diff --git a/apparmor.d/abstractions/wutmp b/apparmor.d/abstractions/wutmp index 7fdf906bd..c8598440f 100644 --- a/apparmor.d/abstractions/wutmp +++ b/apparmor.d/abstractions/wutmp @@ -2,6 +2,7 @@ # # Copyright (C) 2002-2009 Novell/SUSE # Copyright (C) 2009 Canonical Ltd. +# Copyright (C) 2021 Mikhail Morfikov # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public @@ -14,7 +15,8 @@ # some services update wtmp, utmp, and lastlog with per-user # connection information /var/log/lastlog rwk, - /var/log/wtmp wk, + /var/log/wtmp rwk, + /var/log/btmp rwk, @{run}/utmp rwk, # Include additions to the abstraction diff --git a/apparmor.d/accounts-daemon b/apparmor.d/accounts-daemon index 5a658395c..4af634868 100644 --- a/apparmor.d/accounts-daemon +++ b/apparmor.d/accounts-daemon @@ -35,7 +35,5 @@ profile accounts-daemon @{exec_path} { /etc/shells r, /etc/shadow r, - /var/log/wtmp r, - include if exists } diff --git a/apparmor.d/adb b/apparmor.d/adb new file mode 100644 index 000000000..9e5a0fa25 --- /dev/null +++ b/apparmor.d/adb @@ -0,0 +1,38 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/adb +@{exec_path} += /{usr/,}lib/android-sdk/platform-tools/adb +profile adb @{exec_path} { + include + include + include + include + + # For adb kill-server: + # cannot connect to daemon at tcp:5037: Permission denied + network inet stream, + network inet6 stream, + + @{exec_path} mrix, + + owner /tmp/adb.[0-9]*.log rw, + + owner @{HOME}/.android/ rw, + owner @{HOME}/.android/adb.[0-9]* rw, + owner @{HOME}/.android/adbkey rw, + + include if exists +} diff --git a/apparmor.d/cron-apt-compat b/apparmor.d/cron-apt-compat index 11a60c906..a51baf1ea 100644 --- a/apparmor.d/cron-apt-compat +++ b/apparmor.d/cron-apt-compat @@ -14,7 +14,7 @@ abi , include @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/apt-compat -profile cron-apt-compat @{exec_path} flags=(complain) { +profile cron-apt-compat @{exec_path} { include @{exec_path} r, diff --git a/apparmor.d/cron-debtags b/apparmor.d/cron-debtags index 1c2fb135c..faa145d02 100644 --- a/apparmor.d/cron-debtags +++ b/apparmor.d/cron-debtags @@ -14,7 +14,7 @@ abi , include @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/debtags -profile cron-debtags @{exec_path} flags=(complain) { +profile cron-debtags @{exec_path} { include @{exec_path} r, diff --git a/apparmor.d/cron-exim4-base b/apparmor.d/cron-exim4-base index 0a6f999ba..ff239f7df 100644 --- a/apparmor.d/cron-exim4-base +++ b/apparmor.d/cron-exim4-base @@ -14,7 +14,7 @@ abi , include @{exec_path} = /etc/cron.daily/exim4-base -profile cron-exim4-base @{exec_path} flags=(complain) { +profile cron-exim4-base @{exec_path} { include capability dac_read_search, diff --git a/apparmor.d/cron-man-db b/apparmor.d/cron-man-db index e886ccad6..8ef74e808 100644 --- a/apparmor.d/cron-man-db +++ b/apparmor.d/cron-man-db @@ -14,7 +14,7 @@ abi , include @{exec_path} = /etc/cron.{hourly,daily,weekly,monthly}/man-db -profile cron-man-db @{exec_path} flags=(complain) { +profile cron-man-db @{exec_path} { include include diff --git a/apparmor.d/id b/apparmor.d/id new file mode 100644 index 000000000..fe06cc281 --- /dev/null +++ b/apparmor.d/id @@ -0,0 +1,24 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/id +profile id @{exec_path} { + include + include + + @{exec_path} mr, + + include if exists +} diff --git a/apparmor.d/last b/apparmor.d/last new file mode 100644 index 000000000..457556e32 --- /dev/null +++ b/apparmor.d/last @@ -0,0 +1,32 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/last{,b} +profile last @{exec_path} { + include + include + include + + # For the --dns flag + network inet dgram, + network inet6 dgram, + network netlink raw, + + @{exec_path} mr, + + @{PROC}/@{pids}/loginuid r, + + include if exists +} diff --git a/apparmor.d/lastlog b/apparmor.d/lastlog new file mode 100644 index 000000000..b56c9db3a --- /dev/null +++ b/apparmor.d/lastlog @@ -0,0 +1,29 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/lastlog +profile lastlog @{exec_path} { + include + include + + network netlink raw, + + @{exec_path} mr, + + /var/log/lastlog r, + /etc/login.defs r, + + include if exists +} diff --git a/apparmor.d/lightdm b/apparmor.d/lightdm index 034b2d3dd..cbbd7bd95 100644 --- a/apparmor.d/lightdm +++ b/apparmor.d/lightdm @@ -97,7 +97,6 @@ profile lightdm @{exec_path} { # LightDM logs /var/log/lightdm/{,**} rw, - /var/log/btmp wk, @{run}/lightdm/{,**} rw, @{run}/lightdm.pid rw, diff --git a/apparmor.d/sddm b/apparmor.d/sddm index 7be2df2dd..f4c7d6f2e 100644 --- a/apparmor.d/sddm +++ b/apparmor.d/sddm @@ -101,7 +101,6 @@ profile sddm @{exec_path} { owner @{HOME}/.local/share/kwalletd/kdewallet.salt rw, @{HOME}/.local/share/kwalletd/kdewallet.salt r, owner @{run}/user/[0-9]*/kwallet5.socket rw, - /var/log/btmp wk, # Themes /usr/share/sddm/themes/** r, diff --git a/apparmor.d/su b/apparmor.d/su index 916c9c92b..0a0c3434e 100644 --- a/apparmor.d/su +++ b/apparmor.d/su @@ -60,8 +60,6 @@ profile su @{exec_path} { /etc/shells r, - owner /var/log/btmp wk, - # For pam_securetty @{PROC}/cmdline r, @{sys}/devices/virtual/tty/console/active r, diff --git a/apparmor.d/utmpdump b/apparmor.d/utmpdump new file mode 100644 index 000000000..628c07ebe --- /dev/null +++ b/apparmor.d/utmpdump @@ -0,0 +1,26 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/utmpdump +profile utmpdump @{exec_path} { + include + + @{exec_path} mr, + + /var/log/wtmp{,.[0-9]*} r, + /var/log/btmp{,.[0-9]*} r, + + include if exists +} diff --git a/apparmor.d/w b/apparmor.d/w new file mode 100644 index 000000000..6e695609e --- /dev/null +++ b/apparmor.d/w @@ -0,0 +1,34 @@ +# vim:syntax=apparmor +# ------------------------------------------------------------------ +# +# Copyright (C) 2021 Mikhail Morfikov +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of version 2 of the GNU General Public +# License published by the Free Software Foundation. +# +# ------------------------------------------------------------------ + +abi , + +include + +@{exec_path} = /{usr/,}bin/w +profile w @{exec_path} { + include + include + include + + ptrace (read), + + @{exec_path} mr, + + @{PROC}/ r, + @{PROC}/uptime r, + @{PROC}/sys/kernel/osrelease r, + @{PROC}/loadavg r, + @{PROC}/@{pids}/stat r, + @{PROC}/@{pids}/cmdline r, + + include if exists +}