feat(fsp): add mapping abstractions for use with pam_apparmor.

apparmor.d/abstractions/mapping/login

@@ -0,0 +1,41 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal set of rules for login based hat mapping.
+
+  abi <abi/4.0>,
+
+  include <abstractions/bus-system>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+  include <abstractions/wutmp>
+
+  capability audit_write,
+  capability chown,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability fsetid,
+
+  deny capability net_admin,
+
+  network netlink raw,
+
+  dbus send bus=system path=/org/freedesktop/login1
+       interface=org.freedesktop.login1.Manager
+       member=ReleaseSession
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
+
+  @{etc_ro}/security/group.conf r,
+  @{etc_ro}/security/limits.conf r,
+  @{etc_ro}/security/limits.d/{,*} r,
+  @{etc_ro}/security/pam_env.conf r,
+
+  @{etc_ro}/login.defs r,
+  @{etc_ro}/login.defs.d/{,*} r,
+  @{etc_ro}/security/capability.conf r,
+
+  include if exists <abstractions/mapping/login.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/mapping/shadow

@@ -0,0 +1,11 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal set of rules for shadow based hat mapping.
+
+  abi <abi/4.0>,
+
+  include if exists <abstractions/mapping/shadow.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/mapping/sshd

@@ -0,0 +1,55 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal set of rules for sshd based hat mapping. Similar to sshd-session
+
+  abi <abi/4.0>,
+
+  include <abstractions/authentication>
+  include <abstractions/bus-system>
+  include <abstractions/consoles>
+  include <abstractions/nameservice-strict>
+  include <abstractions/wutmp>
+
+  capability audit_write,
+  capability chown,
+  capability dac_read_search,
+  capability kill,
+  capability setgid,
+  capability setuid,
+  capability sys_resource,
+
+  # sshd doesn't require net_admin. libpam-systemd tries to
+  # use it if available to set the send/receive buffers size,
+  # but will fall back to a non-privileged version if it fails.
+  deny capability net_admin,
+
+  network inet6 stream,
+  network netlink raw,
+  network netlink raw,
+
+  signal receive set=exists peer=systemd-journald,
+  signal receive set=hup peer=@{p_systemd},
+
+  unix bind type=stream addr=@@{udbus}/bus/sshd/system,
+
+  dbus send bus=system path=/org/freedesktop/login1
+       interface=org.freedesktop.login1.Manager
+       member={CreateSession,ReleaseSession,CreateSessionWithPIDFD}
+       peer=(name=org.freedesktop.login1, label=systemd-logind),
+
+  /etc/motd r,
+  /etc/locale.conf r,
+
+  @{run}/motd.dynamic rw,
+  @{run}/motd.dynamic.new rw,
+
+  @{PROC}/1/limits r,
+
+  /dev/ptmx rw,
+  /dev/pts/@{int} k,
+
+  include if exists <abstractions/mapping/sshd.d>
+
+# vim:syntax=apparmor

apparmor.d/abstractions/mapping/sudo

@@ -0,0 +1,20 @@
+# apparmor.d - Full set of apparmor profiles
+# Copyright (C) 2025 Alexandre Pujol <alexandre@pujol.io>
+# SPDX-License-Identifier: GPL-2.0-only
+
+# Minimal set of rules for su/sudo based hat mapping.
+
+  abi <abi/4.0>,
+
+  capability audit_write,
+  capability setgid,
+  capability setuid,
+
+  network netlink raw,
+
+  @{etc_ro}/login.defs r,
+  /etc/passwd r,
+
+  include if exists <abstractions/mapping/sudo.d>
+
+# vim:syntax=apparmor