feat(profiles): first set of rules for Ubuntu Core support.
This commit is contained in:
Alexandre Pujol
parent
1316e0ddde
commit
ef292b585c
27 changed files with 351 additions and 92 deletions
|
|
@ -58,7 +58,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
member={CheckAuthorization,Introspect},
|
||||
|
||||
dbus bind bus=system
|
||||
name= org.debian.apt,
|
||||
name=org.debian.apt,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -68,6 +68,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/echo rix,
|
||||
/{usr/,}bin/gdbus rix,
|
||||
/{usr/,}bin/id rix,
|
||||
/{usr/,}bin/ischroot rix,
|
||||
/{usr/,}bin/test rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
|
|
@ -88,6 +89,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
/{usr/,}bin/etckeeper rPx,
|
||||
/{usr/,}bin/ps rPx,
|
||||
/{usr/,}bin/snap rPUx,
|
||||
/{usr/,}bin/systemctl rCx -> systemctl,
|
||||
/{usr/,}lib/cnf-update-db rPx,
|
||||
/{usr/,}lib/needrestart/apt-pinvoke rPx,
|
||||
@{libexec}/zsys-system-autosnapshot rPx,
|
||||
|
|
@ -224,6 +226,31 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
}
|
||||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_resource,
|
||||
|
||||
ptrace (read),
|
||||
|
||||
/{usr/,}bin/systemctl mr,
|
||||
|
||||
/{usr/,}bin/systemd-tty-ask-password-agent rix,
|
||||
|
||||
owner @{run}/systemd/ask-password/ rw,
|
||||
owner @{run}/systemd/ask-password-block/* rw,
|
||||
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
/dev/kmsg w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/apt>
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -27,70 +28,64 @@ profile apt-methods-gpgv @{exec_path} {
|
|||
@{exec_path} mr,
|
||||
|
||||
# The following get "no new privs" so "rix" them
|
||||
/{usr/,}bin/apt-key rix,
|
||||
/{usr/,}bin/apt-config rix,
|
||||
/{usr/,}bin/apt-key rix,
|
||||
/{usr/,}bin/dpkg rix,
|
||||
/{usr/,}bin/find rix,
|
||||
/{usr/,}bin/gpg-connect-agent rix,
|
||||
/{usr/,}bin/gpgconf rix,
|
||||
/{usr/,}bin/find rix,
|
||||
/{usr/,}bin/gpgv rix,
|
||||
|
||||
/{usr/,}bin/head rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/base64 rix,
|
||||
/{usr/,}bin/cat rix,
|
||||
/{usr/,}bin/chmod rix,
|
||||
/{usr/,}bin/cmp rix,
|
||||
/{usr/,}bin/cp rix,
|
||||
/{usr/,}bin/head rix,
|
||||
/{usr/,}bin/mktemp rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/rm rix,
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/sort rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/base64 rix,
|
||||
|
||||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
/usr/share/keyrings/ r,
|
||||
/usr/share/keyrings/*.{gpg,asc} r,
|
||||
|
||||
/etc/apt/apt.conf r,
|
||||
/etc/apt/apt.conf.d/{,*} r,
|
||||
/etc/apt/keyrings/ r,
|
||||
/etc/apt/keyrings/*.{gpg,asc} r,
|
||||
/etc/apt/trusted.gpg r,
|
||||
/etc/apt/trusted.gpg.d/{,*.gpg} r,
|
||||
/etc/dpkg/dpkg.cfg r,
|
||||
/etc/dpkg/dpkg.cfg.d/{,*} r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
/etc/ r,
|
||||
/root/ r,
|
||||
|
||||
/etc/dpkg/dpkg.cfg.d/{,*} r,
|
||||
/etc/dpkg/dpkg.cfg r,
|
||||
/var/lib/apt/lists/{,**} r,
|
||||
/var/lib/dpkg/arch r,
|
||||
/var/lib/extrepo/keys/*.{gpg,asc} r,
|
||||
/var/lib/ubuntu-advantage/apt-esm/{,**} r,
|
||||
owner /var/lib/apt/lists/* rw,
|
||||
owner /var/lib/apt/lists/partial/* rw,
|
||||
|
||||
/etc/apt/apt.conf.d/{,*} r,
|
||||
/etc/apt/apt.conf r,
|
||||
|
||||
/etc/apt/trusted.gpg.d/{,*.gpg} r,
|
||||
/etc/apt/trusted.gpg r,
|
||||
# For package building
|
||||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/apt-key-gpghome.*/ rw,
|
||||
owner /tmp/apt-key-gpghome.*/** rwkl -> /tmp/apt-key-gpghome.*/**,
|
||||
owner /tmp/apt.{conf,sig,data}.* rw,
|
||||
|
||||
/var/lib/apt/lists/{,**} r,
|
||||
owner /var/lib/apt/lists/* rw,
|
||||
owner /var/lib/apt/lists/partial/* rw,
|
||||
|
||||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
/var/lib/dpkg/arch r,
|
||||
|
||||
@{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# Local keyring storage
|
||||
/etc/apt/keyrings/ r,
|
||||
/etc/apt/keyrings/*.{gpg,asc} r,
|
||||
/usr/share/keyrings/ r,
|
||||
/usr/share/keyrings/*.{gpg,asc} r,
|
||||
|
||||
# Extrepo keyring storage
|
||||
/var/lib/extrepo/keys/*.{gpg,asc} r,
|
||||
|
||||
# For package building
|
||||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
/var/log/cron-apt/temp w,
|
||||
|
|
|
|||
|
|
@ -17,19 +17,20 @@ profile apt-methods-http @{exec_path} {
|
|||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
signal (receive) peer=apt-get,
|
||||
signal (receive) peer=apt,
|
||||
signal (receive) peer=aptitude,
|
||||
signal (receive) peer=synaptic,
|
||||
signal (receive) peer=unattended-upgrade,
|
||||
signal (receive) peer=update-manager,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
signal (receive) peer=apt-get,
|
||||
signal (receive) peer=apt,
|
||||
signal (receive) peer=aptitude,
|
||||
signal (receive) peer=synaptic,
|
||||
signal (receive) peer=ubuntu-advantage,
|
||||
signal (receive) peer=unattended-upgrade,
|
||||
signal (receive) peer=update-manager,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# apt-helper gets "no new privs" so "rix" it
|
||||
|
|
@ -47,17 +48,20 @@ profile apt-methods-http @{exec_path} {
|
|||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/** rwk,
|
||||
|
||||
/var/log/cron-apt/temp w,
|
||||
|
||||
/var/lib/apt/lists/{,**} r,
|
||||
owner /var/lib/apt/lists/* rw,
|
||||
owner /var/lib/apt/lists/partial/* rw,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/** rwk,
|
||||
# For package building
|
||||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
# For the aptitude interactive mode
|
||||
/tmp/ r,
|
||||
owner /tmp/aptitude-root.*/aptitude-download-* rw,
|
||||
|
||||
owner /tmp/apt-changelog-*/*.changelog rw,
|
||||
|
||||
@{run}/resolvconf/resolv.conf r,
|
||||
|
|
@ -65,12 +69,7 @@ profile apt-methods-http @{exec_path} {
|
|||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/@{pid}/cgroup r,
|
||||
|
||||
# For package building
|
||||
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
/var/log/cron-apt/temp w,
|
||||
|
||||
include if exists <local/apt-methods-http>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2020-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -17,18 +18,10 @@ profile dpkg-genbuildinfo @{exec_path} flags=(complain) {
|
|||
@{exec_path} r,
|
||||
/{usr/,}bin/perl r,
|
||||
|
||||
/etc/dpkg/origins/debian r,
|
||||
|
||||
# For package building
|
||||
owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
|
||||
/usr/share/lto-disabled-list/lto-disabled-list r,
|
||||
/usr/share/dpkg/cputable r,
|
||||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
owner @{user_config_dirs}/dpkg/buildflags.conf r,
|
||||
|
||||
/usr/local/bin/ r,
|
||||
/usr/local/sbin/ r,
|
||||
/usr/local/lib/ r,
|
||||
|
|
@ -36,5 +29,14 @@ profile dpkg-genbuildinfo @{exec_path} flags=(complain) {
|
|||
/usr/local/include/ r,
|
||||
/usr/local/etc/ r,
|
||||
|
||||
/etc/dpkg/origins/* r,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
|
||||
owner @{user_config_dirs}/dpkg/buildflags.conf r,
|
||||
|
||||
# For package building
|
||||
owner @{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
|
||||
|
||||
include if exists <local/dpkg-genbuildinfo>
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue