9]*/*:[0-9]*.[0-9]*/**/ r, + @{sys}/devices/pci[0-9]*/**/ r, @{sys}/devices/pci[0-9]*/**/backlight/**/{max_brightness,actual_brightness} r, @{sys}/devices/pci[0-9]*/**/backlight/**/{uevent,type} r, @{sys}/devices/pci[0-9]*/**/backlight/**/brightness rw, diff --git a/apparmor.d/groups/systemd/systemd-sysusers b/apparmor.d/groups/systemd/systemd-sysusers index 3b0a93704..32962c00c 100644 --- a/apparmor.d/groups/systemd/systemd-sysusers +++ b/apparmor.d/groups/systemd/systemd-sysusers @@ -9,6 +9,7 @@ include @{exec_path} = @{bin}/systemd-sysusers profile systemd-sysusers @{exec_path} flags=(attach_disconnected) { include + include include capability chown, diff --git a/apparmor.d/groups/virt/cockpit-bridge b/apparmor.d/groups/virt/cockpit-bridge index e2bb2e47f..fc6dbaf53 100644 --- a/apparmor.d/groups/virt/cockpit-bridge +++ b/apparmor.d/groups/virt/cockpit-bridge @@ -16,6 +16,7 @@ profile cockpit-bridge @{exec_path} { include capability dac_read_search, + capability net_admin, capability sys_nice, network inet dgram, @@ -41,8 +42,10 @@ profile cockpit-bridge @{exec_path} { /usr/share/cockpit/{,**} r, /etc/cockpit/{,**} r, + /etc/httpd/conf/mime.types r, /etc/login.defs r, /etc/machine-id r, + /etc/mime.types r, /etc/motd r, /etc/shadow r, /etc/shells r, diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index b7cc408f5..b6627386a 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -204,6 +204,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{sys}/devices/pci[0-9]*/**/mdev_supported_types/*/create w, @{sys}/devices/pci[0-9]*/**/net/*/{,**} r, @{sys}/devices/pci[0-9]*/**/remove w, + @{sys}/devices/pci[0-9]*/**/resource r @{sys}/devices/pci[0-9]*/**/sriov_totalvfs r, @{sys}/devices/system/cpu/cpu[0-9]*/cache/{,**} r, diff --git a/apparmor.d/profiles-a-f/cupsd b/apparmor.d/profiles-a-f/cupsd index dbfa15801..355253960 100644 --- a/apparmor.d/profiles-a-f/cupsd +++ b/apparmor.d/profiles-a-f/cupsd @@ -72,8 +72,9 @@ profile cupsd @{exec_path} flags=(attach_disconnected) { @{lib}/cups/notifier/* rix, /usr/share/cups/{,**} r, - /usr/share/ppd/{,**} r, /usr/share/ghostscript/{,**} r, + /usr/share/poppler/{,**} r, + /usr/share/ppd/{,**} r, /etc/cups/{,**} rw, /etc/foomatic/* r, diff --git a/apparmor.d/profiles-a-f/dkms b/apparmor.d/profiles-a-f/dkms index 0de4bb50c..a248af89c 100644 --- a/apparmor.d/profiles-a-f/dkms +++ b/apparmor.d/profiles-a-f/dkms @@ -121,6 +121,8 @@ profile dkms @{exec_path} flags=(attach_disconnected) { owner /boot/System.map-* r, + owner /tmp/tmp.* r, + # Inherit silencer deny /apparmor/.null rw, diff --git a/apparmor.d/profiles-a-f/findmnt b/apparmor.d/profiles-a-f/findmnt index 5e2cdf726..a3aa526ef 100644 --- a/apparmor.d/profiles-a-f/findmnt +++ b/apparmor.d/profiles-a-f/findmnt @@ -15,6 +15,8 @@ profile findmnt @{exec_path} flags=(attach_disconnected,complain) { capability dac_read_search, + unix (receive) type=stream, + @{exec_path} mr, /etc/fstab r, diff --git a/apparmor.d/profiles-g-l/gssproxy b/apparmor.d/profiles-g-l/gssproxy index 69d4b6f3a..ff0c9b39d 100644 --- a/apparmor.d/profiles-g-l/gssproxy +++ b/apparmor.d/profiles-g-l/gssproxy @@ -14,6 +14,8 @@ profile gssproxy @{exec_path} { @{exec_path} mr, + @{lib}/ r, + /etc/gssproxy/{,**} r, owner /var/lib/gssproxy/{,**} rw, diff --git a/apparmor.d/profiles-m-r/nfsdcld b/apparmor.d/profiles-m-r/nfsdcld index a2bca95ce..064170a89 100644 --- a/apparmor.d/profiles-m-r/nfsdcld +++ b/apparmor.d/profiles-m-r/nfsdcld @@ -10,7 +10,16 @@ include profile nfsdcld @{exec_path} { include + capability mknod, + capability setpcap, + @{exec_path} mr, + /etc/nfs.conf r, + /etc/nfs.conf rk, + + /var/lib/nfs/nfsdcld/{,**} rw, + /var/lib/nfs/rpc_pipefs/nfsd/* rw, + include if exists } \ No newline at end of file diff --git a/apparmor.d/profiles-m-r/nvtop b/apparmor.d/profiles-m-r/nvtop index 8a89c8bab..339d85480 100644 --- a/apparmor.d/profiles-m-r/nvtop +++ b/apparmor.d/profiles-m-r/nvtop @@ -10,6 +10,7 @@ include profile nvtop @{exec_path} flags=(attach_disconnected) { include include + include include include include @@ -36,8 +37,9 @@ profile nvtop @{exec_path} flags=(attach_disconnected) { @{sys}/bus/ r, @{sys}/class/ r, @{sys}/class/drm/ r, - @{sys}/devices/pci[0-9]*/**/enable r, @{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_cur_freq_mhz r, + @{sys}/devices/pci[0-9]*/**/enable r, + @{sys}/devices/system/node/node[0-9]*/cpumap r, @{PROC}/ r, @{PROC}/@{pids}/ r, diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass index c55151b19..fe43edf0b 100644 --- a/apparmor.d/profiles-m-r/pass +++ b/apparmor.d/profiles-m-r/pass @@ -86,7 +86,7 @@ profile pass @{exec_path} { owner @{user_cache_dirs}/vim/{,**} rw, owner @{user_config_dirs}/vim/{,**} rw, - /dev/shm/pass.*/{,*} rw, + owner /dev/shm/pass.*/{,*} rw, deny owner @{HOME}/ r, @@ -140,6 +140,7 @@ profile pass @{exec_path} { owner @{user_password_store_dirs}/ rw, owner @{user_password_store_dirs}/** rwkl -> @{HOME}/.password-store/**, + owner /dev/shm/pass.*/{,*} rw, include if exists } diff --git a/apparmor.d/profiles-s-z/scrcpy b/apparmor.d/profiles-s-z/scrcpy index 2b5fe8def..4c651624d 100644 --- a/apparmor.d/profiles-s-z/scrcpy +++ b/apparmor.d/profiles-s-z/scrcpy @@ -32,6 +32,15 @@ profile scrcpy @{exec_path} { /var/lib/dbus/machine-id r, owner @{user_config_dirs}/ibus/bus/{,@{hex}-unix{,-wayland}-[0-9]} r, + owner @{user_config_dirs}/pulse/client.conf r, + owner @{user_config_dirs}/pulse/cookie r, + owner @{user_config_dirs}/pulse/cookie rk, + + owner @{run}/user/@{uid}/pulse/ r, + + /dev/shm/ r, + + deny @{user_share_dirs}/gvfs-metadata/* r, include if exists } diff --git a/apparmor.d/profiles-s-z/who b/apparmor.d/profiles-s-z/who index 7cc0a6d38..c5846dbbb 100644 --- a/apparmor.d/profiles-s-z/who +++ b/apparmor.d/profiles-s-z/who @@ -17,5 +17,7 @@ profile who @{exec_path} { @{exec_path} mr, + deny owner @{user_share_dirs}/gvfs-metadata/{,*} r, + include if exists } diff --git a/apparmor.d/profiles-s-z/wireplumber b/apparmor.d/profiles-s-z/wireplumber index 7f4d455db..30a951e84 100644 --- a/apparmor.d/profiles-s-z/wireplumber +++ b/apparmor.d/profiles-s-z/wireplumber @@ -59,6 +59,8 @@ profile wireplumber @{exec_path} { @{sys}/devices/pci[0-9]*/**/video4linux/video[0-9]*/uevent r, @{sys}/devices/virtual/dmi/id/bios_vendor r, + owner @{PROC}/@{pid}/task/@{tid}/comm rw, + /dev/media[0-9]* rw, /dev/snd/ r, From 03cf850666288a86876edcc3c95e86409df1b733 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Aug 2023 16:31:49 +0200 Subject: [PATCH 4/5] feat(profile): support for diverse wayland compositors. See #165 --- apparmor.d/abstractions/wayland.d/complete | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 apparmor.d/abstractions/wayland.d/complete diff --git a/apparmor.d/abstractions/wayland.d/complete b/apparmor.d/abstractions/wayland.d/complete new file mode 100644 index 000000000..0be182d2c --- /dev/null +++ b/apparmor.d/abstractions/wayland.d/complete @@ -0,0 +1,6 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2023 Alexandre Pujol +# SPDX-License-Identifier: GPL-2.0-only + + owner /dev/shm/sway* rw, + owner /dev/shm/dunst-?????? rw, From a2c35b07a5b4dbdc1fea5d7556fad632ab5f2eb2 Mon Sep 17 00:00:00 2001 From: Alexandre Pujol Date: Sun, 6 Aug 2023 16:45:39 +0200 Subject: [PATCH 5/5] fix: libvirtd profile. --- apparmor.d/groups/virt/libvirtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apparmor.d/groups/virt/libvirtd b/apparmor.d/groups/virt/libvirtd index b6627386a..0fff7b9b4 100644 --- a/apparmor.d/groups/virt/libvirtd +++ b/apparmor.d/groups/virt/libvirtd @@ -204,7 +204,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) { @{sys}/devices/pci[0-9]*/**/mdev_supported_types/*/create w, @{sys}/devices/pci[0-9]*/**/net/*/{,**} r, @{sys}/devices/pci[0-9]*/**/remove w, - @{sys}/devices/pci[0-9]*/**/resource r + @{sys}/devices/pci[0-9]*/**/resource r, @{sys}/devices/pci[0-9]*/**/sriov_totalvfs r, @{sys}/devices/system/cpu/cpu[0-9]*/cache/{,**} r,