apparmor.d -> profiles
This commit is contained in:
Alexandre Pujol
parent
c408a878b7
commit
e9b8e62fcd
726 changed files with 0 additions and 0 deletions
|
|
@ -1,7 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# Available Xsessions
|
||||
/usr/share/xsessions/{,*.desktop} r,
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Root app location
|
||||
/ r,
|
||||
/usr/ r,
|
||||
/{usr/,}sbin/ r,
|
||||
/{usr/,}sbin/[a-z0-9]* rPUx,
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# User app location
|
||||
/ r,
|
||||
/usr/ r,
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/[a-z0-9]* rPUx,
|
||||
|
||||
# Firefox
|
||||
/{usr/,}lib/ r,
|
||||
/{usr/,}lib/firefox/ r,
|
||||
/{usr/,}lib/firefox/firefox* rPx,
|
||||
|
||||
# Google Chrome
|
||||
/opt/ r,
|
||||
/opt/google/ r,
|
||||
/opt/google/chrome{,-beta,-unstable}/ r,
|
||||
/opt/google/chrome{,-beta,-unstable}/google-chrome{,-beta,-unstable} rPx,
|
||||
|
||||
# Brave
|
||||
/opt/brave.com/ r,
|
||||
/opt/brave.com/brave{,-beta,-dev}/ r,
|
||||
/opt/brave.com/brave{,-beta,-dev}/brave-browser{,-beta,-dev} rPx,
|
||||
|
||||
# Discord
|
||||
/usr/share/ r,
|
||||
/usr/share/discord/ r,
|
||||
/usr/share/discord/Discord rPx,
|
||||
|
||||
# FreeTube
|
||||
/opt/FreeTube/ r,
|
||||
/opt/FreeTube/freetube rPx,
|
||||
/opt/FreeTube-Vue/ r,
|
||||
/opt/FreeTube-Vue/freetube-vue rPx,
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/etc/apt/apt.conf r,
|
||||
/etc/apt/apt.conf.d/{,*} r,
|
||||
|
||||
/etc/apt/preferences r,
|
||||
/etc/apt/preferences.d/{,*} r,
|
||||
|
||||
/etc/apt/sources.list r,
|
||||
/etc/apt/sources.list.d/{,*.list} r,
|
||||
|
||||
/var/lib/apt/lists/{,**} r,
|
||||
/var/lib/apt/extended_states r,
|
||||
|
||||
/var/cache/apt/pkgcache.bin r,
|
||||
/var/cache/apt/srcpkgcache.bin r,
|
||||
|
||||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
|
||||
owner /tmp/clearsigned.message.* rw,
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
/usr/share/sounds/ r,
|
||||
|
||||
# PulseAudio module-ladspa-sink (plugin sc4m_1916)
|
||||
/usr/lib/ladspa/ r,
|
||||
/usr/lib/ladspa/*.so mr,
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
/etc/writable/localtime r,
|
||||
/usr/share/locale/ r,
|
||||
|
||||
# Allow to receive some signals
|
||||
signal (receive) peer=top,
|
||||
signal (receive) peer=htop,
|
||||
signal (receive) set=(term,kill,stop,cont) peer=systemd-shutdown,
|
||||
signal (receive) set=(term,kill) peer=openbox,
|
||||
signal (receive) set=(hup) peer=xinit,
|
||||
signal (receive) set=(term,kill) peer=su,
|
||||
signal (receive) peer=sudo,
|
||||
|
||||
# Allow to write a user defined fifo log devices
|
||||
owner /dev/log-xsession w,
|
||||
owner /dev/log-gnupg w,
|
||||
|
||||
deny owner @{HOME}/.Private/ r,
|
||||
deny owner @{HOME}/.Private/** mrixwlk,
|
||||
|
||||
deny owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
|
||||
deny owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
deny /etc/dconf/{,**} r,
|
||||
|
||||
# When this is blocked, expect lots of the following errors:
|
||||
# dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission denied.
|
||||
# dconf will not work properly.
|
||||
deny owner @{run}/user/[0-9]*/dconf/{,**} rw,
|
||||
|
||||
deny owner @{HOME}/.config/dconf/{,**} rw,
|
||||
deny owner @{HOME}/.cache/dconf/{,**} rw,
|
||||
|
||||
# When GSETTINGS_BACKEND=keyfile
|
||||
deny owner @{HOME}/.config/glib-2.0/ rw,
|
||||
deny owner @{HOME}/.config/glib-2.0/settings/ rw,
|
||||
deny owner @{HOME}/.config/glib-2.0/settings/keyfile rw,
|
||||
deny owner @{HOME}/.config/glib-2.0/settings/.goutputstream-* rw,
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
# The goal of this abstraction is preventing apps (GUI) to be run as the root user by restraining
|
||||
# access to the /root/ dir and its subdirectories. If you don't want to start an app as the super
|
||||
# user (possibly by mistake), just include this abstraction in the app's AppArmor profile.
|
||||
#
|
||||
# Note that some apps will work anyway when run as root even if all of the files in the /root/
|
||||
# are denied. Anyway, most of the apps refuse to start when they don't get the access to the
|
||||
# needed files in the user home dir.
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Use audit for now to see whether some apps are trying to get access to the /root/ dir.
|
||||
audit deny /root/{,**} rwkmlx,
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/dev/ r,
|
||||
/dev/bus/usb/ r,
|
||||
/dev/bus/usb/[0-9]*/ r,
|
||||
/dev/bus/usb/[0-9]*/[0-9]* rw,
|
||||
|
||||
@{sys}/class/ r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/usb/ r,
|
||||
@{sys}/bus/usb/devices/{,**} r,
|
||||
|
||||
@{sys}/devices/**/usb[0-9]/{,**} rw,
|
||||
|
||||
# Udev data about usb devices (~equal to content of lsusb -v)
|
||||
@{run}/udev/data/+usb:* r,
|
||||
@{run}/udev/data/c16[6,7]* r,
|
||||
@{run}/udev/data/c18[0,8,9]* r,
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# The /sys/ entries probably should be tightened
|
||||
|
||||
/dev/ r,
|
||||
|
||||
# Regular disk/partition devices
|
||||
/dev/sd[a-z] rk,
|
||||
/dev/sd[a-z][0-9]* rk,
|
||||
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/** r,
|
||||
@{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,
|
||||
|
||||
# SD card devices
|
||||
/dev/mmcblk[0-9]* rk,
|
||||
/dev/mmcblk[0-9]*p[0-9]* rk,
|
||||
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/** r,
|
||||
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/** r,
|
||||
|
||||
# Loop devices
|
||||
/dev/loop[0-9]* rk,
|
||||
/dev/loop[0-9]*p[0-9]* rk,
|
||||
@{sys}/devices/virtual/block/loop[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/loop[0-9]*/** r,
|
||||
|
||||
# LUKS/LVM (device-mapper) devices
|
||||
/dev/dm-[0-9]* rk,
|
||||
@{sys}/devices/virtual/block/dm-[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/dm-[0-9]*/** r,
|
||||
|
||||
# ZRAM devices
|
||||
/dev/zram[0-9]* rk,
|
||||
@{sys}/devices/virtual/block/zram[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/zram[0-9]*/** r,
|
||||
|
||||
# CD-ROM
|
||||
/dev/sr[0-9]* rk,
|
||||
|
||||
@{sys}/class/block/ r,
|
||||
@{sys}/block/ r,
|
||||
# To be able to look up each block device by major:minor numbers
|
||||
@{sys}/dev/block/ r,
|
||||
|
||||
# According to the kernel docs[1], the major block numbers from 240 to 254 are allocated
|
||||
# dynamically by the kernel for devices which don't have official numbers assigned. It looks like
|
||||
# that "dm" (device mapper) and "zram" are such devices. To avoid issues when kernel config
|
||||
# changes, it's better to allow the whole range (240-254) instead of the single major numbers
|
||||
# visible in the /proc/devices file.
|
||||
# [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt
|
||||
@{run}/udev/data/b254:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b253:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b252:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b251:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b250:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b249:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b248:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b247:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b246:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b245:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b244:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b243:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b242:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b241:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b240:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
|
||||
@{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk*
|
||||
@{run}/udev/data/b11:[0-9]* r, # for /dev/sr*
|
||||
@{run}/udev/data/b8:[0-9]* r, # for /dev/sd*
|
||||
@{run}/udev/data/b7:[0-9]* r, # for /dev/loop*
|
||||
|
||||
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
|
||||
|
||||
@{run}/udev/data/+usb:* r, # for ?
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# The /sys/ entries probably should be tightened
|
||||
|
||||
/dev/ r,
|
||||
|
||||
# Regular disk/partition devices
|
||||
/dev/sd[a-z] rwk,
|
||||
/dev/sd[a-z][0-9]* rwk,
|
||||
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/** r,
|
||||
@{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,
|
||||
|
||||
# SD card devices
|
||||
/dev/mmcblk[0-9]* rwk,
|
||||
/dev/mmcblk[0-9]*p[0-9]* rwk,
|
||||
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/** r,
|
||||
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/** r,
|
||||
|
||||
# Loop devices
|
||||
/dev/loop[0-9]* rwk,
|
||||
/dev/loop[0-9]*p[0-9]* rwk,
|
||||
@{sys}/devices/virtual/block/loop[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/loop[0-9]*/** r,
|
||||
|
||||
# LUKS/LVM (device-mapper) devices
|
||||
/dev/dm-[0-9]* rwk,
|
||||
@{sys}/devices/virtual/block/dm-[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/dm-[0-9]*/** r,
|
||||
|
||||
# ZRAM devices
|
||||
/dev/zram[0-9]* rwk,
|
||||
@{sys}/devices/virtual/block/zram[0-9]*/ r,
|
||||
@{sys}/devices/virtual/block/zram[0-9]*/** r,
|
||||
|
||||
# CD-ROM
|
||||
/dev/sr[0-9]* rwk,
|
||||
|
||||
@{sys}/class/block/ r,
|
||||
@{sys}/block/ r,
|
||||
# To be able to look up each block device by major:minor numbers
|
||||
@{sys}/dev/block/ r,
|
||||
|
||||
# According to the kernel docs[1], the major block numbers from 240 to 254 are allocated
|
||||
# dynamically by the kernel for devices which don't have official numbers assigned. It looks like
|
||||
# that "dm" (device mapper) and "zram" are such devices. To avoid issues when kernel config
|
||||
# changes, it's better to allow the whole range (240-254) instead of the single major numbers
|
||||
# visible in the /proc/devices file.
|
||||
# [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt
|
||||
@{run}/udev/data/b254:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b253:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b252:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b251:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b250:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b249:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b248:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b247:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b246:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b245:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b244:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b243:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b242:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b241:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
@{run}/udev/data/b240:[0-9]* r, # for dynamic kernel assignment of block devices
|
||||
|
||||
@{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk*
|
||||
@{run}/udev/data/b11:[0-9]* r, # for /dev/sr*
|
||||
@{run}/udev/data/b8:[0-9]* r, # for /dev/sd*
|
||||
@{run}/udev/data/b7:[0-9]* r, # for /dev/loop*
|
||||
|
||||
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
|
||||
|
||||
@{run}/udev/data/+usb:* r, # for ?
|
||||
|
|
@ -1,124 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
#
|
||||
# abstraction used by evince binaries
|
||||
#
|
||||
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ubuntu-helpers>
|
||||
|
||||
@{PROC}/[0-9]*/fd/ r,
|
||||
@{PROC}/[0-9]*/mountinfo r,
|
||||
owner @{PROC}/[0-9]*/auxv r,
|
||||
owner @{PROC}/[0-9]*/status r,
|
||||
|
||||
# Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
|
||||
# Possibly move to an abstraction if anything else needs it.
|
||||
deny /run/udev/data/** r,
|
||||
|
||||
# move out to the gnome abstraction if anyone else needs these
|
||||
/dev/.udev/{data,db}/* r,
|
||||
/etc/udev/udev.conf r,
|
||||
/sys/devices/**/block/**/uevent r,
|
||||
|
||||
# apport
|
||||
/etc/default/apport r,
|
||||
|
||||
# XFCE
|
||||
/etc/xfce4/defaults.list r,
|
||||
|
||||
# Lubuntu
|
||||
/etc/xdg/lubuntu/applications/defaults.list r,
|
||||
|
||||
# evince specific
|
||||
/etc/ r,
|
||||
/etc/fstab r,
|
||||
/etc/texmf/ r,
|
||||
/etc/texmf/** r,
|
||||
/etc/xpdf/* r,
|
||||
owner @{HOME}/.config/evince/ rw,
|
||||
owner @{HOME}/.config/evince/** rwkl,
|
||||
|
||||
/usr/bin/gs-esp ixr,
|
||||
/usr/bin/mktexpk Cx -> sanitized_helper,
|
||||
/usr/bin/mktextfm Cx -> sanitized_helper,
|
||||
/usr/bin/dvipdfm Cx -> sanitized_helper,
|
||||
/usr/bin/dvipdfmx Cx -> sanitized_helper,
|
||||
|
||||
# supported archivers
|
||||
/bin/gzip ixr,
|
||||
/bin/bzip2 ixr,
|
||||
/usr/bin/unrar* ixr,
|
||||
/usr/bin/unzip ixr,
|
||||
/usr/bin/7zr ixr,
|
||||
/usr/lib/p7zip/7zr ixr,
|
||||
/usr/bin/7za ixr,
|
||||
/usr/lib/p7zip/7za ixr,
|
||||
/usr/bin/zipnote ixr,
|
||||
/bin/tar ixr,
|
||||
/usr/bin/xz ixr,
|
||||
|
||||
# allow read access to anything in /usr/share, for plugins and input methods
|
||||
/usr/local/share/** r,
|
||||
/usr/share/** r,
|
||||
/usr/lib/ghostscript/** mr,
|
||||
/var/lib/ghostscript/** r,
|
||||
/var/lib/texmf/** r,
|
||||
|
||||
# from http://live.gnome.org/Evince/SupportedDocumentFormats. Allow
|
||||
# read for all supported file formats
|
||||
/**.[bB][mM][pP] r,
|
||||
/**.[dD][jJ][vV][uU] r,
|
||||
/**.[dD][vV][iI] r,
|
||||
/**.[gG][iI][fF] r,
|
||||
/**.[jJ][pP][gG] r,
|
||||
/**.[jJ][pP][eE][gG] r,
|
||||
/**.[oO][dD][pP] r,
|
||||
/**.[fFpP][dD][fF] r,
|
||||
/**.[pP][nN][mM] r,
|
||||
/**.[pP][nN][gG] r,
|
||||
/**.[pP][sS] r,
|
||||
/**.[eE][pP][sS] r,
|
||||
/**.[eE][pP][sS][fFiI23] r,
|
||||
/**.[tT][iI][fF] r,
|
||||
/**.[tT][iI][fF][fF] r,
|
||||
/**.[xX][pP][mM] r,
|
||||
/**.[gG][zZ] r,
|
||||
/**.[bB][zZ]2 r,
|
||||
/**.[cC][bB][rRzZ7] r,
|
||||
/**.[xX][zZ] r,
|
||||
|
||||
# Use abstractions/private-files instead of abstractions/private-files-strict
|
||||
# and add the sensitive files manually to work around LP: #451422. The goal
|
||||
# is to disallow access to the .mozilla folder in general, but to allow
|
||||
# access to the Cache directory, which the browser may tell evince to open
|
||||
# from directly.
|
||||
|
||||
include <abstractions/private-files>
|
||||
audit deny @{HOME}/.gnupg/** mrwkl,
|
||||
audit deny @{HOME}/.ssh/** mrwkl,
|
||||
audit deny @{HOME}/.gnome2_private/** mrwkl,
|
||||
audit deny @{HOME}/.gnome2/keyrings/** mrwkl,
|
||||
audit deny @{HOME}/.kde/share/apps/kwallet/** mrwkl,
|
||||
audit deny @{HOME}/.pki/nssdb/** w,
|
||||
|
||||
audit deny @{HOME}/.mozilla/*/*/* mrwkl,
|
||||
audit deny @{HOME}/.mozilla/**/bookmarkbackups/** mrwkl,
|
||||
audit deny @{HOME}/.mozilla/**/chrome/** mrwkl,
|
||||
audit deny @{HOME}/.mozilla/**/extensions/** mrwkl,
|
||||
audit deny @{HOME}/.mozilla/**/gm_scripts/** mrwkl,
|
||||
|
||||
audit deny @{HOME}/.config/chromium/** mrwkl,
|
||||
audit deny @{HOME}/.evolution/** mrwkl,
|
||||
audit deny @{HOME}/.config/evolution/** mrwkl,
|
||||
audit deny @{HOME}/.kde/share/config/** mrwkl,
|
||||
audit deny @{HOME}/.kde/share/apps/kmail/** mrwkl,
|
||||
audit deny @{HOME}/.{,mozilla-}thunderbird/*/* mrwkl,
|
||||
audit deny @{HOME}/.{,mozilla-}thunderbird/*/[^C][^a][^c][^h][^e]*/** mrwkl,
|
||||
|
||||
# When LP: #451422 is fixed, change the above to simply be:
|
||||
include <abstractions/private-files-strict>
|
||||
#owner @{HOME}/.mozilla/**/*Cache/* r,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
include <local/usr.bin.evince>
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
deny @{PROC}/@{pid}/mountinfo r,
|
||||
deny @{PROC}/@{pid}/mounts r,
|
||||
|
||||
# Usually, apps shouldn't view this file
|
||||
deny /etc/fstab r,
|
||||
|
||||
deny /dev/disk/*/ r,
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
# kate: syntax AppArmor Security Profile
|
||||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018 Nibaldo Gonzalez <nibgonz@gmail.com>
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Flatpak
|
||||
/var/lib/flatpak/exports/share/{,**} r,
|
||||
/var/lib/flatpak/app/**/export/share/applications/{,*.desktop} r,
|
||||
|
||||
owner @{HOME}/.local/share/flatpak/exports/share/{,**} r,
|
||||
owner @{HOME}/.local/share/flatpak/app/{,**.desktop} r,
|
||||
deny owner @{HOME}/.local/share/flatpak/** w,
|
||||
|
||||
# Snap
|
||||
/var/lib/snapd/desktop/applications/mimeinfo.cache r,
|
||||
/var/lib/snapd/desktop/applications/*.desktop r,
|
||||
/var/lib/snapd/desktop/applications/ r,
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# The fontconfig cache can be generated via the following command:
|
||||
# $ fc-cache -f -v
|
||||
# There's no need to give apps the ability to create cache for their own. Apps can generate the
|
||||
# fontconfig cache if some cache files are missing, so if this behavior is desirable, you can use
|
||||
# the "fontconfig-cache-write" abstraction.
|
||||
|
||||
owner @{HOME}/.cache/fontconfig/ r,
|
||||
deny @{HOME}/.cache/fontconfig/ w,
|
||||
deny @{HOME}/.cache/fontconfig/** w,
|
||||
owner @{HOME}/.cache/fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} r,
|
||||
owner @{HOME}/.cache/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} r,
|
||||
|
||||
owner @{HOME}/.fontconfig/ r,
|
||||
deny @{HOME}/.fontconfig/ w,
|
||||
deny @{HOME}/.fontconfig/** w,
|
||||
owner @{HOME}/.fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} r,
|
||||
owner @{HOME}/.fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} r,
|
||||
|
||||
/var/cache/fontconfig/ r,
|
||||
deny /var/cache/fontconfig/ w,
|
||||
deny /var/cache/fontconfig/** w,
|
||||
/var/cache/fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} r,
|
||||
/var/cache/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} r,
|
||||
|
||||
# This is to create .uuid file containing an UUID at a font directory. The UUID will be used to
|
||||
# identify the font directory and is used to determine the cache filename if available.
|
||||
owner /usr/local/share/fonts/.uuid r,
|
||||
deny /usr/local/share/fonts/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
/usr/share/**/.uuid r,
|
||||
deny /usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# For Google Fonts downloaded via font-manager
|
||||
owner "@{HOME}/.local/share/fonts/Google Fonts/.uuid" r,
|
||||
deny "@{HOME}/.local/share/fonts/Google Fonts/.uuid{,.NEW,.LCK,.TMP-*}" w,
|
||||
owner "@{HOME}/.local/share/fonts/Google Fonts/**/.uuid" r,
|
||||
deny "@{HOME}/.local/share/fonts/Google Fonts/**/.uuid{,.NEW,.LCK,.TMP-*}" w,
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/.cache/fontconfig/ rw,
|
||||
owner @{HOME}/.cache/fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} rw,
|
||||
owner @{HOME}/.cache/fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwk,
|
||||
|
||||
owner @{HOME}/.fontconfig/ rw,
|
||||
owner @{HOME}/.fontconfig/CACHEDIR.TAG{,.NEW,.LCK,.TMP-*} rw,
|
||||
owner @{HOME}/.fontconfig/[a-f0-9]*.cache-?{,.NEW,.LCK,.TMP-*} rwk,
|
||||
|
||||
# This is to create .uuid file containing an UUID at a font directory. The UUID will be used to
|
||||
# identify the font directory and is used to determine the cache filename if available.
|
||||
owner /usr/local/share/fonts/.uuid{,.NEW,.LCK,.TMP-*} rw,
|
||||
link /usr/local/share/fonts/.uuid.LCK -> /usr/local/share/fonts/.uuid.TMP-*,
|
||||
/usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} r,
|
||||
deny /usr/share/**/.uuid{,.NEW,.LCK,.TMP-*} w,
|
||||
|
||||
# For Google Fonts downloaded via font-manager (###FIXME### when they fix resolving of vars)
|
||||
owner "@{HOME}/.local/share/fonts/Google Fonts/.uuid{,.NEW,.LCK,.TMP-*}" rw,
|
||||
link "@{HOME}/.local/share/fonts/Google Fonts/.uuid.LCK" -> "/home/*/.local/share/fonts/Google Fonts/.uuid.TMP-*",
|
||||
owner "@{HOME}/.local/share/fonts/Google Fonts/**/.uuid{,.NEW,.LCK,.TMP-*}" rw,
|
||||
link "@{HOME}/.local/share/fonts/Google Fonts/**/.uuid.LCK" -> "/home/*/.local/share/fonts/Google Fonts/**/.uuid.TMP-*",
|
||||
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
owner @{HOME}/.icons/default/index.theme r,
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/.fzf/{,**} r,
|
||||
|
||||
owner @{HOME}/.fzf.* r,
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
include <abstractions/base>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/X>
|
||||
|
||||
# TODO: adjust when support finer-grained netlink rules
|
||||
network netlink raw,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
/etc/wildmidi/wildmidi.cfg r,
|
||||
|
||||
/dev/ r,
|
||||
/dev/bus/usb/ r,
|
||||
/dev/dri/ r,
|
||||
|
||||
# /dev/shm is a symlink to /run/shm on ubuntu
|
||||
owner /{dev,run}/shm/shmfd-* rw,
|
||||
|
||||
/run/udev/data/c* r,
|
||||
/run/udev/data/+pci:* r,
|
||||
/run/udev/data/+usb* r,
|
||||
|
||||
/sys/bus/ r,
|
||||
/sys/bus/usb/devices/ r,
|
||||
/sys/class/ r,
|
||||
/sys/class/drm/ r,
|
||||
/sys/devices/pci[0-9]*/**/{busnum,config,devnum,descriptors,speed,uevent} r,
|
||||
/sys/devices/system/node/ r,
|
||||
/sys/devices/system/node/*/meminfo r,
|
||||
|
||||
owner /tmp/orcexec.* mrw,
|
||||
owner /{,var/}run/user/[0-9]*/orcexec.* mrw,
|
||||
# needed if /tmp is mounted noexec:
|
||||
owner @{HOME}/orcexec.* mr,
|
||||
|
||||
/usr/lib/frei0r-[0-9]/*.so m,
|
||||
# /usr/lib/@{multiarch}/dri/** mr,
|
||||
/usr/lib/@{multiarch}/gstreamer[0-9]*.[0-9]*/gstreamer-[0-9]*.[0-9]*/gst-plugin-scanner mrix,
|
||||
/usr/lib/@{multiarch}/libproxy/*/modules/*.so mr,
|
||||
/usr/lib/@{multiarch}/libvisual-[0-9].[0-9]/*/*.so m,
|
||||
|
||||
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/ rw,
|
||||
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/registry.*.bin rw,
|
||||
owner @{HOME}/{.cache/,.}gstreamer-[0-9]*.[0-9]*/registry.*.bin.tmp* rw,
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/usr/share/themes/{,**} r,
|
||||
|
||||
/usr/share/gtksourceview-[0-9]*/ r,
|
||||
/usr/share/gtksourceview-[0-9]*/** r,
|
||||
|
||||
/usr/share/gtk-3.0/ r,
|
||||
/usr/share/gtk-3.0/settings.ini r,
|
||||
|
||||
/etc/gtk-2.0/ r,
|
||||
/etc/gtk-2.0/gtkrc r,
|
||||
/etc/gtk-3.0/ r,
|
||||
/etc/gtk-3.0/*.conf r,
|
||||
|
||||
/etc/gtk/gtkrc r,
|
||||
|
||||
owner @{HOME}/.gtk r,
|
||||
owner @{HOME}/.gtkrc r,
|
||||
owner @{HOME}/.gtkrc-2.0 r,
|
||||
owner @{HOME}/.gtk-bookmarks r,
|
||||
owner @{HOME}/.config/gtkrc r,
|
||||
owner @{HOME}/.config/gtkrc-2.0 r,
|
||||
owner @{HOME}/.config/gtk-3.0/ rw,
|
||||
owner @{HOME}/.config/gtk-3.0/settings.ini r,
|
||||
owner @{HOME}/.config/gtk-3.0/bookmarks r,
|
||||
owner @{HOME}/.config/gtk-3.0/gtk.css r,
|
||||
|
||||
# for gtk file dialog
|
||||
owner @{HOME}/.config/gtk-2.0/ rw,
|
||||
owner @{HOME}/.config/gtk-2.0/gtkfilechooser.ini* rw,
|
||||
|
||||
# .Xauthority file required for X connections
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
# Xsession errors file
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# abstract path in ibus < 1.5.22 uses /tmp
|
||||
unix (connect, receive, send)
|
||||
type=stream
|
||||
peer=(addr="@/tmp/ibus/dbus-*"),
|
||||
|
||||
# abstract path in ibus >= 1.5.22 uses $XDG_CACHE_HOME (ie, @{user_cache_dirs})
|
||||
# This should use this, but due to LP: #1856738 we cannot
|
||||
#unix (connect, receive, send)
|
||||
# type=stream
|
||||
# peer=(addr="@@{user_cache_dirs}/ibus/dbus-*"),
|
||||
unix (connect, receive, send)
|
||||
type=stream
|
||||
peer=(addr="@/home/*/.cache/ibus/dbus-*"),
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/usr/share/kde4/** r,
|
||||
|
||||
/{usr/,}lib/kde4/*.so mr,
|
||||
/{usr/,}lib/kde4/plugins/*/ r,
|
||||
/{usr/,}lib/kde4/plugins/*/*.so mr,
|
||||
|
||||
# Create home KDE directory structure
|
||||
owner @{HOME}/.kde{,4}/ rw,
|
||||
owner @{HOME}/.kde{,4}/**/ rw,
|
||||
owner @{HOME}/.config/kde.org/ rw,
|
||||
owner @{HOME}/.config/kde.org/**/ rw,
|
||||
|
||||
# Common configs
|
||||
owner @{HOME}/.kde{,4}/share/config/kdeglobals r,
|
||||
owner @{HOME}/.kde{,4}/share/config/kdebugrc r,
|
||||
owner @{HOME}/.kde{,4}/share/config/servicetype_profilerc r,
|
||||
|
||||
# Phonon
|
||||
owner @{HOME}/.config/kde.org/libphonon.conf rk,
|
||||
|
||||
owner @{HOME}/.config/Trolltech.conf rk,
|
||||
|
||||
owner /var/tmp/kdecache-*/ r,
|
||||
owner /var/tmp/kdecache-*/** r,
|
||||
owner /var/tmp/kdecache-*/*.kcache rw,
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
|
||||
# KDE/Plasma5 themes
|
||||
#/{usr/,}lib/@{multiarch}/qt5/plugins/platformthemes/KDEPlasmaPlatformTheme.so mr,
|
||||
#/{usr/,}lib/@{multiarch}/qt5/plugins/styles/breeze.so mr,
|
||||
#/usr/share/plasma/look-and-feel/** r,
|
||||
#/usr/share/color-schemes/*.colors r,
|
||||
|
||||
#/usr/share/kservices5/{,**/} r,
|
||||
#/usr/share/kservices5/*.protocol r,
|
||||
|
||||
#/usr/share/knotifications5/plasma_workspace.notifyrc r,
|
||||
|
||||
# For app config (in order to work the KDE_APP_NAME variable has to be set in profile which
|
||||
# includes this abstraction)
|
||||
#owner @{HOME}/.config/#[0-9]*[0-9] rwk,
|
||||
#owner @{HOME}/.config/@{KDE_APP_NAME}rc* rwlk -> @{HOME}/.config/#[0-9]*[0-9],
|
||||
#owner @{run}/user/[0-9]*/#[0-9]*[0-9] rw,
|
||||
#owner @{run}/user/[0-9]*/@{KDE_APP_NAME}*.slave-socket rwl -> @{run}/user/[0-9]*/#[0-9]*[0-9],
|
||||
|
||||
# Common KDE config files
|
||||
#owner @{HOME}/.config/#[0-9]*[0-9] rw,
|
||||
#owner @{HOME}/.config/kdeglobals* rwkl -> @{HOME}/.config/#[0-9]*[0-9],
|
||||
#owner @{HOME}/.config/baloofilerc r,
|
||||
#owner @{HOME}/.config/dolphinrc r,
|
||||
#owner @{HOME}/.config/trashrc r,
|
||||
#owner @{HOME}/.config/knfsshare r,
|
||||
#owner /**/.directory r,
|
||||
|
||||
# For bookmarks
|
||||
#/{usr/,}bin/keditbookmarks rPUx,
|
||||
#owner @{HOME}/.local/share/kfile/ rw,
|
||||
#owner @{HOME}/.local/share/kfile/#[0-9]*[0-9] rw,
|
||||
#owner @{HOME}/.local/share/kfile/bookmarks.xml* rwl -> @{HOME}/.local/share/kfile/#[0-9]*[0-9],
|
||||
|
||||
# Common cache files
|
||||
#owner @{HOME}/.cache/icon-cache.kcache rw,
|
||||
#owner @{HOME}/.cache/ksycoca5_* r,
|
||||
|
||||
# Think what to do about this #FIXME#
|
||||
# It seems when a QT app is started in Plasma5/KDE5 environment it also wants the following.
|
||||
include <abstractions/recent-documents-write>
|
||||
#signal (send) set=(term, kill) peer=unconfined,
|
||||
#deny @{sys}/bus/ r,
|
||||
#deny @{sys}/bus/usb/devices/ r,
|
||||
#deny @{sys}/class/ r,
|
||||
#deny @{run}/udev/data/b8:[0-9]* r, # for /dev/sda1 , etc.
|
||||
#deny @{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/001/001 , etc.
|
||||
#deny @{run}/udev/data/+usb:* r, #
|
||||
#/etc/exports r,
|
||||
#/etc/xdg/menus/ r,
|
||||
#/usr/share/mime/ r,
|
||||
#owner @{HOME}/.config/menus/ r,
|
||||
#owner @{HOME}/.config/menus/applications-merged/ r,
|
||||
|
|
@ -1,121 +0,0 @@
|
|||
#include <abstractions/base>
|
||||
|
||||
# Allow receiving signals from libvirtd
|
||||
signal (receive) peer=libvirtd,
|
||||
signal (receive) peer=/usr/sbin/libvirtd,
|
||||
|
||||
umount,
|
||||
|
||||
# ignore DENIED message on / remount
|
||||
deny mount options=(ro, remount) -> /,
|
||||
|
||||
# allow tmpfs mounts everywhere
|
||||
mount fstype=tmpfs,
|
||||
|
||||
# allow mqueue mounts everywhere
|
||||
mount fstype=mqueue,
|
||||
|
||||
# allow fuse mounts everywhere
|
||||
mount fstype=fuse.*,
|
||||
|
||||
# deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
|
||||
mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
|
||||
deny @{PROC}/sys/fs/** wklx,
|
||||
|
||||
# allow efivars to be mounted, writing to it will be blocked though
|
||||
mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
|
||||
|
||||
# block some other dangerous paths
|
||||
deny @{PROC}/sysrq-trigger rwklx,
|
||||
deny @{PROC}/mem rwklx,
|
||||
deny @{PROC}/kmem rwklx,
|
||||
|
||||
# deny writes in /sys except for /sys/fs/cgroup, also allow
|
||||
# fusectl, securityfs and debugfs to be mounted there (read-only)
|
||||
mount fstype=fusectl -> /sys/fs/fuse/connections/,
|
||||
mount fstype=securityfs -> /sys/kernel/security/,
|
||||
mount fstype=debugfs -> /sys/kernel/debug/,
|
||||
mount fstype=proc -> /proc/,
|
||||
mount fstype=sysfs -> /sys/,
|
||||
deny /sys/firmware/efi/efivars/** rwklx,
|
||||
deny /sys/kernel/security/** rwklx,
|
||||
|
||||
# generated by: lxc-generate-aa-rules.py container-rules.base
|
||||
deny /proc/sys/[^kn]*{,/**} wklx,
|
||||
deny /proc/sys/k[^e]*{,/**} wklx,
|
||||
deny /proc/sys/ke[^r]*{,/**} wklx,
|
||||
deny /proc/sys/ker[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kern[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kerne[^l]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/d[^o]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/do[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/doma[^i]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domai[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domain[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainname?*{,/**} wklx,
|
||||
deny /proc/sys/kernel/h[^o]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/ho[^s]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hos[^t]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/host[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostname?*{,/**} wklx,
|
||||
deny /proc/sys/kernel/m[^s]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/msg*/** wklx,
|
||||
deny /proc/sys/kernel/s[^he]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/se[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/sem*/** wklx,
|
||||
deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/shm*/** wklx,
|
||||
deny /proc/sys/kernel?*{,/**} wklx,
|
||||
deny /proc/sys/n[^e]*{,/**} wklx,
|
||||
deny /proc/sys/ne[^t]*{,/**} wklx,
|
||||
deny /proc/sys/net?*{,/**} wklx,
|
||||
deny /sys/[^fdc]*{,/**} wklx,
|
||||
deny /sys/c[^l]*{,/**} wklx,
|
||||
deny /sys/cl[^a]*{,/**} wklx,
|
||||
deny /sys/cla[^s]*{,/**} wklx,
|
||||
deny /sys/clas[^s]*{,/**} wklx,
|
||||
deny /sys/class/[^n]*{,/**} wklx,
|
||||
deny /sys/class/n[^e]*{,/**} wklx,
|
||||
deny /sys/class/ne[^t]*{,/**} wklx,
|
||||
deny /sys/class/net?*{,/**} wklx,
|
||||
deny /sys/class?*{,/**} wklx,
|
||||
deny /sys/d[^e]*{,/**} wklx,
|
||||
deny /sys/de[^v]*{,/**} wklx,
|
||||
deny /sys/dev[^i]*{,/**} wklx,
|
||||
deny /sys/devi[^c]*{,/**} wklx,
|
||||
deny /sys/devic[^e]*{,/**} wklx,
|
||||
deny /sys/device[^s]*{,/**} wklx,
|
||||
deny /sys/devices/[^v]*{,/**} wklx,
|
||||
deny /sys/devices/v[^i]*{,/**} wklx,
|
||||
deny /sys/devices/vi[^r]*{,/**} wklx,
|
||||
deny /sys/devices/vir[^t]*{,/**} wklx,
|
||||
deny /sys/devices/virt[^u]*{,/**} wklx,
|
||||
deny /sys/devices/virtu[^a]*{,/**} wklx,
|
||||
deny /sys/devices/virtua[^l]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/[^n]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/n[^e]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/net?*{,/**} wklx,
|
||||
deny /sys/devices/virtual?*{,/**} wklx,
|
||||
deny /sys/devices?*{,/**} wklx,
|
||||
deny /sys/f[^s]*{,/**} wklx,
|
||||
deny /sys/fs/[^c]*{,/**} wklx,
|
||||
deny /sys/fs/c[^g]*{,/**} wklx,
|
||||
deny /sys/fs/cg[^r]*{,/**} wklx,
|
||||
deny /sys/fs/cgr[^o]*{,/**} wklx,
|
||||
deny /sys/fs/cgro[^u]*{,/**} wklx,
|
||||
deny /sys/fs/cgrou[^p]*{,/**} wklx,
|
||||
deny /sys/fs/cgroup?*{,/**} wklx,
|
||||
deny /sys/fs?*{,/**} wklx,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
#include <local/abstractions/libvirt-lxc>
|
||||
|
|
@ -1,248 +0,0 @@
|
|||
#include <abstractions/base>
|
||||
#include <abstractions/consoles>
|
||||
#include <abstractions/nameservice>
|
||||
|
||||
# required for reading disk images
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
capability chown,
|
||||
|
||||
# needed to drop privileges
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
ptrace (readby, tracedby) peer=libvirtd,
|
||||
ptrace (readby, tracedby) peer=/usr/sbin/libvirtd,
|
||||
|
||||
signal (receive) peer=libvirtd,
|
||||
signal (receive) peer=/usr/sbin/libvirtd,
|
||||
|
||||
/dev/kvm rw,
|
||||
/dev/net/tun rw,
|
||||
/dev/ptmx rw,
|
||||
@{PROC}/*/status r,
|
||||
# When qemu is signaled to terminate, it will read cmdline of signaling
|
||||
# process for reporting purposes. Allowing read access to a process
|
||||
# cmdline may leak sensitive information embedded in the cmdline.
|
||||
@{PROC}/@{pid}/cmdline r,
|
||||
# Per man(5) proc, the kernel enforces that a thread may
|
||||
# only modify its comm value or those in its thread group.
|
||||
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
|
||||
@{PROC}/sys/kernel/cap_last_cap r,
|
||||
@{PROC}/sys/vm/overcommit_memory r,
|
||||
# detect hardware capabilities via qemu_getauxval
|
||||
owner @{PROC}/*/auxv r,
|
||||
|
||||
# For hostdev access. The actual devices will be added dynamically
|
||||
/sys/bus/usb/devices/ r,
|
||||
/sys/devices/**/usb[0-9]*/** r,
|
||||
# libusb needs udev data about usb devices (~equal to content of lsusb -v)
|
||||
/run/udev/data/+usb* r,
|
||||
/run/udev/data/c16[6,7]* r,
|
||||
/run/udev/data/c18[0,8,9]* r,
|
||||
|
||||
# WARNING: this gives the guest direct access to host hardware and specific
|
||||
# portions of shared memory. This is required for sound using ALSA with kvm,
|
||||
# but may constitute a security risk. If your environment does not require
|
||||
# the use of sound in your VMs, feel free to comment out or prepend 'deny' to
|
||||
# the rules for files in /dev.
|
||||
/dev/snd/* rw,
|
||||
/{dev,run}/shm r,
|
||||
/{dev,run}/shmpulse-shm* r,
|
||||
/{dev,run}/shmpulse-shm* rwk,
|
||||
capability ipc_lock,
|
||||
# spice
|
||||
owner /{dev,run}/shm/spice.* rw,
|
||||
# 'kill' is not required for sound and is a security risk. Do not enable
|
||||
# unless you absolutely need it.
|
||||
deny capability kill,
|
||||
|
||||
# Uncomment the following if you need access to /dev/fb*
|
||||
#/dev/fb* rw,
|
||||
|
||||
/etc/pulse/client.conf r,
|
||||
@{HOME}/.pulse-cookie rwk,
|
||||
owner /root/.pulse-cookie rwk,
|
||||
owner /root/.pulse/ rw,
|
||||
owner /root/.pulse/* rw,
|
||||
/usr/share/alsa/** r,
|
||||
owner /tmp/pulse-*/ rw,
|
||||
owner /tmp/pulse-*/* rw,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
# access to firmware's etc
|
||||
/usr/share/AAVMF/** r,
|
||||
/usr/share/bochs/** r,
|
||||
/usr/share/edk2-ovmf/** r,
|
||||
/usr/share/kvm/** r,
|
||||
/usr/share/misc/sgabios.bin r,
|
||||
/usr/share/openbios/** r,
|
||||
/usr/share/openhackware/** r,
|
||||
/usr/share/OVMF/** r,
|
||||
/usr/share/ovmf/** r,
|
||||
/usr/share/proll/** r,
|
||||
/usr/share/qemu-efi/** r,
|
||||
/usr/share/qemu-kvm/** r,
|
||||
/usr/share/qemu/** r,
|
||||
/usr/share/seabios/** r,
|
||||
/usr/share/sgabios/** r,
|
||||
/usr/share/slof/** r,
|
||||
/usr/share/vgabios/** r,
|
||||
|
||||
# pki for libvirt-vnc and libvirt-spice (LP: #901272, #1690140)
|
||||
/etc/pki/CA/ r,
|
||||
/etc/pki/CA/* r,
|
||||
/etc/pki/libvirt{,-spice,-vnc}/ r,
|
||||
/etc/pki/libvirt{,-spice,-vnc}/** r,
|
||||
/etc/pki/qemu/ r,
|
||||
/etc/pki/qemu/** r,
|
||||
|
||||
# the various binaries
|
||||
/usr/bin/kvm rmix,
|
||||
/usr/bin/kvm-spice rmix,
|
||||
/usr/bin/qemu rmix,
|
||||
/usr/bin/qemu-aarch64 rmix,
|
||||
/usr/bin/qemu-alpha rmix,
|
||||
/usr/bin/qemu-arm rmix,
|
||||
/usr/bin/qemu-armeb rmix,
|
||||
/usr/bin/qemu-cris rmix,
|
||||
/usr/bin/qemu-i386 rmix,
|
||||
/usr/bin/qemu-kvm rmix,
|
||||
/usr/bin/qemu-m68k rmix,
|
||||
/usr/bin/qemu-microblaze rmix,
|
||||
/usr/bin/qemu-microblazeel rmix,
|
||||
/usr/bin/qemu-mips rmix,
|
||||
/usr/bin/qemu-mips64 rmix,
|
||||
/usr/bin/qemu-mips64el rmix,
|
||||
/usr/bin/qemu-mipsel rmix,
|
||||
/usr/bin/qemu-mipsn32 rmix,
|
||||
/usr/bin/qemu-mipsn32el rmix,
|
||||
/usr/bin/qemu-or32 rmix,
|
||||
/usr/bin/qemu-ppc rmix,
|
||||
/usr/bin/qemu-ppc64 rmix,
|
||||
/usr/bin/qemu-ppc64abi32 rmix,
|
||||
/usr/bin/qemu-ppc64le rmix,
|
||||
/usr/bin/qemu-s390x rmix,
|
||||
/usr/bin/qemu-sh4 rmix,
|
||||
/usr/bin/qemu-sh4eb rmix,
|
||||
/usr/bin/qemu-sparc rmix,
|
||||
/usr/bin/qemu-sparc32plus rmix,
|
||||
/usr/bin/qemu-sparc64 rmix,
|
||||
/usr/bin/qemu-system-aarch64 rmix,
|
||||
/usr/bin/qemu-system-alpha rmix,
|
||||
/usr/bin/qemu-system-arm rmix,
|
||||
/usr/bin/qemu-system-cris rmix,
|
||||
/usr/bin/qemu-system-hppa rmix,
|
||||
/usr/bin/qemu-system-i386 rmix,
|
||||
/usr/bin/qemu-system-lm32 rmix,
|
||||
/usr/bin/qemu-system-m68k rmix,
|
||||
/usr/bin/qemu-system-microblaze rmix,
|
||||
/usr/bin/qemu-system-microblazeel rmix,
|
||||
/usr/bin/qemu-system-mips rmix,
|
||||
/usr/bin/qemu-system-mips64 rmix,
|
||||
/usr/bin/qemu-system-mips64el rmix,
|
||||
/usr/bin/qemu-system-mipsel rmix,
|
||||
/usr/bin/qemu-system-moxie rmix,
|
||||
/usr/bin/qemu-system-nios2 rmix,
|
||||
/usr/bin/qemu-system-or1k rmix,
|
||||
/usr/bin/qemu-system-or32 rmix,
|
||||
/usr/bin/qemu-system-ppc rmix,
|
||||
/usr/bin/qemu-system-ppc64 rmix,
|
||||
/usr/bin/qemu-system-ppcemb rmix,
|
||||
/usr/bin/qemu-system-riscv32 rmix,
|
||||
/usr/bin/qemu-system-riscv64 rmix,
|
||||
/usr/bin/qemu-system-s390x rmix,
|
||||
/usr/bin/qemu-system-sh4 rmix,
|
||||
/usr/bin/qemu-system-sh4eb rmix,
|
||||
/usr/bin/qemu-system-sparc rmix,
|
||||
/usr/bin/qemu-system-sparc64 rmix,
|
||||
/usr/bin/qemu-system-tricore rmix,
|
||||
/usr/bin/qemu-system-unicore32 rmix,
|
||||
/usr/bin/qemu-system-x86_64 rmix,
|
||||
/usr/bin/qemu-system-xtensa rmix,
|
||||
/usr/bin/qemu-system-xtensaeb rmix,
|
||||
/usr/bin/qemu-unicore32 rmix,
|
||||
/usr/bin/qemu-x86_64 rmix,
|
||||
# for Debian/Ubuntu qemu-block-extra / RPMs qemu-block-* (LP: #1554761)
|
||||
/usr/{lib,lib64}/qemu/*.so mr,
|
||||
/usr/lib/@{multiarch}/qemu/*.so mr,
|
||||
|
||||
# let qemu load old shared objects after upgrades (LP: #1847361)
|
||||
/{var/,}run/qemu/*/*.so mr,
|
||||
# but explicitly deny writing to these files
|
||||
audit deny /{var/,}run/qemu/*/*.so w,
|
||||
|
||||
# swtpm
|
||||
/{usr/,}bin/swtpm rmix,
|
||||
/usr/{lib,lib64}/libswtpm_libtpms.so mr,
|
||||
/usr/lib/@{multiarch}/libswtpm_libtpms.so mr,
|
||||
|
||||
# for save and resume
|
||||
/{usr/,}bin/dash rmix,
|
||||
/{usr/,}bin/dd rmix,
|
||||
/{usr/,}bin/cat rmix,
|
||||
|
||||
# for restore
|
||||
/{usr/,}bin/bash rmix,
|
||||
|
||||
# for usb access
|
||||
/dev/bus/usb/ r,
|
||||
/etc/udev/udev.conf r,
|
||||
/sys/bus/ r,
|
||||
/sys/class/ r,
|
||||
|
||||
# for rbd
|
||||
/etc/ceph/ceph.conf r,
|
||||
|
||||
# Various functions will need to enumerate /tmp (e.g. ceph), allow the base
|
||||
# dir and a few known functions like samba support.
|
||||
# We want to avoid to give blanket rw permission to everything under /tmp,
|
||||
# users are expected to add site specific addons for more uncommon cases.
|
||||
# Qemu processes usually all run as the same users, so the "owner"
|
||||
# restriction prevents access to other services files, but not across
|
||||
# different instances.
|
||||
# This is a tradeoff between usability and security - if paths would be more
|
||||
# predictable that would be preferred - at least for write rules we would
|
||||
# want more unique paths per rule.
|
||||
/{,var/}tmp/ r,
|
||||
owner /{,var/}tmp/**/ r,
|
||||
|
||||
# for file-posix getting limits since 9103f1ce
|
||||
/sys/devices/**/block/*/queue/max_segments r,
|
||||
|
||||
# for ppc device-tree access
|
||||
@{PROC}/device-tree/ r,
|
||||
@{PROC}/device-tree/** r,
|
||||
/sys/firmware/devicetree/** r,
|
||||
|
||||
# allow connect with openGraphicsFD to work
|
||||
unix (send, receive) type=stream addr=none peer=(label=libvirtd),
|
||||
unix (send, receive) type=stream addr=none peer=(label=/usr/sbin/libvirtd),
|
||||
|
||||
# for gathering information about available host resources
|
||||
/sys/devices/system/cpu/ r,
|
||||
/sys/devices/system/node/ r,
|
||||
/sys/devices/system/node/node[0-9]*/meminfo r,
|
||||
/sys/module/vhost/parameters/max_mem_regions r,
|
||||
|
||||
# silence refusals to open lttng files (see LP: #1432644)
|
||||
deny /dev/shm/lttng-ust-wait-* r,
|
||||
deny /run/shm/lttng-ust-wait-* r,
|
||||
|
||||
# for vfio hotplug on systems without static vfio (LP: #1775777)
|
||||
/dev/vfio/vfio rw,
|
||||
|
||||
# required for sasl GSSAPI plugin
|
||||
/etc/gss/mech.d/ r,
|
||||
/etc/gss/mech.d/* r,
|
||||
|
||||
# required by libpmem init to fts_open()/fts_read() the symlinks in
|
||||
# /sys/bus/nd/devices
|
||||
/ r, # harmless on any lsb compliant system
|
||||
/sys/bus/nd/devices/{,**/} r,
|
||||
|
||||
# Site-specific additions and overrides. See local/README for details.
|
||||
#include <local/abstractions/libvirt-qemu>
|
||||
|
|
@ -1,114 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Profile for restricting lightdm guest session
|
||||
# Author: Martin Pitt <martin.pitt@ubuntu.com>
|
||||
|
||||
# This abstraction provides the majority of the confinement for guest sessions.
|
||||
# It is in its own abstraction so we can have a centralized place for
|
||||
# confinement for the various lightdm sessions (guest, freerdp, uccsconfigure,
|
||||
# etc). Note that this profile intentionally omits chromium-browser.
|
||||
|
||||
# Requires apparmor 2.9
|
||||
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/cups-client>
|
||||
include <abstractions/dbus>
|
||||
include <abstractions/dbus-session>
|
||||
include <abstractions/dbus-accessibility>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
# bug in compiz https://launchpad.net/bugs/697678
|
||||
/etc/compizconfig/config rw,
|
||||
/etc/compizconfig/unity.ini rw,
|
||||
|
||||
/ r,
|
||||
/bin/ rmix,
|
||||
/bin/fusermount Px,
|
||||
/bin/** rmix,
|
||||
/cdrom/ rmix,
|
||||
/cdrom/** rmix,
|
||||
/dev/ r,
|
||||
/dev/** rmw, # audio devices etc.
|
||||
owner /dev/shm/** rmw,
|
||||
/etc/ r,
|
||||
/etc/** rmk,
|
||||
/etc/X11/Xsession ix,
|
||||
/etc/X11/xdm/** ix, # needed for openSUSE's default session-wrapper
|
||||
/etc/X11/xinit/** ix, # needed for openSUSE's default session-wrapper
|
||||
/lib/ r,
|
||||
/lib/** rmixk,
|
||||
/lib32/ r,
|
||||
/lib32/** rmixk,
|
||||
/lib64/ r,
|
||||
/lib64/** rmixk,
|
||||
owner /{,run/}media/ r,
|
||||
owner /{,run/}media/** rmwlixk, # we want access to USB sticks and the like
|
||||
/opt/ r,
|
||||
/opt/** rmixk,
|
||||
@{PROC}/ r,
|
||||
@{PROC}/* rm,
|
||||
@{PROC}/[0-9]*/net/ r,
|
||||
@{PROC}/[0-9]*/net/dev r,
|
||||
@{PROC}/asound rm,
|
||||
@{PROC}/asound/** rm,
|
||||
@{PROC}/ati rm,
|
||||
@{PROC}/ati/** rm,
|
||||
@{PROC}/sys/vm/overcommit_memory r,
|
||||
owner @{PROC}/** rm,
|
||||
# needed for gnome-keyring-daemon
|
||||
@{PROC}/*/status r,
|
||||
# needed for bamfdaemon and utilities such as ps and killall
|
||||
@{PROC}/*/stat r,
|
||||
/sbin/ r,
|
||||
/sbin/** rmixk,
|
||||
/sys/ r,
|
||||
/sys/** rm,
|
||||
# needed for confined trusted helpers, such as dbus-daemon
|
||||
/sys/kernel/security/apparmor/.access rw,
|
||||
/tmp/ rw,
|
||||
owner /tmp/** rwlkmix,
|
||||
/usr/ r,
|
||||
/usr/** rmixk,
|
||||
/var/ r,
|
||||
/var/** rmixk,
|
||||
/var/guest-data/** rw, # allow to store files permanently
|
||||
/var/tmp/ rw,
|
||||
owner /var/tmp/** rwlkm,
|
||||
/{,var/}run/ r,
|
||||
# necessary for writing to sockets, etc.
|
||||
/{,var/}run/** rmkix,
|
||||
/{,var/}run/mir_socket rw,
|
||||
/{,var/}run/screen/** wl,
|
||||
/{,var/}run/shm/** wl,
|
||||
/{,var/}run/uuidd/request w,
|
||||
# libpam-xdg-support/logind
|
||||
owner /{,var/}run/user/*/** rw,
|
||||
|
||||
capability ipc_lock,
|
||||
|
||||
# allow processes in the guest session to signal and ptrace each other
|
||||
signal peer=@{profile_name},
|
||||
ptrace peer=@{profile_name},
|
||||
# needed when logging out of the guest session
|
||||
signal (receive) peer=unconfined,
|
||||
|
||||
unix peer=(label=@{profile_name}),
|
||||
unix (receive) peer=(label=unconfined),
|
||||
unix (create),
|
||||
unix (getattr, getopt, setopt, shutdown),
|
||||
unix (bind, listen, accept, receive, send) type=stream addr="@/com/ubuntu/upstart-session/**",
|
||||
unix (bind, listen) type=stream addr="@/tmp/dbus-*",
|
||||
unix (bind, listen) type=stream addr="@/tmp/.ICE-unix/[0-9]*",
|
||||
unix (bind, listen) type=stream addr="@/dbus-vfs-daemon/*",
|
||||
unix (bind, listen) type=stream addr="@guest*",
|
||||
unix (connect, receive, send) type=stream peer=(addr="@/tmp/dbus-*"),
|
||||
unix (connect, receive, send) type=stream peer=(addr="@/tmp/.X11-unix/X[0-9]*"),
|
||||
unix (connect, receive, send) type=stream peer=(addr="@/dbus-vfs-daemon/*"),
|
||||
unix (connect, receive, send) type=stream peer=(addr="@guest*"),
|
||||
|
||||
# silence warnings for stuff that we really don't want to grant
|
||||
deny capability dac_override,
|
||||
deny capability dac_read_search,
|
||||
#deny /etc/** w, # re-enable once LP#697678 is fixed
|
||||
deny /usr/** w,
|
||||
deny /var/crash/ w,
|
||||
|
|
@ -1,76 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Profile abstraction for restricting chromium in the lightdm guest session
|
||||
# Author: Jamie Strandboge <jamie@canonical.com>
|
||||
|
||||
# The abstraction provides the additional accesses required to launch
|
||||
# chromium based browsers from within an lightdm session. Because AppArmor
|
||||
# cannot yet merge profiles and because we want to utilize the access rules
|
||||
# provided in abstractions/lightdm, this abstraction must be separate from
|
||||
# abstractions/lightdm.
|
||||
|
||||
# Requires apparmor 2.9
|
||||
|
||||
/usr/lib/chromium/chromium Cx -> chromium,
|
||||
/usr/lib/chromium-browser/chromium-browser Cx -> chromium,
|
||||
/usr/bin/webapp-container Cx -> chromium,
|
||||
/usr/bin/webbrowser-app Cx -> chromium,
|
||||
/usr/bin/ubuntu-html5-app-launcher Cx -> chromium,
|
||||
/opt/google/chrome-stable/google-chrome-stable Cx -> chromium,
|
||||
/opt/google/chrome-beta/google-chrome-beta Cx -> chromium,
|
||||
/opt/google/chrome-unstable/google-chrome-unstable Cx -> chromium,
|
||||
/opt/google/chrome/google-chrome Cx -> chromium,
|
||||
|
||||
# Allow ptracing processes in the chromium child profile
|
||||
ptrace peer=/usr/lib/lightdm/lightdm-guest-session//chromium,
|
||||
|
||||
# Allow receiving and sending signals to processes in the chromium child profile
|
||||
signal (receive, send) peer=/usr/lib/lightdm/lightdm-guest-session//chromium,
|
||||
|
||||
# Allow communications with chromium child profile via unix sockets
|
||||
unix peer=(label=/usr/lib/lightdm/lightdm-guest-session//chromium),
|
||||
|
||||
profile chromium {
|
||||
# Allow all the same accesses as other applications in the guest session
|
||||
include <abstractions/lightdm>
|
||||
|
||||
# but also allow a few things because of chromium-browser's sandboxing that
|
||||
# are not appropriate to other guest session applications.
|
||||
owner @{PROC}/[0-9]*/oom_{,score_}adj w,
|
||||
@{PROC}/sys/kernel/shmmax r,
|
||||
capability sys_admin, # for sandbox to change namespaces
|
||||
capability sys_chroot, # fod sandbox to chroot to a safe directory
|
||||
capability setgid, # for sandbox to drop privileges
|
||||
capability setuid, # for sandbox to drop privileges
|
||||
capability sys_ptrace, # chromium needs this to keep track of itself
|
||||
@{PROC}/sys/kernel/yama/ptrace_scope r,
|
||||
|
||||
# Allow ptrace reads of processes in the lightdm-guest-session
|
||||
ptrace (read) peer=/usr/lib/lightdm/lightdm-guest-session,
|
||||
# Allow other guest session processes to read and trace us
|
||||
ptrace (readby, tracedby) peer=/usr/lib/lightdm/lightdm-guest-session,
|
||||
ptrace (readby, tracedby) peer=@{profile_name},
|
||||
|
||||
# Allow us to receive and send signals from processes in the
|
||||
# lightdm-guest-session
|
||||
signal (receive, send) set=("exists", "term") peer=/usr/lib/lightdm/lightdm-guest-session,
|
||||
|
||||
# Allow us to receive and send on unix sockets from processes in the
|
||||
# lightdm-guest-session
|
||||
unix (receive, send) peer=(label=/usr/lib/lightdm/lightdm-guest-session),
|
||||
|
||||
@{PROC}/[0-9]*/ r, # sandbox wants these
|
||||
@{PROC}/[0-9]*/fd/ r, # sandbox wants these
|
||||
@{PROC}/[0-9]*/statm r, # sandbox wants these
|
||||
@{PROC}/[0-9]*/task/[0-9]*/stat r, # sandbox wants these
|
||||
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
|
||||
/selinux/ r,
|
||||
|
||||
/usr/lib/chromium/chrome-sandbox ix,
|
||||
/usr/lib/chromium-browser/chromium-browser-sandbox ix,
|
||||
/usr/lib/@{multiarch}/oxide-qt/chrome-sandbox ix,
|
||||
/opt/google/chrome-*/chrome-sandbox ix,
|
||||
}
|
||||
|
|
@ -1,225 +0,0 @@
|
|||
network,
|
||||
capability,
|
||||
file,
|
||||
umount,
|
||||
|
||||
# dbus, signal, ptrace and unix are only supported by recent apparmor
|
||||
# versions. Comment them if the apparmor parser doesn't recognize them.
|
||||
|
||||
# This also needs additional rules to reach outside of the container via
|
||||
# DBus, so just let all of DBus within the container.
|
||||
dbus,
|
||||
|
||||
# Allow us to receive signals from anywhere. Note: if per-container profiles
|
||||
# are supported, for container isolation this should be changed to something
|
||||
# like:
|
||||
# signal (receive) peer=unconfined,
|
||||
# signal (receive) peer=/usr/bin/lxc-start,
|
||||
signal (receive),
|
||||
|
||||
# Allow us to send signals to ourselves
|
||||
signal peer=@{profile_name},
|
||||
|
||||
# Allow other processes to read our /proc entries, futexes, perf tracing and
|
||||
# kcmp for now (they will need 'read' in the first place). Administrators can
|
||||
# override with:
|
||||
# deny ptrace (readby) ...
|
||||
ptrace (readby),
|
||||
|
||||
# Allow other processes to trace us by default (they will need 'trace' in
|
||||
# the first place). Administrators can override with:
|
||||
# deny ptrace (tracedby) ...
|
||||
ptrace (tracedby),
|
||||
|
||||
# Allow us to ptrace ourselves
|
||||
ptrace peer=@{profile_name},
|
||||
|
||||
# Allow receive via unix sockets from anywhere. Note: if per-container
|
||||
# profiles are supported, for container isolation this should be changed to
|
||||
# something like:
|
||||
# unix (receive) peer=(label=unconfined),
|
||||
unix (receive),
|
||||
|
||||
# Allow all unix in the container
|
||||
unix peer=(label=@{profile_name}),
|
||||
|
||||
# ignore DENIED message on / remount
|
||||
deny mount options=(ro, remount) -> /,
|
||||
deny mount options=(ro, remount, silent) -> /,
|
||||
|
||||
# allow tmpfs mounts everywhere
|
||||
mount fstype=tmpfs,
|
||||
|
||||
# allow hugetlbfs mounts everywhere
|
||||
mount fstype=hugetlbfs,
|
||||
|
||||
# allow mqueue mounts everywhere
|
||||
mount fstype=mqueue,
|
||||
|
||||
# allow fuse mounts everywhere
|
||||
mount fstype=fuse,
|
||||
mount fstype=fuse.*,
|
||||
|
||||
# deny access under /proc/bus to avoid e.g. messing with pci devices directly
|
||||
deny @{PROC}/bus/** wklx,
|
||||
|
||||
# deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
|
||||
mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
|
||||
deny @{PROC}/sys/fs/** wklx,
|
||||
|
||||
# allow efivars to be mounted, writing to it will be blocked though
|
||||
mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
|
||||
|
||||
# block some other dangerous paths
|
||||
deny @{PROC}/kcore rwklx,
|
||||
deny @{PROC}/sysrq-trigger rwklx,
|
||||
deny @{PROC}/acpi/** rwklx,
|
||||
|
||||
# deny writes in /sys except for /sys/fs/cgroup, also allow
|
||||
# fusectl, securityfs and debugfs to be mounted there (read-only)
|
||||
mount fstype=fusectl -> /sys/fs/fuse/connections/,
|
||||
mount fstype=securityfs -> /sys/kernel/security/,
|
||||
mount fstype=debugfs -> /sys/kernel/debug/,
|
||||
deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
|
||||
mount fstype=proc -> /proc/,
|
||||
mount fstype=sysfs -> /sys/,
|
||||
mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,
|
||||
deny /sys/firmware/efi/efivars/** rwklx,
|
||||
deny /sys/kernel/security/** rwklx,
|
||||
mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,
|
||||
|
||||
# deny reads from debugfs
|
||||
deny /sys/kernel/debug/{,**} rwklx,
|
||||
|
||||
# allow paths to be made slave, shared, private or unbindable
|
||||
# FIXME: This currently doesn't work due to the apparmor parser treating those as allowing all mounts.
|
||||
# mount options=(rw,make-slave) -> **,
|
||||
# mount options=(rw,make-rslave) -> **,
|
||||
# mount options=(rw,make-shared) -> **,
|
||||
# mount options=(rw,make-rshared) -> **,
|
||||
# mount options=(rw,make-private) -> **,
|
||||
# mount options=(rw,make-rprivate) -> **,
|
||||
# mount options=(rw,make-unbindable) -> **,
|
||||
# mount options=(rw,make-runbindable) -> **,
|
||||
|
||||
# allow bind-mounts of anything except /proc, /sys and /dev
|
||||
mount options=(rw,bind) /[^spd]*{,/**},
|
||||
mount options=(rw,bind) /d[^e]*{,/**},
|
||||
mount options=(rw,bind) /de[^v]*{,/**},
|
||||
mount options=(rw,bind) /dev/.[^l]*{,/**},
|
||||
mount options=(rw,bind) /dev/.l[^x]*{,/**},
|
||||
mount options=(rw,bind) /dev/.lx[^c]*{,/**},
|
||||
mount options=(rw,bind) /dev/.lxc?*{,/**},
|
||||
mount options=(rw,bind) /dev/[^.]*{,/**},
|
||||
mount options=(rw,bind) /dev?*{,/**},
|
||||
mount options=(rw,bind) /p[^r]*{,/**},
|
||||
mount options=(rw,bind) /pr[^o]*{,/**},
|
||||
mount options=(rw,bind) /pro[^c]*{,/**},
|
||||
mount options=(rw,bind) /proc?*{,/**},
|
||||
mount options=(rw,bind) /s[^y]*{,/**},
|
||||
mount options=(rw,bind) /sy[^s]*{,/**},
|
||||
mount options=(rw,bind) /sys?*{,/**},
|
||||
|
||||
# allow various ro-bind-*re*-mounts
|
||||
mount options=(ro,remount,bind),
|
||||
mount options=(ro,remount,bind,nosuid),
|
||||
mount options=(ro,remount,bind,noexec),
|
||||
mount options=(ro,remount,bind,nodev),
|
||||
mount options=(ro,remount,bind,nosuid,noexec),
|
||||
mount options=(ro,remount,bind,noexec,nodev),
|
||||
mount options=(ro,remount,bind,nodev,nosuid),
|
||||
mount options=(ro,remount,bind,nosuid,noexec,nodev),
|
||||
|
||||
# allow moving mounts except for /proc, /sys and /dev
|
||||
mount options=(rw,move) /[^spd]*{,/**},
|
||||
mount options=(rw,move) /d[^e]*{,/**},
|
||||
mount options=(rw,move) /de[^v]*{,/**},
|
||||
mount options=(rw,move) /dev/.[^l]*{,/**},
|
||||
mount options=(rw,move) /dev/.l[^x]*{,/**},
|
||||
mount options=(rw,move) /dev/.lx[^c]*{,/**},
|
||||
mount options=(rw,move) /dev/.lxc?*{,/**},
|
||||
mount options=(rw,move) /dev/[^.]*{,/**},
|
||||
mount options=(rw,move) /dev?*{,/**},
|
||||
mount options=(rw,move) /p[^r]*{,/**},
|
||||
mount options=(rw,move) /pr[^o]*{,/**},
|
||||
mount options=(rw,move) /pro[^c]*{,/**},
|
||||
mount options=(rw,move) /proc?*{,/**},
|
||||
mount options=(rw,move) /s[^y]*{,/**},
|
||||
mount options=(rw,move) /sy[^s]*{,/**},
|
||||
mount options=(rw,move) /sys?*{,/**},
|
||||
# generated by: lxc-generate-aa-rules.py container-rules.base
|
||||
deny /proc/sys/[^kn]*{,/**} wklx,
|
||||
deny /proc/sys/k[^e]*{,/**} wklx,
|
||||
deny /proc/sys/ke[^r]*{,/**} wklx,
|
||||
deny /proc/sys/ker[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kern[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kerne[^l]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/d[^o]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/do[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/doma[^i]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domai[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domain[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/domainname?*{,/**} wklx,
|
||||
deny /proc/sys/kernel/h[^o]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/ho[^s]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hos[^t]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/host[^n]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/hostname?*{,/**} wklx,
|
||||
deny /proc/sys/kernel/m[^s]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/msg*/** wklx,
|
||||
deny /proc/sys/kernel/s[^he]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/se[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/sem*/** wklx,
|
||||
deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
|
||||
deny /proc/sys/kernel/shm*/** wklx,
|
||||
deny /proc/sys/kernel?*{,/**} wklx,
|
||||
deny /proc/sys/n[^e]*{,/**} wklx,
|
||||
deny /proc/sys/ne[^t]*{,/**} wklx,
|
||||
deny /proc/sys/net?*{,/**} wklx,
|
||||
deny /sys/[^fdc]*{,/**} wklx,
|
||||
deny /sys/c[^l]*{,/**} wklx,
|
||||
deny /sys/cl[^a]*{,/**} wklx,
|
||||
deny /sys/cla[^s]*{,/**} wklx,
|
||||
deny /sys/clas[^s]*{,/**} wklx,
|
||||
deny /sys/class/[^n]*{,/**} wklx,
|
||||
deny /sys/class/n[^e]*{,/**} wklx,
|
||||
deny /sys/class/ne[^t]*{,/**} wklx,
|
||||
deny /sys/class/net?*{,/**} wklx,
|
||||
deny /sys/class?*{,/**} wklx,
|
||||
deny /sys/d[^e]*{,/**} wklx,
|
||||
deny /sys/de[^v]*{,/**} wklx,
|
||||
deny /sys/dev[^i]*{,/**} wklx,
|
||||
deny /sys/devi[^c]*{,/**} wklx,
|
||||
deny /sys/devic[^e]*{,/**} wklx,
|
||||
deny /sys/device[^s]*{,/**} wklx,
|
||||
deny /sys/devices/[^v]*{,/**} wklx,
|
||||
deny /sys/devices/v[^i]*{,/**} wklx,
|
||||
deny /sys/devices/vi[^r]*{,/**} wklx,
|
||||
deny /sys/devices/vir[^t]*{,/**} wklx,
|
||||
deny /sys/devices/virt[^u]*{,/**} wklx,
|
||||
deny /sys/devices/virtu[^a]*{,/**} wklx,
|
||||
deny /sys/devices/virtua[^l]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/[^n]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/n[^e]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
|
||||
deny /sys/devices/virtual/net?*{,/**} wklx,
|
||||
deny /sys/devices/virtual?*{,/**} wklx,
|
||||
deny /sys/devices?*{,/**} wklx,
|
||||
deny /sys/f[^s]*{,/**} wklx,
|
||||
deny /sys/fs/[^c]*{,/**} wklx,
|
||||
deny /sys/fs/c[^g]*{,/**} wklx,
|
||||
deny /sys/fs/cg[^r]*{,/**} wklx,
|
||||
deny /sys/fs/cgr[^o]*{,/**} wklx,
|
||||
deny /sys/fs/cgro[^u]*{,/**} wklx,
|
||||
deny /sys/fs/cgrou[^p]*{,/**} wklx,
|
||||
deny /sys/fs/cgroup?*{,/**} wklx,
|
||||
deny /sys/fs?*{,/**} wklx,
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
network,
|
||||
capability,
|
||||
file,
|
||||
|
||||
# The following 3 entries are only supported by recent apparmor versions.
|
||||
# Comment them if the apparmor parser doesn't recognize them.
|
||||
dbus,
|
||||
signal,
|
||||
ptrace,
|
||||
|
||||
# currently blocked by apparmor bug
|
||||
mount -> /usr/lib*/*/lxc/{**,},
|
||||
mount -> /usr/lib*/lxc/{**,},
|
||||
mount -> /usr/lib/x86_64-linux-gnu/lxc/rootfs/{,**},
|
||||
mount fstype=devpts -> /dev/pts/,
|
||||
mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
|
||||
mount options=bind /dev/pts/** -> /dev/**,
|
||||
mount options=(rw, make-slave) -> **,
|
||||
mount options=(rw, make-rslave) -> **,
|
||||
mount fstype=debugfs,
|
||||
# allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
|
||||
mount -> /var/lib/lxc/{**,},
|
||||
|
||||
mount /dev/.lxc-boot-id -> /proc/sys/kernel/random/boot_id,
|
||||
mount options=(ro, nosuid, nodev, noexec, remount, bind) -> /proc/sys/kernel/random/boot_id,
|
||||
|
||||
# required for some pre-mount hooks
|
||||
mount fstype=overlayfs,
|
||||
mount fstype=aufs,
|
||||
mount fstype=ecryptfs,
|
||||
|
||||
# all umounts are under the original root's /mnt, but right now we
|
||||
# can't allow those umounts after pivot_root. So allow all umounts
|
||||
# right now. They'll be restricted for the container at least.
|
||||
umount,
|
||||
#umount /mnt/{**,},
|
||||
|
||||
# This may look a bit redundant, however it appears we need all of
|
||||
# them if we want things to work properly on all combinations of kernel
|
||||
# and userspace parser...
|
||||
pivot_root /usr/lib*/lxc/,
|
||||
pivot_root /usr/lib*/*/lxc/,
|
||||
pivot_root /usr/lib*/lxc/**,
|
||||
pivot_root /usr/lib*/*/lxc/**,
|
||||
pivot_root /usr/lib/x86_64-linux-gnu/lxc/rootfs/{,**},
|
||||
|
||||
change_profile -> lxc-*,
|
||||
change_profile -> lxc-**,
|
||||
change_profile -> unconfined,
|
||||
change_profile -> :lxc-*:unconfined,
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/etc/hosts r,
|
||||
/etc/host.conf r,
|
||||
/etc/resolv.conf r,
|
||||
/etc/nsswitch.conf r,
|
||||
/etc/passwd r,
|
||||
/etc/gai.conf r,
|
||||
/etc/group r,
|
||||
/etc/protocols r,
|
||||
/etc/default/nss r,
|
||||
/etc/services r,
|
||||
|
||||
# NSS records from systemd-userdbd.service
|
||||
/{var,}run/systemd/userdb/ r,
|
||||
/{var,}run/systemd/userdb/io.systemd.{NameServiceSwitch,Multiplexer,DynamicUser,Home} r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
/usr/local/lib{,32,64}/python{2.[4-7],3,3.[0-9]}/{site,dist}-packages/**/ r,
|
||||
|
||||
# Silencer
|
||||
/{usr/,}lib/python3/** w,
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
/dev/kmsg w,
|
||||
|
||||
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/thumbnails/ r,
|
||||
owner @{HOME}/thumbnails/{large,normal}/ r,
|
||||
owner @{HOME}/thumbnails/{large,normal}/[a-f0-9]*.png r,
|
||||
|
||||
owner @{HOME}/.cache/thumbnails/ r,
|
||||
owner @{HOME}/.cache/thumbnails/{large,normal}/ r,
|
||||
owner @{HOME}/.cache/thumbnails/{large,normal}/[a-f0-9]*.png r,
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/thumbnails/ rw,
|
||||
owner @{HOME}/thumbnails/{large,normal}/ rw,
|
||||
owner @{HOME}/thumbnails/{large,normal}/#[0-9]*[0-9] rw,
|
||||
owner @{HOME}/thumbnails/{large,normal}/[a-f0-9]*.png rwl -> @{HOME}/.cache/thumbnails/{large,normal}/#[0-9]*[0-9],
|
||||
|
||||
owner @{HOME}/.cache/thumbnails/ rw,
|
||||
owner @{HOME}/.cache/thumbnails/{large,normal}/ rw,
|
||||
owner @{HOME}/.cache/thumbnails/{large,normal}/#[0-9]*[0-9] rw,
|
||||
owner @{HOME}/.cache/thumbnails/{large,normal}/[a-f0-9]*.png rwl -> @{HOME}/.cache/thumbnails/{large,normal}/#[0-9]*[0-9],
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/openssl>
|
||||
|
||||
network tcp,
|
||||
network udp,
|
||||
|
||||
capability chown,
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability fsetid,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
/usr/bin/tor r,
|
||||
/usr/sbin/tor r,
|
||||
|
||||
# Needed by obfs4proxy
|
||||
/proc/sys/net/core/somaxconn r,
|
||||
|
||||
/proc/sys/kernel/random/uuid r,
|
||||
/sys/devices/system/cpu/ r,
|
||||
/sys/devices/system/cpu/** r,
|
||||
|
||||
/etc/tor/* r,
|
||||
/usr/share/tor/** r,
|
||||
|
||||
/usr/bin/obfsproxy PUx,
|
||||
/usr/bin/obfs4proxy Pix,
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Author: Jamie Strandboge <jamie@canonical.com>
|
||||
|
||||
# Description: Limit executable access and reasonable read access. A look at
|
||||
# the gconf schema files for totem-video-thumbnailer reveals at least the
|
||||
# following files:
|
||||
# 3gpp, ac3, acm, aiff, amr-wb, ape, asf, asx, au, avi, basic, divx, dv, flac,
|
||||
# flc, fli, flic, flv, google-video-pointer, gpp, gsm, m4a, m4v, matroska,
|
||||
# midi, mod, mp3, mp4, mp4es, mpeg, mpt2, msvideo, ms-wm, musepack,mxf,
|
||||
# netshow, nsv, off, ogm, pict, pn-realaudio, prs.sid, quicktime, ram,
|
||||
# realpix, rn, sbc, sdp, shorten, speex, theora, totem-stream, tta, ultravox,
|
||||
# vivo, vorbis, wav, wavpack, wax, webm, wma, wmv, wmx, wpl, wvx, x-anim,
|
||||
# x-it, xm
|
||||
#
|
||||
# While ideally we would narrow down our read access to the above, this is
|
||||
# a maintenance problem and doesn't work for files without extensions.
|
||||
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/gstreamer>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/dbus-session>
|
||||
|
||||
# Allow read on all directories
|
||||
/**/ r,
|
||||
|
||||
# Allow read on removable media and files in /usr/share and /usr/local/share
|
||||
/usr/local/share/** r,
|
||||
/usr/share/** r,
|
||||
/{media,mnt,opt,srv}/** r,
|
||||
|
||||
owner @{HOME}/.cache/mesa/** rwk,
|
||||
owner @{HOME}/.cache/thumbnails/** rw,
|
||||
owner @{HOME}/.cache/totem/ rw,
|
||||
owner @{HOME}/.cache/totem/** rwk,
|
||||
owner @{HOME}/.cache/totem-* rwk,
|
||||
owner @{HOME}/.cache/tracker/db-locale.txt r,
|
||||
owner @{HOME}/.cache/tracker/meta.db{,-shm,-journal,-wal} rwk,
|
||||
owner @{HOME}/.cache/tracker/ontologies.gvdb r,
|
||||
owner @{HOME}/.config/totem/ rwk,
|
||||
owner @{HOME}/.config/totem/** rwk,
|
||||
owner @{HOME}/.local/share/grilo-plugins/ rwk,
|
||||
owner @{HOME}/.local/share/grilo-plugins/*.db{,-shm,-journal,-wal} rwk,
|
||||
owner @{HOME}/.local/share/gvfs-metadata/** r,
|
||||
owner @{HOME}/.local/share/totem/ rwk,
|
||||
owner @{HOME}/.local/share/tracker/data/tracker-store.journal rwk,
|
||||
|
||||
owner @{PROC}/@{pid}/{mountinfo,status} r,
|
||||
|
||||
/run/udev/data/c* r,
|
||||
/run/udev/data/+drm:card* r,
|
||||
/run/udev/data/+usb* r,
|
||||
|
||||
/sys/devices/system/node/*/meminfo r,
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/.config/trashrc rw,
|
||||
owner @{HOME}/.config/trashrc.lock rwk,
|
||||
owner @{HOME}/.config/#[0-9]*[0-9] rwk,
|
||||
owner @{HOME}/.config/trashrc.* rwl -> @{HOME}/.config/#[0-9]*[0-9],
|
||||
|
||||
owner @{run}/user/[0-9]*/#[0-9]*[0-9] rw,
|
||||
owner @{run}/user/[0-9]*/trash.so*.[0-9].slave-socket rwl -> @{run}/user/[0-9]*/#[0-9]*[0-9],
|
||||
|
||||
# Home trash location
|
||||
owner @{HOME}/.local/share/Trash/ rw,
|
||||
owner @{HOME}/.local/share/Trash/#[0-9]*[0-9] rw,
|
||||
owner @{HOME}/.local/share/Trash/directorysizes{,.*} rwl -> @{HOME}/.local/share/Trash/#[0-9]*[0-9],
|
||||
owner @{HOME}/.local/share/Trash/files/{,**} rw,
|
||||
owner @{HOME}/.local/share/Trash/info/ rw,
|
||||
owner @{HOME}/.local/share/Trash/info/*.trashinfo{,.*} rw,
|
||||
owner @{HOME}/.local/share/Trash/expunged/ rw,
|
||||
owner @{HOME}/.local/share/Trash/expunged/[0-9]* rw,
|
||||
|
||||
# Partitions' trash location when the admin creates the .Trash/ folder in the top lvl dir
|
||||
owner /media/*/.Trash/ rw,
|
||||
owner /media/*/.Trash/[0-9]*/ rw,
|
||||
owner /media/*/.Trash/[0-9]*/#[0-9]*[0-9] rw,
|
||||
owner /media/*/.Trash/[0-9]*/directorysizes{,.*} rwl -> /media/*/.Trash/[0-9]*/#[0-9]*[0-9],
|
||||
owner /media/*/.Trash/[0-9]*/files/{,**} rw,
|
||||
owner /media/*/.Trash/[0-9]*/info/ rw,
|
||||
owner /media/*/.Trash/[0-9]*/info/*.trashinfo{,.*} rw,
|
||||
owner /media/*/.Trash/[0-9]*/expunged/ rw,
|
||||
owner /media/*/.Trash/[0-9]*/expunged/[0-9]* rw,
|
||||
|
||||
# Partitions' trash location when the admin doesn't create the .Trash/ folder in the top lvl dir
|
||||
owner /media/*/.Trash-[0-9]*/ rw,
|
||||
owner /media/*/.Trash-[0-9]*/#[0-9]*[0-9] rw,
|
||||
owner /media/*/.Trash-[0-9]*/directorysizes{,.*} rwl -> /media/*/.Trash-[0-9]*/#[0-9]*[0-9],
|
||||
owner /media/*/.Trash-[0-9]*/files/{,**} rw,
|
||||
owner /media/*/.Trash-[0-9]*/info/ rw,
|
||||
owner /media/*/.Trash-[0-9]*/info/*.trashinfo{,.*} rw,
|
||||
owner /media/*/.Trash-[0-9]*/expunged/ rw,
|
||||
owner /media/*/.Trash-[0-9]*/expunged/[0-9]* rw,
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Canonical Ltd.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
# Author: Jamie Strandboge <jamie@canonical.com>
|
||||
|
||||
# For site-specific adjustments, please see:
|
||||
# /etc/apparmor.d/local/chromium-browser
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <abstractions/ubuntu-browsers.d/plugins-common>
|
||||
include <abstractions/ubuntu-browsers.d/mailto>
|
||||
include <abstractions/ubuntu-browsers.d/multimedia>
|
||||
include <abstractions/ubuntu-browsers.d/productivity>
|
||||
include <abstractions/ubuntu-browsers.d/java>
|
||||
include <abstractions/ubuntu-browsers.d/kde>
|
||||
include <abstractions/ubuntu-browsers.d/text-editors>
|
||||
include <abstractions/ubuntu-browsers.d/ubuntu-integration>
|
||||
include <abstractions/ubuntu-browsers.d/user-files>
|
||||
|
|
@ -1,120 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Java plugin
|
||||
owner @{HOME}/.java/deployment/deployment.properties k,
|
||||
/etc/java-*/ r,
|
||||
/etc/java-*/** r,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}lib/*/IcedTeaPlugin.so mr,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}lib/*/IcedTeaPlugin.so mr,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java cx -> browser_openjdk,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java cx -> browser_openjdk,
|
||||
/usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} cx -> browser_java,
|
||||
/usr/lib/jvm/java-*-sun-1.*/jre/lib/*/libnp*.so cx -> browser_java,
|
||||
/usr/lib/j2*-ibm/jre/bin/java cx -> browser_java,
|
||||
owner /{,var/}run/user/*/icedteaplugin-*/ rw,
|
||||
owner /{,var/}run/user/*/icedteaplugin-*/** rwk,
|
||||
|
||||
# Profile for the supported OpenJDK in Ubuntu. This doesn't require the
|
||||
# unfortunate workarounds of the proprietary Javas, so have a separate
|
||||
# profile.
|
||||
profile browser_openjdk {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/kde>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/private-files-strict>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
@{PROC}/@{pid}/net/if_inet6 r,
|
||||
@{PROC}/@{pid}/net/ipv6_route r,
|
||||
|
||||
/etc/java-*/ r,
|
||||
/etc/java-*/** r,
|
||||
/etc/lsb-release r,
|
||||
/etc/ssl/certs/java/* r,
|
||||
/etc/timezone r,
|
||||
/etc/writable/timezone r,
|
||||
|
||||
@{PROC}/@{pid}/ r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/filesystems r,
|
||||
@{sys}/devices/system/cpu/ r,
|
||||
@{sys}/devices/system/cpu/** r,
|
||||
/usr/share/** r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/bin/env ix,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk/{,jre/}bin/java ix,
|
||||
/usr/lib/jvm/java-[1-9]{,[0-9]}-openjdk-{amd64,armel,armhf,i386,powerpc}/{,jre/}bin/java ix,
|
||||
/usr/lib/jvm/java-{6,7}-openjdk*/jre/lib/i386/client/classes.jsa m,
|
||||
|
||||
# Why would java need this?
|
||||
deny /usr/bin/gconftool-2 x,
|
||||
|
||||
owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-appletviewer-to-plugin rw,
|
||||
owner /{,var/}run/user/[0-9]*/icedteaplugin-*-*/[0-9]*-icedteanp-plugin-{,debug-}to-appletviewer r,
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/** rwk,
|
||||
}
|
||||
|
||||
# Profile for commercial Javas. These need workarounds to work right (eg
|
||||
# Sun's forcing of an executable stack (LP: #535247)).
|
||||
profile browser_java {
|
||||
include <abstractions/base>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/gnome>
|
||||
include <abstractions/kde>
|
||||
include <abstractions/nameservice>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/user-tmp>
|
||||
include <abstractions/private-files-strict>
|
||||
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
@{PROC}/@{pid}/net/if_inet6 r,
|
||||
@{PROC}/@{pid}/net/ipv6_route r,
|
||||
@{PROC}/loadavg r,
|
||||
|
||||
/etc/debian_version r,
|
||||
/etc/java-*/ r,
|
||||
/etc/java-*/** r,
|
||||
/etc/lsb-release r,
|
||||
/etc/ssl/certs/java/* r,
|
||||
/etc/timezone r,
|
||||
/etc/writable/timezone r,
|
||||
|
||||
@{PROC}/@{pid}/ r,
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/filesystems r,
|
||||
@{sys}/devices/system/cpu/ r,
|
||||
@{sys}/devices/system/cpu/** r,
|
||||
/usr/share/** r,
|
||||
/var/lib/dbus/machine-id r,
|
||||
|
||||
/usr/bin/env ix,
|
||||
/usr/lib/jvm/java-*-sun-1.*/jre/bin/java{,_vm} ix,
|
||||
/usr/lib/jvm/java-*-sun-1.*/jre/lib/i386/client/classes.jsa m,
|
||||
/usr/lib/j2*-ibm/jre/bin/java ix,
|
||||
|
||||
# noisy, can't write here anyway
|
||||
deny /etc/.java/ w,
|
||||
deny /etc/.java/** w,
|
||||
|
||||
deny /usr/bin/gconftool-2 x,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/** rwk,
|
||||
|
||||
# These are seriously unfortunate, but required due to LP: #535247
|
||||
/etc/passwd m,
|
||||
owner @{HOME}/.java/**/cache/** m,
|
||||
owner /tmp/** m,
|
||||
/usr/lib{,32,64}/jvm/**/*.jar mr,
|
||||
/usr/share/fonts/** m,
|
||||
}
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Users of this abstraction need to include the ubuntu-helpers abstraction
|
||||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <abstractions/kde>
|
||||
/usr/bin/kde4-config Cx -> sanitized_helper,
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# for mailto:
|
||||
include <abstractions/ubuntu-email>
|
||||
include <abstractions/ubuntu-console-email>
|
||||
|
||||
# Terminals for using console applications. These abstractions should ideally
|
||||
# have 'ix' to restrct access to what only firefox is allowed to do
|
||||
include <abstractions/ubuntu-gnome-terminal>
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Users of this abstraction need to include the ubuntu-helpers abstraction
|
||||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <abstractions/X>
|
||||
|
||||
# Pulseaudio
|
||||
/usr/bin/pulseaudio Pixr,
|
||||
|
||||
# Image viewers
|
||||
/usr/bin/eog Cxr -> sanitized_helper,
|
||||
/usr/bin/gimp* Cxr -> sanitized_helper,
|
||||
/usr/bin/shotwell Cxr -> sanitized_helper,
|
||||
/usr/bin/digikam Cxr -> sanitized_helper,
|
||||
/usr/bin/gwenview Cxr -> sanitized_helper,
|
||||
|
||||
include <abstractions/ubuntu-media-players>
|
||||
owner @{HOME}/.adobe/ w,
|
||||
owner @{HOME}/.adobe/** rw,
|
||||
owner @{HOME}/.macromedia/ w,
|
||||
owner @{HOME}/.macromedia/** rw,
|
||||
/opt/real/RealPlayer/mozilla/nphelix.so rm,
|
||||
/usr/bin/lpstat Cxr -> sanitized_helper,
|
||||
/usr/bin/lpr Cxr -> sanitized_helper,
|
||||
|
||||
# Bittorrent clients
|
||||
include <abstractions/ubuntu-bittorrent-clients>
|
||||
|
||||
# Archivers
|
||||
/usr/bin/ark Cxr -> sanitized_helper,
|
||||
/usr/bin/file-roller Cxr -> sanitized_helper,
|
||||
/usr/bin/xarchiver Cxr -> sanitized_helper,
|
||||
/usr/local/lib{,32,64}/*.so* mr,
|
||||
|
||||
# News feed readers
|
||||
include <abstractions/ubuntu-feed-readers>
|
||||
|
||||
# If we allow the above, nvidia based systems will also need this
|
||||
include <abstractions/nvidia>
|
||||
|
||||
# Virus scanners
|
||||
/usr/bin/clamscan Cx -> sanitized_helper,
|
||||
|
||||
# gxine (LP: #1057642)
|
||||
/var/lib/xine/gxine.desktop r,
|
||||
|
||||
# For WebRTC camera access (LP: #1665535)
|
||||
/dev/video[0-9]* rw,
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
#
|
||||
# Plugins/helpers
|
||||
#
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
/usr/lib/** rm,
|
||||
/{,usr/}bin/bash ixr,
|
||||
/{,usr/}bin/dash ixr,
|
||||
/{,usr/}bin/grep ixr,
|
||||
/{,usr/}bin/sed ixr,
|
||||
/usr/bin/m4 ixr,
|
||||
|
||||
# Since all the ubuntu-browsers.d abstractions need this, just include it
|
||||
# here
|
||||
include <abstractions/ubuntu-helpers>
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Users of this abstraction need to include the ubuntu-helpers abstraction
|
||||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Openoffice.org
|
||||
/usr/bin/ooffice Cxr -> sanitized_helper,
|
||||
/usr/bin/oocalc Cxr -> sanitized_helper,
|
||||
/usr/bin/oodraw Cxr -> sanitized_helper,
|
||||
/usr/bin/ooimpress Cxr -> sanitized_helper,
|
||||
/usr/bin/oowriter Cxr -> sanitized_helper,
|
||||
/usr/lib/openoffice/program/soffice Cxr -> sanitized_helper,
|
||||
|
||||
# LibreOffice
|
||||
/usr/bin/libreoffice Cxr -> sanitized_helper,
|
||||
/usr/bin/localc Cxr -> sanitized_helper,
|
||||
/usr/bin/lodraw Cxr -> sanitized_helper,
|
||||
/usr/bin/loimpress Cxr -> sanitized_helper,
|
||||
/usr/bin/lowriter Cxr -> sanitized_helper,
|
||||
/usr/lib/libreoffice/program/soffice Cxr -> sanitized_helper,
|
||||
|
||||
# PDFs
|
||||
/usr/bin/evince Cxr -> sanitized_helper,
|
||||
/usr/bin/okular Cxr -> sanitized_helper,
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Users of this abstraction need to include the ubuntu-helpers abstraction
|
||||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Text editors (It's All Text [https://addons.mozilla.org/en-US/firefox/addon/4125])
|
||||
/usr/bin/emacsclient.emacs-snapshot Cxr -> sanitized_helper,
|
||||
/usr/bin/emacsclient.emacs2[2-9] Cxr -> sanitized_helper,
|
||||
/usr/bin/emacs-snapshot-gtk Cxr -> sanitized_helper,
|
||||
/usr/bin/gedit Cxr -> sanitized_helper,
|
||||
/usr/bin/vim.gnome Cxr -> sanitized_helper,
|
||||
/usr/bin/leafpad Cxr -> sanitized_helper,
|
||||
/usr/bin/mousepad Cxr -> sanitized_helper,
|
||||
/usr/bin/kate Cxr -> sanitized_helper,
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# Users of this abstraction need to include the ubuntu-helpers abstraction
|
||||
# in the toplevel profile. Eg:
|
||||
# include <abstractions/ubuntu-helpers>
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Apport
|
||||
/usr/bin/apport-bug Cx -> sanitized_helper,
|
||||
|
||||
# Package installation
|
||||
/usr/bin/apturl Cxr -> sanitized_helper,
|
||||
/usr/share/software-center/software-center Cxr -> sanitized_helper,
|
||||
|
||||
# Input Methods
|
||||
/usr/bin/scim Cx -> sanitized_helper,
|
||||
/usr/bin/scim-bridge Cx -> sanitized_helper,
|
||||
|
||||
# File managers
|
||||
/usr/bin/nautilus Cxr -> sanitized_helper,
|
||||
/usr/bin/{t,T}hunar Cxr -> sanitized_helper,
|
||||
/usr/bin/dolphin Cxr -> sanitized_helper,
|
||||
|
||||
# Themes
|
||||
/usr/bin/gnome-appearance-properties Cxr -> sanitized_helper,
|
||||
|
||||
# Kubuntu
|
||||
/usr/lib/mozilla/kmozillahelper Cxr -> sanitized_helper,
|
||||
|
||||
# Exo-aware applications
|
||||
include <abstractions/exo-open>
|
||||
|
||||
# unity webapps integration. Could go in its own abstraction
|
||||
owner /run/user/*/dconf/user rw,
|
||||
owner @{HOME}/.local/share/unity-webapps/availableapps*.db rwk,
|
||||
/usr/bin/debconf-communicate Cxr -> sanitized_helper,
|
||||
owner @{HOME}/.config/libaccounts-glib/accounts.db rk,
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# firefox-notify
|
||||
include <abstractions/python>
|
||||
/usr/bin/python2.[4567] ix,
|
||||
/usr/share/xul-ext/notify/**/download_complete_notify.py ix,
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
# Allow read to all files user has DAC access to and write access to all
|
||||
# files owned by the user in $HOME.
|
||||
@{HOME}/ r,
|
||||
@{HOME}/** r,
|
||||
owner @{HOME}/** w,
|
||||
|
||||
# Do not allow read and/or write to particularly sensitive/problematic files
|
||||
include <abstractions/private-files>
|
||||
audit deny @{HOME}/.ssh/{,**} mrwkl,
|
||||
audit deny @{HOME}/.gnome2_private/{,**} mrwkl,
|
||||
audit deny @{HOME}/.kde{,4}/{,share/,share/apps/} w,
|
||||
audit deny @{HOME}/.kde{,4}/share/apps/kwallet/{,**} mrwkl,
|
||||
|
||||
# Comment this out if using gpg plugin/addons
|
||||
audit deny @{HOME}/.gnupg/{,**} mrwkl,
|
||||
|
||||
# Allow read to all files user has DAC access to and write for files the user
|
||||
# owns on removable media and filesystems.
|
||||
/media/** r,
|
||||
/mnt/** r,
|
||||
/srv/** r,
|
||||
/net/** r,
|
||||
owner /media/** w,
|
||||
owner /mnt/** w,
|
||||
owner /srv/** w,
|
||||
owner /net/** w,
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/[dD]ownload{,s}/ r,
|
||||
owner @{HOME}/[dD]ownload{,s}/** rwl,
|
||||
|
||||
owner /media/*/[dD]ownload/ r,
|
||||
owner /media/*/[dD]ownload/** rwl,
|
||||
|
||||
owner @{HOME}/[dD]esktop/ r,
|
||||
owner @{HOME}/[dD]esktop/** rwl,
|
||||
|
||||
# For SSHFS mounts (without owner as files in such mounts can be owned by different users)
|
||||
@{HOME}/mount-sshfs/ r,
|
||||
@{HOME}/mount-sshfs/** rwl,
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
owner @{HOME}/.cache/ rw,
|
||||
owner @{HOME}/.cache/vlc/ rw,
|
||||
owner @{HOME}/.cache/vlc/art/ rw,
|
||||
owner @{HOME}/.cache/vlc/art/artistalbum/ rw,
|
||||
owner @{HOME}/.cache/vlc/art/artistalbum/**/ rw,
|
||||
owner @{HOME}/.cache/vlc/art/artistalbum/**/art rw,
|
||||
owner @{HOME}/.cache/vlc/art/artistalbum/**/art.jpg rw,
|
||||
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
owner @{run}/user/[0-9]*/wayland-[0-9]* rw,
|
||||
owner @{run}/user/[0-9]*/{mesa,mutter,sdl,wayland-cursor,weston,xwayland}-shared-* rw,
|
||||
owner /dev/shm/wlroots-* rw,
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Mikhail Morfikov
|
||||
# 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
deny /var/log/wtmp wk,
|
||||
/var/log/wtmp rwk,
|
||||
/var/log/btmp rwk,
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
/usr/share/zsh/{,**} r,
|
||||
/usr/local/share/zsh/{,**} r,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/zsh/[0-9]*/zsh/*.so mr,
|
||||
|
||||
/etc/zsh/zshenv r,
|
||||
/etc/zsh/zshrc r,
|
||||
/etc/zsh/zprofile r,
|
||||
/etc/zsh/zlogin r,
|
||||
|
||||
owner @{HOME}/.zshrc r,
|
||||
owner @{HOME}/.zsh_history rw,
|
||||
owner @{HOME}/.zsh_history.LOCK rwk,
|
||||
|
||||
owner @{HOME}/.oh-my-zsh/{,**} r,
|
||||
owner @{HOME}/.oh-my-zsh/log/update.lock/ w,
|
||||
|
||||
owner @{HOME}/.zcompdump-* rw,
|
||||
Loading…
Add table
Add a link
Reference in a new issue